xref: /freebsd/sys/compat/linuxkpi/common/src/linux_80211.c (revision 1110ed3b46ea2765fd45ebfb4e0f0fd997ecb92e)
1 /*-
2  * Copyright (c) 2020-2025 The FreeBSD Foundation
3  * Copyright (c) 2020-2025 Bjoern A. Zeeb
4  *
5  * This software was developed by Björn Zeeb under sponsorship from
6  * the FreeBSD Foundation.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  */
29 
30 /*
31  * Public functions are called linuxkpi_*().
32  * Internal (static) functions are called lkpi_*().
33  *
34  * The internal structures holding metadata over public structures are also
35  * called lkpi_xxx (usually with a member at the end called xxx).
36  * Note: we do not replicate the structure names but the general variable names
37  * for these (e.g., struct hw -> struct lkpi_hw, struct sta -> struct lkpi_sta).
38  * There are macros to access one from the other.
39  * We call the internal versions lxxx (e.g., hw -> lhw, sta -> lsta).
40  */
41 
42 /*
43  * TODO:
44  * - lots :)
45  * - HW_CRYPTO: we need a "keystore" and an ordered list for suspend/resume.
46  */
47 
48 #include <sys/param.h>
49 #include <sys/types.h>
50 #include <sys/kernel.h>
51 #include <sys/errno.h>
52 #include <sys/malloc.h>
53 #include <sys/module.h>
54 #include <sys/mutex.h>
55 #include <sys/sbuf.h>
56 #include <sys/socket.h>
57 #include <sys/sysctl.h>
58 #include <sys/queue.h>
59 #include <sys/taskqueue.h>
60 #include <sys/libkern.h>
61 
62 #include <net/if.h>
63 #include <net/if_var.h>
64 #include <net/if_media.h>
65 #include <net/ethernet.h>
66 
67 #include <net80211/ieee80211_var.h>
68 #include <net80211/ieee80211_proto.h>
69 #include <net80211/ieee80211_ratectl.h>
70 #include <net80211/ieee80211_radiotap.h>
71 #include <net80211/ieee80211_vht.h>
72 
73 #define	LINUXKPI_NET80211
74 #include <net/mac80211.h>
75 
76 #include <linux/workqueue.h>
77 #include <linux/rculist.h>
78 #include "linux_80211.h"
79 
80 #define	LKPI_80211_WME
81 #define	LKPI_80211_HW_CRYPTO
82 #define	LKPI_80211_HT
83 #define	LKPI_80211_VHT
84 
85 #if defined(LKPI_80211_VHT) && !defined(LKPI_80211_HT)
86 #define	LKPI_80211_HT
87 #endif
88 #if defined(LKPI_80211_HT) && !defined(LKPI_80211_HW_CRYPTO)
89 #define	LKPI_80211_HW_CRYPTO
90 #endif
91 
92 static MALLOC_DEFINE(M_LKPI80211, "lkpi80211", "LinuxKPI 80211 compat");
93 
94 /* XXX-BZ really want this and others in queue.h */
95 #define	TAILQ_ELEM_INIT(elm, field) do {				\
96 	(elm)->field.tqe_next = NULL;					\
97 	(elm)->field.tqe_prev = NULL;					\
98 } while (0)
99 
100 /* -------------------------------------------------------------------------- */
101 
102 SYSCTL_DECL(_compat_linuxkpi);
103 SYSCTL_NODE(_compat_linuxkpi, OID_AUTO, 80211, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
104     "LinuxKPI 802.11 compatibility layer");
105 
106 #if defined(LKPI_80211_HW_CRYPTO)
107 static bool lkpi_hwcrypto = false;
108 SYSCTL_BOOL(_compat_linuxkpi_80211, OID_AUTO, hw_crypto, CTLFLAG_RDTUN,
109     &lkpi_hwcrypto, 0, "Enable LinuxKPI 802.11 hardware crypto offload");
110 #endif
111 
112 /* Keep public for as long as header files are using it too. */
113 int linuxkpi_debug_80211;
114 
115 #ifdef LINUXKPI_DEBUG_80211
116 SYSCTL_INT(_compat_linuxkpi_80211, OID_AUTO, debug, CTLFLAG_RWTUN,
117     &linuxkpi_debug_80211, 0, "LinuxKPI 802.11 debug level");
118 
119 #define	UNIMPLEMENTED		if (linuxkpi_debug_80211 & D80211_TODO)		\
120     printf("XXX-TODO %s:%d: UNIMPLEMENTED\n", __func__, __LINE__)
121 #define	TRACEOK()		if (linuxkpi_debug_80211 & D80211_TRACEOK)	\
122     printf("XXX-TODO %s:%d: TRACEPOINT\n", __func__, __LINE__)
123 #else
124 #define	UNIMPLEMENTED		do { } while (0)
125 #define	TRACEOK()		do { } while (0)
126 #endif
127 
128 /* #define	PREP_TX_INFO_DURATION	(IEEE80211_TRANS_WAIT * 1000) */
129 #ifndef PREP_TX_INFO_DURATION
130 #define	PREP_TX_INFO_DURATION	0 /* Let the driver do its thing. */
131 #endif
132 
133 /* This is DSAP | SSAP | CTRL | ProtoID/OrgCode{3}. */
134 const uint8_t rfc1042_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
135 
136 /* IEEE 802.11-05/0257r1 */
137 const uint8_t bridge_tunnel_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
138 
139 /* IEEE 802.11e Table 20i-UP-to-AC mappings. */
140 static const uint8_t ieee80211e_up_to_ac[] = {
141 	IEEE80211_AC_BE,
142 	IEEE80211_AC_BK,
143 	IEEE80211_AC_BK,
144 	IEEE80211_AC_BE,
145 	IEEE80211_AC_VI,
146 	IEEE80211_AC_VI,
147 	IEEE80211_AC_VO,
148 	IEEE80211_AC_VO,
149 #if 0
150 	IEEE80211_AC_VO, /* We treat MGMT as TID 8, which is set as AC_VO */
151 #endif
152 };
153 
154 const struct cfg80211_ops linuxkpi_mac80211cfgops = {
155 	/*
156 	 * XXX TODO need a "glue layer" to link cfg80211 ops to
157 	 * mac80211 and to the driver or net80211.
158 	 * Can we pass some on 1:1? Need to compare the (*f)().
159 	 */
160 };
161 
162 #if 0
163 static struct lkpi_sta *lkpi_find_lsta_by_ni(struct lkpi_vif *,
164     struct ieee80211_node *);
165 #endif
166 static void lkpi_80211_txq_tx_one(struct lkpi_sta *, struct mbuf *);
167 static void lkpi_80211_txq_task(void *, int);
168 static void lkpi_80211_lhw_rxq_task(void *, int);
169 static void lkpi_ieee80211_free_skb_mbuf(void *);
170 #ifdef LKPI_80211_WME
171 static int lkpi_wme_update(struct lkpi_hw *, struct ieee80211vap *, bool);
172 #endif
173 
174 static const char *
175 lkpi_rate_info_bw_to_str(enum rate_info_bw bw)
176 {
177 
178 	switch (bw) {
179 
180         case RATE_INFO_BW_20:
181 		return ("20");
182 		break;
183         case RATE_INFO_BW_5:
184 		return ("5");
185 		break;
186         case RATE_INFO_BW_10:
187 		return ("10");
188 		break;
189         case RATE_INFO_BW_40:
190 		return ("40");
191 		break;
192         case RATE_INFO_BW_80:
193 		return ("80");
194 		break;
195         case RATE_INFO_BW_160:
196 		return ("160");
197 		break;
198         case RATE_INFO_BW_HE_RU:
199 		IMPROVE("nl80211_he_ru_alloc");
200 		return ("HE_RU");
201 		break;
202         case RATE_INFO_BW_320:
203 		return ("320");
204 		break;
205         case RATE_INFO_BW_EHT_RU:
206 		IMPROVE("nl80211_eht_ru_alloc");
207 		return ("EHT_RU");
208 		break;
209 	default:
210 		return ("?");
211 		break;
212 	}
213 }
214 
215 static void
216 lkpi_nl80211_sta_info_to_str(struct sbuf *s, const char *prefix,
217     const uint64_t flags)
218 {
219 	int bit, i;
220 
221 	sbuf_printf(s, "%s %#010jx", prefix, flags);
222 
223 	i = 0;
224 	for (bit = 0; bit < BITS_PER_TYPE(flags); bit++) {
225 
226 		if ((flags & BIT_ULL(bit)) == 0)
227 			continue;
228 
229 #define	EXPAND_CASE(_flag)						\
230 	case NL80211_STA_INFO_ ## _flag:				\
231 		sbuf_printf(s, "%c%s", (i == 0) ? '<' : ',', #_flag);	\
232 		i++;							\
233 		break;
234 
235 		switch (bit) {
236 		EXPAND_CASE(BEACON_RX)
237 		EXPAND_CASE(BEACON_SIGNAL_AVG)
238 		EXPAND_CASE(BSS_PARAM)
239 		EXPAND_CASE(CHAIN_SIGNAL)
240 		EXPAND_CASE(CHAIN_SIGNAL_AVG)
241 		EXPAND_CASE(CONNECTED_TIME)
242 		EXPAND_CASE(INACTIVE_TIME)
243 		EXPAND_CASE(SIGNAL)
244 		EXPAND_CASE(SIGNAL_AVG)
245 		EXPAND_CASE(STA_FLAGS)
246 		EXPAND_CASE(RX_BITRATE)
247 		EXPAND_CASE(RX_PACKETS)
248 		EXPAND_CASE(RX_BYTES)
249 		EXPAND_CASE(RX_DROP_MISC)
250 		EXPAND_CASE(TX_BITRATE)
251 		EXPAND_CASE(TX_PACKETS)
252 		EXPAND_CASE(TX_BYTES)
253 		EXPAND_CASE(TX_BYTES64)
254 		EXPAND_CASE(RX_BYTES64)
255 		EXPAND_CASE(TX_FAILED)
256 		EXPAND_CASE(TX_RETRIES)
257 		EXPAND_CASE(RX_DURATION)
258 		EXPAND_CASE(TX_DURATION)
259 		EXPAND_CASE(ACK_SIGNAL)
260 		EXPAND_CASE(ACK_SIGNAL_AVG)
261 		default:
262 			sbuf_printf(s, "%c?%d", (i == 0) ? '<' : ',', bit);
263 			break;
264 		}
265 	}
266 #undef	EXPAND_CASE
267 	if (i > 0)
268 		sbuf_printf(s, ">");
269 	sbuf_printf(s, "\n");
270 }
271 
272 static int
273 lkpi_80211_dump_stas(SYSCTL_HANDLER_ARGS)
274 {
275 	struct lkpi_hw *lhw;
276 	struct ieee80211_hw *hw;
277 	struct ieee80211vap *vap;
278 	struct lkpi_vif *lvif;
279 	struct ieee80211_vif *vif;
280 	struct lkpi_sta *lsta;
281 	struct ieee80211_sta *sta;
282 	struct station_info sinfo;
283 	struct sbuf s;
284 	int error;
285 
286 	if (req->newptr)
287 		return (EPERM);
288 
289 	lvif = (struct lkpi_vif *)arg1;
290 	vif = LVIF_TO_VIF(lvif);
291 	vap = LVIF_TO_VAP(lvif);
292 	lhw = vap->iv_ic->ic_softc;
293 	hw = LHW_TO_HW(lhw);
294 
295 	sbuf_new_for_sysctl(&s, NULL, 1024, req);
296 
297 	wiphy_lock(hw->wiphy);
298 	list_for_each_entry(lsta, &lvif->lsta_list, lsta_list) {
299 		sta = LSTA_TO_STA(lsta);
300 
301 		sbuf_putc(&s, '\n');
302 		sbuf_printf(&s, "lsta %p sta %p added_to_drv %d\n", lsta, sta, lsta->added_to_drv);
303 
304 		memset(&sinfo, 0, sizeof(sinfo));
305 		error = lkpi_80211_mo_sta_statistics(hw, vif, sta, &sinfo);
306 		if (error == EEXIST)	/* Not added to driver. */
307 			continue;
308 		if (error == ENOTSUPP) {
309 			sbuf_printf(&s, " sta_statistics not supported\n");
310 			continue;
311 		}
312 		if (error != 0) {
313 			sbuf_printf(&s, " sta_statistics failed: %d\n", error);
314 			continue;
315 		}
316 
317 		lkpi_nl80211_sta_info_to_str(&s, " nl80211_sta_info (valid fields)", sinfo.filled);
318 		sbuf_printf(&s, " connected_time %u inactive_time %u\n",
319 		    sinfo.connected_time, sinfo.inactive_time);
320 		sbuf_printf(&s, " rx_bytes %ju rx_packets %u rx_dropped_misc %u\n",
321 		    (uintmax_t)sinfo.rx_bytes, sinfo.rx_packets, sinfo.rx_dropped_misc);
322 		sbuf_printf(&s, " rx_duration %ju rx_beacon %u rx_beacon_signal_avg %d\n",
323 		    (uintmax_t)sinfo.rx_duration, sinfo.rx_beacon, (int8_t)sinfo.rx_beacon_signal_avg);
324 
325 		sbuf_printf(&s, " tx_bytes %ju tx_packets %u tx_failed %u\n",
326 		    (uintmax_t)sinfo.tx_bytes, sinfo.tx_packets, sinfo.tx_failed);
327 		sbuf_printf(&s, " tx_duration %ju tx_retries %u\n",
328 		    (uintmax_t)sinfo.tx_duration, sinfo.tx_retries);
329 
330 		sbuf_printf(&s, " signal %d signal_avg %d ack_signal %d avg_ack_signal %d\n",
331 		    sinfo.signal, sinfo.signal_avg, sinfo.ack_signal, sinfo.avg_ack_signal);
332 
333 		sbuf_printf(&s, " generation %d assoc_req_ies_len %zu chains %d\n",
334 		    sinfo.generation, sinfo.assoc_req_ies_len, sinfo.chains);
335 
336 		for (int i = 0; i < sinfo.chains && i < IEEE80211_MAX_CHAINS; i++) {
337 			sbuf_printf(&s, "  chain[%d] signal %d signal_avg %d\n",
338 			    i, (int8_t)sinfo.chain_signal[i], (int8_t)sinfo.chain_signal_avg[i]);
339 		}
340 
341 		/* assoc_req_ies, bss_param, sta_flags */
342 
343 		sbuf_printf(&s, " rxrate: flags %b bw %u(%s) legacy %u kbit/s mcs %u nss %u\n",
344 		    sinfo.rxrate.flags, CFG80211_RATE_INFO_FLAGS_BITS,
345 		    sinfo.rxrate.bw, lkpi_rate_info_bw_to_str(sinfo.rxrate.bw),
346 		    sinfo.rxrate.legacy * 100,
347 		    sinfo.rxrate.mcs, sinfo.rxrate.nss);
348 		sbuf_printf(&s, "         he_dcm %u he_gi %u he_ru_alloc %u eht_gi %u\n",
349 		    sinfo.rxrate.he_dcm, sinfo.rxrate.he_gi, sinfo.rxrate.he_ru_alloc,
350 		    sinfo.rxrate.eht_gi);
351 		sbuf_printf(&s, " txrate: flags %b bw %u(%s) legacy %u kbit/s mcs %u nss %u\n",
352 		    sinfo.txrate.flags, CFG80211_RATE_INFO_FLAGS_BITS,
353 		    sinfo.txrate.bw, lkpi_rate_info_bw_to_str(sinfo.txrate.bw),
354 		    sinfo.txrate.legacy * 100,
355 		    sinfo.txrate.mcs, sinfo.txrate.nss);
356 		sbuf_printf(&s, "         he_dcm %u he_gi %u he_ru_alloc %u eht_gi %u\n",
357 		    sinfo.txrate.he_dcm, sinfo.txrate.he_gi, sinfo.txrate.he_ru_alloc,
358 		    sinfo.txrate.eht_gi);
359 	}
360 	wiphy_unlock(hw->wiphy);
361 
362 	sbuf_finish(&s);
363 	sbuf_delete(&s);
364 
365 	return (0);
366 }
367 
368 static enum ieee80211_sta_rx_bw
369 lkpi_cw_to_rx_bw(enum nl80211_chan_width cw)
370 {
371 	switch (cw) {
372 	case NL80211_CHAN_WIDTH_320:
373 		return (IEEE80211_STA_RX_BW_320);
374 	case NL80211_CHAN_WIDTH_160:
375 	case NL80211_CHAN_WIDTH_80P80:
376 		return (IEEE80211_STA_RX_BW_160);
377 	case NL80211_CHAN_WIDTH_80:
378 		return (IEEE80211_STA_RX_BW_80);
379 	case NL80211_CHAN_WIDTH_40:
380 		return (IEEE80211_STA_RX_BW_40);
381 	case NL80211_CHAN_WIDTH_20:
382 	case NL80211_CHAN_WIDTH_20_NOHT:
383 		return (IEEE80211_STA_RX_BW_20);
384 	case NL80211_CHAN_WIDTH_5:
385 	case NL80211_CHAN_WIDTH_10:
386 		/* Unsupported input. */
387 		return (IEEE80211_STA_RX_BW_20);
388 	}
389 }
390 
391 static enum nl80211_chan_width
392 lkpi_rx_bw_to_cw(enum ieee80211_sta_rx_bw rx_bw)
393 {
394 	switch (rx_bw) {
395 	case IEEE80211_STA_RX_BW_20:
396 		return (NL80211_CHAN_WIDTH_20);	/* _NOHT */
397 	case IEEE80211_STA_RX_BW_40:
398 		return (NL80211_CHAN_WIDTH_40);
399 	case IEEE80211_STA_RX_BW_80:
400 		return (NL80211_CHAN_WIDTH_80);
401 	case IEEE80211_STA_RX_BW_160:
402 		return (NL80211_CHAN_WIDTH_160); /* 80P80 */
403 	case IEEE80211_STA_RX_BW_320:
404 		return (NL80211_CHAN_WIDTH_320);
405 	}
406 }
407 
408 static void
409 lkpi_sync_chanctx_cw_from_rx_bw(struct ieee80211_hw *hw,
410     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
411 {
412 	struct ieee80211_chanctx_conf *chanctx_conf;
413 	enum ieee80211_sta_rx_bw old_bw;
414 	uint32_t changed;
415 
416 	chanctx_conf = rcu_dereference_protected(vif->bss_conf.chanctx_conf,
417 	    lockdep_is_held(&hw->wiphy->mtx));
418 	if (chanctx_conf == NULL)
419 		return;
420 
421 	old_bw = lkpi_cw_to_rx_bw(chanctx_conf->def.width);
422 	if (old_bw == sta->deflink.bandwidth)
423 		return;
424 
425 	chanctx_conf->def.width = lkpi_rx_bw_to_cw(sta->deflink.bandwidth);
426 	if (chanctx_conf->def.width == NL80211_CHAN_WIDTH_20 &&
427 	    !sta->deflink.ht_cap.ht_supported)
428 		chanctx_conf->def.width = NL80211_CHAN_WIDTH_20_NOHT;
429 
430 	chanctx_conf->min_def = chanctx_conf->def;
431 
432 	vif->bss_conf.chanreq.oper.width = chanctx_conf->def.width;
433 
434 	changed = IEEE80211_CHANCTX_CHANGE_MIN_WIDTH;
435 	changed |= IEEE80211_CHANCTX_CHANGE_WIDTH;
436 	lkpi_80211_mo_change_chanctx(hw, chanctx_conf, changed);
437 }
438 
439 #if defined(LKPI_80211_HT)
440 static void
441 lkpi_sta_sync_ht_from_ni(struct ieee80211_vif *vif, struct ieee80211_sta *sta,
442     struct ieee80211_node *ni)
443 {
444 	struct ieee80211vap *vap;
445 	uint8_t *ie;
446 	struct ieee80211_ht_cap *htcap;
447 	int i, rx_nss;
448 
449 	if ((ni->ni_flags & IEEE80211_NODE_HT) == 0) {
450 		sta->deflink.ht_cap.ht_supported = false;
451 		return;
452 	}
453 
454 	sta->deflink.ht_cap.ht_supported = true;
455 
456 	/* htcap->ampdu_params_info */
457 	vap = ni->ni_vap;
458 	sta->deflink.ht_cap.ampdu_density = _IEEE80211_MASKSHIFT(ni->ni_htparam, IEEE80211_HTCAP_MPDUDENSITY);
459 	if (sta->deflink.ht_cap.ampdu_density > vap->iv_ampdu_density)
460 		sta->deflink.ht_cap.ampdu_density = vap->iv_ampdu_density;
461 	sta->deflink.ht_cap.ampdu_factor = _IEEE80211_MASKSHIFT(ni->ni_htparam, IEEE80211_HTCAP_MAXRXAMPDU);
462 	if (sta->deflink.ht_cap.ampdu_factor > vap->iv_ampdu_rxmax)
463 		sta->deflink.ht_cap.ampdu_factor = vap->iv_ampdu_rxmax;
464 
465 	ie = ni->ni_ies.htcap_ie;
466 	KASSERT(ie != NULL, ("%s: HT but no htcap_ie on ni %p\n", __func__, ni));
467 	if (ie[0] == IEEE80211_ELEMID_VENDOR)
468 		ie += 4;
469 	ie += 2;
470 	htcap = (struct ieee80211_ht_cap *)ie;
471 	sta->deflink.ht_cap.cap = htcap->cap_info;
472 	sta->deflink.ht_cap.mcs = htcap->mcs;
473 
474 	if ((sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) != 0 &&
475 	    IEEE80211_IS_CHAN_HT40(ni->ni_chan))
476 		sta->deflink.bandwidth = IEEE80211_STA_RX_BW_40;
477 	else
478 		sta->deflink.bandwidth = IEEE80211_STA_RX_BW_20;
479 
480 	/*
481 	 * 802.11n-2009 20.6 Parameters for HT MCSs gives the mandatory/
482 	 * optional MCS for Nss=1..4.  We need to check the first four
483 	 * MCS sets from the Rx MCS Bitmask; then there is MCS 32 and
484 	 * MCS33.. is UEQM.
485 	 */
486 	rx_nss = 0;
487 	for (i = 0; i < 4; i++) {
488 		if (htcap->mcs.rx_mask[i])
489 			rx_nss++;
490 	}
491 	if (rx_nss > 0)
492 		sta->deflink.rx_nss = rx_nss;
493 
494 	IMPROVE("sta->wme");
495 
496 	if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_MAX_AMSDU)
497 		sta->deflink.agg.max_amsdu_len = IEEE80211_MAX_MPDU_LEN_HT_7935;
498 	else
499 		sta->deflink.agg.max_amsdu_len = IEEE80211_MAX_MPDU_LEN_HT_3839;
500 	sta->deflink.agg.max_rc_amsdu_len = IEEE80211_MAX_MPDU_LEN_HT_BA;
501 #ifdef __handled_by_driver__	/* iwlwifi only? actually unused? */
502 	for (i = 0; i < nitems(sta.deflink.agg.max_tid_amsdu_len); i++) {
503 		sta->deflink.agg.max_tid_amsdu_len[j] = ;
504 	}
505 #endif
506 }
507 #endif
508 
509 #if defined(LKPI_80211_VHT)
510 static void
511 lkpi_sta_sync_vht_from_ni(struct ieee80211_vif *vif, struct ieee80211_sta *sta,
512     struct ieee80211_node *ni)
513 {
514 	uint32_t width;
515 	int rx_nss;
516 	uint16_t rx_mcs_map;
517 	uint8_t mcs;
518 
519 	if ((ni->ni_flags & IEEE80211_NODE_VHT) == 0 ||
520 	    !IEEE80211_IS_CHAN_VHT_5GHZ(ni->ni_chan)) {
521 		sta->deflink.vht_cap.vht_supported = false;
522 		return;
523 	}
524 
525 	sta->deflink.vht_cap.vht_supported = true;
526 
527 	sta->deflink.vht_cap.cap = ni->ni_vhtcap;
528 	sta->deflink.vht_cap.vht_mcs = ni->ni_vht_mcsinfo;
529 
530 	/*
531 	 * If VHT20/40 are selected do not update the bandwidth
532 	 * from HT but stya on VHT.
533 	 */
534 	if (ni->ni_vht_chanwidth == IEEE80211_VHT_CHANWIDTH_USE_HT)
535 		goto skip_bw;
536 
537 	width = (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK);
538 	switch (width) {
539 #if 0
540 	case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ:
541 	case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ:
542 		sta->deflink.bandwidth = IEEE80211_STA_RX_BW_160;
543 		break;
544 #endif
545 	default:
546 		/* Check if we do support 160Mhz somehow after all. */
547 #if 0
548 		if ((sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_EXT_NSS_BW_MASK) != 0)
549 			sta->deflink.bandwidth = IEEE80211_STA_RX_BW_160;
550 		else
551 #endif
552 			sta->deflink.bandwidth = IEEE80211_STA_RX_BW_80;
553 	}
554 skip_bw:
555 
556 	rx_nss = 0;
557 	rx_mcs_map = sta->deflink.vht_cap.vht_mcs.rx_mcs_map;
558 	for (int i = 7; i >= 0; i--) {
559 		mcs = rx_mcs_map >> (2 * i);
560 		mcs &= 0x3;
561 		if (mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED) {
562 			rx_nss = i + 1;
563 			break;
564 		}
565 	}
566 	if (rx_nss > 0)
567 		sta->deflink.rx_nss = rx_nss;
568 
569 	switch (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MAX_MPDU_MASK) {
570 	case IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454:
571 		sta->deflink.agg.max_amsdu_len = IEEE80211_MAX_MPDU_LEN_VHT_11454;
572 		break;
573 	case IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991:
574 		sta->deflink.agg.max_amsdu_len = IEEE80211_MAX_MPDU_LEN_VHT_7991;
575 		break;
576 	case IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895:
577 	default:
578 		sta->deflink.agg.max_amsdu_len = IEEE80211_MAX_MPDU_LEN_VHT_3895;
579 		break;
580 	}
581 }
582 #endif
583 
584 static void
585 lkpi_sta_sync_from_ni(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
586     struct ieee80211_sta *sta, struct ieee80211_node *ni, bool updchnctx)
587 {
588 
589 #if defined(LKPI_80211_HT)
590 	lkpi_sta_sync_ht_from_ni(vif, sta, ni);
591 #endif
592 #if defined(LKPI_80211_VHT)
593 	lkpi_sta_sync_vht_from_ni(vif, sta, ni);
594 #endif
595 	/*
596 	 * We are also called from node allocation which net80211
597 	 * can do even on `ifconfig down`; in that case the chanctx
598 	 * may still be valid and we get a discrepancy between
599 	 * sta and chanctx.  Thus do not try to update the chanctx
600 	 * when called from lkpi_lsta_alloc().
601 	 */
602 	if (updchnctx)
603 		lkpi_sync_chanctx_cw_from_rx_bw(hw, vif, sta);
604 }
605 
606 static uint8_t
607 lkpi_get_max_rx_chains(struct ieee80211_node *ni)
608 {
609 	uint8_t chains;
610 #if defined(LKPI_80211_HT) || defined(LKPI_80211_VHT)
611 	struct lkpi_sta *lsta;
612 	struct ieee80211_sta *sta;
613 
614 	lsta = ni->ni_drv_data;
615 	sta = LSTA_TO_STA(lsta);
616 #endif
617 
618 	chains = 1;
619 #if defined(LKPI_80211_HT)
620 	IMPROVE("We should factor counting MCS/NSS out for sync and here");
621 	if (sta->deflink.ht_cap.ht_supported)
622 		chains = MAX(chains, sta->deflink.rx_nss);
623 #endif
624 
625 #if defined(LKPI_80211_VHT)
626 	if (sta->deflink.vht_cap.vht_supported)
627 		chains = MAX(chains, sta->deflink.rx_nss);
628 #endif
629 
630 	return (chains);
631 }
632 
633 static void
634 lkpi_lsta_dump(struct lkpi_sta *lsta, struct ieee80211_node *ni,
635     const char *_f, int _l)
636 {
637 
638 #ifdef LINUXKPI_DEBUG_80211
639 	if ((linuxkpi_debug_80211 & D80211_TRACE_STA) == 0)
640 		return;
641 	if (lsta == NULL)
642 		return;
643 
644 	printf("%s:%d lsta %p ni %p sta %p\n",
645 	    _f, _l, lsta, ni, &lsta->sta);
646 	if (ni != NULL)
647 		ieee80211_dump_node(NULL, ni);
648 	printf("\ttxq_task txq len %d mtx\n", mbufq_len(&lsta->txq));
649 	printf("\tkc %p state %d added_to_drv %d in_mgd %d\n",
650 		&lsta->kc[0], lsta->state, lsta->added_to_drv, lsta->in_mgd);
651 #endif
652 }
653 
654 static void
655 lkpi_lsta_remove(struct lkpi_sta *lsta, struct lkpi_vif *lvif)
656 {
657 
658 	lockdep_assert_wiphy(lsta->hw->wiphy);
659 
660 	KASSERT(!list_empty(&lsta->lsta_list),
661 	    ("%s: lsta %p ni %p\n", __func__, lsta, lsta->ni));
662 	list_del_init(&lsta->lsta_list);
663 }
664 
665 static struct lkpi_sta *
666 lkpi_lsta_alloc(struct ieee80211vap *vap, const uint8_t mac[IEEE80211_ADDR_LEN],
667     struct ieee80211_hw *hw, struct ieee80211_node *ni)
668 {
669 	struct lkpi_sta *lsta;
670 	struct lkpi_vif *lvif;
671 	struct ieee80211_vif *vif;
672 	struct ieee80211_sta *sta;
673 	int band, i, tid;
674 
675 	lsta = malloc(sizeof(*lsta) + hw->sta_data_size, M_LKPI80211,
676 	    M_NOWAIT | M_ZERO);
677 	if (lsta == NULL)
678 		return (NULL);
679 
680 	lsta->hw = hw;
681 	lsta->added_to_drv = false;
682 	lsta->state = IEEE80211_STA_NOTEXIST;
683 	/*
684 	 * Link the ni to the lsta here without taking a reference.
685 	 * For one we would have to take the reference in node_init()
686 	 * as ieee80211_alloc_node() will initialise the refcount after us.
687 	 * For the other a ni and an lsta are 1:1 mapped and always together
688 	 * from [ic_]node_alloc() to [ic_]node_free() so we are essentally
689 	 * using the ni references for the lsta as well despite it being
690 	 * two separate allocations.
691 	 */
692 	lsta->ni = ni;
693 	/* The back-pointer "drv_data" to net80211_node let's us get lsta. */
694 	ni->ni_drv_data = lsta;
695 
696 	lvif = VAP_TO_LVIF(vap);
697 	vif = LVIF_TO_VIF(lvif);
698 	sta = LSTA_TO_STA(lsta);
699 
700 	IEEE80211_ADDR_COPY(sta->addr, mac);
701 
702 	/* TXQ */
703 	for (tid = 0; tid < nitems(sta->txq); tid++) {
704 		struct lkpi_txq *ltxq;
705 
706 		/* We are not limiting ourselves to hw.queues here. */
707 		ltxq = malloc(sizeof(*ltxq) + hw->txq_data_size,
708 		    M_LKPI80211, M_NOWAIT | M_ZERO);
709 		if (ltxq == NULL)
710 			goto cleanup;
711 		/* iwlwifi//mvm/sta.c::tid_to_mac80211_ac[] */
712 		if (tid == IEEE80211_NUM_TIDS) {
713 			if (!ieee80211_hw_check(hw, STA_MMPDU_TXQ)) {
714 				free(ltxq, M_LKPI80211);
715 				continue;
716 			}
717 			IMPROVE("AP/if we support non-STA here too");
718 			ltxq->txq.ac = IEEE80211_AC_VO;
719 		} else {
720 			ltxq->txq.ac = ieee80211e_up_to_ac[tid & 7];
721 		}
722 		ltxq->seen_dequeue = false;
723 		ltxq->stopped = false;
724 		ltxq->txq.vif = vif;
725 		ltxq->txq.tid = tid;
726 		ltxq->txq.sta = sta;
727 		TAILQ_ELEM_INIT(ltxq, txq_entry);
728 		skb_queue_head_init(&ltxq->skbq);
729 		LKPI_80211_LTXQ_LOCK_INIT(ltxq);
730 		sta->txq[tid] = &ltxq->txq;
731 	}
732 
733 	/* Deflink information. */
734 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
735 		struct ieee80211_supported_band *supband;
736 
737 		supband = hw->wiphy->bands[band];
738 		if (supband == NULL)
739 			continue;
740 
741 		for (i = 0; i < supband->n_bitrates; i++) {
742 			switch (band) {
743 			case NL80211_BAND_2GHZ:
744 				switch (supband->bitrates[i].bitrate) {
745 				case 240:	/* 11g only */
746 				case 120:	/* 11g only */
747 				case 110:
748 				case 60:	/* 11g only */
749 				case 55:
750 				case 20:
751 				case 10:
752 					sta->deflink.supp_rates[band] |= BIT(i);
753 					break;
754 				}
755 				break;
756 			case NL80211_BAND_5GHZ:
757 				switch (supband->bitrates[i].bitrate) {
758 				case 240:
759 				case 120:
760 				case 60:
761 					sta->deflink.supp_rates[band] |= BIT(i);
762 					break;
763 				}
764 				break;
765 			}
766 		}
767 	}
768 
769 	sta->deflink.smps_mode = IEEE80211_SMPS_OFF;
770 	sta->deflink.bandwidth = IEEE80211_STA_RX_BW_20;
771 	sta->deflink.rx_nss = 1;
772 
773 	wiphy_lock(hw->wiphy);
774 	lkpi_sta_sync_from_ni(hw, vif, sta, ni, false);
775 	wiphy_unlock(hw->wiphy);
776 
777 	IMPROVE("he, eht, bw_320, ... smps_mode, ..");
778 
779 	/* Link configuration. */
780 	IEEE80211_ADDR_COPY(sta->deflink.addr, sta->addr);
781 	sta->link[0] = &sta->deflink;
782 	for (i = 1; i < nitems(sta->link); i++) {
783 		IMPROVE("more links; only link[0] = deflink currently.");
784 	}
785 
786 	/* Deferred TX path. */
787 	LKPI_80211_LSTA_TXQ_LOCK_INIT(lsta);
788 	TASK_INIT(&lsta->txq_task, 0, lkpi_80211_txq_task, lsta);
789 	mbufq_init(&lsta->txq, IFQ_MAXLEN);
790 	lsta->txq_ready = true;
791 
792 	return (lsta);
793 
794 cleanup:
795 	for (; tid >= 0; tid--) {
796 		struct lkpi_txq *ltxq;
797 
798 		ltxq = TXQ_TO_LTXQ(sta->txq[tid]);
799 		LKPI_80211_LTXQ_LOCK_DESTROY(ltxq);
800 		free(sta->txq[tid], M_LKPI80211);
801 	}
802 	free(lsta, M_LKPI80211);
803 	return (NULL);
804 }
805 
806 static void
807 lkpi_lsta_free(struct lkpi_sta *lsta, struct ieee80211_node *ni)
808 {
809 	struct mbuf *m;
810 
811 	if (lsta->added_to_drv)
812 		panic("%s: Trying to free an lsta still known to firmware: "
813 		    "lsta %p ni %p added_to_drv %d\n",
814 		    __func__, lsta, ni, lsta->added_to_drv);
815 
816 	/* XXX-BZ free resources, ... */
817 	IMPROVE();
818 
819 	/* Drain sta->txq[] */
820 
821 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
822 	lsta->txq_ready = false;
823 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
824 
825 	/* Drain taskq, won't be restarted until added_to_drv is set again. */
826 	while (taskqueue_cancel(taskqueue_thread, &lsta->txq_task, NULL) != 0)
827 		taskqueue_drain(taskqueue_thread, &lsta->txq_task);
828 
829 	/* Flush mbufq (make sure to release ni refs!). */
830 	m = mbufq_dequeue(&lsta->txq);
831 	while (m != NULL) {
832 		struct ieee80211_node *nim;
833 
834 		nim = (struct ieee80211_node *)m->m_pkthdr.rcvif;
835 		if (nim != NULL)
836 			ieee80211_free_node(nim);
837 		m_freem(m);
838 		m = mbufq_dequeue(&lsta->txq);
839 	}
840 	KASSERT(mbufq_empty(&lsta->txq), ("%s: lsta %p has txq len %d != 0\n",
841 	    __func__, lsta, mbufq_len(&lsta->txq)));
842 	LKPI_80211_LSTA_TXQ_LOCK_DESTROY(lsta);
843 
844 	/* Remove lsta from vif; that is done by the state machine.  Should assert it? */
845 
846 	IMPROVE("Make sure everything is cleaned up.");
847 
848 	/* Free lsta. */
849 	lsta->ni = NULL;
850 	ni->ni_drv_data = NULL;
851 	free(lsta, M_LKPI80211);
852 }
853 
854 
855 static enum nl80211_band
856 lkpi_net80211_chan_to_nl80211_band(struct ieee80211_channel *c)
857 {
858 
859 	if (IEEE80211_IS_CHAN_2GHZ(c))
860 		return (NL80211_BAND_2GHZ);
861 	else if (IEEE80211_IS_CHAN_5GHZ(c))
862 		return (NL80211_BAND_5GHZ);
863 #ifdef __notyet__
864 	else if ()
865 		return (NL80211_BAND_6GHZ);
866 	else if ()
867 		return (NL80211_BAND_60GHZ);
868 	else if (IEEE80211_IS_CHAN_GSM(c))
869 		return (NL80211_BAND_XXX);
870 #endif
871 	else
872 		panic("%s: unsupported band. c %p flags %#x\n",
873 		    __func__, c, c->ic_flags);
874 }
875 
876 static uint32_t
877 lkpi_nl80211_band_to_net80211_band(enum nl80211_band band)
878 {
879 
880 	/* XXX-BZ this is just silly; net80211 is too convoluted. */
881 	/* IEEE80211_CHAN_A / _G / .. doesn't really work either. */
882 	switch (band) {
883 	case NL80211_BAND_2GHZ:
884 		return (IEEE80211_CHAN_2GHZ);
885 		break;
886 	case NL80211_BAND_5GHZ:
887 		return (IEEE80211_CHAN_5GHZ);
888 		break;
889 	case NL80211_BAND_60GHZ:
890 		break;
891 	case NL80211_BAND_6GHZ:
892 		break;
893 	default:
894 		panic("%s: unsupported band %u\n", __func__, band);
895 		break;
896 	}
897 
898 	IMPROVE();
899 	return (0x00);
900 }
901 
902 #if 0
903 static enum ieee80211_ac_numbers
904 lkpi_ac_net_to_l80211(int ac)
905 {
906 
907 	switch (ac) {
908 	case WME_AC_VO:
909 		return (IEEE80211_AC_VO);
910 	case WME_AC_VI:
911 		return (IEEE80211_AC_VI);
912 	case WME_AC_BE:
913 		return (IEEE80211_AC_BE);
914 	case WME_AC_BK:
915 		return (IEEE80211_AC_BK);
916 	default:
917 		printf("%s: invalid WME_AC_* input: ac = %d\n", __func__, ac);
918 		return (IEEE80211_AC_BE);
919 	}
920 }
921 #endif
922 
923 static enum nl80211_iftype
924 lkpi_opmode_to_vif_type(enum ieee80211_opmode opmode)
925 {
926 
927 	switch (opmode) {
928 	case IEEE80211_M_IBSS:
929 		return (NL80211_IFTYPE_ADHOC);
930 		break;
931 	case IEEE80211_M_STA:
932 		return (NL80211_IFTYPE_STATION);
933 		break;
934 	case IEEE80211_M_WDS:
935 		return (NL80211_IFTYPE_WDS);
936 		break;
937 	case IEEE80211_M_HOSTAP:
938 		return (NL80211_IFTYPE_AP);
939 		break;
940 	case IEEE80211_M_MONITOR:
941 		return (NL80211_IFTYPE_MONITOR);
942 		break;
943 	case IEEE80211_M_MBSS:
944 		return (NL80211_IFTYPE_MESH_POINT);
945 		break;
946 	case IEEE80211_M_AHDEMO:
947 		/* FALLTHROUGH */
948 	default:
949 		printf("ERROR: %s: unsupported opmode %d\n", __func__, opmode);
950 		/* FALLTHROUGH */
951 	}
952 	return (NL80211_IFTYPE_UNSPECIFIED);
953 }
954 
955 #ifdef LKPI_80211_HW_CRYPTO
956 static const char *
957 lkpi_cipher_suite_to_name(uint32_t wlan_cipher_suite)
958 {
959 
960 	switch (wlan_cipher_suite) {
961 	case WLAN_CIPHER_SUITE_WEP40:
962 		return ("WEP40");
963 	case WLAN_CIPHER_SUITE_TKIP:
964 		return ("TKIP");
965 	case WLAN_CIPHER_SUITE_CCMP:
966 		return ("CCMP");
967 	case WLAN_CIPHER_SUITE_WEP104:
968 		return ("WEP104");
969 	case WLAN_CIPHER_SUITE_AES_CMAC:
970 		return ("AES_CMAC");
971 	case WLAN_CIPHER_SUITE_GCMP:
972 		return ("GCMP");
973 	case WLAN_CIPHER_SUITE_GCMP_256:
974 		return ("GCMP_256");
975 	case WLAN_CIPHER_SUITE_CCMP_256:
976 		return ("CCMP_256");
977 	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
978 		return ("BIP_GMAC_128");
979 	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
980 		return ("BIP_GMAC_256");
981 	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
982 		return ("BIP_CMAC_256");
983 	default:
984 		return ("??");
985 	}
986 }
987 
988 static uint32_t
989 lkpi_l80211_to_net80211_cyphers(uint32_t wlan_cipher_suite)
990 {
991 
992 	switch (wlan_cipher_suite) {
993 	case WLAN_CIPHER_SUITE_WEP40:
994 		return (IEEE80211_CRYPTO_WEP);
995 	case WLAN_CIPHER_SUITE_TKIP:
996 		return (IEEE80211_CRYPTO_TKIP);
997 	case WLAN_CIPHER_SUITE_CCMP:
998 		return (IEEE80211_CRYPTO_AES_CCM);
999 	case WLAN_CIPHER_SUITE_WEP104:
1000 		return (IEEE80211_CRYPTO_WEP);
1001 	case WLAN_CIPHER_SUITE_AES_CMAC:
1002 	case WLAN_CIPHER_SUITE_GCMP:
1003 	case WLAN_CIPHER_SUITE_GCMP_256:
1004 	case WLAN_CIPHER_SUITE_CCMP_256:
1005 	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
1006 	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
1007 	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
1008 		printf("%s: unsupported WLAN Cipher Suite %#08x | %u (%s)\n",
1009 		    __func__,
1010 		    wlan_cipher_suite >> 8, wlan_cipher_suite & 0xff,
1011 		    lkpi_cipher_suite_to_name(wlan_cipher_suite));
1012 		break;
1013 	default:
1014 		printf("%s: unknown WLAN Cipher Suite %#08x | %u (%s)\n",
1015 		    __func__,
1016 		    wlan_cipher_suite >> 8, wlan_cipher_suite & 0xff,
1017 		    lkpi_cipher_suite_to_name(wlan_cipher_suite));
1018 	}
1019 
1020 	return (0);
1021 }
1022 
1023 static uint32_t
1024 lkpi_net80211_to_l80211_cipher_suite(uint32_t cipher, uint8_t keylen)
1025 {
1026 
1027 	switch (cipher) {
1028 	case IEEE80211_CIPHER_TKIP:
1029 		return (WLAN_CIPHER_SUITE_TKIP);
1030 	case IEEE80211_CIPHER_AES_CCM:
1031 		return (WLAN_CIPHER_SUITE_CCMP);
1032 	case IEEE80211_CIPHER_WEP:
1033 		if (keylen < 8)
1034 			return (WLAN_CIPHER_SUITE_WEP40);
1035 		else
1036 			return (WLAN_CIPHER_SUITE_WEP104);
1037 		break;
1038 	case IEEE80211_CIPHER_AES_OCB:
1039 	case IEEE80211_CIPHER_TKIPMIC:
1040 	case IEEE80211_CIPHER_CKIP:
1041 	case IEEE80211_CIPHER_NONE:
1042 		printf("%s: unsupported cipher %#010x\n", __func__, cipher);
1043 		break;
1044 	default:
1045 		printf("%s: unknown cipher %#010x\n", __func__, cipher);
1046 	};
1047 	return (0);
1048 }
1049 #endif
1050 
1051 #ifdef __notyet__
1052 static enum ieee80211_sta_state
1053 lkpi_net80211_state_to_sta_state(enum ieee80211_state state)
1054 {
1055 
1056 	/*
1057 	 * XXX-BZ The net80211 states are "try to ..", the lkpi8011 states are
1058 	 * "done".  Also ASSOC/AUTHORIZED are both "RUN" then?
1059 	 */
1060 	switch (state) {
1061 	case IEEE80211_S_INIT:
1062 		return (IEEE80211_STA_NOTEXIST);
1063 	case IEEE80211_S_SCAN:
1064 		return (IEEE80211_STA_NONE);
1065 	case IEEE80211_S_AUTH:
1066 		return (IEEE80211_STA_AUTH);
1067 	case IEEE80211_S_ASSOC:
1068 		return (IEEE80211_STA_ASSOC);
1069 	case IEEE80211_S_RUN:
1070 		return (IEEE80211_STA_AUTHORIZED);
1071 	case IEEE80211_S_CAC:
1072 	case IEEE80211_S_CSA:
1073 	case IEEE80211_S_SLEEP:
1074 	default:
1075 		UNIMPLEMENTED;
1076 	};
1077 
1078 	return (IEEE80211_STA_NOTEXIST);
1079 }
1080 #endif
1081 
1082 static struct linuxkpi_ieee80211_channel *
1083 lkpi_find_lkpi80211_chan(struct lkpi_hw *lhw,
1084     struct ieee80211_channel *c)
1085 {
1086 	struct ieee80211_hw *hw;
1087 	struct linuxkpi_ieee80211_channel *channels;
1088 	enum nl80211_band band;
1089 	int i, nchans;
1090 
1091 	hw = LHW_TO_HW(lhw);
1092 	band = lkpi_net80211_chan_to_nl80211_band(c);
1093 	if (hw->wiphy->bands[band] == NULL)
1094 		return (NULL);
1095 
1096 	nchans = hw->wiphy->bands[band]->n_channels;
1097 	if (nchans <= 0)
1098 		return (NULL);
1099 
1100 	channels = hw->wiphy->bands[band]->channels;
1101 	for (i = 0; i < nchans; i++) {
1102 		if (channels[i].hw_value == c->ic_ieee)
1103 			return (&channels[i]);
1104 	}
1105 
1106 	return (NULL);
1107 }
1108 
1109 #if 0
1110 static struct linuxkpi_ieee80211_channel *
1111 lkpi_get_lkpi80211_chan(struct ieee80211com *ic, struct ieee80211_node *ni)
1112 {
1113 	struct linuxkpi_ieee80211_channel *chan;
1114 	struct ieee80211_channel *c;
1115 	struct lkpi_hw *lhw;
1116 
1117 	chan = NULL;
1118 	if (ni != NULL && ni->ni_chan != IEEE80211_CHAN_ANYC)
1119 		c = ni->ni_chan;
1120 	else if (ic->ic_bsschan != IEEE80211_CHAN_ANYC)
1121 		c = ic->ic_bsschan;
1122 	else if (ic->ic_curchan != IEEE80211_CHAN_ANYC)
1123 		c = ic->ic_curchan;
1124 	else
1125 		c = NULL;
1126 
1127 	if (c != NULL && c != IEEE80211_CHAN_ANYC) {
1128 		lhw = ic->ic_softc;
1129 		chan = lkpi_find_lkpi80211_chan(lhw, c);
1130 	}
1131 
1132 	return (chan);
1133 }
1134 #endif
1135 
1136 struct linuxkpi_ieee80211_channel *
1137 linuxkpi_ieee80211_get_channel(struct wiphy *wiphy, uint32_t freq)
1138 {
1139 	enum nl80211_band band;
1140 
1141 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
1142 		struct ieee80211_supported_band *supband;
1143 		struct linuxkpi_ieee80211_channel *channels;
1144 		int i;
1145 
1146 		supband = wiphy->bands[band];
1147 		if (supband == NULL || supband->n_channels == 0)
1148 			continue;
1149 
1150 		channels = supband->channels;
1151 		for (i = 0; i < supband->n_channels; i++) {
1152 			if (channels[i].center_freq == freq)
1153 				return (&channels[i]);
1154 		}
1155 	}
1156 
1157 	return (NULL);
1158 }
1159 
1160 #ifdef LKPI_80211_HW_CRYPTO
1161 static int
1162 lkpi_sta_del_keys(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
1163     struct lkpi_sta *lsta)
1164 {
1165 	int error;
1166 
1167 	if (!lkpi_hwcrypto)
1168 		return (0);
1169 
1170 	lockdep_assert_wiphy(hw->wiphy);
1171 	ieee80211_ref_node(lsta->ni);
1172 
1173 	error = 0;
1174 	for (ieee80211_keyix keyix = 0; keyix < nitems(lsta->kc); keyix++) {
1175 		struct ieee80211_key_conf *kc;
1176 		int err;
1177 
1178 		if (lsta->kc[keyix] == NULL)
1179 			continue;
1180 		kc = lsta->kc[keyix];
1181 
1182 		err = lkpi_80211_mo_set_key(hw, DISABLE_KEY, vif,
1183 		    LSTA_TO_STA(lsta), kc);
1184 		if (err != 0) {
1185 			ic_printf(lsta->ni->ni_ic, "%s: set_key cmd %d(%s) for "
1186 			    "sta %6D failed: %d\n", __func__, DISABLE_KEY,
1187 			    "DISABLE", lsta->sta.addr, ":", err);
1188 			error++;
1189 
1190 			/*
1191 			 * If we free the key here we will never be able to get it
1192 			 * removed from the driver/fw which will likely make us
1193 			 * crash (firmware).
1194 			 */
1195 			continue;
1196 		}
1197 #ifdef LINUXKPI_DEBUG_80211
1198 		if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1199 			ic_printf(lsta->ni->ni_ic, "%s: set_key cmd %d(%s) for "
1200 			    "sta %6D succeeded: keyidx %u hw_key_idx %u flags %#10x\n",
1201 			    __func__, DISABLE_KEY, "DISABLE", lsta->sta.addr, ":",
1202 			    kc->keyidx, kc->hw_key_idx, kc->flags);
1203 #endif
1204 
1205 		lsta->kc[keyix] = NULL;
1206 		free(kc, M_LKPI80211);
1207 	}
1208 	ieee80211_free_node(lsta->ni);
1209 	return (error);
1210 }
1211 
1212 static int
1213 _lkpi_iv_key_delete(struct ieee80211vap *vap, const struct ieee80211_key *k)
1214 {
1215 	struct ieee80211com *ic;
1216 	struct lkpi_hw *lhw;
1217 	struct ieee80211_hw *hw;
1218 	struct lkpi_vif *lvif;
1219 	struct lkpi_sta *lsta;
1220 	struct ieee80211_vif *vif;
1221 	struct ieee80211_sta *sta;
1222 	struct ieee80211_node *ni;
1223 	struct ieee80211_key_conf *kc;
1224 	int error;
1225 
1226 	ic = vap->iv_ic;
1227 	lhw = ic->ic_softc;
1228 	hw = LHW_TO_HW(lhw);
1229 	lvif = VAP_TO_LVIF(vap);
1230 	vif = LVIF_TO_VIF(lvif);
1231 
1232 	if (vap->iv_bss == NULL) {
1233 		ic_printf(ic, "%s: iv_bss %p for vap %p is NULL\n",
1234 		    __func__, vap->iv_bss, vap);
1235 		return (0);
1236 	}
1237 	ni = ieee80211_ref_node(vap->iv_bss);
1238 	lsta = ni->ni_drv_data;
1239 	if (lsta == NULL) {
1240 		ic_printf(ic, "%s: ni %p (%6D) with lsta NULL\n",
1241 		    __func__, ni, ni->ni_bssid, ":");
1242 		ieee80211_free_node(ni);
1243 		return (0);
1244 	}
1245 	sta = LSTA_TO_STA(lsta);
1246 
1247 	if (lsta->kc[k->wk_keyix] == NULL) {
1248 #ifdef LINUXKPI_DEBUG_80211
1249 		if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1250 			ic_printf(ic, "%s: sta %6D and no key information, "
1251 			    "keyidx %u wk_macaddr %6D; returning success\n",
1252 			    __func__, sta->addr, ":",
1253 			    k->wk_keyix, k->wk_macaddr, ":");
1254 #endif
1255 		ieee80211_free_node(ni);
1256 		return (1);
1257 	}
1258 
1259 	kc = lsta->kc[k->wk_keyix];
1260 	/* Re-check under lock. */
1261 	if (kc == NULL) {
1262 #ifdef LINUXKPI_DEBUG_80211
1263 		if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1264 			ic_printf(ic, "%s: sta %6D and key information vanished, "
1265 			    "returning success\n", __func__, sta->addr, ":");
1266 #endif
1267 		error = 1;
1268 		goto out;
1269 	}
1270 
1271 	error = lkpi_80211_mo_set_key(hw, DISABLE_KEY, vif, sta, kc);
1272 	if (error != 0) {
1273 		ic_printf(ic, "%s: set_key cmd %d(%s) for sta %6D failed: %d\n",
1274 		    __func__, DISABLE_KEY, "DISABLE", sta->addr, ":", error);
1275 		error = 0;
1276 		goto out;
1277 	}
1278 
1279 #ifdef LINUXKPI_DEBUG_80211
1280 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1281 		ic_printf(ic, "%s: set_key cmd %d(%s) for sta %6D succeeded: "
1282 		    "keyidx %u hw_key_idx %u flags %#10x\n", __func__,
1283 		    DISABLE_KEY, "DISABLE", sta->addr, ":",
1284 		    kc->keyidx, kc->hw_key_idx, kc->flags);
1285 #endif
1286 	lsta->kc[k->wk_keyix] = NULL;
1287 	free(kc, M_LKPI80211);
1288 	error = 1;
1289 out:
1290 	ieee80211_free_node(ni);
1291 	return (error);
1292 }
1293 
1294 static int
1295 lkpi_iv_key_delete(struct ieee80211vap *vap, const struct ieee80211_key *k)
1296 {
1297 
1298 	/* XXX-BZ one day we should replace this iterating over VIFs, or node list? */
1299 	/* See also lkpi_sta_del_keys() these days. */
1300 	return (_lkpi_iv_key_delete(vap, k));
1301 }
1302 
1303 static int
1304 _lkpi_iv_key_set(struct ieee80211vap *vap, const struct ieee80211_key *k)
1305 {
1306 	struct ieee80211com *ic;
1307 	struct lkpi_hw *lhw;
1308 	struct ieee80211_hw *hw;
1309 	struct lkpi_vif *lvif;
1310 	struct lkpi_sta *lsta;
1311 	struct ieee80211_vif *vif;
1312 	struct ieee80211_sta *sta;
1313 	struct ieee80211_node *ni;
1314 	struct ieee80211_key_conf *kc;
1315 	uint32_t lcipher;
1316 	int error;
1317 
1318 	ic = vap->iv_ic;
1319 	lhw = ic->ic_softc;
1320 	hw = LHW_TO_HW(lhw);
1321 	lvif = VAP_TO_LVIF(vap);
1322 	vif = LVIF_TO_VIF(lvif);
1323 
1324 	if (vap->iv_bss == NULL) {
1325 		ic_printf(ic, "%s: iv_bss %p for vap %p is NULL\n",
1326 		    __func__, vap->iv_bss, vap);
1327 		return (0);
1328 	}
1329 	ni = ieee80211_ref_node(vap->iv_bss);
1330 	lsta = ni->ni_drv_data;
1331 	if (lsta == NULL) {
1332 		ic_printf(ic, "%s: ni %p (%6D) with lsta NULL\n",
1333 		    __func__, ni, ni->ni_bssid, ":");
1334 		ieee80211_free_node(ni);
1335 		return (0);
1336 	}
1337 	sta = LSTA_TO_STA(lsta);
1338 
1339 	if (lsta->kc[k->wk_keyix] != NULL) {
1340 		IMPROVE("Still in firmware? Del first. Can we assert this cannot happen?");
1341 		ic_printf(ic, "%s: sta %6D found with key information\n",
1342 		    __func__, sta->addr, ":");
1343 		kc = lsta->kc[k->wk_keyix];
1344 		lsta->kc[k->wk_keyix] = NULL;
1345 		free(kc, M_LKPI80211);
1346 		kc = NULL;	/* safeguard */
1347 	}
1348 
1349 	lcipher = lkpi_net80211_to_l80211_cipher_suite(
1350 	    k->wk_cipher->ic_cipher, k->wk_keylen);
1351 	switch (lcipher) {
1352 	case WLAN_CIPHER_SUITE_CCMP:
1353 		break;
1354 	case WLAN_CIPHER_SUITE_TKIP:
1355 	default:
1356 		ic_printf(ic, "%s: CIPHER SUITE %#x (%s) not supported\n",
1357 		    __func__, lcipher, lkpi_cipher_suite_to_name(lcipher));
1358 		IMPROVE();
1359 		ieee80211_free_node(ni);
1360 		return (0);
1361 	}
1362 
1363 	kc = malloc(sizeof(*kc) + k->wk_keylen, M_LKPI80211, M_WAITOK | M_ZERO);
1364 	kc->_k = k;		/* Save the pointer to net80211. */
1365 	atomic64_set(&kc->tx_pn, k->wk_keytsc);
1366 	kc->cipher = lcipher;
1367 	kc->keyidx = k->wk_keyix;
1368 #if 0
1369 	kc->hw_key_idx = /* set by hw and needs to be passed for TX */;
1370 #endif
1371 	atomic64_set(&kc->tx_pn, k->wk_keytsc);
1372 	kc->keylen = k->wk_keylen;
1373 	memcpy(kc->key, k->wk_key, k->wk_keylen);
1374 
1375 	if (k->wk_flags & (IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV))
1376 		kc->flags |= IEEE80211_KEY_FLAG_PAIRWISE;
1377 	if (k->wk_flags & IEEE80211_KEY_GROUP)
1378 		kc->flags &= ~IEEE80211_KEY_FLAG_PAIRWISE;
1379 
1380 	switch (kc->cipher) {
1381 	case WLAN_CIPHER_SUITE_CCMP:
1382 		kc->iv_len = k->wk_cipher->ic_header;
1383 		kc->icv_len = k->wk_cipher->ic_trailer;
1384 		break;
1385 	case WLAN_CIPHER_SUITE_TKIP:
1386 	default:
1387 		/* currently UNREACH */
1388 		IMPROVE();
1389 		break;
1390 	};
1391 	lsta->kc[k->wk_keyix] = kc;
1392 
1393 	error = lkpi_80211_mo_set_key(hw, SET_KEY, vif, sta, kc);
1394 	if (error != 0) {
1395 		ic_printf(ic, "%s: set_key cmd %d(%s) for sta %6D failed: %d\n",
1396 		    __func__, SET_KEY, "SET", sta->addr, ":", error);
1397 		lsta->kc[k->wk_keyix] = NULL;
1398 		free(kc, M_LKPI80211);
1399 		ieee80211_free_node(ni);
1400 		return (0);
1401 	}
1402 
1403 #ifdef LINUXKPI_DEBUG_80211
1404 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1405 		ic_printf(ic, "%s: set_key cmd %d(%s) for sta %6D succeeded: "
1406 		    "kc %p keyidx %u hw_key_idx %u flags %#010x\n", __func__,
1407 		    SET_KEY, "SET", sta->addr, ":",
1408 		    kc, kc->keyidx, kc->hw_key_idx, kc->flags);
1409 #endif
1410 
1411 	ieee80211_free_node(ni);
1412 	return (1);
1413 }
1414 
1415 static  int
1416 lkpi_iv_key_set(struct ieee80211vap *vap, const struct ieee80211_key *k)
1417 {
1418 
1419 	return (_lkpi_iv_key_set(vap, k));
1420 }
1421 
1422 static void
1423 lkpi_iv_key_update_begin(struct ieee80211vap *vap)
1424 {
1425 	struct ieee80211_node_table *nt;
1426 	struct ieee80211com *ic;
1427 	struct lkpi_hw *lhw;
1428 	struct ieee80211_hw *hw;
1429 	struct lkpi_vif *lvif;
1430 	bool icislocked, ntislocked;
1431 
1432 	ic = vap->iv_ic;
1433 	lhw = ic->ic_softc;
1434 	hw = LHW_TO_HW(lhw);
1435 	lvif = VAP_TO_LVIF(vap);
1436 	nt = &ic->ic_sta;
1437 
1438 	icislocked = IEEE80211_IS_LOCKED(ic);
1439 	ntislocked = IEEE80211_NODE_IS_LOCKED(nt);
1440 
1441 #ifdef LINUXKPI_DEBUG_80211
1442 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1443 		ic_printf(ic, "%s: tid %d vap %p ic %p %slocked nt %p %slocked "
1444 		    "lvif ic_unlocked %d nt_unlocked %d\n", __func__,
1445 		    curthread->td_tid, vap,
1446 		    ic, icislocked ? "" : "un", nt, ntislocked ? "" : "un",
1447 		    lvif->ic_unlocked, lvif->nt_unlocked);
1448 #endif
1449 
1450 	/* This is inconsistent net80211 locking to be fixed one day. */
1451 	if (icislocked)
1452 		IEEE80211_UNLOCK(ic);
1453 	if (ntislocked)
1454 		IEEE80211_NODE_UNLOCK(nt);
1455 
1456 	wiphy_lock(hw->wiphy);
1457 
1458 	/*
1459 	 * ic/nt_unlocked could be a bool given we are under the lock and there
1460 	 * must only be a single thread.
1461 	 * In case anything in the future disturbs the order the refcnt will
1462 	 * help us catching problems a lot easier.
1463 	 */
1464 	if (icislocked)
1465 		refcount_acquire(&lvif->ic_unlocked);
1466 	if (ntislocked)
1467 		refcount_acquire(&lvif->nt_unlocked);
1468 }
1469 
1470 static void
1471 lkpi_iv_key_update_end(struct ieee80211vap *vap)
1472 {
1473 	struct ieee80211_node_table *nt;
1474 	struct ieee80211com *ic;
1475 	struct lkpi_hw *lhw;
1476 	struct ieee80211_hw *hw;
1477 	struct lkpi_vif *lvif;
1478 	bool icislocked, ntislocked;
1479 
1480 	ic = vap->iv_ic;
1481 	lhw = ic->ic_softc;
1482 	hw = LHW_TO_HW(lhw);
1483 	lvif = VAP_TO_LVIF(vap);
1484 	nt = &ic->ic_sta;
1485 
1486 	icislocked = IEEE80211_IS_LOCKED(ic);
1487 	MPASS(!icislocked);
1488 	ntislocked = IEEE80211_NODE_IS_LOCKED(nt);
1489 	MPASS(!ntislocked);
1490 
1491 #ifdef LINUXKPI_DEBUG_80211
1492 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1493 		ic_printf(ic, "%s: tid %d vap %p ic %p %slocked nt %p %slocked "
1494 		    "lvif ic_unlocked %d nt_unlocked %d\n", __func__,
1495 		    curthread->td_tid, vap,
1496 		    ic, icislocked ? "" : "un", nt, ntislocked ? "" : "un",
1497 		    lvif->ic_unlocked, lvif->nt_unlocked);
1498 #endif
1499 
1500 	/*
1501 	 * Check under lock; see comment in lkpi_iv_key_update_begin().
1502 	 * In case the refcnt gets out of sync locking in net80211 will
1503 	 * quickly barf as well (trying to unlock a lock not held).
1504 	 */
1505 	icislocked = refcount_release_if_last(&lvif->ic_unlocked);
1506 	ntislocked = refcount_release_if_last(&lvif->nt_unlocked);
1507 	wiphy_unlock(hw->wiphy);
1508 
1509 	/*
1510 	 * This is inconsistent net80211 locking to be fixed one day.
1511 	 * ic before nt to avoid a LOR.
1512 	 */
1513 	if (icislocked)
1514 		IEEE80211_LOCK(ic);
1515 	if (ntislocked)
1516 		IEEE80211_NODE_LOCK(nt);
1517 }
1518 #endif
1519 
1520 static u_int
1521 lkpi_ic_update_mcast_copy(void *arg, struct sockaddr_dl *sdl, u_int cnt)
1522 {
1523 	struct netdev_hw_addr_list *mc_list;
1524 	struct netdev_hw_addr *addr;
1525 
1526 	KASSERT(arg != NULL && sdl != NULL, ("%s: arg %p sdl %p cnt %u\n",
1527 	    __func__, arg, sdl, cnt));
1528 
1529 	mc_list = arg;
1530 	/* If it is on the list already skip it. */
1531 	netdev_hw_addr_list_for_each(addr, mc_list) {
1532 		if (!memcmp(addr->addr, LLADDR(sdl), sdl->sdl_alen))
1533 			return (0);
1534 	}
1535 
1536 	addr = malloc(sizeof(*addr), M_LKPI80211, M_NOWAIT | M_ZERO);
1537 	if (addr == NULL)
1538 		return (0);
1539 
1540 	INIT_LIST_HEAD(&addr->addr_list);
1541 	memcpy(addr->addr, LLADDR(sdl), sdl->sdl_alen);
1542 	/* XXX this should be a netdev function? */
1543 	list_add(&addr->addr_list, &mc_list->addr_list);
1544 	mc_list->count++;
1545 
1546 #ifdef LINUXKPI_DEBUG_80211
1547 	if (linuxkpi_debug_80211 & D80211_TRACE)
1548 		printf("%s:%d: mc_list count %d: added %6D\n",
1549 		    __func__, __LINE__, mc_list->count, addr->addr, ":");
1550 #endif
1551 
1552 	return (1);
1553 }
1554 
1555 static void
1556 lkpi_update_mcast_filter(struct ieee80211com *ic, bool force)
1557 {
1558 	struct lkpi_hw *lhw;
1559 	struct ieee80211_hw *hw;
1560 	struct netdev_hw_addr_list mc_list;
1561 	struct list_head *le, *next;
1562 	struct netdev_hw_addr *addr;
1563 	struct ieee80211vap *vap;
1564 	u64 mc;
1565 	unsigned int changed_flags, total_flags;
1566 
1567 	lhw = ic->ic_softc;
1568 
1569 	if (lhw->ops->prepare_multicast == NULL ||
1570 	    lhw->ops->configure_filter == NULL)
1571 		return;
1572 
1573 	if (!lhw->update_mc && !force)
1574 		return;
1575 
1576 	changed_flags = total_flags = 0;
1577 	mc_list.count = 0;
1578 	INIT_LIST_HEAD(&mc_list.addr_list);
1579 	if (ic->ic_allmulti == 0) {
1580 		TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
1581 			if_foreach_llmaddr(vap->iv_ifp,
1582 			    lkpi_ic_update_mcast_copy, &mc_list);
1583 	} else {
1584 		changed_flags |= FIF_ALLMULTI;
1585 	}
1586 
1587 	hw = LHW_TO_HW(lhw);
1588 	mc = lkpi_80211_mo_prepare_multicast(hw, &mc_list);
1589 	/*
1590 	 * XXX-BZ make sure to get this sorted what is a change,
1591 	 * what gets all set; what was already set?
1592 	 */
1593 	total_flags = changed_flags;
1594 	lkpi_80211_mo_configure_filter(hw, changed_flags, &total_flags, mc);
1595 
1596 #ifdef LINUXKPI_DEBUG_80211
1597 	if (linuxkpi_debug_80211 & D80211_TRACE)
1598 		printf("%s: changed_flags %#06x count %d total_flags %#010x\n",
1599 		    __func__, changed_flags, mc_list.count, total_flags);
1600 #endif
1601 
1602 	if (mc_list.count != 0) {
1603 		list_for_each_safe(le, next, &mc_list.addr_list) {
1604 			addr = list_entry(le, struct netdev_hw_addr, addr_list);
1605 			free(addr, M_LKPI80211);
1606 			mc_list.count--;
1607 		}
1608 	}
1609 	KASSERT(mc_list.count == 0, ("%s: mc_list %p count %d != 0\n",
1610 	    __func__, &mc_list, mc_list.count));
1611 }
1612 
1613 static enum ieee80211_bss_changed
1614 lkpi_update_dtim_tsf(struct ieee80211_vif *vif, struct ieee80211_node *ni,
1615     struct ieee80211vap *vap, const char *_f, int _l)
1616 {
1617 	enum ieee80211_bss_changed bss_changed;
1618 
1619 	bss_changed = 0;
1620 
1621 #ifdef LINUXKPI_DEBUG_80211
1622 	if (linuxkpi_debug_80211 & D80211_TRACE)
1623 		printf("%s:%d [%s:%d] assoc %d aid %d beacon_int %u "
1624 		    "dtim_period %u sync_dtim_count %u sync_tsf %ju "
1625 		    "sync_device_ts %u bss_changed %#010jx\n",
1626 			__func__, __LINE__, _f, _l,
1627 			vif->cfg.assoc, vif->cfg.aid,
1628 			vif->bss_conf.beacon_int, vif->bss_conf.dtim_period,
1629 			vif->bss_conf.sync_dtim_count,
1630 			(uintmax_t)vif->bss_conf.sync_tsf,
1631 			vif->bss_conf.sync_device_ts,
1632 			(uintmax_t)bss_changed);
1633 #endif
1634 
1635 	if (vif->bss_conf.beacon_int != ni->ni_intval) {
1636 		vif->bss_conf.beacon_int = ni->ni_intval;
1637 		/* iwlwifi FW bug workaround; iwl_mvm_mac_sta_state. */
1638 		if (vif->bss_conf.beacon_int < 16)
1639 			vif->bss_conf.beacon_int = 16;
1640 		bss_changed |= BSS_CHANGED_BEACON_INT;
1641 	}
1642 	if (vif->bss_conf.dtim_period != vap->iv_dtim_period &&
1643 	    vap->iv_dtim_period > 0) {
1644 		vif->bss_conf.dtim_period = vap->iv_dtim_period;
1645 		bss_changed |= BSS_CHANGED_BEACON_INFO;
1646 	}
1647 
1648 	vif->bss_conf.sync_dtim_count = vap->iv_dtim_count;
1649 	vif->bss_conf.sync_tsf = le64toh(ni->ni_tstamp.tsf);
1650 	/* vif->bss_conf.sync_device_ts = set in linuxkpi_ieee80211_rx. */
1651 
1652 #ifdef LINUXKPI_DEBUG_80211
1653 	if (linuxkpi_debug_80211 & D80211_TRACE)
1654 		printf("%s:%d [%s:%d] assoc %d aid %d beacon_int %u "
1655 		    "dtim_period %u sync_dtim_count %u sync_tsf %ju "
1656 		    "sync_device_ts %u bss_changed %#010jx\n",
1657 			__func__, __LINE__, _f, _l,
1658 			vif->cfg.assoc, vif->cfg.aid,
1659 			vif->bss_conf.beacon_int, vif->bss_conf.dtim_period,
1660 			vif->bss_conf.sync_dtim_count,
1661 			(uintmax_t)vif->bss_conf.sync_tsf,
1662 			vif->bss_conf.sync_device_ts,
1663 			(uintmax_t)bss_changed);
1664 #endif
1665 
1666 	return (bss_changed);
1667 }
1668 
1669 static void
1670 lkpi_stop_hw_scan(struct lkpi_hw *lhw, struct ieee80211_vif *vif)
1671 {
1672 	struct ieee80211_hw *hw;
1673 	int error;
1674 	bool cancel;
1675 
1676 	LKPI_80211_LHW_SCAN_LOCK(lhw);
1677 	cancel = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
1678 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
1679 	if (!cancel)
1680 		return;
1681 
1682 	hw = LHW_TO_HW(lhw);
1683 
1684 	IEEE80211_UNLOCK(lhw->ic);
1685 	wiphy_lock(hw->wiphy);
1686 	/* Need to cancel the scan. */
1687 	lkpi_80211_mo_cancel_hw_scan(hw, vif);
1688 	wiphy_unlock(hw->wiphy);
1689 
1690 	/* Need to make sure we see ieee80211_scan_completed. */
1691 	LKPI_80211_LHW_SCAN_LOCK(lhw);
1692 	if ((lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0)
1693 		error = msleep(lhw, &lhw->scan_mtx, 0, "lhwscanstop", hz/2);
1694 	cancel = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
1695 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
1696 
1697 	IEEE80211_LOCK(lhw->ic);
1698 
1699 	if (cancel)
1700 		ic_printf(lhw->ic, "%s: failed to cancel scan: %d (%p, %p)\n",
1701 		    __func__, error, lhw, vif);
1702 }
1703 
1704 static void
1705 lkpi_hw_conf_idle(struct ieee80211_hw *hw, bool new)
1706 {
1707 	struct lkpi_hw *lhw;
1708 	int error;
1709 	bool old;
1710 
1711 	old = hw->conf.flags & IEEE80211_CONF_IDLE;
1712 	if (old == new)
1713 		return;
1714 
1715 	hw->conf.flags ^= IEEE80211_CONF_IDLE;
1716 	error = lkpi_80211_mo_config(hw, IEEE80211_CONF_CHANGE_IDLE);
1717 	if (error != 0 && error != EOPNOTSUPP) {
1718 		lhw = HW_TO_LHW(hw);
1719 		ic_printf(lhw->ic, "ERROR: %s: config %#0x returned %d\n",
1720 		    __func__, IEEE80211_CONF_CHANGE_IDLE, error);
1721 	}
1722 }
1723 
1724 static enum ieee80211_bss_changed
1725 lkpi_disassoc(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
1726     struct lkpi_hw *lhw)
1727 {
1728 	enum ieee80211_bss_changed changed;
1729 
1730 	changed = 0;
1731 	sta->aid = 0;
1732 	if (vif->cfg.assoc) {
1733 
1734 		lhw->update_mc = true;
1735 		lkpi_update_mcast_filter(lhw->ic, true);
1736 
1737 		vif->cfg.assoc = false;
1738 		vif->cfg.aid = 0;
1739 		changed |= BSS_CHANGED_ASSOC;
1740 		IMPROVE();
1741 
1742 		/*
1743 		 * Executing the bss_info_changed(BSS_CHANGED_ASSOC) with
1744 		 * assoc = false right away here will remove the sta from
1745 		 * firmware for iwlwifi.
1746 		 * We no longer do this but only return the BSS_CHNAGED value.
1747 		 * The caller is responsible for removing the sta gong to
1748 		 * IEEE80211_STA_NOTEXIST and then executing the
1749 		 * bss_info_changed() update.
1750 		 * See lkpi_sta_run_to_init() for more detailed comment.
1751 		 */
1752 	}
1753 
1754 	return (changed);
1755 }
1756 
1757 static void
1758 lkpi_wake_tx_queues(struct ieee80211_hw *hw, struct ieee80211_sta *sta,
1759     bool dequeue_seen, bool no_emptyq)
1760 {
1761 	struct lkpi_txq *ltxq;
1762 	int tid;
1763 	bool ltxq_empty;
1764 
1765 	/* Wake up all queues to know they are allocated in the driver. */
1766 	for (tid = 0; tid < nitems(sta->txq); tid++) {
1767 
1768 		if (tid == IEEE80211_NUM_TIDS) {
1769 			IMPROVE("station specific?");
1770 			if (!ieee80211_hw_check(hw, STA_MMPDU_TXQ))
1771 				continue;
1772 		} else if (tid >= hw->queues)
1773 			continue;
1774 
1775 		if (sta->txq[tid] == NULL)
1776 			continue;
1777 
1778 		ltxq = TXQ_TO_LTXQ(sta->txq[tid]);
1779 		if (dequeue_seen && !ltxq->seen_dequeue)
1780 			continue;
1781 
1782 		LKPI_80211_LTXQ_LOCK(ltxq);
1783 		ltxq_empty = skb_queue_empty(&ltxq->skbq);
1784 		LKPI_80211_LTXQ_UNLOCK(ltxq);
1785 		if (no_emptyq && ltxq_empty)
1786 			continue;
1787 
1788 		lkpi_80211_mo_wake_tx_queue(hw, sta->txq[tid]);
1789 	}
1790 }
1791 
1792 /*
1793  * On the way down from RUN -> ASSOC -> AUTH we may send a DISASSOC or DEAUTH
1794  * packet.  The problem is that the state machine functions tend to hold the
1795  * LHW lock which will prevent lkpi_80211_txq_tx_one() from sending the packet.
1796  * We call this after dropping the ic lock and before acquiring the LHW lock.
1797  * we make sure no further packets are queued and if they are queued the task
1798  * will finish or be cancelled.  At the end if a packet is left we manually
1799  * send it.  scan_to_auth() would re-enable sending if the lsta would be
1800  * re-used.
1801  */
1802 static void
1803 lkpi_80211_flush_tx(struct lkpi_hw *lhw, struct lkpi_sta *lsta)
1804 {
1805 	struct ieee80211_hw *hw;
1806 	struct mbufq mq;
1807 	struct mbuf *m;
1808 	int len;
1809 
1810 	/* There is no lockdep_assert_not_held_wiphy(). */
1811 	hw = LHW_TO_HW(lhw);
1812 	lockdep_assert_not_held(&hw->wiphy->mtx);
1813 
1814 	/* Do not accept any new packets until scan_to_auth or lsta_free(). */
1815 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
1816 	lsta->txq_ready = false;
1817 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
1818 
1819 	while (taskqueue_cancel(taskqueue_thread, &lsta->txq_task, NULL) != 0)
1820 		taskqueue_drain(taskqueue_thread, &lsta->txq_task);
1821 
1822 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
1823 	len = mbufq_len(&lsta->txq);
1824 	if (len <= 0) {
1825 		LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
1826 		return;
1827 	}
1828 
1829 	mbufq_init(&mq, IFQ_MAXLEN);
1830 	mbufq_concat(&mq, &lsta->txq);
1831 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
1832 
1833 	m = mbufq_dequeue(&mq);
1834 	while (m != NULL) {
1835 		lkpi_80211_txq_tx_one(lsta, m);
1836 		m = mbufq_dequeue(&mq);
1837 	}
1838 }
1839 
1840 
1841 static void
1842 lkpi_remove_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
1843 {
1844 	struct ieee80211_chanctx_conf *chanctx_conf;
1845 	struct lkpi_chanctx *lchanctx;
1846 
1847 	chanctx_conf = rcu_dereference_protected(vif->bss_conf.chanctx_conf,
1848 	    lockdep_is_held(&hw->wiphy->mtx));
1849 
1850 	if (chanctx_conf == NULL)
1851 		return;
1852 
1853 	/* Remove vif context. */
1854 	lkpi_80211_mo_unassign_vif_chanctx(hw, vif, &vif->bss_conf, chanctx_conf);
1855 
1856 	lkpi_hw_conf_idle(hw, true);
1857 
1858 	/* Remove chan ctx. */
1859 	lkpi_80211_mo_remove_chanctx(hw, chanctx_conf);
1860 
1861 	/* Cleanup. */
1862 	rcu_assign_pointer(vif->bss_conf.chanctx_conf, NULL);
1863 	lchanctx = CHANCTX_CONF_TO_LCHANCTX(chanctx_conf);
1864 	list_del(&lchanctx->entry);
1865 	free(lchanctx, M_LKPI80211);
1866 }
1867 
1868 
1869 /* -------------------------------------------------------------------------- */
1870 
1871 static int
1872 lkpi_sta_state_do_nada(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1873 {
1874 
1875 	return (0);
1876 }
1877 
1878 /* lkpi_iv_newstate() handles the stop scan case generally. */
1879 #define	lkpi_sta_scan_to_init(_v, _n, _a)	lkpi_sta_state_do_nada(_v, _n, _a)
1880 
1881 static int
1882 lkpi_sta_scan_to_auth(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1883 {
1884 	struct linuxkpi_ieee80211_channel *chan;
1885 	struct lkpi_chanctx *lchanctx;
1886 	struct ieee80211_chanctx_conf *chanctx_conf;
1887 	struct lkpi_hw *lhw;
1888 	struct ieee80211_hw *hw;
1889 	struct lkpi_vif *lvif;
1890 	struct ieee80211_vif *vif;
1891 	struct ieee80211_node *ni;
1892 	struct lkpi_sta *lsta;
1893 	enum ieee80211_bss_changed bss_changed;
1894 	struct ieee80211_prep_tx_info prep_tx_info;
1895 	uint32_t changed;
1896 	int error;
1897 
1898 	/*
1899 	 * In here we use vap->iv_bss until lvif->lvif_bss is set.
1900 	 * For all later (STATE >= AUTH) functions we need to use the lvif
1901 	 * cache which will be tracked even through (*iv_update_bss)().
1902 	 */
1903 
1904 	if (vap->iv_bss == NULL) {
1905 		ic_printf(vap->iv_ic, "%s: no iv_bss for vap %p\n", __func__, vap);
1906 		return (EINVAL);
1907 	}
1908 	/*
1909 	 * Keep the ni alive locally.  In theory (and practice) iv_bss can change
1910 	 * once we unlock here.  This is due to net80211 allowing state changes
1911 	 * and new join1() despite having an active node as well as due to
1912 	 * the fact that the iv_bss can be swapped under the hood in (*iv_update_bss).
1913 	 */
1914 	ni = ieee80211_ref_node(vap->iv_bss);
1915 	if (ni->ni_chan == NULL || ni->ni_chan == IEEE80211_CHAN_ANYC) {
1916 		ic_printf(vap->iv_ic, "%s: no channel set for iv_bss ni %p "
1917 		    "on vap %p\n", __func__, ni, vap);
1918 		ieee80211_free_node(ni);	/* Error handling for the local ni. */
1919 		return (EINVAL);
1920 	}
1921 
1922 	lhw = vap->iv_ic->ic_softc;
1923 	chan = lkpi_find_lkpi80211_chan(lhw, ni->ni_chan);
1924 	if (chan == NULL) {
1925 		ic_printf(vap->iv_ic, "%s: failed to get LKPI channel from "
1926 		    "iv_bss ni %p on vap %p\n", __func__, ni, vap);
1927 		ieee80211_free_node(ni);	/* Error handling for the local ni. */
1928 		return (ESRCH);
1929 	}
1930 
1931 	hw = LHW_TO_HW(lhw);
1932 	lvif = VAP_TO_LVIF(vap);
1933 	vif = LVIF_TO_VIF(lvif);
1934 
1935 	LKPI_80211_LVIF_LOCK(lvif);
1936 	/* XXX-BZ KASSERT later? */
1937 	if (lvif->lvif_bss_synched || lvif->lvif_bss != NULL) {
1938 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
1939 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
1940 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
1941 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
1942 		    lvif->lvif_bss_synched);
1943 		LKPI_80211_LVIF_UNLOCK(lvif);
1944 		ieee80211_free_node(ni);	/* Error handling for the local ni. */
1945 		return (EBUSY);
1946 	}
1947 	LKPI_80211_LVIF_UNLOCK(lvif);
1948 
1949 	IEEE80211_UNLOCK(vap->iv_ic);
1950 	wiphy_lock(hw->wiphy);
1951 
1952 	/* Add chanctx (or if exists, change it). */
1953 	chanctx_conf = rcu_dereference_protected(vif->bss_conf.chanctx_conf,
1954 	    lockdep_is_held(&hw->wiphy->mtx));
1955 	if (chanctx_conf != NULL) {
1956 		lchanctx = CHANCTX_CONF_TO_LCHANCTX(chanctx_conf);
1957 		IMPROVE("diff changes for changed, working on live copy, rcu");
1958 	} else {
1959 		/* Keep separate alloc as in Linux this is rcu managed? */
1960 		lchanctx = malloc(sizeof(*lchanctx) + hw->chanctx_data_size,
1961 		    M_LKPI80211, M_WAITOK | M_ZERO);
1962 		chanctx_conf = &lchanctx->chanctx_conf;
1963 	}
1964 
1965 	chanctx_conf->rx_chains_static = 1;
1966 	chanctx_conf->rx_chains_dynamic = 1;
1967 	chanctx_conf->radar_enabled =
1968 	    (chan->flags & IEEE80211_CHAN_RADAR) ? true : false;
1969 	chanctx_conf->def.chan = chan;
1970 	chanctx_conf->def.width = NL80211_CHAN_WIDTH_20_NOHT;
1971 	chanctx_conf->def.center_freq1 = ieee80211_get_channel_center_freq1(ni->ni_chan);
1972 	chanctx_conf->def.center_freq2 = ieee80211_get_channel_center_freq2(ni->ni_chan);
1973 	IMPROVE("Check vht_cap from band not just chan?");
1974 	KASSERT(ni->ni_chan != NULL && ni->ni_chan != IEEE80211_CHAN_ANYC,
1975 	   ("%s:%d: ni %p ni_chan %p\n", __func__, __LINE__, ni, ni->ni_chan));
1976 
1977 #ifdef LKPI_80211_HT
1978 	if (IEEE80211_IS_CHAN_HT(ni->ni_chan)) {
1979 		if (IEEE80211_IS_CHAN_HT40(ni->ni_chan))
1980 			chanctx_conf->def.width = NL80211_CHAN_WIDTH_40;
1981 		else
1982 			chanctx_conf->def.width = NL80211_CHAN_WIDTH_20;
1983 	}
1984 #endif
1985 #ifdef LKPI_80211_VHT
1986 	if (IEEE80211_IS_CHAN_VHT_5GHZ(ni->ni_chan)) {
1987 #ifdef __notyet__
1988 		if (IEEE80211_IS_CHAN_VHT80P80(ni->ni_chan))
1989 			chanctx_conf->def.width = NL80211_CHAN_WIDTH_80P80;
1990 		else if (IEEE80211_IS_CHAN_VHT160(ni->ni_chan))
1991 			chanctx_conf->def.width = NL80211_CHAN_WIDTH_160;
1992 		else
1993 #endif
1994 		if (IEEE80211_IS_CHAN_VHT80(ni->ni_chan))
1995 			chanctx_conf->def.width = NL80211_CHAN_WIDTH_80;
1996 	}
1997 #endif
1998 	chanctx_conf->rx_chains_dynamic = lkpi_get_max_rx_chains(ni);
1999 	/* Responder ... */
2000 #if 0
2001 	chanctx_conf->min_def.chan = chanctx_conf->def.chan;
2002 	chanctx_conf->min_def.width = NL80211_CHAN_WIDTH_20_NOHT;
2003 #ifdef LKPI_80211_HT
2004 	if (IEEE80211_IS_CHAN_HT(ni->ni_chan) || IEEE80211_IS_CHAN_VHT(ni->ni_chan))
2005 		chanctx_conf->min_def.width = NL80211_CHAN_WIDTH_20;
2006 #endif
2007 	chanctx_conf->min_def.center_freq1 = chanctx_conf->def.center_freq1;
2008 	chanctx_conf->min_def.center_freq2 = chanctx_conf->def.center_freq2;
2009 #else
2010 	chanctx_conf->min_def = chanctx_conf->def;
2011 #endif
2012 
2013 	/* Set bss info (bss_info_changed). */
2014 	bss_changed = 0;
2015 	vif->bss_conf.bssid = ni->ni_bssid;
2016 	bss_changed |= BSS_CHANGED_BSSID;
2017 	vif->bss_conf.txpower = ni->ni_txpower;
2018 	bss_changed |= BSS_CHANGED_TXPOWER;
2019 	vif->cfg.idle = false;
2020 	bss_changed |= BSS_CHANGED_IDLE;
2021 
2022 	/* vif->bss_conf.basic_rates ? Where exactly? */
2023 
2024 	/* Should almost assert it is this. */
2025 	vif->cfg.assoc = false;
2026 	vif->cfg.aid = 0;
2027 
2028 	bss_changed |= lkpi_update_dtim_tsf(vif, ni, vap, __func__, __LINE__);
2029 
2030 	error = 0;
2031 	if (vif->bss_conf.chanctx_conf == chanctx_conf) {
2032 		changed = IEEE80211_CHANCTX_CHANGE_MIN_WIDTH;
2033 		changed |= IEEE80211_CHANCTX_CHANGE_RADAR;
2034 		changed |= IEEE80211_CHANCTX_CHANGE_RX_CHAINS;
2035 		changed |= IEEE80211_CHANCTX_CHANGE_WIDTH;
2036 		lkpi_80211_mo_change_chanctx(hw, chanctx_conf, changed);
2037 	} else {
2038 		error = lkpi_80211_mo_add_chanctx(hw, chanctx_conf);
2039 		if (error == 0 || error == EOPNOTSUPP) {
2040 			vif->bss_conf.chanreq.oper.chan = chanctx_conf->def.chan;
2041 			vif->bss_conf.chanreq.oper.width = chanctx_conf->def.width;
2042 			vif->bss_conf.chanreq.oper.center_freq1 =
2043 			    chanctx_conf->def.center_freq1;
2044 			vif->bss_conf.chanreq.oper.center_freq2 =
2045 			    chanctx_conf->def.center_freq2;
2046 		} else {
2047 			ic_printf(vap->iv_ic, "%s:%d: mo_add_chanctx "
2048 			    "failed: %d\n", __func__, __LINE__, error);
2049 			goto out;
2050 		}
2051 
2052 		list_add_rcu(&lchanctx->entry, &lhw->lchanctx_list);
2053 		rcu_assign_pointer(vif->bss_conf.chanctx_conf, chanctx_conf);
2054 
2055 		/* Assign vif chanctx. */
2056 		if (error == 0)
2057 			error = lkpi_80211_mo_assign_vif_chanctx(hw, vif,
2058 			    &vif->bss_conf, chanctx_conf);
2059 		if (error == EOPNOTSUPP)
2060 			error = 0;
2061 		if (error != 0) {
2062 			ic_printf(vap->iv_ic, "%s:%d: mo_assign_vif_chanctx "
2063 			    "failed: %d\n", __func__, __LINE__, error);
2064 			lkpi_80211_mo_remove_chanctx(hw, chanctx_conf);
2065 			rcu_assign_pointer(vif->bss_conf.chanctx_conf, NULL);
2066 			lchanctx = CHANCTX_CONF_TO_LCHANCTX(chanctx_conf);
2067 			list_del(&lchanctx->entry);
2068 			free(lchanctx, M_LKPI80211);
2069 			goto out;
2070 		}
2071 	}
2072 	IMPROVE("update radiotap chan fields too");
2073 
2074 	/* RATES */
2075 	IMPROVE("bss info: not all needs to come now and rates are missing");
2076 	lkpi_80211_mo_bss_info_changed(hw, vif, &vif->bss_conf, bss_changed);
2077 
2078 	/*
2079 	 * Given ni and lsta are 1:1 from alloc to free we can assert that
2080 	 * ni always has lsta data attach despite net80211 node swapping
2081 	 * under the hoods.
2082 	 */
2083 	KASSERT(ni->ni_drv_data != NULL, ("%s: ni %p ni_drv_data %p\n",
2084 	    __func__, ni, ni->ni_drv_data));
2085 	lsta = ni->ni_drv_data;
2086 
2087 	/*
2088 	 * Make sure in case the sta did not change and we re-add it,
2089 	 * that we can tx again.
2090 	 */
2091 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
2092 	lsta->txq_ready = true;
2093 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
2094 
2095 	/* Insert the [l]sta into the list of known stations. */
2096 	list_add_tail(&lsta->lsta_list, &lvif->lsta_list);
2097 
2098 	/* Add (or adjust) sta and change state (from NOTEXIST) to NONE. */
2099 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
2100 	KASSERT(lsta->state == IEEE80211_STA_NOTEXIST, ("%s: lsta %p state not "
2101 	    "NOTEXIST: %#x\n", __func__, lsta, lsta->state));
2102 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_NONE);
2103 	if (error != 0) {
2104 		IMPROVE("do we need to undo the chan ctx?");
2105 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(NONE) "
2106 		    "failed: %d\n", __func__, __LINE__, error);
2107 		goto out;
2108 	}
2109 #if 0
2110 	lsta->added_to_drv = true;	/* mo manages. */
2111 #endif
2112 
2113 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
2114 
2115 #if 0
2116 	/*
2117 	 * Wakeup all queues now that sta is there so we have as much time to
2118 	 * possibly prepare the queue in the driver to be ready for the 1st
2119 	 * packet;  lkpi_80211_txq_tx_one() still has a workaround as there
2120 	 * is no guarantee or way to check.
2121 	 * XXX-BZ and by now we know that this does not work on all drivers
2122 	 * for all queues.
2123 	 */
2124 	lkpi_wake_tx_queues(hw, LSTA_TO_STA(lsta), false, false);
2125 #endif
2126 
2127 	/* Start mgd_prepare_tx. */
2128 	memset(&prep_tx_info, 0, sizeof(prep_tx_info));
2129 	prep_tx_info.duration = PREP_TX_INFO_DURATION;
2130 	lkpi_80211_mo_mgd_prepare_tx(hw, vif, &prep_tx_info);
2131 	lsta->in_mgd = true;
2132 
2133 	/*
2134 	 * What is going to happen next:
2135 	 * - <twiddle> .. we should end up in "auth_to_assoc"
2136 	 * - event_callback
2137 	 * - update sta_state (NONE to AUTH)
2138 	 * - mgd_complete_tx
2139 	 * (ideally we'd do that on a callback for something else ...)
2140 	 */
2141 
2142 	wiphy_unlock(hw->wiphy);
2143 	IEEE80211_LOCK(vap->iv_ic);
2144 
2145 	LKPI_80211_LVIF_LOCK(lvif);
2146 	/* Re-check given (*iv_update_bss) could have happened while we were unlocked. */
2147 	if (lvif->lvif_bss_synched || lvif->lvif_bss != NULL ||
2148 	    lsta->ni != vap->iv_bss)
2149 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
2150 		    "lvif_bss->ni %p synched %d, ni %p lsta %p\n", __func__, __LINE__,
2151 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
2152 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
2153 		    lvif->lvif_bss_synched, ni, lsta);
2154 
2155 	/*
2156 	 * Reference the "ni" for caching the lsta/ni in lvif->lvif_bss.
2157 	 * Given we cache lsta we use lsta->ni instead of ni here (even though
2158 	 * lsta->ni == ni) to be distinct from the rest of the code where we do
2159 	 * assume that ni == vap->iv_bss which it may or may not be.
2160 	 * So do NOT use iv_bss here anymore as that may have diverged from our
2161 	 * function local ni already while ic was unlocked and would lead to
2162 	 * inconsistencies.  Go and see if we lost a race and do not update
2163 	 * lvif_bss_synched in that case.
2164 	 */
2165 	ieee80211_ref_node(lsta->ni);
2166 	lvif->lvif_bss = lsta;
2167 	if (lsta->ni == vap->iv_bss) {
2168 		lvif->lvif_bss_synched = true;
2169 	} else {
2170 		/* Set to un-synched no matter what. */
2171 		lvif->lvif_bss_synched = false;
2172 		/*
2173 		 * We do not error as someone has to take us down.
2174 		 * If we are followed by a 2nd, new net80211::join1() going to
2175 		 * AUTH lkpi_sta_a_to_a() will error, lkpi_sta_auth_to_{scan,init}()
2176 		 * will take the lvif->lvif_bss node down eventually.
2177 		 * What happens with the vap->iv_bss node will entirely be up
2178 		 * to net80211 as we never used the node beyond alloc()/free()
2179 		 * and we do not hold an extra reference for that anymore given
2180 		 * ni : lsta == 1:1.
2181 		 */
2182 	}
2183 	LKPI_80211_LVIF_UNLOCK(lvif);
2184 	goto out_relocked;
2185 
2186 out:
2187 	wiphy_unlock(hw->wiphy);
2188 	IEEE80211_LOCK(vap->iv_ic);
2189 out_relocked:
2190 	/*
2191 	 * Release the reference that kept the ni stable locally
2192 	 * during the work of this function.
2193 	 */
2194 	if (ni != NULL)
2195 		ieee80211_free_node(ni);
2196 	return (error);
2197 }
2198 
2199 static int
2200 lkpi_sta_auth_to_scan(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2201 {
2202 	struct lkpi_hw *lhw;
2203 	struct ieee80211_hw *hw;
2204 	struct lkpi_vif *lvif;
2205 	struct ieee80211_vif *vif;
2206 	struct ieee80211_node *ni;
2207 	struct lkpi_sta *lsta;
2208 	struct ieee80211_sta *sta;
2209 	struct ieee80211_prep_tx_info prep_tx_info;
2210 	int error;
2211 
2212 	lhw = vap->iv_ic->ic_softc;
2213 	hw = LHW_TO_HW(lhw);
2214 	lvif = VAP_TO_LVIF(vap);
2215 	vif = LVIF_TO_VIF(lvif);
2216 
2217 	LKPI_80211_LVIF_LOCK(lvif);
2218 #ifdef LINUXKPI_DEBUG_80211
2219 	/* XXX-BZ KASSERT later; state going down so no action. */
2220 	if (lvif->lvif_bss == NULL)
2221 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
2222 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
2223 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
2224 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
2225 		    lvif->lvif_bss_synched);
2226 #endif
2227 
2228 	lsta = lvif->lvif_bss;
2229 	LKPI_80211_LVIF_UNLOCK(lvif);
2230 	KASSERT(lsta != NULL && lsta->ni != NULL, ("%s: lsta %p ni %p "
2231 	    "lvif %p vap %p\n", __func__,
2232 	    lsta, (lsta != NULL) ? lsta->ni : NULL, lvif, vap));
2233 	ni = lsta->ni;			/* Reference held for lvif_bss. */
2234 	sta = LSTA_TO_STA(lsta);
2235 
2236 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
2237 
2238 	IEEE80211_UNLOCK(vap->iv_ic);
2239 	wiphy_lock(hw->wiphy);
2240 
2241 	/* flush, drop. */
2242 	lkpi_80211_mo_flush(hw, vif,  nitems(sta->txq), true);
2243 
2244 	/* Wake tx queues to get packet(s) out. */
2245 	lkpi_wake_tx_queues(hw, sta, false, true);
2246 
2247 	/* flush, no drop */
2248 	lkpi_80211_mo_flush(hw, vif,  nitems(sta->txq), false);
2249 
2250 	/* End mgd_complete_tx. */
2251 	if (lsta->in_mgd) {
2252 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
2253 		prep_tx_info.success = false;
2254 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
2255 		lsta->in_mgd = false;
2256 	}
2257 
2258 	/* sync_rx_queues */
2259 	lkpi_80211_mo_sync_rx_queues(hw);
2260 
2261 	/* sta_pre_rcu_remove */
2262         lkpi_80211_mo_sta_pre_rcu_remove(hw, vif, sta);
2263 
2264 	/* Take the station down. */
2265 
2266 	/* Adjust sta and change state (from NONE) to NOTEXIST. */
2267 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
2268 	KASSERT(lsta->state == IEEE80211_STA_NONE, ("%s: lsta %p state not "
2269 	    "NONE: %#x, nstate %d arg %d\n", __func__, lsta, lsta->state, nstate, arg));
2270 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_NOTEXIST);
2271 	if (error != 0) {
2272 		IMPROVE("do we need to undo the chan ctx?");
2273 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(NOTEXIST) "
2274 		    "failed: %d\n", __func__, __LINE__, error);
2275 		goto out;
2276 	}
2277 #if 0
2278 	lsta->added_to_drv = false;	/* mo manages. */
2279 #endif
2280 
2281 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
2282 
2283 	LKPI_80211_LVIF_LOCK(lvif);
2284 	/* Remove ni reference for this cache of lsta. */
2285 	lvif->lvif_bss = NULL;
2286 	lvif->lvif_bss_synched = false;
2287 	LKPI_80211_LVIF_UNLOCK(lvif);
2288 	lkpi_lsta_remove(lsta, lvif);
2289 	/*
2290 	 * The very last release the reference on the ni for the ni/lsta on
2291 	 * lvif->lvif_bss.  Upon return from this both ni and lsta are invalid
2292 	 * and potentially freed.
2293 	 */
2294 	ieee80211_free_node(ni);
2295 
2296 	/* conf_tx */
2297 
2298 	lkpi_remove_chanctx(hw, vif);
2299 
2300 out:
2301 	wiphy_unlock(hw->wiphy);
2302 	IEEE80211_LOCK(vap->iv_ic);
2303 	return (error);
2304 }
2305 
2306 static int
2307 lkpi_sta_auth_to_init(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2308 {
2309 	int error;
2310 
2311 	error = lkpi_sta_auth_to_scan(vap, nstate, arg);
2312 	if (error == 0)
2313 		error = lkpi_sta_scan_to_init(vap, nstate, arg);
2314 	return (error);
2315 }
2316 
2317 static int
2318 lkpi_sta_auth_to_assoc(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2319 {
2320 	struct lkpi_hw *lhw;
2321 	struct ieee80211_hw *hw;
2322 	struct lkpi_vif *lvif;
2323 	struct ieee80211_vif *vif;
2324 	struct lkpi_sta *lsta;
2325 	struct ieee80211_prep_tx_info prep_tx_info;
2326 	int error;
2327 
2328 	lhw = vap->iv_ic->ic_softc;
2329 	hw = LHW_TO_HW(lhw);
2330 	lvif = VAP_TO_LVIF(vap);
2331 	vif = LVIF_TO_VIF(lvif);
2332 
2333 	IEEE80211_UNLOCK(vap->iv_ic);
2334 	wiphy_lock(hw->wiphy);
2335 
2336 	LKPI_80211_LVIF_LOCK(lvif);
2337 	/* XXX-BZ KASSERT later? */
2338 	if (!lvif->lvif_bss_synched || lvif->lvif_bss == NULL) {
2339 #ifdef LINUXKPI_DEBUG_80211
2340 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
2341 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
2342 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
2343 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
2344 		    lvif->lvif_bss_synched);
2345 #endif
2346 		error = ENOTRECOVERABLE;
2347 		LKPI_80211_LVIF_UNLOCK(lvif);
2348 		goto out;
2349 	}
2350 	lsta = lvif->lvif_bss;
2351 	LKPI_80211_LVIF_UNLOCK(lvif);
2352 
2353 	KASSERT(lsta != NULL, ("%s: lsta %p\n", __func__, lsta));
2354 
2355 	/* Finish auth. */
2356 	IMPROVE("event callback");
2357 
2358 	/* Update sta_state (NONE to AUTH). */
2359 	KASSERT(lsta->state == IEEE80211_STA_NONE, ("%s: lsta %p state not "
2360 	    "NONE: %#x\n", __func__, lsta, lsta->state));
2361 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_AUTH);
2362 	if (error != 0) {
2363 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(AUTH) "
2364 		    "failed: %d\n", __func__, __LINE__, error);
2365 		goto out;
2366 	}
2367 
2368 	/* End mgd_complete_tx. */
2369 	if (lsta->in_mgd) {
2370 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
2371 		prep_tx_info.success = true;
2372 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
2373 		lsta->in_mgd = false;
2374 	}
2375 
2376 	/* Now start assoc. */
2377 
2378 	/* Start mgd_prepare_tx. */
2379 	if (!lsta->in_mgd) {
2380 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
2381 		prep_tx_info.duration = PREP_TX_INFO_DURATION;
2382 		lkpi_80211_mo_mgd_prepare_tx(hw, vif, &prep_tx_info);
2383 		lsta->in_mgd = true;
2384 	}
2385 
2386 	/* Wake tx queue to get packet out. */
2387 	lkpi_wake_tx_queues(hw, LSTA_TO_STA(lsta), false, true);
2388 
2389 	/*
2390 	 * <twiddle> .. we end up in "assoc_to_run"
2391 	 * - update sta_state (AUTH to ASSOC)
2392 	 * - conf_tx [all]
2393 	 * - bss_info_changed (assoc, aid, ssid, ..)
2394 	 * - change_chanctx (if needed)
2395 	 * - event_callback
2396 	 * - mgd_complete_tx
2397 	 */
2398 
2399 out:
2400 	wiphy_unlock(hw->wiphy);
2401 	IEEE80211_LOCK(vap->iv_ic);
2402 	return (error);
2403 }
2404 
2405 /* auth_to_auth, assoc_to_assoc. */
2406 static int
2407 lkpi_sta_a_to_a(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2408 {
2409 	struct lkpi_hw *lhw;
2410 	struct ieee80211_hw *hw;
2411 	struct lkpi_vif *lvif;
2412 	struct ieee80211_vif *vif;
2413 	struct lkpi_sta *lsta;
2414 	struct ieee80211_prep_tx_info prep_tx_info;
2415 	int error;
2416 
2417 	lhw = vap->iv_ic->ic_softc;
2418 	hw = LHW_TO_HW(lhw);
2419 	lvif = VAP_TO_LVIF(vap);
2420 	vif = LVIF_TO_VIF(lvif);
2421 
2422 	IEEE80211_UNLOCK(vap->iv_ic);
2423 	wiphy_lock(hw->wiphy);
2424 
2425 	LKPI_80211_LVIF_LOCK(lvif);
2426 	/* XXX-BZ KASSERT later? */
2427 	if (!lvif->lvif_bss_synched || lvif->lvif_bss == NULL) {
2428 #ifdef LINUXKPI_DEBUG_80211
2429 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
2430 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
2431 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
2432 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
2433 		    lvif->lvif_bss_synched);
2434 #endif
2435 		LKPI_80211_LVIF_UNLOCK(lvif);
2436 		error = ENOTRECOVERABLE;
2437 		goto out;
2438 	}
2439 	lsta = lvif->lvif_bss;
2440 	LKPI_80211_LVIF_UNLOCK(lvif);
2441 
2442 	KASSERT(lsta != NULL, ("%s: lsta %p! lvif %p vap %p\n", __func__,
2443 	    lsta, lvif, vap));
2444 
2445 	IMPROVE("event callback?");
2446 
2447 	/* End mgd_complete_tx. */
2448 	if (lsta->in_mgd) {
2449 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
2450 		prep_tx_info.success = false;
2451 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
2452 		lsta->in_mgd = false;
2453 	}
2454 
2455 	/* Now start assoc. */
2456 
2457 	/* Start mgd_prepare_tx. */
2458 	if (!lsta->in_mgd) {
2459 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
2460 		prep_tx_info.duration = PREP_TX_INFO_DURATION;
2461 		lkpi_80211_mo_mgd_prepare_tx(hw, vif, &prep_tx_info);
2462 		lsta->in_mgd = true;
2463 	}
2464 
2465 	error = 0;
2466 out:
2467 	wiphy_unlock(hw->wiphy);
2468 	IEEE80211_LOCK(vap->iv_ic);
2469 
2470 	return (error);
2471 }
2472 
2473 static int
2474 _lkpi_sta_assoc_to_down(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2475 {
2476 	struct lkpi_hw *lhw;
2477 	struct ieee80211_hw *hw;
2478 	struct lkpi_vif *lvif;
2479 	struct ieee80211_vif *vif;
2480 	struct ieee80211_node *ni;
2481 	struct lkpi_sta *lsta;
2482 	struct ieee80211_sta *sta;
2483 	struct ieee80211_prep_tx_info prep_tx_info;
2484 	enum ieee80211_bss_changed bss_changed;
2485 	int error;
2486 
2487 	lhw = vap->iv_ic->ic_softc;
2488 	hw = LHW_TO_HW(lhw);
2489 	lvif = VAP_TO_LVIF(vap);
2490 	vif = LVIF_TO_VIF(lvif);
2491 
2492 	IEEE80211_UNLOCK(vap->iv_ic);
2493 	wiphy_lock(hw->wiphy);
2494 
2495 	LKPI_80211_LVIF_LOCK(lvif);
2496 #ifdef LINUXKPI_DEBUG_80211
2497 	/* XXX-BZ KASSERT later; state going down so no action. */
2498 	if (lvif->lvif_bss == NULL)
2499 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
2500 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
2501 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
2502 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
2503 		    lvif->lvif_bss_synched);
2504 #endif
2505 	lsta = lvif->lvif_bss;
2506 	LKPI_80211_LVIF_UNLOCK(lvif);
2507 	KASSERT(lsta != NULL && lsta->ni != NULL, ("%s: lsta %p ni %p "
2508 	    "lvif %p vap %p\n", __func__,
2509 	    lsta, (lsta != NULL) ? lsta->ni : NULL, lvif, vap));
2510 
2511 	ni = lsta->ni;		/* Reference held for lvif_bss. */
2512 	sta = LSTA_TO_STA(lsta);
2513 
2514 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
2515 
2516 	/* flush, drop. */
2517 	lkpi_80211_mo_flush(hw, vif,  nitems(sta->txq), true);
2518 
2519 	IMPROVE("What are the proper conditions for DEAUTH_NEED_MGD_TX_PREP?");
2520 	if (ieee80211_hw_check(hw, DEAUTH_NEED_MGD_TX_PREP) &&
2521 	    !lsta->in_mgd) {
2522 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
2523 		prep_tx_info.duration = PREP_TX_INFO_DURATION;
2524 		prep_tx_info.was_assoc = true;
2525 		lkpi_80211_mo_mgd_prepare_tx(hw, vif, &prep_tx_info);
2526 		lsta->in_mgd = true;
2527 	}
2528 
2529 	wiphy_unlock(hw->wiphy);
2530 	IEEE80211_LOCK(vap->iv_ic);
2531 
2532 	/* Call iv_newstate first so we get potential DEAUTH packet out. */
2533 	error = lvif->iv_newstate(vap, nstate, arg);
2534 	if (error != 0) {
2535 		ic_printf(vap->iv_ic, "%s:%d: iv_newstate(%p, %d, %d) "
2536 		    "failed: %d\n", __func__, __LINE__, vap, nstate, arg, error);
2537 		goto outni;
2538 	}
2539 
2540 	IEEE80211_UNLOCK(vap->iv_ic);
2541 
2542 	/* Ensure the packets get out. */
2543 	lkpi_80211_flush_tx(lhw, lsta);
2544 
2545 	wiphy_lock(hw->wiphy);
2546 
2547 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
2548 
2549 	/* Wake tx queues to get packet(s) out. */
2550 	lkpi_wake_tx_queues(hw, sta, false, true);
2551 
2552 	/* flush, no drop */
2553 	lkpi_80211_mo_flush(hw, vif,  nitems(sta->txq), false);
2554 
2555 	/* End mgd_complete_tx. */
2556 	if (lsta->in_mgd) {
2557 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
2558 		prep_tx_info.success = false;
2559 		prep_tx_info.was_assoc = true;
2560 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
2561 		lsta->in_mgd = false;
2562 	}
2563 
2564 	/* sync_rx_queues */
2565 	lkpi_80211_mo_sync_rx_queues(hw);
2566 
2567 	/* sta_pre_rcu_remove */
2568         lkpi_80211_mo_sta_pre_rcu_remove(hw, vif, sta);
2569 
2570 	/* Take the station down. */
2571 
2572 	/* Update sta and change state (from AUTH) to NONE. */
2573 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
2574 	KASSERT(lsta->state == IEEE80211_STA_AUTH, ("%s: lsta %p state not "
2575 	    "AUTH: %#x\n", __func__, lsta, lsta->state));
2576 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_NONE);
2577 	if (error != 0) {
2578 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(NONE) "
2579 		    "failed: %d\n", __func__, __LINE__, error);
2580 		goto out;
2581 	}
2582 
2583 	/* See comment in lkpi_sta_run_to_init(). */
2584 	bss_changed = 0;
2585 	bss_changed |= lkpi_disassoc(sta, vif, lhw);
2586 
2587 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
2588 
2589 	/* Adjust sta and change state (from NONE) to NOTEXIST. */
2590 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
2591 	KASSERT(lsta->state == IEEE80211_STA_NONE, ("%s: lsta %p state not "
2592 	    "NONE: %#x, nstate %d arg %d\n", __func__, lsta, lsta->state, nstate, arg));
2593 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_NOTEXIST);
2594 	if (error != 0) {
2595 		IMPROVE("do we need to undo the chan ctx?");
2596 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(NOTEXIST) "
2597 		    "failed: %d\n", __func__, __LINE__, error);
2598 		goto out;
2599 	}
2600 
2601 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);	/* sta no longer save to use. */
2602 
2603 	IMPROVE("Any bss_info changes to announce?");
2604 	vif->bss_conf.qos = 0;
2605 	bss_changed |= BSS_CHANGED_QOS;
2606 	vif->cfg.ssid_len = 0;
2607 	memset(vif->cfg.ssid, '\0', sizeof(vif->cfg.ssid));
2608 	bss_changed |= BSS_CHANGED_BSSID;
2609 	lkpi_80211_mo_bss_info_changed(hw, vif, &vif->bss_conf, bss_changed);
2610 
2611 	LKPI_80211_LVIF_LOCK(lvif);
2612 	/* Remove ni reference for this cache of lsta. */
2613 	lvif->lvif_bss = NULL;
2614 	lvif->lvif_bss_synched = false;
2615 	LKPI_80211_LVIF_UNLOCK(lvif);
2616 	lkpi_lsta_remove(lsta, lvif);
2617 	/*
2618 	 * The very last release the reference on the ni for the ni/lsta on
2619 	 * lvif->lvif_bss.  Upon return from this both ni and lsta are invalid
2620 	 * and potentially freed.
2621 	 */
2622 	ieee80211_free_node(ni);
2623 
2624 	/* conf_tx */
2625 
2626 	lkpi_remove_chanctx(hw, vif);
2627 
2628 	error = EALREADY;
2629 out:
2630 	wiphy_unlock(hw->wiphy);
2631 	IEEE80211_LOCK(vap->iv_ic);
2632 outni:
2633 	return (error);
2634 }
2635 
2636 static int
2637 lkpi_sta_assoc_to_auth(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2638 {
2639 	int error;
2640 
2641 	error = _lkpi_sta_assoc_to_down(vap, nstate, arg);
2642 	if (error != 0 && error != EALREADY)
2643 		return (error);
2644 
2645 	/* At this point iv_bss is long a new node! */
2646 
2647 	error |= lkpi_sta_scan_to_auth(vap, nstate, 0);
2648 	return (error);
2649 }
2650 
2651 static int
2652 lkpi_sta_assoc_to_scan(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2653 {
2654 	int error;
2655 
2656 	error = _lkpi_sta_assoc_to_down(vap, nstate, arg);
2657 	return (error);
2658 }
2659 
2660 static int
2661 lkpi_sta_assoc_to_init(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2662 {
2663 	int error;
2664 
2665 	error = _lkpi_sta_assoc_to_down(vap, nstate, arg);
2666 	return (error);
2667 }
2668 
2669 static int
2670 lkpi_sta_assoc_to_run(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2671 {
2672 	struct lkpi_hw *lhw;
2673 	struct ieee80211_hw *hw;
2674 	struct lkpi_vif *lvif;
2675 	struct ieee80211_vif *vif;
2676 	struct ieee80211_node *ni;
2677 	struct lkpi_sta *lsta;
2678 	struct ieee80211_sta *sta;
2679 	struct ieee80211_prep_tx_info prep_tx_info;
2680 	enum ieee80211_bss_changed bss_changed;
2681 	int error;
2682 
2683 	lhw = vap->iv_ic->ic_softc;
2684 	hw = LHW_TO_HW(lhw);
2685 	lvif = VAP_TO_LVIF(vap);
2686 	vif = LVIF_TO_VIF(lvif);
2687 
2688 	IEEE80211_UNLOCK(vap->iv_ic);
2689 	wiphy_lock(hw->wiphy);
2690 
2691 	LKPI_80211_LVIF_LOCK(lvif);
2692 	/* XXX-BZ KASSERT later? */
2693 	if (!lvif->lvif_bss_synched || lvif->lvif_bss == NULL) {
2694 #ifdef LINUXKPI_DEBUG_80211
2695 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
2696 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
2697 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
2698 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
2699 		    lvif->lvif_bss_synched);
2700 #endif
2701 		LKPI_80211_LVIF_UNLOCK(lvif);
2702 		error = ENOTRECOVERABLE;
2703 		goto out;
2704 	}
2705 	lsta = lvif->lvif_bss;
2706 	LKPI_80211_LVIF_UNLOCK(lvif);
2707 	KASSERT(lsta != NULL && lsta->ni != NULL, ("%s: lsta %p ni %p "
2708 	    "lvif %p vap %p\n", __func__,
2709 	    lsta, (lsta != NULL) ? lsta->ni : NULL, lvif, vap));
2710 
2711 	ni = lsta->ni;		/* Reference held for lvif_bss. */
2712 
2713 	IMPROVE("ponder some of this moved to ic_newassoc, scan_assoc_success, "
2714 	    "and to lesser extend ieee80211_notify_node_join");
2715 
2716 	/* Finish assoc. */
2717 	/* Update sta_state (AUTH to ASSOC) and set aid. */
2718 	KASSERT(lsta->state == IEEE80211_STA_AUTH, ("%s: lsta %p state not "
2719 	    "AUTH: %#x\n", __func__, lsta, lsta->state));
2720 	sta = LSTA_TO_STA(lsta);
2721 	sta->aid = IEEE80211_NODE_AID(ni);
2722 #ifdef LKPI_80211_WME
2723 	if (vap->iv_flags & IEEE80211_F_WME)
2724 		sta->wme = true;
2725 #endif
2726 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_ASSOC);
2727 	if (error != 0) {
2728 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(ASSOC) "
2729 		    "failed: %d\n", __func__, __LINE__, error);
2730 		goto out;
2731 	}
2732 
2733 	IMPROVE("wme / conf_tx [all]");
2734 
2735 	/* Update bss info (bss_info_changed) (assoc, aid, ..). */
2736 	bss_changed = 0;
2737 #ifdef LKPI_80211_WME
2738 	bss_changed |= lkpi_wme_update(lhw, vap, true);
2739 #endif
2740 	if (!vif->cfg.assoc || vif->cfg.aid != IEEE80211_NODE_AID(ni)) {
2741 		vif->cfg.assoc = true;
2742 		vif->cfg.aid = IEEE80211_NODE_AID(ni);
2743 		bss_changed |= BSS_CHANGED_ASSOC;
2744 	}
2745 	/* We set SSID but this is not BSSID! */
2746 	vif->cfg.ssid_len = ni->ni_esslen;
2747 	memcpy(vif->cfg.ssid, ni->ni_essid, ni->ni_esslen);
2748 	if ((vap->iv_flags & IEEE80211_F_SHPREAMBLE) !=
2749 	    vif->bss_conf.use_short_preamble) {
2750 		vif->bss_conf.use_short_preamble ^= 1;
2751 		/* bss_changed |= BSS_CHANGED_??? */
2752 	}
2753 	if ((vap->iv_flags & IEEE80211_F_SHSLOT) !=
2754 	    vif->bss_conf.use_short_slot) {
2755 		vif->bss_conf.use_short_slot ^= 1;
2756 		/* bss_changed |= BSS_CHANGED_??? */
2757 	}
2758 	if ((ni->ni_flags & IEEE80211_NODE_QOS) !=
2759 	    vif->bss_conf.qos) {
2760 		vif->bss_conf.qos ^= 1;
2761 		bss_changed |= BSS_CHANGED_QOS;
2762 	}
2763 
2764 	bss_changed |= lkpi_update_dtim_tsf(vif, ni, vap, __func__, __LINE__);
2765 	lkpi_80211_mo_bss_info_changed(hw, vif, &vif->bss_conf, bss_changed);
2766 
2767 	/* - change_chanctx (if needed)
2768 	 * - event_callback
2769 	 */
2770 
2771 	/* End mgd_complete_tx. */
2772 	if (lsta->in_mgd) {
2773 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
2774 		prep_tx_info.success = true;
2775 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
2776 		lsta->in_mgd = false;
2777 	}
2778 
2779 	lkpi_hw_conf_idle(hw, false);
2780 
2781 	/*
2782 	 * And then:
2783 	 * - (more packets)?
2784 	 * - set_key
2785 	 * - set_default_unicast_key
2786 	 * - set_key (?)
2787 	 * - ipv6_addr_change (?)
2788 	 */
2789 	/* Prepare_multicast && configure_filter. */
2790 	lhw->update_mc = true;
2791 	lkpi_update_mcast_filter(vap->iv_ic, true);
2792 
2793 	if (!ieee80211_node_is_authorized(ni)) {
2794 		IMPROVE("net80211 does not consider node authorized");
2795 	}
2796 
2797 	sta->deflink.rx_nss = MAX(1, sta->deflink.rx_nss);
2798 	IMPROVE("Is this the right spot, has net80211 done all updates already?");
2799 	lkpi_sta_sync_from_ni(hw, vif, sta, ni, true);
2800 
2801 	/* Update sta_state (ASSOC to AUTHORIZED). */
2802 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
2803 	KASSERT(lsta->state == IEEE80211_STA_ASSOC, ("%s: lsta %p state not "
2804 	    "ASSOC: %#x\n", __func__, lsta, lsta->state));
2805 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_AUTHORIZED);
2806 	if (error != 0) {
2807 		IMPROVE("undo some changes?");
2808 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(AUTHORIZED) "
2809 		    "failed: %d\n", __func__, __LINE__, error);
2810 		goto out;
2811 	}
2812 
2813 	/* - drv_config (?)
2814 	 * - bss_info_changed
2815 	 * - set_rekey_data (?)
2816 	 *
2817 	 * And now we should be passing packets.
2818 	 */
2819 	IMPROVE("Need that bssid setting, and the keys");
2820 
2821 	bss_changed = 0;
2822 	bss_changed |= lkpi_update_dtim_tsf(vif, ni, vap, __func__, __LINE__);
2823 	lkpi_80211_mo_bss_info_changed(hw, vif, &vif->bss_conf, bss_changed);
2824 
2825 out:
2826 	wiphy_unlock(hw->wiphy);
2827 	IEEE80211_LOCK(vap->iv_ic);
2828 	return (error);
2829 }
2830 
2831 static int
2832 lkpi_sta_auth_to_run(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2833 {
2834 	int error;
2835 
2836 	error = lkpi_sta_auth_to_assoc(vap, nstate, arg);
2837 	if (error == 0)
2838 		error = lkpi_sta_assoc_to_run(vap, nstate, arg);
2839 	return (error);
2840 }
2841 
2842 static int
2843 lkpi_sta_run_to_assoc(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2844 {
2845 	struct lkpi_hw *lhw;
2846 	struct ieee80211_hw *hw;
2847 	struct lkpi_vif *lvif;
2848 	struct ieee80211_vif *vif;
2849 	struct ieee80211_node *ni;
2850 	struct lkpi_sta *lsta;
2851 	struct ieee80211_sta *sta;
2852 	struct ieee80211_prep_tx_info prep_tx_info;
2853 #if 0
2854 	enum ieee80211_bss_changed bss_changed;
2855 #endif
2856 	int error;
2857 
2858 	lhw = vap->iv_ic->ic_softc;
2859 	hw = LHW_TO_HW(lhw);
2860 	lvif = VAP_TO_LVIF(vap);
2861 	vif = LVIF_TO_VIF(lvif);
2862 
2863 	LKPI_80211_LVIF_LOCK(lvif);
2864 #ifdef LINUXKPI_DEBUG_80211
2865 	/* XXX-BZ KASSERT later; state going down so no action. */
2866 	if (lvif->lvif_bss == NULL)
2867 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
2868 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
2869 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
2870 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
2871 		    lvif->lvif_bss_synched);
2872 #endif
2873 	lsta = lvif->lvif_bss;
2874 	LKPI_80211_LVIF_UNLOCK(lvif);
2875 	KASSERT(lsta != NULL && lsta->ni != NULL, ("%s: lsta %p ni %p "
2876 	    "lvif %p vap %p\n", __func__,
2877 	    lsta, (lsta != NULL) ? lsta->ni : NULL, lvif, vap));
2878 
2879 	ni = lsta->ni;		/* Reference held for lvif_bss. */
2880 	sta = LSTA_TO_STA(lsta);
2881 
2882 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
2883 
2884 	IEEE80211_UNLOCK(vap->iv_ic);
2885 	wiphy_lock(hw->wiphy);
2886 
2887 	/* flush, drop. */
2888 	lkpi_80211_mo_flush(hw, vif,  nitems(sta->txq), true);
2889 
2890 	IMPROVE("What are the proper conditions for DEAUTH_NEED_MGD_TX_PREP?");
2891 	if (ieee80211_hw_check(hw, DEAUTH_NEED_MGD_TX_PREP) &&
2892 	    !lsta->in_mgd) {
2893 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
2894 		prep_tx_info.duration = PREP_TX_INFO_DURATION;
2895 		prep_tx_info.was_assoc = true;
2896 		lkpi_80211_mo_mgd_prepare_tx(hw, vif, &prep_tx_info);
2897 		lsta->in_mgd = true;
2898 	}
2899 
2900 	wiphy_unlock(hw->wiphy);
2901 	IEEE80211_LOCK(vap->iv_ic);
2902 
2903 	/* Call iv_newstate first so we get potential DISASSOC packet out. */
2904 	error = lvif->iv_newstate(vap, nstate, arg);
2905 	if (error != 0) {
2906 		ic_printf(vap->iv_ic, "%s:%d: iv_newstate(%p, %d, %d) "
2907 		    "failed: %d\n", __func__, __LINE__, vap, nstate, arg, error);
2908 		goto outni;
2909 	}
2910 
2911 	IEEE80211_UNLOCK(vap->iv_ic);
2912 
2913 	/* Ensure the packets get out. */
2914 	lkpi_80211_flush_tx(lhw, lsta);
2915 
2916 	wiphy_lock(hw->wiphy);
2917 
2918 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
2919 
2920 	/* Wake tx queues to get packet(s) out. */
2921 	lkpi_wake_tx_queues(hw, sta, false, true);
2922 
2923 	/* flush, no drop */
2924 	lkpi_80211_mo_flush(hw, vif,  nitems(sta->txq), false);
2925 
2926 	/* End mgd_complete_tx. */
2927 	if (lsta->in_mgd) {
2928 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
2929 		prep_tx_info.success = false;
2930 		prep_tx_info.was_assoc = true;
2931 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
2932 		lsta->in_mgd = false;
2933 	}
2934 
2935 #if 0
2936 	/* sync_rx_queues */
2937 	lkpi_80211_mo_sync_rx_queues(hw);
2938 
2939 	/* sta_pre_rcu_remove */
2940         lkpi_80211_mo_sta_pre_rcu_remove(hw, vif, sta);
2941 #endif
2942 
2943 	/* Take the station down. */
2944 
2945 	/* Adjust sta and change state (from AUTHORIZED) to ASSOC. */
2946 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
2947 	KASSERT(lsta->state == IEEE80211_STA_AUTHORIZED, ("%s: lsta %p state not "
2948 	    "AUTHORIZED: %#x\n", __func__, lsta, lsta->state));
2949 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_ASSOC);
2950 	if (error != 0) {
2951 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(ASSOC) "
2952 		    "failed: %d\n", __func__, __LINE__, error);
2953 		goto out;
2954 	}
2955 
2956 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
2957 
2958 #ifdef LKPI_80211_HW_CRYPTO
2959 	if (lkpi_hwcrypto) {
2960 		error = lkpi_sta_del_keys(hw, vif, lsta);
2961 		if (error != 0) {
2962 			ic_printf(vap->iv_ic, "%s:%d: lkpi_sta_del_keys "
2963 			    "failed: %d\n", __func__, __LINE__, error);
2964 			/*
2965 			 * Either drv/fw will crash or cleanup itself,
2966 			 * otherwise net80211 will delete the keys (at a
2967 			 * less appropriate time).
2968 			 */
2969 			/* goto out; */
2970 		}
2971 	}
2972 #endif
2973 
2974 	/* Update sta_state (ASSOC to AUTH). */
2975 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
2976 	KASSERT(lsta->state == IEEE80211_STA_ASSOC, ("%s: lsta %p state not "
2977 	    "ASSOC: %#x\n", __func__, lsta, lsta->state));
2978 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_AUTH);
2979 	if (error != 0) {
2980 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(AUTH) "
2981 		    "failed: %d\n", __func__, __LINE__, error);
2982 		goto out;
2983 	}
2984 
2985 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
2986 
2987 #if 0
2988 	/* Update bss info (bss_info_changed) (assoc, aid, ..). */
2989 	lkpi_disassoc(sta, vif, lhw);
2990 #endif
2991 
2992 	error = EALREADY;
2993 out:
2994 	wiphy_unlock(hw->wiphy);
2995 	IEEE80211_LOCK(vap->iv_ic);
2996 outni:
2997 	return (error);
2998 }
2999 
3000 static int
3001 lkpi_sta_run_to_init(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3002 {
3003 	struct lkpi_hw *lhw;
3004 	struct ieee80211_hw *hw;
3005 	struct lkpi_vif *lvif;
3006 	struct ieee80211_vif *vif;
3007 	struct ieee80211_node *ni;
3008 	struct lkpi_sta *lsta;
3009 	struct ieee80211_sta *sta;
3010 	struct ieee80211_prep_tx_info prep_tx_info;
3011 	enum ieee80211_bss_changed bss_changed;
3012 	int error;
3013 
3014 	lhw = vap->iv_ic->ic_softc;
3015 	hw = LHW_TO_HW(lhw);
3016 	lvif = VAP_TO_LVIF(vap);
3017 	vif = LVIF_TO_VIF(lvif);
3018 
3019 	IEEE80211_UNLOCK(vap->iv_ic);
3020 	wiphy_lock(hw->wiphy);
3021 
3022 	LKPI_80211_LVIF_LOCK(lvif);
3023 #ifdef LINUXKPI_DEBUG_80211
3024 	/* XXX-BZ KASSERT later; state going down so no action. */
3025 	if (lvif->lvif_bss == NULL)
3026 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
3027 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
3028 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
3029 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
3030 		    lvif->lvif_bss_synched);
3031 #endif
3032 	lsta = lvif->lvif_bss;
3033 	LKPI_80211_LVIF_UNLOCK(lvif);
3034 	KASSERT(lsta != NULL && lsta->ni != NULL, ("%s: lsta %p ni %p "
3035 	    "lvif %p vap %p\n", __func__,
3036 	    lsta, (lsta != NULL) ? lsta->ni : NULL, lvif, vap));
3037 
3038 	ni = lsta->ni;		/* Reference held for lvif_bss. */
3039 	sta = LSTA_TO_STA(lsta);
3040 
3041 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3042 
3043 	/* flush, drop. */
3044 	lkpi_80211_mo_flush(hw, vif,  nitems(sta->txq), true);
3045 
3046 	IMPROVE("What are the proper conditions for DEAUTH_NEED_MGD_TX_PREP?");
3047 	if (ieee80211_hw_check(hw, DEAUTH_NEED_MGD_TX_PREP) &&
3048 	    !lsta->in_mgd) {
3049 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3050 		prep_tx_info.duration = PREP_TX_INFO_DURATION;
3051 		prep_tx_info.was_assoc = true;
3052 		lkpi_80211_mo_mgd_prepare_tx(hw, vif, &prep_tx_info);
3053 		lsta->in_mgd = true;
3054 	}
3055 
3056 	wiphy_unlock(hw->wiphy);
3057 	IEEE80211_LOCK(vap->iv_ic);
3058 
3059 	/* Call iv_newstate first so we get potential DISASSOC packet out. */
3060 	error = lvif->iv_newstate(vap, nstate, arg);
3061 	if (error != 0) {
3062 		ic_printf(vap->iv_ic, "%s:%d: iv_newstate(%p, %d, %d) "
3063 		    "failed: %d\n", __func__, __LINE__, vap, nstate, arg, error);
3064 		goto outni;
3065 	}
3066 
3067 	IEEE80211_UNLOCK(vap->iv_ic);
3068 
3069 	/* Ensure the packets get out. */
3070 	lkpi_80211_flush_tx(lhw, lsta);
3071 
3072 	wiphy_lock(hw->wiphy);
3073 
3074 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3075 
3076 	/* Wake tx queues to get packet(s) out. */
3077 	lkpi_wake_tx_queues(hw, sta, false, true);
3078 
3079 	/* flush, no drop */
3080 	lkpi_80211_mo_flush(hw, vif,  nitems(sta->txq), false);
3081 
3082 	/* End mgd_complete_tx. */
3083 	if (lsta->in_mgd) {
3084 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3085 		prep_tx_info.success = false;
3086 		prep_tx_info.was_assoc = true;
3087 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
3088 		lsta->in_mgd = false;
3089 	}
3090 
3091 	/* sync_rx_queues */
3092 	lkpi_80211_mo_sync_rx_queues(hw);
3093 
3094 	/* sta_pre_rcu_remove */
3095         lkpi_80211_mo_sta_pre_rcu_remove(hw, vif, sta);
3096 
3097 	/* Take the station down. */
3098 
3099 	/* Adjust sta and change state (from AUTHORIZED) to ASSOC. */
3100 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
3101 	KASSERT(lsta->state == IEEE80211_STA_AUTHORIZED, ("%s: lsta %p state not "
3102 	    "AUTHORIZED: %#x\n", __func__, lsta, lsta->state));
3103 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_ASSOC);
3104 	if (error != 0) {
3105 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(ASSOC) "
3106 		    "failed: %d\n", __func__, __LINE__, error);
3107 		goto out;
3108 	}
3109 
3110 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3111 
3112 #ifdef LKPI_80211_HW_CRYPTO
3113 	if (lkpi_hwcrypto) {
3114 		error = lkpi_sta_del_keys(hw, vif, lsta);
3115 		if (error != 0) {
3116 			ic_printf(vap->iv_ic, "%s:%d: lkpi_sta_del_keys "
3117 			    "failed: %d\n", __func__, __LINE__, error);
3118 			/*
3119 			 * Either drv/fw will crash or cleanup itself,
3120 			 * otherwise net80211 will delete the keys (at a
3121 			 * less appropriate time).
3122 			 */
3123 			/* goto out; */
3124 		}
3125 	}
3126 #endif
3127 
3128 	/* Update sta_state (ASSOC to AUTH). */
3129 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
3130 	KASSERT(lsta->state == IEEE80211_STA_ASSOC, ("%s: lsta %p state not "
3131 	    "ASSOC: %#x\n", __func__, lsta, lsta->state));
3132 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_AUTH);
3133 	if (error != 0) {
3134 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(AUTH) "
3135 		    "failed: %d\n", __func__, __LINE__, error);
3136 		goto out;
3137 	}
3138 
3139 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3140 
3141 	/* Update sta and change state (from AUTH) to NONE. */
3142 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
3143 	KASSERT(lsta->state == IEEE80211_STA_AUTH, ("%s: lsta %p state not "
3144 	    "AUTH: %#x\n", __func__, lsta, lsta->state));
3145 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_NONE);
3146 	if (error != 0) {
3147 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(NONE) "
3148 		    "failed: %d\n", __func__, __LINE__, error);
3149 		goto out;
3150 	}
3151 
3152 	bss_changed = 0;
3153 	/*
3154 	 * Start updating bss info (bss_info_changed) (assoc, aid, ..).
3155 	 *
3156 	 * One would expect this to happen when going off AUTHORIZED.
3157 	 * See comment there; removes the sta from fw if not careful
3158 	 * (bss_info_changed() change is executed right away).
3159 	 *
3160 	 * We need to do this now, before sta changes to IEEE80211_STA_NOTEXIST
3161 	 * as otherwise drivers (iwlwifi at least) will silently not remove
3162 	 * the sta from the firmware and when we will add a new one trigger
3163 	 * a fw assert.
3164 	 *
3165 	 * The order which works best so far avoiding early removal or silent
3166 	 * non-removal seems to be (for iwlwifi::mld-mac80211.c cases;
3167 	 * the iwlwifi:mac80211.c case still to be tested):
3168 	 * 1) lkpi_disassoc(): set vif->cfg.assoc = false (aid=0 side effect here)
3169 	 * 2) call the last sta_state update -> IEEE80211_STA_NOTEXIST
3170 	 *    (removes the sta given assoc is false)
3171 	 * 3) add the remaining BSS_CHANGED changes and call bss_info_changed()
3172 	 * 4) call unassign_vif_chanctx
3173 	 * 5) call lkpi_hw_conf_idle
3174 	 * 6) call remove_chanctx
3175 	 */
3176 	bss_changed |= lkpi_disassoc(sta, vif, lhw);
3177 
3178 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3179 
3180 	/* Adjust sta and change state (from NONE) to NOTEXIST. */
3181 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
3182 	KASSERT(lsta->state == IEEE80211_STA_NONE, ("%s: lsta %p state not "
3183 	    "NONE: %#x, nstate %d arg %d\n", __func__, lsta, lsta->state, nstate, arg));
3184 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_NOTEXIST);
3185 	if (error != 0) {
3186 		IMPROVE("do we need to undo the chan ctx?");
3187 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(NOTEXIST) "
3188 		    "failed: %d\n", __func__, __LINE__, error);
3189 		goto out;
3190 	}
3191 
3192 	lkpi_lsta_remove(lsta, lvif);
3193 
3194 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);	/* sta no longer save to use. */
3195 
3196 	IMPROVE("Any bss_info changes to announce?");
3197 	vif->bss_conf.qos = 0;
3198 	bss_changed |= BSS_CHANGED_QOS;
3199 	vif->cfg.ssid_len = 0;
3200 	memset(vif->cfg.ssid, '\0', sizeof(vif->cfg.ssid));
3201 	bss_changed |= BSS_CHANGED_BSSID;
3202 	vif->bss_conf.use_short_preamble = false;
3203 	vif->bss_conf.qos = false;
3204 	/* XXX BSS_CHANGED_???? */
3205 	lkpi_80211_mo_bss_info_changed(hw, vif, &vif->bss_conf, bss_changed);
3206 
3207 	LKPI_80211_LVIF_LOCK(lvif);
3208 	/* Remove ni reference for this cache of lsta. */
3209 	lvif->lvif_bss = NULL;
3210 	lvif->lvif_bss_synched = false;
3211 	LKPI_80211_LVIF_UNLOCK(lvif);
3212 	/*
3213 	 * The very last release the reference on the ni for the ni/lsta on
3214 	 * lvif->lvif_bss.  Upon return from this both ni and lsta are invalid
3215 	 * and potentially freed.
3216 	 */
3217 	ieee80211_free_node(ni);
3218 
3219 	/* conf_tx */
3220 
3221 	lkpi_remove_chanctx(hw, vif);
3222 
3223 	error = EALREADY;
3224 out:
3225 	wiphy_unlock(hw->wiphy);
3226 	IEEE80211_LOCK(vap->iv_ic);
3227 outni:
3228 	return (error);
3229 }
3230 
3231 static int
3232 lkpi_sta_run_to_scan(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3233 {
3234 
3235 	return (lkpi_sta_run_to_init(vap, nstate, arg));
3236 }
3237 
3238 static int
3239 lkpi_sta_run_to_auth(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3240 {
3241 	int error;
3242 
3243 	error = lkpi_sta_run_to_init(vap, nstate, arg);
3244 	if (error != 0 && error != EALREADY)
3245 		return (error);
3246 
3247 	/* At this point iv_bss is long a new node! */
3248 
3249 	error |= lkpi_sta_scan_to_auth(vap, nstate, 0);
3250 	return (error);
3251 }
3252 
3253 /* -------------------------------------------------------------------------- */
3254 
3255 /*
3256  * The matches the documented state changes in net80211::sta_newstate().
3257  * XXX (1) without CSA and SLEEP yet, * XXX (2) not all unhandled cases
3258  * there are "invalid" (so there is a room for failure here).
3259  */
3260 struct fsm_state {
3261 	/* INIT, SCAN, AUTH, ASSOC, CAC, RUN, CSA, SLEEP */
3262 	enum ieee80211_state ostate;
3263 	enum ieee80211_state nstate;
3264 	int (*handler)(struct ieee80211vap *, enum ieee80211_state, int);
3265 } sta_state_fsm[] = {
3266 	{ IEEE80211_S_INIT,	IEEE80211_S_INIT, lkpi_sta_state_do_nada },
3267 	{ IEEE80211_S_SCAN,	IEEE80211_S_INIT, lkpi_sta_state_do_nada },	/* scan_to_init */
3268 	{ IEEE80211_S_AUTH,	IEEE80211_S_INIT, lkpi_sta_auth_to_init },	/* not explicitly in sta_newstate() */
3269 	{ IEEE80211_S_ASSOC,	IEEE80211_S_INIT, lkpi_sta_assoc_to_init },	/* Send DEAUTH. */
3270 	{ IEEE80211_S_RUN,	IEEE80211_S_INIT, lkpi_sta_run_to_init },	/* Send DISASSOC. */
3271 
3272 	{ IEEE80211_S_INIT,	IEEE80211_S_SCAN, lkpi_sta_state_do_nada },
3273 	{ IEEE80211_S_SCAN,	IEEE80211_S_SCAN, lkpi_sta_state_do_nada },
3274 	{ IEEE80211_S_AUTH,	IEEE80211_S_SCAN, lkpi_sta_auth_to_scan },
3275 	{ IEEE80211_S_ASSOC,	IEEE80211_S_SCAN, lkpi_sta_assoc_to_scan },
3276 	{ IEEE80211_S_RUN,	IEEE80211_S_SCAN, lkpi_sta_run_to_scan },	/* Beacon miss. */
3277 
3278 	{ IEEE80211_S_INIT,	IEEE80211_S_AUTH, lkpi_sta_scan_to_auth },	/* Send AUTH. */
3279 	{ IEEE80211_S_SCAN,	IEEE80211_S_AUTH, lkpi_sta_scan_to_auth },	/* Send AUTH. */
3280 	{ IEEE80211_S_AUTH,	IEEE80211_S_AUTH, lkpi_sta_a_to_a },		/* Send ?AUTH. */
3281 	{ IEEE80211_S_ASSOC,	IEEE80211_S_AUTH, lkpi_sta_assoc_to_auth },	/* Send ?AUTH. */
3282 	{ IEEE80211_S_RUN,	IEEE80211_S_AUTH, lkpi_sta_run_to_auth },	/* Send ?AUTH. */
3283 
3284 	{ IEEE80211_S_AUTH,	IEEE80211_S_ASSOC, lkpi_sta_auth_to_assoc },	/* Send ASSOCREQ. */
3285 	{ IEEE80211_S_ASSOC,	IEEE80211_S_ASSOC, lkpi_sta_a_to_a },		/* Send ASSOCREQ. */
3286 	{ IEEE80211_S_RUN,	IEEE80211_S_ASSOC, lkpi_sta_run_to_assoc },	/* Send ASSOCREQ/REASSOCREQ. */
3287 
3288 	{ IEEE80211_S_AUTH,	IEEE80211_S_RUN, lkpi_sta_auth_to_run },
3289 	{ IEEE80211_S_ASSOC,	IEEE80211_S_RUN, lkpi_sta_assoc_to_run },
3290 	{ IEEE80211_S_RUN,	IEEE80211_S_RUN, lkpi_sta_state_do_nada },
3291 
3292 	/* Dummy at the end without handler. */
3293 	{ IEEE80211_S_INIT,	IEEE80211_S_INIT, NULL },
3294 };
3295 
3296 static int
3297 lkpi_iv_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3298 {
3299 	struct ieee80211com *ic;
3300 	struct lkpi_hw *lhw;
3301 	struct lkpi_vif *lvif;
3302 	struct ieee80211_vif *vif;
3303 	struct fsm_state *s;
3304 	enum ieee80211_state ostate;
3305 	int error;
3306 
3307 	ic = vap->iv_ic;
3308 	IEEE80211_LOCK_ASSERT(ic);
3309 	ostate = vap->iv_state;
3310 
3311 #ifdef LINUXKPI_DEBUG_80211
3312 	if (linuxkpi_debug_80211 & D80211_TRACE)
3313 		ic_printf(vap->iv_ic, "%s:%d: vap %p nstate %#x arg %#x\n",
3314 		    __func__, __LINE__, vap, nstate, arg);
3315 #endif
3316 
3317 	if (vap->iv_opmode == IEEE80211_M_STA) {
3318 
3319 		lhw = ic->ic_softc;
3320 		lvif = VAP_TO_LVIF(vap);
3321 		vif = LVIF_TO_VIF(lvif);
3322 
3323 		/* No need to replicate this in most state handlers. */
3324 		if (ostate == IEEE80211_S_SCAN && nstate != IEEE80211_S_SCAN)
3325 			lkpi_stop_hw_scan(lhw, vif);
3326 
3327 		s = sta_state_fsm;
3328 
3329 	} else {
3330 		ic_printf(vap->iv_ic, "%s: only station mode currently supported: "
3331 		    "cap %p iv_opmode %d\n", __func__, vap, vap->iv_opmode);
3332 		return (ENOSYS);
3333 	}
3334 
3335 	error = 0;
3336 	for (; s->handler != NULL; s++) {
3337 		if (ostate == s->ostate && nstate == s->nstate) {
3338 #ifdef LINUXKPI_DEBUG_80211
3339 			if (linuxkpi_debug_80211 & D80211_TRACE)
3340 				ic_printf(vap->iv_ic, "%s: new state %d (%s) ->"
3341 				    " %d (%s): arg %d.\n", __func__,
3342 				    ostate, ieee80211_state_name[ostate],
3343 				    nstate, ieee80211_state_name[nstate], arg);
3344 #endif
3345 			error = s->handler(vap, nstate, arg);
3346 			break;
3347 		}
3348 	}
3349 	IEEE80211_LOCK_ASSERT(vap->iv_ic);
3350 
3351 	if (s->handler == NULL) {
3352 		IMPROVE("turn this into a KASSERT\n");
3353 		ic_printf(vap->iv_ic, "%s: unsupported state transition "
3354 		    "%d (%s) -> %d (%s)\n", __func__,
3355 		    ostate, ieee80211_state_name[ostate],
3356 		    nstate, ieee80211_state_name[nstate]);
3357 		return (ENOSYS);
3358 	}
3359 
3360 	if (error == EALREADY) {
3361 #ifdef LINUXKPI_DEBUG_80211
3362 		if (linuxkpi_debug_80211 & D80211_TRACE)
3363 			ic_printf(vap->iv_ic, "%s: state transition %d (%s) -> "
3364 			    "%d (%s): iv_newstate already handled: %d.\n",
3365 			    __func__, ostate, ieee80211_state_name[ostate],
3366 			    nstate, ieee80211_state_name[nstate], error);
3367 #endif
3368 		return (0);
3369 	}
3370 
3371 	if (error != 0) {
3372 		ic_printf(vap->iv_ic, "%s: error %d during state transition "
3373 		    "%d (%s) -> %d (%s)\n", __func__, error,
3374 		    ostate, ieee80211_state_name[ostate],
3375 		    nstate, ieee80211_state_name[nstate]);
3376 		return (error);
3377 	}
3378 
3379 #ifdef LINUXKPI_DEBUG_80211
3380 	if (linuxkpi_debug_80211 & D80211_TRACE)
3381 		ic_printf(vap->iv_ic, "%s:%d: vap %p nstate %#x arg %#x "
3382 		    "calling net80211 parent\n",
3383 		    __func__, __LINE__, vap, nstate, arg);
3384 #endif
3385 
3386 	return (lvif->iv_newstate(vap, nstate, arg));
3387 }
3388 
3389 /* -------------------------------------------------------------------------- */
3390 
3391 /*
3392  * We overload (*iv_update_bss) as otherwise we have cases in, e.g.,
3393  * net80211::ieee80211_sta_join1() where vap->iv_bss gets replaced by a
3394  * new node without us knowing and thus our ni/lsta are out of sync.
3395  */
3396 static struct ieee80211_node *
3397 lkpi_iv_update_bss(struct ieee80211vap *vap, struct ieee80211_node *ni)
3398 {
3399 	struct lkpi_vif *lvif;
3400 	struct ieee80211_node *rni;
3401 
3402 	IEEE80211_LOCK_ASSERT(vap->iv_ic);
3403 
3404 	lvif = VAP_TO_LVIF(vap);
3405 
3406 	LKPI_80211_LVIF_LOCK(lvif);
3407 	lvif->lvif_bss_synched = false;
3408 	LKPI_80211_LVIF_UNLOCK(lvif);
3409 
3410 	rni = lvif->iv_update_bss(vap, ni);
3411 	return (rni);
3412 }
3413 
3414 #ifdef LKPI_80211_WME
3415 static int
3416 lkpi_wme_update(struct lkpi_hw *lhw, struct ieee80211vap *vap, bool planned)
3417 {
3418 	struct ieee80211com *ic;
3419 	struct ieee80211_hw *hw;
3420 	struct lkpi_vif *lvif;
3421 	struct ieee80211_vif *vif;
3422 	struct chanAccParams chp;
3423 	struct wmeParams wmeparr[WME_NUM_AC];
3424 	struct ieee80211_tx_queue_params txqp;
3425 	enum ieee80211_bss_changed changed;
3426 	int error;
3427 	uint16_t ac;
3428 
3429 	hw = LHW_TO_HW(lhw);
3430 	lockdep_assert_wiphy(hw->wiphy);
3431 
3432 	IMPROVE();
3433 	KASSERT(WME_NUM_AC == IEEE80211_NUM_ACS, ("%s: WME_NUM_AC %d != "
3434 	    "IEEE80211_NUM_ACS %d\n", __func__, WME_NUM_AC, IEEE80211_NUM_ACS));
3435 
3436 	if (vap == NULL)
3437 		return (0);
3438 
3439 	if ((vap->iv_flags & IEEE80211_F_WME) == 0)
3440 		return (0);
3441 
3442 	if (lhw->ops->conf_tx == NULL)
3443 		return (0);
3444 
3445 	if (!planned && (vap->iv_state != IEEE80211_S_RUN)) {
3446 		lhw->update_wme = true;
3447 		return (0);
3448 	}
3449 	lhw->update_wme = false;
3450 
3451 	ic = lhw->ic;
3452 	ieee80211_wme_ic_getparams(ic, &chp);
3453 	IEEE80211_LOCK(ic);
3454 	for (ac = 0; ac < WME_NUM_AC; ac++)
3455 		wmeparr[ac] = chp.cap_wmeParams[ac];
3456 	IEEE80211_UNLOCK(ic);
3457 
3458 	lvif = VAP_TO_LVIF(vap);
3459 	vif = LVIF_TO_VIF(lvif);
3460 
3461 	/* Configure tx queues (conf_tx) & send BSS_CHANGED_QOS. */
3462 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
3463 		struct wmeParams *wmep;
3464 
3465 		wmep = &wmeparr[ac];
3466 		bzero(&txqp, sizeof(txqp));
3467 		txqp.cw_min = wmep->wmep_logcwmin;
3468 		txqp.cw_max = wmep->wmep_logcwmax;
3469 		txqp.txop = wmep->wmep_txopLimit;
3470 		txqp.aifs = wmep->wmep_aifsn;
3471 		error = lkpi_80211_mo_conf_tx(hw, vif, /* link_id */0, ac, &txqp);
3472 		if (error != 0)
3473 			ic_printf(ic, "%s: conf_tx ac %u failed %d\n",
3474 			    __func__, ac, error);
3475 	}
3476 	changed = BSS_CHANGED_QOS;
3477 	if (!planned)
3478 		lkpi_80211_mo_bss_info_changed(hw, vif, &vif->bss_conf, changed);
3479 
3480 	return (changed);
3481 }
3482 #endif
3483 
3484 static int
3485 lkpi_ic_wme_update(struct ieee80211com *ic)
3486 {
3487 #ifdef LKPI_80211_WME
3488 	struct ieee80211vap *vap;
3489 	struct lkpi_hw *lhw;
3490 	struct ieee80211_hw *hw;
3491 
3492 	IMPROVE("Use the per-VAP callback in net80211.");
3493 	vap = TAILQ_FIRST(&ic->ic_vaps);
3494 	if (vap == NULL)
3495 		return (0);
3496 
3497 	lhw = ic->ic_softc;
3498 	hw = LHW_TO_HW(lhw);
3499 
3500 	wiphy_lock(hw->wiphy);
3501 	lkpi_wme_update(lhw, vap, false);
3502 	wiphy_unlock(hw->wiphy);
3503 #endif
3504 	return (0);	/* unused */
3505 }
3506 
3507 /*
3508  * Change link-layer address on the vif (if the vap is not started/"UP").
3509  * This can happen if a user changes 'ether' using ifconfig.
3510  * The code is based on net80211/ieee80211_freebsd.c::wlan_iflladdr() but
3511  * we do use a per-[l]vif event handler to be sure we exist as we
3512  * cannot assume that from every vap derives a vif and we have a hard
3513  * time checking based on net80211 information.
3514  * Should this ever become a real problem we could add a callback function
3515  * to wlan_iflladdr() to be set optionally but that would be for a
3516  * single-consumer (or needs a list) -- was just too complicated for an
3517  * otherwise perfect mechanism FreeBSD already provides.
3518  */
3519 static void
3520 lkpi_vif_iflladdr(void *arg, struct ifnet *ifp)
3521 {
3522 	struct epoch_tracker et;
3523 	struct ieee80211_vif *vif;
3524 
3525 	NET_EPOCH_ENTER(et);
3526 	/* NB: identify vap's by if_transmit; left as an extra check. */
3527 	if (if_gettransmitfn(ifp) != ieee80211_vap_transmit ||
3528 	    (if_getflags(ifp) & IFF_UP) != 0) {
3529 		NET_EPOCH_EXIT(et);
3530 		return;
3531 	}
3532 
3533 	vif = arg;
3534 	IEEE80211_ADDR_COPY(vif->bss_conf.addr, if_getlladdr(ifp));
3535 	NET_EPOCH_EXIT(et);
3536 }
3537 
3538 static struct ieee80211vap *
3539 lkpi_ic_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ],
3540     int unit, enum ieee80211_opmode opmode, int flags,
3541     const uint8_t bssid[IEEE80211_ADDR_LEN],
3542     const uint8_t mac[IEEE80211_ADDR_LEN])
3543 {
3544 	struct lkpi_hw *lhw;
3545 	struct ieee80211_hw *hw;
3546 	struct lkpi_vif *lvif;
3547 	struct ieee80211vap *vap;
3548 	struct ieee80211_vif *vif;
3549 	struct ieee80211_tx_queue_params txqp;
3550 	enum ieee80211_bss_changed changed;
3551 	struct sysctl_oid *node;
3552 	size_t len;
3553 	int error, i;
3554 	uint16_t ac;
3555 
3556 	if (!TAILQ_EMPTY(&ic->ic_vaps))	/* 1 so far. Add <n> once this works. */
3557 		return (NULL);
3558 
3559 	lhw = ic->ic_softc;
3560 	hw = LHW_TO_HW(lhw);
3561 
3562 	len = sizeof(*lvif);
3563 	len += hw->vif_data_size;	/* vif->drv_priv */
3564 
3565 	lvif = malloc(len, M_80211_VAP, M_WAITOK | M_ZERO);
3566 	mtx_init(&lvif->mtx, "lvif", NULL, MTX_DEF);
3567 	INIT_LIST_HEAD(&lvif->lsta_list);
3568 	lvif->lvif_bss = NULL;
3569 	refcount_init(&lvif->nt_unlocked, 0);
3570 	lvif->lvif_bss_synched = false;
3571 	vap = LVIF_TO_VAP(lvif);
3572 
3573 	vif = LVIF_TO_VIF(lvif);
3574 	memcpy(vif->addr, mac, IEEE80211_ADDR_LEN);
3575 	vif->p2p = false;
3576 	vif->probe_req_reg = false;
3577 	vif->type = lkpi_opmode_to_vif_type(opmode);
3578 	lvif->wdev.iftype = vif->type;
3579 	/* Need to fill in other fields as well. */
3580 	IMPROVE();
3581 
3582 	/* XXX-BZ hardcoded for now! */
3583 #if 1
3584 	RCU_INIT_POINTER(vif->bss_conf.chanctx_conf, NULL);
3585 	vif->bss_conf.vif = vif;
3586 	/* vap->iv_myaddr is not set until net80211::vap_setup or vap_attach. */
3587 	IEEE80211_ADDR_COPY(vif->bss_conf.addr, mac);
3588 	lvif->lvif_ifllevent = EVENTHANDLER_REGISTER(iflladdr_event,
3589 	    lkpi_vif_iflladdr, vif, EVENTHANDLER_PRI_ANY);
3590 	vif->bss_conf.link_id = 0;	/* Non-MLO operation. */
3591 	vif->bss_conf.chanreq.oper.width = NL80211_CHAN_WIDTH_20_NOHT;
3592 	vif->bss_conf.use_short_preamble = false;	/* vap->iv_flags IEEE80211_F_SHPREAMBLE */
3593 	vif->bss_conf.use_short_slot = false;		/* vap->iv_flags IEEE80211_F_SHSLOT */
3594 	vif->bss_conf.qos = false;
3595 	vif->bss_conf.use_cts_prot = false;		/* vap->iv_protmode */
3596 	vif->bss_conf.ht_operation_mode = IEEE80211_HT_OP_MODE_PROTECTION_NONE;
3597 	vif->cfg.aid = 0;
3598 	vif->cfg.assoc = false;
3599 	vif->cfg.idle = true;
3600 	vif->cfg.ps = false;
3601 	IMPROVE("Check other fields and then figure out whats is left elsewhere of them");
3602 	/*
3603 	 * We need to initialize it to something as the bss_info_changed call
3604 	 * will try to copy from it in iwlwifi and NULL is a panic.
3605 	 * We will set the proper one in scan_to_auth() before being assoc.
3606 	 */
3607 	vif->bss_conf.bssid = ieee80211broadcastaddr;
3608 #endif
3609 #if 0
3610 	vif->bss_conf.dtim_period = 0; /* IEEE80211_DTIM_DEFAULT ; must stay 0. */
3611 	IEEE80211_ADDR_COPY(vif->bss_conf.bssid, bssid);
3612 	vif->bss_conf.beacon_int = ic->ic_bintval;
3613 	/* iwlwifi bug. */
3614 	if (vif->bss_conf.beacon_int < 16)
3615 		vif->bss_conf.beacon_int = 16;
3616 #endif
3617 
3618 	/* Link Config */
3619 	vif->link_conf[0] = &vif->bss_conf;
3620 	for (i = 0; i < nitems(vif->link_conf); i++) {
3621 		IMPROVE("more than 1 link one day");
3622 	}
3623 
3624 	/* Setup queue defaults; driver may override in (*add_interface). */
3625 	for (i = 0; i < IEEE80211_NUM_ACS; i++) {
3626 		if (ieee80211_hw_check(hw, QUEUE_CONTROL))
3627 			vif->hw_queue[i] = IEEE80211_INVAL_HW_QUEUE;
3628 		else if (hw->queues >= IEEE80211_NUM_ACS)
3629 			vif->hw_queue[i] = i;
3630 		else
3631 			vif->hw_queue[i] = 0;
3632 
3633 		/* Initialize the queue to running. Stopped? */
3634 		lvif->hw_queue_stopped[i] = false;
3635 	}
3636 	vif->cab_queue = IEEE80211_INVAL_HW_QUEUE;
3637 
3638 	IMPROVE();
3639 
3640 	error = lkpi_80211_mo_start(hw);
3641 	if (error != 0) {
3642 		ic_printf(ic, "%s: failed to start hw: %d\n", __func__, error);
3643 		mtx_destroy(&lvif->mtx);
3644 		free(lvif, M_80211_VAP);
3645 		return (NULL);
3646 	}
3647 
3648 	error = lkpi_80211_mo_add_interface(hw, vif);
3649 	if (error != 0) {
3650 		IMPROVE();	/* XXX-BZ mo_stop()? */
3651 		ic_printf(ic, "%s: failed to add interface: %d\n", __func__, error);
3652 		mtx_destroy(&lvif->mtx);
3653 		free(lvif, M_80211_VAP);
3654 		return (NULL);
3655 	}
3656 
3657 	LKPI_80211_LHW_LVIF_LOCK(lhw);
3658 	TAILQ_INSERT_TAIL(&lhw->lvif_head, lvif, lvif_entry);
3659 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
3660 
3661 	/* Set bss_info. */
3662 	changed = 0;
3663 	lkpi_80211_mo_bss_info_changed(hw, vif, &vif->bss_conf, changed);
3664 
3665 	/* Configure tx queues (conf_tx), default WME & send BSS_CHANGED_QOS. */
3666 	IMPROVE("Hardcoded values; to fix see 802.11-2016, 9.4.2.29 EDCA Parameter Set element");
3667 	wiphy_lock(hw->wiphy);
3668 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
3669 
3670 		bzero(&txqp, sizeof(txqp));
3671 		txqp.cw_min = 15;
3672 		txqp.cw_max = 1023;
3673 		txqp.txop = 0;
3674 		txqp.aifs = 2;
3675 		error = lkpi_80211_mo_conf_tx(hw, vif, /* link_id */0, ac, &txqp);
3676 		if (error != 0)
3677 			ic_printf(ic, "%s: conf_tx ac %u failed %d\n",
3678 			    __func__, ac, error);
3679 	}
3680 	wiphy_unlock(hw->wiphy);
3681 	changed = BSS_CHANGED_QOS;
3682 	lkpi_80211_mo_bss_info_changed(hw, vif, &vif->bss_conf, changed);
3683 
3684 	/* Force MC init. */
3685 	lkpi_update_mcast_filter(ic, true);
3686 
3687 	IMPROVE();
3688 
3689 	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
3690 
3691 	/* Override with LinuxKPI method so we can drive mac80211/cfg80211. */
3692 	lvif->iv_newstate = vap->iv_newstate;
3693 	vap->iv_newstate = lkpi_iv_newstate;
3694 	lvif->iv_update_bss = vap->iv_update_bss;
3695 	vap->iv_update_bss = lkpi_iv_update_bss;
3696 
3697 #ifdef LKPI_80211_HW_CRYPTO
3698 	/* Key management. */
3699 	if (lkpi_hwcrypto && lhw->ops->set_key != NULL) {
3700 		vap->iv_key_set = lkpi_iv_key_set;
3701 		vap->iv_key_delete = lkpi_iv_key_delete;
3702 		vap->iv_key_update_begin = lkpi_iv_key_update_begin;
3703 		vap->iv_key_update_end = lkpi_iv_key_update_end;
3704 	}
3705 #endif
3706 
3707 #ifdef LKPI_80211_HT
3708 	/* Stay with the iv_ampdu_rxmax,limit / iv_ampdu_density defaults until later. */
3709 #endif
3710 
3711 	ieee80211_ratectl_init(vap);
3712 
3713 	/* Complete setup. */
3714 	ieee80211_vap_attach(vap, ieee80211_media_change,
3715 	    ieee80211_media_status, mac);
3716 
3717 #ifdef LKPI_80211_HT
3718 	/*
3719 	 * Modern chipset/fw/drv will do A-MPDU in drv/fw and fail
3720 	 * to do so if they cannot do the crypto too.
3721 	 */
3722 	if (!lkpi_hwcrypto && ieee80211_hw_check(hw, AMPDU_AGGREGATION))
3723 		vap->iv_flags_ht &= ~IEEE80211_FHT_AMPDU_RX;
3724 #endif
3725 #if defined(LKPI_80211_HT)
3726 	/* 20250125-BZ Keep A-MPDU TX cleared until we sorted out AddBA for all drivers. */
3727 	vap->iv_flags_ht &= ~IEEE80211_FHT_AMPDU_TX;
3728 #endif
3729 
3730 	if (hw->max_listen_interval == 0)
3731 		hw->max_listen_interval = 7 * (ic->ic_lintval / ic->ic_bintval);
3732 	hw->conf.listen_interval = hw->max_listen_interval;
3733 	ic->ic_set_channel(ic);
3734 
3735 	/* XXX-BZ do we need to be able to update these? */
3736 	hw->wiphy->frag_threshold = vap->iv_fragthreshold;
3737 	lkpi_80211_mo_set_frag_threshold(hw, vap->iv_fragthreshold);
3738 	hw->wiphy->rts_threshold = vap->iv_rtsthreshold;
3739 	lkpi_80211_mo_set_rts_threshold(hw, vap->iv_rtsthreshold);
3740 	/* any others? */
3741 
3742 	/* Add per-VIF/VAP sysctls. */
3743 	sysctl_ctx_init(&lvif->sysctl_ctx);
3744 
3745 	node = SYSCTL_ADD_NODE(&lvif->sysctl_ctx,
3746 	    SYSCTL_CHILDREN(&sysctl___compat_linuxkpi_80211),
3747 	    OID_AUTO, if_name(vap->iv_ifp),
3748 	    CTLFLAG_RD | CTLFLAG_SKIP | CTLFLAG_MPSAFE, NULL, "VIF Information");
3749 
3750 	SYSCTL_ADD_PROC(&lvif->sysctl_ctx,
3751 	    SYSCTL_CHILDREN(node), OID_AUTO, "dump_stas",
3752 	    CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_MPSAFE, lvif, 0,
3753 	    lkpi_80211_dump_stas, "A", "Dump sta statistics of this vif");
3754 
3755 	IMPROVE();
3756 
3757 	return (vap);
3758 }
3759 
3760 void
3761 linuxkpi_ieee80211_unregister_hw(struct ieee80211_hw *hw)
3762 {
3763 
3764 	wiphy_unregister(hw->wiphy);
3765 	linuxkpi_ieee80211_ifdetach(hw);
3766 
3767 	IMPROVE();
3768 }
3769 
3770 void
3771 linuxkpi_ieee80211_restart_hw(struct ieee80211_hw *hw)
3772 {
3773 
3774 	TODO();
3775 }
3776 
3777 static void
3778 lkpi_ic_vap_delete(struct ieee80211vap *vap)
3779 {
3780 	struct ieee80211com *ic;
3781 	struct lkpi_hw *lhw;
3782 	struct ieee80211_hw *hw;
3783 	struct lkpi_vif *lvif;
3784 	struct ieee80211_vif *vif;
3785 
3786 	lvif = VAP_TO_LVIF(vap);
3787 	vif = LVIF_TO_VIF(lvif);
3788 	ic = vap->iv_ic;
3789 	lhw = ic->ic_softc;
3790 	hw = LHW_TO_HW(lhw);
3791 
3792 	EVENTHANDLER_DEREGISTER(iflladdr_event, lvif->lvif_ifllevent);
3793 
3794 	/* Clear up per-VIF/VAP sysctls. */
3795 	sysctl_ctx_free(&lvif->sysctl_ctx);
3796 
3797 	LKPI_80211_LHW_LVIF_LOCK(lhw);
3798 	TAILQ_REMOVE(&lhw->lvif_head, lvif, lvif_entry);
3799 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
3800 
3801 	ieee80211_ratectl_deinit(vap);
3802 	ieee80211_vap_detach(vap);
3803 
3804 	IMPROVE("clear up other bits in this state");
3805 
3806 	lkpi_80211_mo_remove_interface(hw, vif);
3807 
3808 	/* Single VAP, so we can do this here. */
3809 	lkpi_80211_mo_stop(hw, false);			/* XXX SUSPEND */
3810 
3811 	mtx_destroy(&lvif->mtx);
3812 	free(lvif, M_80211_VAP);
3813 }
3814 
3815 static void
3816 lkpi_ic_update_mcast(struct ieee80211com *ic)
3817 {
3818 
3819 	lkpi_update_mcast_filter(ic, false);
3820 	TRACEOK();
3821 }
3822 
3823 static void
3824 lkpi_ic_update_promisc(struct ieee80211com *ic)
3825 {
3826 
3827 	UNIMPLEMENTED;
3828 }
3829 
3830 static void
3831 lkpi_ic_update_chw(struct ieee80211com *ic)
3832 {
3833 
3834 	UNIMPLEMENTED;
3835 }
3836 
3837 /* Start / stop device. */
3838 static void
3839 lkpi_ic_parent(struct ieee80211com *ic)
3840 {
3841 	struct lkpi_hw *lhw;
3842 	struct ieee80211_hw *hw;
3843 #ifdef HW_START_STOP
3844 	int error;
3845 #endif
3846 	bool start_all;
3847 
3848 	IMPROVE();
3849 
3850 	lhw = ic->ic_softc;
3851 	hw = LHW_TO_HW(lhw);
3852 	start_all = false;
3853 
3854 	/* IEEE80211_UNLOCK(ic); */
3855 	wiphy_lock(hw->wiphy);
3856 	if (ic->ic_nrunning > 0) {
3857 #ifdef HW_START_STOP
3858 		error = lkpi_80211_mo_start(hw);
3859 		if (error == 0)
3860 #endif
3861 			start_all = true;
3862 	} else {
3863 #ifdef HW_START_STOP
3864 		lkpi_80211_mo_stop(hw, false);		/* XXX SUSPEND */
3865 #endif
3866 	}
3867 	wiphy_unlock(hw->wiphy);
3868 	/* IEEE80211_LOCK(ic); */
3869 
3870 	if (start_all)
3871 		ieee80211_start_all(ic);
3872 }
3873 
3874 bool
3875 linuxkpi_ieee80211_is_ie_id_in_ie_buf(const u8 ie, const u8 *ie_ids,
3876     size_t ie_ids_len)
3877 {
3878 	int i;
3879 
3880 	for (i = 0; i < ie_ids_len; i++) {
3881 		if (ie == *ie_ids)
3882 			return (true);
3883 	}
3884 
3885 	return (false);
3886 }
3887 
3888 /* Return true if skipped; false if error. */
3889 bool
3890 linuxkpi_ieee80211_ie_advance(size_t *xp, const u8 *ies, size_t ies_len)
3891 {
3892 	size_t x;
3893 	uint8_t l;
3894 
3895 	x = *xp;
3896 
3897 	KASSERT(x < ies_len, ("%s: x %zu ies_len %zu ies %p\n",
3898 	    __func__, x, ies_len, ies));
3899 	l = ies[x + 1];
3900 	x += 2 + l;
3901 
3902 	if (x > ies_len)
3903 		return (false);
3904 
3905 	*xp = x;
3906 	return (true);
3907 }
3908 
3909 static uint8_t *
3910 lkpi_scan_ies_add(uint8_t *p, struct ieee80211_scan_ies *scan_ies,
3911     uint32_t band_mask, struct ieee80211vap *vap, struct ieee80211_hw *hw)
3912 {
3913 	struct ieee80211_supported_band *supband;
3914 	struct linuxkpi_ieee80211_channel *channels;
3915 	struct ieee80211com *ic;
3916 	const struct ieee80211_channel *chan;
3917 	const struct ieee80211_rateset *rs;
3918 	uint8_t *pb;
3919 	int band, i;
3920 
3921 	ic = vap->iv_ic;
3922 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
3923 		if ((band_mask & (1 << band)) == 0)
3924 			continue;
3925 
3926 		supband = hw->wiphy->bands[band];
3927 		/*
3928 		 * This should not happen;
3929 		 * band_mask is a bitmask of valid bands to scan on.
3930 		 */
3931 		if (supband == NULL || supband->n_channels == 0)
3932 			continue;
3933 
3934 		/* Find a first channel to get the mode and rates from. */
3935 		channels = supband->channels;
3936 		chan = NULL;
3937 		for (i = 0; i < supband->n_channels; i++) {
3938 
3939 			if (channels[i].flags & IEEE80211_CHAN_DISABLED)
3940 				continue;
3941 
3942 			chan = ieee80211_find_channel(ic,
3943 			    channels[i].center_freq, 0);
3944 			if (chan != NULL)
3945 				break;
3946 		}
3947 
3948 		/* This really should not happen. */
3949 		if (chan == NULL)
3950 			continue;
3951 
3952 		pb = p;
3953 		rs = ieee80211_get_suprates(ic, chan);	/* calls chan2mode */
3954 		p = ieee80211_add_rates(p, rs);
3955 		p = ieee80211_add_xrates(p, rs);
3956 
3957 #if defined(LKPI_80211_HT)
3958 		if ((vap->iv_flags_ht & IEEE80211_FHT_HT) != 0) {
3959 			struct ieee80211_channel *c;
3960 
3961 			c = ieee80211_ht_adjust_channel(ic, ic->ic_curchan,
3962 			    vap->iv_flags_ht);
3963 			p = ieee80211_add_htcap_ch(p, vap, c);
3964 		}
3965 #endif
3966 #if defined(LKPI_80211_VHT)
3967 		if (band == NL80211_BAND_5GHZ &&
3968 		    (vap->iv_vht_flags & IEEE80211_FVHT_VHT) != 0) {
3969 			struct ieee80211_channel *c;
3970 
3971 			c = ieee80211_ht_adjust_channel(ic, ic->ic_curchan,
3972 			    vap->iv_flags_ht);
3973 			c = ieee80211_vht_adjust_channel(ic, c,
3974 			    vap->iv_vht_flags);
3975 			p = ieee80211_add_vhtcap_ch(p, vap, c);
3976 		}
3977 #endif
3978 
3979 		scan_ies->ies[band] = pb;
3980 		scan_ies->len[band] = p - pb;
3981 	}
3982 
3983 	/* Add common_ies */
3984 	pb = p;
3985 	if ((vap->iv_flags & IEEE80211_F_WPA1) != 0 &&
3986 	    vap->iv_wpa_ie != NULL) {
3987 		memcpy(p, vap->iv_wpa_ie, 2 + vap->iv_wpa_ie[1]);
3988 		p += 2 + vap->iv_wpa_ie[1];
3989 	}
3990 	if (vap->iv_appie_probereq != NULL) {
3991 		memcpy(p, vap->iv_appie_probereq->ie_data,
3992 		    vap->iv_appie_probereq->ie_len);
3993 		p += vap->iv_appie_probereq->ie_len;
3994 	}
3995 	scan_ies->common_ies = pb;
3996 	scan_ies->common_ie_len = p - pb;
3997 
3998 	return (p);
3999 }
4000 
4001 static void
4002 lkpi_ic_scan_start(struct ieee80211com *ic)
4003 {
4004 	struct lkpi_hw *lhw;
4005 	struct ieee80211_hw *hw;
4006 	struct lkpi_vif *lvif;
4007 	struct ieee80211_vif *vif;
4008 	struct ieee80211_scan_state *ss;
4009 	struct ieee80211vap *vap;
4010 	int error;
4011 	bool is_hw_scan;
4012 
4013 	lhw = ic->ic_softc;
4014 	LKPI_80211_LHW_SCAN_LOCK(lhw);
4015 	if ((lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0) {
4016 		/* A scan is still running. */
4017 		LKPI_80211_LHW_SCAN_UNLOCK(lhw);
4018 		return;
4019 	}
4020 	is_hw_scan = (lhw->scan_flags & LKPI_LHW_SCAN_HW) != 0;
4021 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
4022 
4023 	ss = ic->ic_scan;
4024 	vap = ss->ss_vap;
4025 	if (vap->iv_state != IEEE80211_S_SCAN) {
4026 		IMPROVE("We need to be able to scan if not in S_SCAN");
4027 		return;
4028 	}
4029 
4030 	hw = LHW_TO_HW(lhw);
4031 	if (!is_hw_scan) {
4032 		/* If hw_scan is cleared clear FEXT_SCAN_OFFLOAD too. */
4033 		vap->iv_flags_ext &= ~IEEE80211_FEXT_SCAN_OFFLOAD;
4034 sw_scan:
4035 		lvif = VAP_TO_LVIF(vap);
4036 		vif = LVIF_TO_VIF(lvif);
4037 
4038 		if (vap->iv_state == IEEE80211_S_SCAN)
4039 			lkpi_hw_conf_idle(hw, false);
4040 
4041 		lkpi_80211_mo_sw_scan_start(hw, vif, vif->addr);
4042 		/* net80211::scan_start() handled PS for us. */
4043 		IMPROVE();
4044 		/* XXX Also means it is too late to flush queues?
4045 		 * need to check iv_sta_ps or overload? */
4046 		/* XXX want to adjust ss end time/ maxdwell? */
4047 
4048 	} else {
4049 		struct ieee80211_scan_request *hw_req;
4050 		struct linuxkpi_ieee80211_channel *lc, **cpp;
4051 		struct cfg80211_ssid *ssids;
4052 		struct cfg80211_scan_6ghz_params *s6gp;
4053 		size_t chan_len, nchan, ssids_len, s6ghzlen;
4054 		int band, i, ssid_count, common_ie_len;
4055 		uint32_t band_mask;
4056 		uint8_t *ie, *ieend;
4057 		bool running;
4058 
4059 		ssid_count = min(ss->ss_nssid, hw->wiphy->max_scan_ssids);
4060 		ssids_len = ssid_count * sizeof(*ssids);
4061 		s6ghzlen = 0 * (sizeof(*s6gp));			/* XXX-BZ */
4062 
4063 		band_mask = 0;
4064 		nchan = 0;
4065 		if (ieee80211_hw_check(hw, SINGLE_SCAN_ON_ALL_BANDS)) {
4066 #if 0	/* Avoid net80211 scan lists until it has proper scan offload support. */
4067 			for (i = ss->ss_next; i < ss->ss_last; i++) {
4068 				nchan++;
4069 				band = lkpi_net80211_chan_to_nl80211_band(
4070 				    ss->ss_chans[ss->ss_next + i]);
4071 				band_mask |= (1 << band);
4072 			}
4073 #else
4074 			/* Instead we scan for all channels all the time. */
4075 			for (band = 0; band < NUM_NL80211_BANDS; band++) {
4076 				switch (band) {
4077 				case NL80211_BAND_2GHZ:
4078 				case NL80211_BAND_5GHZ:
4079 					break;
4080 				default:
4081 					continue;
4082 				}
4083 				if (hw->wiphy->bands[band] != NULL) {
4084 					nchan += hw->wiphy->bands[band]->n_channels;
4085 					band_mask |= (1 << band);
4086 				}
4087 			}
4088 #endif
4089 		} else {
4090 			IMPROVE("individual band scans not yet supported, only scanning first band");
4091 			/* In theory net80211 should drive this. */
4092 			/* Probably we need to add local logic for now;
4093 			 * need to deal with scan_complete
4094 			 * and cancel_scan and keep local state.
4095 			 * Also cut the nchan down above.
4096 			 */
4097 			/* XXX-BZ ath10k does not set this but still does it? &$%^ */
4098 		}
4099 
4100 		chan_len = nchan * (sizeof(lc) + sizeof(*lc));
4101 
4102 		common_ie_len = 0;
4103 		if ((vap->iv_flags & IEEE80211_F_WPA1) != 0 &&
4104 		    vap->iv_wpa_ie != NULL)
4105 			common_ie_len += vap->iv_wpa_ie[1];
4106 		if (vap->iv_appie_probereq != NULL)
4107 			common_ie_len += vap->iv_appie_probereq->ie_len;
4108 
4109 		/* We would love to check this at an earlier stage... */
4110 		if (common_ie_len >  hw->wiphy->max_scan_ie_len) {
4111 			ic_printf(ic, "WARNING: %s: common_ie_len %d > "
4112 			    "wiphy->max_scan_ie_len %d\n", __func__,
4113 			    common_ie_len, hw->wiphy->max_scan_ie_len);
4114 		}
4115 
4116 		hw_req = malloc(sizeof(*hw_req) + ssids_len +
4117 		    s6ghzlen + chan_len + lhw->supbands * lhw->scan_ie_len +
4118 		    common_ie_len, M_LKPI80211, M_WAITOK | M_ZERO);
4119 
4120 		hw_req->req.flags = 0;			/* XXX ??? */
4121 		/* hw_req->req.wdev */
4122 		hw_req->req.wiphy = hw->wiphy;
4123 		hw_req->req.no_cck = false;		/* XXX */
4124 #if 0
4125 		/* This seems to pessimise default scanning behaviour. */
4126 		hw_req->req.duration_mandatory = TICKS_2_USEC(ss->ss_mindwell);
4127 		hw_req->req.duration = TICKS_2_USEC(ss->ss_maxdwell);
4128 #endif
4129 #ifdef __notyet__
4130 		hw_req->req.flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
4131 		memcpy(hw_req->req.mac_addr, xxx, IEEE80211_ADDR_LEN);
4132 		memset(hw_req->req.mac_addr_mask, 0xxx, IEEE80211_ADDR_LEN);
4133 #endif
4134 		eth_broadcast_addr(hw_req->req.bssid);
4135 
4136 		hw_req->req.n_channels = nchan;
4137 		cpp = (struct linuxkpi_ieee80211_channel **)(hw_req + 1);
4138 		lc = (struct linuxkpi_ieee80211_channel *)(cpp + nchan);
4139 		for (i = 0; i < nchan; i++) {
4140 			*(cpp + i) =
4141 			    (struct linuxkpi_ieee80211_channel *)(lc + i);
4142 		}
4143 #if 0	/* Avoid net80211 scan lists until it has proper scan offload support. */
4144 		for (i = 0; i < nchan; i++) {
4145 			struct ieee80211_channel *c;
4146 
4147 			c = ss->ss_chans[ss->ss_next + i];
4148 			lc->hw_value = c->ic_ieee;
4149 			lc->center_freq = c->ic_freq;	/* XXX */
4150 			/* lc->flags */
4151 			lc->band = lkpi_net80211_chan_to_nl80211_band(c);
4152 			lc->max_power = c->ic_maxpower;
4153 			/* lc-> ... */
4154 			lc++;
4155 		}
4156 #else
4157 		for (band = 0; band < NUM_NL80211_BANDS; band++) {
4158 			struct ieee80211_supported_band *supband;
4159 			struct linuxkpi_ieee80211_channel *channels;
4160 
4161 			/* Band disabled for scanning? */
4162 			if ((band_mask & (1 << band)) == 0)
4163 				continue;
4164 
4165 			/* Nothing to scan in band? */
4166 			supband = hw->wiphy->bands[band];
4167 			if (supband == NULL || supband->n_channels == 0)
4168 				continue;
4169 
4170 			channels = supband->channels;
4171 			for (i = 0; i < supband->n_channels; i++) {
4172 				*lc = channels[i];
4173 				lc++;
4174 			}
4175 		}
4176 #endif
4177 
4178 		hw_req->req.n_ssids = ssid_count;
4179 		if (hw_req->req.n_ssids > 0) {
4180 			ssids = (struct cfg80211_ssid *)lc;
4181 			hw_req->req.ssids = ssids;
4182 			for (i = 0; i < ssid_count; i++) {
4183 				ssids->ssid_len = ss->ss_ssid[i].len;
4184 				memcpy(ssids->ssid, ss->ss_ssid[i].ssid,
4185 				    ss->ss_ssid[i].len);
4186 				ssids++;
4187 			}
4188 			s6gp = (struct cfg80211_scan_6ghz_params *)ssids;
4189 		} else {
4190 			s6gp = (struct cfg80211_scan_6ghz_params *)lc;
4191 		}
4192 
4193 		/* 6GHz one day. */
4194 		hw_req->req.n_6ghz_params = 0;
4195 		hw_req->req.scan_6ghz_params = NULL;
4196 		hw_req->req.scan_6ghz = false;	/* Weird boolean; not what you think. */
4197 		/* s6gp->... */
4198 
4199 		ie = ieend = (uint8_t *)s6gp;
4200 		/* Copy per-band IEs, copy common IEs */
4201 		ieend = lkpi_scan_ies_add(ie, &hw_req->ies, band_mask, vap, hw);
4202 		hw_req->req.ie = ie;
4203 		hw_req->req.ie_len = ieend - ie;
4204 
4205 		lvif = VAP_TO_LVIF(vap);
4206 		vif = LVIF_TO_VIF(lvif);
4207 
4208 		LKPI_80211_LHW_SCAN_LOCK(lhw);
4209 		/* Re-check under lock. */
4210 		running = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
4211 		if (!running) {
4212 			KASSERT(lhw->hw_req == NULL, ("%s: ic %p lhw %p hw_req %p "
4213 			    "!= NULL\n", __func__, ic, lhw, lhw->hw_req));
4214 
4215 			lhw->scan_flags |= LKPI_LHW_SCAN_RUNNING;
4216 			lhw->hw_req = hw_req;
4217 		}
4218 		LKPI_80211_LHW_SCAN_UNLOCK(lhw);
4219 		if (running) {
4220 			free(hw_req, M_LKPI80211);
4221 			return;
4222 		}
4223 
4224 		error = lkpi_80211_mo_hw_scan(hw, vif, hw_req);
4225 		if (error != 0) {
4226 			ieee80211_cancel_scan(vap);
4227 
4228 			/*
4229 			 * ieee80211_scan_completed must be called in either
4230 			 * case of error or none.  So let the free happen there
4231 			 * and only there.
4232 			 * That would be fine in theory but in practice drivers
4233 			 * behave differently:
4234 			 * ath10k does not return hw_scan until after scan_complete
4235 			 *        and can then still return an error.
4236 			 * rtw88 can return 1 or -EBUSY without scan_complete
4237 			 * iwlwifi can return various errors before scan starts
4238 			 * ...
4239 			 * So we cannot rely on that behaviour and have to check
4240 			 * and balance between both code paths.
4241 			 */
4242 			LKPI_80211_LHW_SCAN_LOCK(lhw);
4243 			if ((lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0) {
4244 				free(lhw->hw_req, M_LKPI80211);
4245 				lhw->hw_req = NULL;
4246 				lhw->scan_flags &= ~LKPI_LHW_SCAN_RUNNING;
4247 			}
4248 			LKPI_80211_LHW_SCAN_UNLOCK(lhw);
4249 
4250 			/*
4251 			 * XXX-SIGH magic number.
4252 			 * rtw88 has a magic "return 1" if offloading scan is
4253 			 * not possible.  Fall back to sw scan in that case.
4254 			 */
4255 			if (error == 1) {
4256 				LKPI_80211_LHW_SCAN_LOCK(lhw);
4257 				lhw->scan_flags &= ~LKPI_LHW_SCAN_HW;
4258 				LKPI_80211_LHW_SCAN_UNLOCK(lhw);
4259 				/*
4260 				 * XXX If we clear this now and later a driver
4261 				 * thinks it * can do a hw_scan again, we will
4262 				 * currently not re-enable it?
4263 				 */
4264 				vap->iv_flags_ext &= ~IEEE80211_FEXT_SCAN_OFFLOAD;
4265 				ieee80211_start_scan(vap,
4266 				    IEEE80211_SCAN_ACTIVE |
4267 				    IEEE80211_SCAN_NOPICK |
4268 				    IEEE80211_SCAN_ONCE,
4269 				    IEEE80211_SCAN_FOREVER,
4270 				    ss->ss_mindwell ? ss->ss_mindwell : msecs_to_ticks(20),
4271 				    ss->ss_maxdwell ? ss->ss_maxdwell : msecs_to_ticks(200),
4272 				    vap->iv_des_nssid, vap->iv_des_ssid);
4273 				goto sw_scan;
4274 			}
4275 
4276 			ic_printf(ic, "ERROR: %s: hw_scan returned %d\n",
4277 			    __func__, error);
4278 		}
4279 	}
4280 }
4281 
4282 static void
4283 lkpi_ic_scan_end(struct ieee80211com *ic)
4284 {
4285 	struct lkpi_hw *lhw;
4286 	bool is_hw_scan;
4287 
4288 	lhw = ic->ic_softc;
4289 	LKPI_80211_LHW_SCAN_LOCK(lhw);
4290 	if ((lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) == 0) {
4291 		LKPI_80211_LHW_SCAN_UNLOCK(lhw);
4292 		return;
4293 	}
4294 	is_hw_scan = (lhw->scan_flags & LKPI_LHW_SCAN_HW) != 0;
4295 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
4296 
4297 	if (!is_hw_scan) {
4298 		struct ieee80211_scan_state *ss;
4299 		struct ieee80211vap *vap;
4300 		struct ieee80211_hw *hw;
4301 		struct lkpi_vif *lvif;
4302 		struct ieee80211_vif *vif;
4303 
4304 		ss = ic->ic_scan;
4305 		vap = ss->ss_vap;
4306 		hw = LHW_TO_HW(lhw);
4307 		lvif = VAP_TO_LVIF(vap);
4308 		vif = LVIF_TO_VIF(lvif);
4309 
4310 		lkpi_80211_mo_sw_scan_complete(hw, vif);
4311 
4312 		/* Send PS to stop buffering if n80211 does not for us? */
4313 
4314 		if (vap->iv_state == IEEE80211_S_SCAN)
4315 			lkpi_hw_conf_idle(hw, true);
4316 	}
4317 }
4318 
4319 static void
4320 lkpi_ic_scan_curchan(struct ieee80211_scan_state *ss,
4321     unsigned long maxdwell)
4322 {
4323 	struct lkpi_hw *lhw;
4324 	bool is_hw_scan;
4325 
4326 	lhw = ss->ss_ic->ic_softc;
4327 	LKPI_80211_LHW_SCAN_LOCK(lhw);
4328 	is_hw_scan = (lhw->scan_flags & LKPI_LHW_SCAN_HW) != 0;
4329 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
4330 	if (!is_hw_scan)
4331 		lhw->ic_scan_curchan(ss, maxdwell);
4332 }
4333 
4334 static void
4335 lkpi_ic_scan_mindwell(struct ieee80211_scan_state *ss)
4336 {
4337 	struct lkpi_hw *lhw;
4338 	bool is_hw_scan;
4339 
4340 	lhw = ss->ss_ic->ic_softc;
4341 	LKPI_80211_LHW_SCAN_LOCK(lhw);
4342 	is_hw_scan = (lhw->scan_flags & LKPI_LHW_SCAN_HW) != 0;
4343 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
4344 	if (!is_hw_scan)
4345 		lhw->ic_scan_mindwell(ss);
4346 }
4347 
4348 static void
4349 lkpi_ic_set_channel(struct ieee80211com *ic)
4350 {
4351 	struct lkpi_hw *lhw;
4352 	struct ieee80211_hw *hw;
4353 	struct ieee80211_channel *c;
4354 	struct linuxkpi_ieee80211_channel *chan;
4355 	int error;
4356 	bool hw_scan_running;
4357 
4358 	lhw = ic->ic_softc;
4359 
4360 	/* If we do not support (*config)() save us the work. */
4361 	if (lhw->ops->config == NULL)
4362 		return;
4363 
4364 	/* If we have a hw_scan running do not switch channels. */
4365 	LKPI_80211_LHW_SCAN_LOCK(lhw);
4366 	hw_scan_running =
4367 	    (lhw->scan_flags & (LKPI_LHW_SCAN_RUNNING|LKPI_LHW_SCAN_HW)) ==
4368 		(LKPI_LHW_SCAN_RUNNING|LKPI_LHW_SCAN_HW);
4369 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
4370 	if (hw_scan_running)
4371 		return;
4372 
4373 	c = ic->ic_curchan;
4374 	if (c == NULL || c == IEEE80211_CHAN_ANYC) {
4375 		ic_printf(ic, "%s: c %p ops->config %p\n", __func__,
4376 		    c, lhw->ops->config);
4377 		return;
4378 	}
4379 
4380 	chan = lkpi_find_lkpi80211_chan(lhw, c);
4381 	if (chan == NULL) {
4382 		ic_printf(ic, "%s: c %p chan %p\n", __func__,
4383 		    c, chan);
4384 		return;
4385 	}
4386 
4387 	/* XXX max power for scanning? */
4388 	IMPROVE();
4389 
4390 	hw = LHW_TO_HW(lhw);
4391 	cfg80211_chandef_create(&hw->conf.chandef, chan,
4392 #ifdef LKPI_80211_HT
4393 	    (ic->ic_flags_ht & IEEE80211_FHT_HT) ? NL80211_CHAN_HT20 :
4394 #endif
4395 	    NL80211_CHAN_NO_HT);
4396 
4397 	error = lkpi_80211_mo_config(hw, IEEE80211_CONF_CHANGE_CHANNEL);
4398 	if (error != 0 && error != EOPNOTSUPP) {
4399 		ic_printf(ic, "ERROR: %s: config %#0x returned %d\n",
4400 		    __func__, IEEE80211_CONF_CHANGE_CHANNEL, error);
4401 		/* XXX should we unroll to the previous chandef? */
4402 		IMPROVE();
4403 	} else {
4404 		/* Update radiotap channels as well. */
4405 		lhw->rtap_tx.wt_chan_freq = htole16(c->ic_freq);
4406 		lhw->rtap_tx.wt_chan_flags = htole16(c->ic_flags);
4407 		lhw->rtap_rx.wr_chan_freq = htole16(c->ic_freq);
4408 		lhw->rtap_rx.wr_chan_flags = htole16(c->ic_flags);
4409 	}
4410 
4411 	/* Currently PS is hard coded off! Not sure it belongs here. */
4412 	IMPROVE();
4413 	if (ieee80211_hw_check(hw, SUPPORTS_PS) &&
4414 	    (hw->conf.flags & IEEE80211_CONF_PS) != 0) {
4415 		hw->conf.flags &= ~IEEE80211_CONF_PS;
4416 		error = lkpi_80211_mo_config(hw, IEEE80211_CONF_CHANGE_PS);
4417 		if (error != 0 && error != EOPNOTSUPP)
4418 			ic_printf(ic, "ERROR: %s: config %#0x returned "
4419 			    "%d\n", __func__, IEEE80211_CONF_CHANGE_PS,
4420 			    error);
4421 	}
4422 }
4423 
4424 static struct ieee80211_node *
4425 lkpi_ic_node_alloc(struct ieee80211vap *vap,
4426     const uint8_t mac[IEEE80211_ADDR_LEN])
4427 {
4428 	struct ieee80211com *ic;
4429 	struct lkpi_hw *lhw;
4430 	struct ieee80211_node *ni;
4431 	struct ieee80211_hw *hw;
4432 	struct lkpi_sta *lsta;
4433 
4434 	ic = vap->iv_ic;
4435 	lhw = ic->ic_softc;
4436 
4437 	/* We keep allocations de-coupled so we can deal with the two worlds. */
4438 	if (lhw->ic_node_alloc == NULL)
4439 		return (NULL);
4440 
4441 	ni = lhw->ic_node_alloc(vap, mac);
4442 	if (ni == NULL)
4443 		return (NULL);
4444 
4445 	hw = LHW_TO_HW(lhw);
4446 	lsta = lkpi_lsta_alloc(vap, mac, hw, ni);
4447 	if (lsta == NULL) {
4448 		if (lhw->ic_node_free != NULL)
4449 			lhw->ic_node_free(ni);
4450 		return (NULL);
4451 	}
4452 
4453 	return (ni);
4454 }
4455 
4456 static int
4457 lkpi_ic_node_init(struct ieee80211_node *ni)
4458 {
4459 	struct ieee80211com *ic;
4460 	struct lkpi_hw *lhw;
4461 	int error;
4462 
4463 	ic = ni->ni_ic;
4464 	lhw = ic->ic_softc;
4465 
4466 	if (lhw->ic_node_init != NULL) {
4467 		error = lhw->ic_node_init(ni);
4468 		if (error != 0)
4469 			return (error);
4470 	}
4471 
4472 	/* XXX-BZ Sync other state over. */
4473 	IMPROVE();
4474 
4475 	return (0);
4476 }
4477 
4478 static void
4479 lkpi_ic_node_cleanup(struct ieee80211_node *ni)
4480 {
4481 	struct ieee80211com *ic;
4482 	struct lkpi_hw *lhw;
4483 
4484 	ic = ni->ni_ic;
4485 	lhw = ic->ic_softc;
4486 
4487 	/* XXX-BZ remove from driver, ... */
4488 	IMPROVE();
4489 
4490 	if (lhw->ic_node_cleanup != NULL)
4491 		lhw->ic_node_cleanup(ni);
4492 }
4493 
4494 static void
4495 lkpi_ic_node_free(struct ieee80211_node *ni)
4496 {
4497 	struct ieee80211com *ic;
4498 	struct lkpi_hw *lhw;
4499 	struct lkpi_sta *lsta;
4500 
4501 	ic = ni->ni_ic;
4502 	lhw = ic->ic_softc;
4503 	lsta = ni->ni_drv_data;
4504 
4505 	/* KASSERT lsta is not NULL here. Print ni/ni__refcnt. */
4506 
4507 	/*
4508 	 * Pass in the original ni just in case of error we could check that
4509 	 * it is the same as lsta->ni.
4510 	 */
4511 	lkpi_lsta_free(lsta, ni);
4512 
4513 	if (lhw->ic_node_free != NULL)
4514 		lhw->ic_node_free(ni);
4515 }
4516 
4517 static int
4518 lkpi_ic_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
4519         const struct ieee80211_bpf_params *params __unused)
4520 {
4521 	struct lkpi_sta *lsta;
4522 
4523 	lsta = ni->ni_drv_data;
4524 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
4525 #if 0
4526 	if (!lsta->added_to_drv || !lsta->txq_ready) {
4527 #else
4528 	/*
4529 	 * Backout this part of 886653492945f which breaks rtw88 or
4530 	 * in general drivers without (*sta_state)() but only the
4531 	 * legacy fallback to (*sta_add)().
4532 	 */
4533 	if (!lsta->txq_ready) {
4534 #endif
4535 		LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
4536 		/*
4537 		 * Free the mbuf (do NOT release ni ref for the m_pkthdr.rcvif!
4538 		 * ieee80211_raw_output() does that in case of error).
4539 		 */
4540 		m_free(m);
4541 		return (ENETDOWN);
4542 	}
4543 
4544 	/* Queue the packet and enqueue the task to handle it. */
4545 	mbufq_enqueue(&lsta->txq, m);
4546 	taskqueue_enqueue(taskqueue_thread, &lsta->txq_task);
4547 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
4548 
4549 #ifdef LINUXKPI_DEBUG_80211
4550 	if (linuxkpi_debug_80211 & D80211_TRACE_TX)
4551 		printf("%s:%d lsta %p ni %p %6D mbuf_qlen %d\n",
4552 		    __func__, __LINE__, lsta, ni, ni->ni_macaddr, ":",
4553 		    mbufq_len(&lsta->txq));
4554 #endif
4555 
4556 	return (0);
4557 }
4558 
4559 #ifdef LKPI_80211_HW_CRYPTO
4560 static int
4561 lkpi_hw_crypto_prepare(struct lkpi_sta *lsta, struct ieee80211_key *k,
4562     struct sk_buff *skb)
4563 {
4564 	struct ieee80211_tx_info *info;
4565 	struct ieee80211_key_conf *kc;
4566 	struct ieee80211_hdr *hdr;
4567 	uint32_t hlen, hdrlen;
4568 	uint8_t *p;
4569 
4570 	KASSERT(lsta != NULL, ("%s: lsta is NULL", __func__));
4571 	KASSERT(k != NULL, ("%s: key is NULL", __func__));
4572 	KASSERT(skb != NULL, ("%s: skb is NULL", __func__));
4573 
4574 	kc = lsta->kc[k->wk_keyix];
4575 
4576 	info = IEEE80211_SKB_CB(skb);
4577 	info->control.hw_key = kc;
4578 
4579 	/* MUST NOT happen. KASSERT? */
4580 	if (kc == NULL) {
4581 		ic_printf(lsta->ni->ni_ic, "%s: lsta %p k %p skb %p, "
4582 		    "kc is NULL on hw crypto offload\n", __func__, lsta, k, skb);
4583 		return (ENXIO);
4584 	}
4585 
4586 
4587 	IMPROVE("the following should be WLAN_CIPHER_SUITE specific");
4588 	/* We currently only support CCMP so we hardcode things here. */
4589 
4590 	hdr = (void *)skb->data;
4591 
4592 	/*
4593 	 * Check if we have anythig to do as requested by driver
4594 	 * or if we are done?
4595 	 */
4596 	if ((kc->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) == 0 &&
4597 	    (kc->flags & IEEE80211_KEY_FLAG_GENERATE_IV) == 0 &&
4598 	    /* MFP */
4599 	    !((kc->flags & IEEE80211_KEY_FLAG_GENERATE_IV_MGMT) != 0 &&
4600 		ieee80211_is_mgmt(hdr->frame_control)))
4601 			return (0);
4602 
4603 	hlen = k->wk_cipher->ic_header;
4604 	if (skb_headroom(skb) < hlen)
4605 		return (ENOSPC);
4606 
4607 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
4608 	p = skb_push(skb, hlen);
4609 	memmove(p, p + hlen, hdrlen);
4610 
4611 	/* If driver request space only we are done. */
4612 	if ((kc->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) != 0)
4613 		return (0);
4614 
4615 	p += hdrlen;
4616 	k->wk_cipher->ic_setiv(k, p);
4617 
4618 	return (0);
4619 }
4620 #endif
4621 
4622 static void
4623 lkpi_80211_txq_tx_one(struct lkpi_sta *lsta, struct mbuf *m)
4624 {
4625 	struct ieee80211_node *ni;
4626 	struct ieee80211_frame *wh;
4627 	struct ieee80211_key *k;
4628 	struct sk_buff *skb;
4629 	struct ieee80211com *ic;
4630 	struct lkpi_hw *lhw;
4631 	struct ieee80211_hw *hw;
4632 	struct lkpi_vif *lvif;
4633 	struct ieee80211_vif *vif;
4634 	struct ieee80211_channel *c;
4635 	struct ieee80211_tx_control control;
4636 	struct ieee80211_tx_info *info;
4637 	struct ieee80211_sta *sta;
4638 	struct ieee80211_hdr *hdr;
4639 	struct lkpi_txq *ltxq;
4640 	void *buf;
4641 	ieee80211_keyix keyix;
4642 	uint8_t ac, tid;
4643 
4644 	M_ASSERTPKTHDR(m);
4645 #ifdef LINUXKPI_DEBUG_80211
4646 	if (linuxkpi_debug_80211 & D80211_TRACE_TX_DUMP)
4647 		hexdump(mtod(m, const void *), m->m_len, "RAW TX (plain) ", 0);
4648 #endif
4649 
4650 	ni = lsta->ni;
4651 	k = NULL;
4652 	keyix = IEEE80211_KEYIX_NONE;
4653 	wh = mtod(m, struct ieee80211_frame *);
4654 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
4655 
4656 #ifdef LKPI_80211_HW_CRYPTO
4657 		if (lkpi_hwcrypto) {
4658 			k = ieee80211_crypto_get_txkey(ni, m);
4659 			if (k != NULL && lsta->kc[k->wk_keyix] != NULL)
4660 				keyix = k->wk_keyix;
4661 		}
4662 #endif
4663 
4664 		/* Encrypt the frame if need be. */
4665 		if (keyix == IEEE80211_KEYIX_NONE) {
4666 			/* Retrieve key for TX && do software encryption. */
4667 			k = ieee80211_crypto_encap(ni, m);
4668 			if (k == NULL) {
4669 				ieee80211_free_node(ni);
4670 				m_freem(m);
4671 				return;
4672 			}
4673 		}
4674 	}
4675 
4676 	ic = ni->ni_ic;
4677 	lhw = ic->ic_softc;
4678 	hw = LHW_TO_HW(lhw);
4679 	c = ni->ni_chan;
4680 
4681 	if (ieee80211_radiotap_active_vap(ni->ni_vap)) {
4682 		struct lkpi_radiotap_tx_hdr *rtap;
4683 
4684 		rtap = &lhw->rtap_tx;
4685 		rtap->wt_flags = 0;
4686 		if (k != NULL)
4687 			rtap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
4688 		if (m->m_flags & M_FRAG)
4689 			rtap->wt_flags |= IEEE80211_RADIOTAP_F_FRAG;
4690 		IMPROVE();
4691 		rtap->wt_rate = 0;
4692 		if (c != NULL && c != IEEE80211_CHAN_ANYC) {
4693 			rtap->wt_chan_freq = htole16(c->ic_freq);
4694 			rtap->wt_chan_flags = htole16(c->ic_flags);
4695 		}
4696 
4697 		ieee80211_radiotap_tx(ni->ni_vap, m);
4698 	}
4699 
4700 	/*
4701 	 * net80211 should handle hw->extra_tx_headroom.
4702 	 * Though for as long as we are copying we don't mind.
4703 	 * XXX-BZ rtw88 asks for too much headroom for ipv6+tcp:
4704 	 * https://lists.freebsd.org/archives/freebsd-transport/2022-February/000012.html
4705 	 */
4706 	skb = dev_alloc_skb(hw->extra_tx_headroom + m->m_pkthdr.len);
4707 	if (skb == NULL) {
4708 		static uint8_t skb_alloc_failures = 0;
4709 
4710 		if (skb_alloc_failures++ == 0) {
4711 			int tid;
4712 
4713 			sta = LSTA_TO_STA(lsta);
4714 			ic_printf(ic, "ERROR %s: skb alloc failed %d + %d, lsta %p sta %p ni %p\n",
4715 			    __func__, hw->extra_tx_headroom, m->m_pkthdr.len, lsta, sta, ni);
4716 			for (tid = 0; tid < nitems(sta->txq); tid++) {
4717 				if (sta->txq[tid] == NULL)
4718 					continue;
4719 				ltxq = TXQ_TO_LTXQ(sta->txq[tid]);
4720 				ic_printf(ic, "  tid %d ltxq %p seen_dequeue %d stopped %d skb_queue_len %u\n",
4721 				    tid, ltxq, ltxq->seen_dequeue, ltxq->stopped, skb_queue_len(&ltxq->skbq));
4722 			}
4723 		}
4724 		ieee80211_free_node(ni);
4725 		m_freem(m);
4726 		return;
4727 	}
4728 	skb_reserve(skb, hw->extra_tx_headroom);
4729 
4730 	/* XXX-BZ we need a SKB version understanding mbuf. */
4731 	/* Save the mbuf for ieee80211_tx_complete(). */
4732 	skb->m_free_func = lkpi_ieee80211_free_skb_mbuf;
4733 	skb->m = m;
4734 #if 0
4735 	skb_put_data(skb, m->m_data, m->m_pkthdr.len);
4736 #else
4737 	buf = skb_put(skb, m->m_pkthdr.len);
4738 	m_copydata(m, 0, m->m_pkthdr.len, buf);
4739 #endif
4740 	/* Save the ni. */
4741 	m->m_pkthdr.PH_loc.ptr = ni;
4742 
4743 	lvif = VAP_TO_LVIF(ni->ni_vap);
4744 	vif = LVIF_TO_VIF(lvif);
4745 
4746 	hdr = (void *)skb->data;
4747 	tid = linuxkpi_ieee80211_get_tid(hdr, true);
4748 	if (tid == IEEE80211_NONQOS_TID) { /* == IEEE80211_NUM_TIDS */
4749 		if (!ieee80211_is_data(hdr->frame_control)) {
4750 			/* MGMT and CTRL frames go on TID 7/VO. */
4751 			skb->priority = 7;
4752 			ac = IEEE80211_AC_VO;
4753 		} else {
4754 			/* Other non-QOS traffic goes to BE. */
4755 			/* Contrary to net80211 we MUST NOT promote M_EAPOL. */
4756 			skb->priority = 0;
4757 			ac = IEEE80211_AC_BE;
4758 		}
4759 	} else {
4760 		skb->priority = tid & IEEE80211_QOS_CTL_TID_MASK;
4761 		ac = ieee80211e_up_to_ac[tid & 7];
4762 	}
4763 	skb_set_queue_mapping(skb, ac);
4764 
4765 	info = IEEE80211_SKB_CB(skb);
4766 	info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
4767 	/* Slight delay; probably only happens on scanning so fine? */
4768 	if (c == NULL || c == IEEE80211_CHAN_ANYC)
4769 		c = ic->ic_curchan;
4770 	info->band = lkpi_net80211_chan_to_nl80211_band(c);
4771 	info->hw_queue = vif->hw_queue[ac];
4772 	if (m->m_flags & M_EAPOL)
4773 		info->control.flags |= IEEE80211_TX_CTRL_PORT_CTRL_PROTO;
4774 	info->control.vif = vif;
4775 	/* XXX-BZ info->control.rates */
4776 #ifdef __notyet__
4777 #ifdef LKPI_80211_HT
4778 	info->control.rts_cts_rate_idx=
4779 	info->control.use_rts= /* RTS */
4780 	info->control.use_cts_prot= /* RTS/CTS*/
4781 #endif
4782 #endif
4783 
4784 	sta = LSTA_TO_STA(lsta);
4785 #ifdef LKPI_80211_HW_CRYPTO
4786 	if (lkpi_hwcrypto && keyix != IEEE80211_KEYIX_NONE) {
4787 		int error;
4788 
4789 		error = lkpi_hw_crypto_prepare(lsta, k, skb);
4790 		if (error != 0) {
4791 			/*
4792 			 * We only have to free the skb which will free the
4793 			 * mbuf and release the reference on the ni.
4794 			 */
4795 			dev_kfree_skb(skb);
4796 			return;
4797 		}
4798 	}
4799 #endif
4800 
4801 	IMPROVE();
4802 
4803 	ltxq = NULL;
4804 	if (!ieee80211_is_data_present(hdr->frame_control)) {
4805 		if (vif->type == NL80211_IFTYPE_STATION &&
4806 		    lsta->added_to_drv &&
4807 		    sta->txq[IEEE80211_NUM_TIDS] != NULL)
4808 			ltxq = TXQ_TO_LTXQ(sta->txq[IEEE80211_NUM_TIDS]);
4809 	} else if (lsta->added_to_drv &&
4810 	    sta->txq[skb->priority] != NULL) {
4811 		ltxq = TXQ_TO_LTXQ(sta->txq[skb->priority]);
4812 	}
4813 	if (ltxq == NULL)
4814 		goto ops_tx;
4815 
4816 	KASSERT(ltxq != NULL, ("%s: lsta %p sta %p m %p skb %p "
4817 	    "ltxq %p != NULL\n", __func__, lsta, sta, m, skb, ltxq));
4818 
4819 	LKPI_80211_LTXQ_LOCK(ltxq);
4820 	skb_queue_tail(&ltxq->skbq, skb);
4821 #ifdef LINUXKPI_DEBUG_80211
4822 	if (linuxkpi_debug_80211 & D80211_TRACE_TX)
4823 		printf("%s:%d mo_wake_tx_queue :: %d %u lsta %p sta %p "
4824 		    "ni %p %6D skb %p lxtq %p { qlen %u, ac %d tid %u } "
4825 		    "WAKE_TX_Q ac %d prio %u qmap %u\n",
4826 		    __func__, __LINE__,
4827 		    curthread->td_tid, (unsigned int)ticks,
4828 		    lsta, sta, ni, ni->ni_macaddr, ":", skb, ltxq,
4829 		    skb_queue_len(&ltxq->skbq), ltxq->txq.ac,
4830 		    ltxq->txq.tid, ac, skb->priority, skb->qmap);
4831 #endif
4832 	LKPI_80211_LTXQ_UNLOCK(ltxq);
4833 	wiphy_lock(hw->wiphy);
4834 	lkpi_80211_mo_wake_tx_queue(hw, &ltxq->txq);
4835 	wiphy_unlock(hw->wiphy);
4836 	return;
4837 
4838 ops_tx:
4839 #ifdef LINUXKPI_DEBUG_80211
4840 	if (linuxkpi_debug_80211 & D80211_TRACE_TX)
4841 		printf("%s:%d mo_tx :: lsta %p sta %p ni %p %6D skb %p "
4842 		    "TX ac %d prio %u qmap %u\n",
4843 		    __func__, __LINE__, lsta, sta, ni, ni->ni_macaddr, ":",
4844 		    skb, ac, skb->priority, skb->qmap);
4845 #endif
4846 	memset(&control, 0, sizeof(control));
4847 	control.sta = sta;
4848 	wiphy_lock(hw->wiphy);
4849 	lkpi_80211_mo_tx(hw, &control, skb);
4850 	wiphy_unlock(hw->wiphy);
4851 }
4852 
4853 static void
4854 lkpi_80211_txq_task(void *ctx, int pending)
4855 {
4856 	struct lkpi_sta *lsta;
4857 	struct mbufq mq;
4858 	struct mbuf *m;
4859 	bool shall_tx;
4860 
4861 	lsta = ctx;
4862 
4863 #ifdef LINUXKPI_DEBUG_80211
4864 	if (linuxkpi_debug_80211 & D80211_TRACE_TX)
4865 		printf("%s:%d lsta %p ni %p %6D pending %d mbuf_qlen %d\n",
4866 		    __func__, __LINE__, lsta, lsta->ni, lsta->ni->ni_macaddr, ":",
4867 		    pending, mbufq_len(&lsta->txq));
4868 #endif
4869 
4870 	mbufq_init(&mq, IFQ_MAXLEN);
4871 
4872 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
4873 	/*
4874 	 * Do not re-check lsta->txq_ready here; we may have a pending
4875 	 * disassoc/deauth frame still.  On the contrary if txq_ready is
4876 	 * false we do not have a valid sta anymore in the firmware so no
4877 	 * point to try to TX.
4878 	 * We also use txq_ready as a semaphore and will drain the txq manually
4879 	 * if needed on our way towards SCAN/INIT in the state machine.
4880 	 */
4881 #if 0
4882 	shall_tx = lsta->added_to_drv && lsta->txq_ready;
4883 #else
4884 	/*
4885 	 * Backout this part of 886653492945f which breaks rtw88 or
4886 	 * in general drivers without (*sta_state)() but only the
4887 	 * legacy fallback to (*sta_add)().
4888 	 */
4889 	shall_tx = lsta->txq_ready;
4890 #endif
4891 	if (__predict_true(shall_tx))
4892 		mbufq_concat(&mq, &lsta->txq);
4893 	/*
4894 	 * else a state change will push the packets out manually or
4895 	 * lkpi_lsta_free() will drain the lsta->txq and free the mbufs.
4896 	 */
4897 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
4898 
4899 	m = mbufq_dequeue(&mq);
4900 	while (m != NULL) {
4901 		lkpi_80211_txq_tx_one(lsta, m);
4902 		m = mbufq_dequeue(&mq);
4903 	}
4904 }
4905 
4906 static int
4907 lkpi_ic_transmit(struct ieee80211com *ic, struct mbuf *m)
4908 {
4909 
4910 	/* XXX TODO */
4911 	IMPROVE();
4912 
4913 	/* Quick and dirty cheating hack. */
4914 	struct ieee80211_node *ni;
4915 
4916 	ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
4917 	return (lkpi_ic_raw_xmit(ni, m, NULL));
4918 }
4919 
4920 #ifdef LKPI_80211_HT
4921 static int
4922 lkpi_ic_recv_action(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
4923     const uint8_t *frm, const uint8_t *efrm)
4924 {
4925 	struct ieee80211com *ic;
4926 	struct lkpi_hw *lhw;
4927 
4928 	ic = ni->ni_ic;
4929 	lhw = ic->ic_softc;
4930 
4931 	IMPROVE_HT("recv_action called; nothing to do in lkpi; make debugging");
4932 
4933 	return (lhw->ic_recv_action(ni, wh, frm, efrm));
4934 }
4935 
4936 static int
4937 lkpi_ic_send_action(struct ieee80211_node *ni, int category, int action, void *sa)
4938 {
4939 	struct ieee80211com *ic;
4940 	struct lkpi_hw *lhw;
4941 
4942 	ic = ni->ni_ic;
4943 	lhw = ic->ic_softc;
4944 
4945 	IMPROVE_HT("send_action called; nothing to do in lkpi; make debugging");
4946 
4947 	return (lhw->ic_send_action(ni, category, action, sa));
4948 }
4949 
4950 
4951 static int
4952 lkpi_ic_ampdu_enable(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
4953 {
4954 	struct ieee80211com *ic;
4955 	struct lkpi_hw *lhw;
4956 
4957 	ic = ni->ni_ic;
4958 	lhw = ic->ic_softc;
4959 
4960 	IMPROVE_HT("ieee80211_ampdu_enable called; nothing to do in lkpi for now; make debugging");
4961 
4962 	return (lhw->ic_ampdu_enable(ni, tap));
4963 }
4964 
4965 /*
4966  * (*ic_addba_request)() is called by ieee80211_ampdu_request() before
4967  * calling send_action(CAT_BA, BA_ADDBA_REQUEST).
4968  *
4969  * NB: returns 0 on ERROR!
4970  */
4971 static int
4972 lkpi_ic_addba_request(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap,
4973     int dialogtoken, int baparamset, int batimeout)
4974 {
4975 	struct ieee80211com *ic;
4976 	struct lkpi_hw *lhw;
4977 	struct ieee80211_hw *hw;
4978 	struct ieee80211vap *vap;
4979 	struct lkpi_vif *lvif;
4980 	struct ieee80211_vif *vif;
4981 	struct lkpi_sta *lsta;
4982 	struct ieee80211_sta *sta;
4983 	struct ieee80211_ampdu_params params = { };
4984 	int error;
4985 
4986 	ic = ni->ni_ic;
4987 	lhw = ic->ic_softc;
4988 	hw = LHW_TO_HW(lhw);
4989 	vap = ni->ni_vap;
4990 	lvif = VAP_TO_LVIF(vap);
4991 	vif = LVIF_TO_VIF(lvif);
4992 	lsta = ni->ni_drv_data;
4993 	sta = LSTA_TO_STA(lsta);
4994 
4995 	if (!lsta->added_to_drv) {
4996 		ic_printf(ic, "%s: lsta %p ni %p, sta %p not added to firmware\n",
4997 		    __func__, lsta, ni, sta);
4998 		return (0);
4999 	}
5000 
5001 	params.sta = sta;
5002 	params.action = IEEE80211_AMPDU_TX_START;
5003 	/* Keep 0 here! */
5004 	params.buf_size = 0;
5005 	params.timeout = 0;
5006 	params.ssn = tap->txa_start & (IEEE80211_SEQ_RANGE-1);
5007 	params.tid = tap->txa_tid;
5008 	params.amsdu = false;
5009 
5010 	IEEE80211_UNLOCK(ic);
5011 	wiphy_lock(hw->wiphy);
5012 	error = lkpi_80211_mo_ampdu_action(hw, vif, &params);
5013 	wiphy_unlock(hw->wiphy);
5014 	IEEE80211_LOCK(ic);
5015 	if (error != 0) {
5016 		ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p tap %p\n",
5017 		    __func__, error, ni, tap);
5018 		return (0);
5019 	}
5020 
5021 	return (lhw->ic_addba_request(ni, tap, dialogtoken, baparamset, batimeout));
5022 }
5023 
5024 /*
5025  * (*ic_addba_response)() is called from ht_recv_action_ba_addba_response()
5026  * and calls the default ieee80211_addba_response() which always returns 1.
5027  *
5028  * NB: No error checking in net80211!
5029  * Staying with 0 is an error.
5030  */
5031 static int
5032 lkpi_ic_addba_response(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap,
5033     int status, int baparamset, int batimeout)
5034 {
5035 	struct ieee80211com *ic;
5036 	struct lkpi_hw *lhw;
5037 	struct ieee80211_hw *hw;
5038 	struct ieee80211vap *vap;
5039 	struct lkpi_vif *lvif;
5040 	struct ieee80211_vif *vif;
5041 	struct lkpi_sta *lsta;
5042 	struct ieee80211_sta *sta;
5043 	struct ieee80211_ampdu_params params = { };
5044 	int error;
5045 
5046 	ic = ni->ni_ic;
5047 	lhw = ic->ic_softc;
5048 	hw = LHW_TO_HW(lhw);
5049 	vap = ni->ni_vap;
5050 	lvif = VAP_TO_LVIF(vap);
5051 	vif = LVIF_TO_VIF(lvif);
5052 	lsta = ni->ni_drv_data;
5053 	sta = LSTA_TO_STA(lsta);
5054 
5055 	if (!lsta->added_to_drv) {
5056 		ic_printf(ic, "%s: lsta %p ni %p, sta %p not added to firmware\n",
5057 		    __func__, lsta, ni, sta);
5058 		return (0);
5059 	}
5060 
5061 	if (status == IEEE80211_STATUS_SUCCESS) {
5062 		params.sta = sta;
5063 		params.action = IEEE80211_AMPDU_TX_OPERATIONAL;
5064 		params.buf_size = tap->txa_wnd;
5065 		params.timeout = 0;
5066 		params.ssn = 0;
5067 		params.tid = tap->txa_tid;
5068 		if ((tap->txa_flags & IEEE80211_AGGR_AMSDU) != 0)
5069 			params.amsdu = true;
5070 		else
5071 			params.amsdu = false;
5072 	} else {
5073 		/* We need to free the allocated resources. */
5074 		params.sta = sta;
5075 		switch (status) {
5076 			/* params.action = FLUSH, FLUSH_CONT */
5077 		default:
5078 			params.action = IEEE80211_AMPDU_TX_STOP_CONT;
5079 			break;
5080 		}
5081 		params.buf_size = 0;
5082 		params.timeout = 0;
5083 		params.ssn = 0;
5084 		params.tid = tap->txa_tid;
5085 		params.amsdu = false;
5086 	}
5087 
5088 	IEEE80211_UNLOCK(ic);
5089 	wiphy_lock(hw->wiphy);
5090 	error = lkpi_80211_mo_ampdu_action(hw, vif, &params);
5091 	wiphy_unlock(hw->wiphy);
5092 	IEEE80211_LOCK(ic);
5093 	if (error != 0) {
5094 		ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p tap %p\n",
5095 		    __func__, error, ni, tap);
5096 		return (0);
5097 	}
5098 
5099 	IMPROVE_HT("who unleashes the TXQ? and when?, do we need to ni->ni_txseqs[tid] = tap->txa_start & 0xfff;");
5100 
5101 	return (lhw->ic_addba_response(ni, tap, status, baparamset, batimeout));
5102 }
5103 
5104 /*
5105  * (*ic_addba_stop)() is called from ampdu_tx_stop(), ht_recv_action_ba_delba(),
5106  * and ieee80211_ampdu_stop() and calls the default ieee80211_addba_stop().
5107  */
5108 static void
5109 lkpi_ic_addba_stop(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
5110 {
5111 	struct ieee80211com *ic;
5112 	struct lkpi_hw *lhw;
5113 	struct ieee80211_hw *hw;
5114 	struct ieee80211vap *vap;
5115 	struct lkpi_vif *lvif;
5116 	struct ieee80211_vif *vif;
5117 	struct lkpi_sta *lsta;
5118 	struct ieee80211_sta *sta;
5119 	struct ieee80211_ampdu_params params = { };
5120 	int error;
5121 
5122 	ic = ni->ni_ic;
5123 	lhw = ic->ic_softc;
5124 	hw = LHW_TO_HW(lhw);
5125 	vap = ni->ni_vap;
5126 	lvif = VAP_TO_LVIF(vap);
5127 	vif = LVIF_TO_VIF(lvif);
5128 	lsta = ni->ni_drv_data;
5129 	sta = LSTA_TO_STA(lsta);
5130 
5131 	if (!lsta->added_to_drv) {
5132 		ic_printf(ic, "%s: lsta %p ni %p, sta %p not added to firmware\n",
5133 		    __func__, lsta, ni, sta);
5134 		goto n80211;
5135 	}
5136 
5137 	/* We need to free the allocated resources. */
5138 	params.sta = sta;
5139 	IMPROVE("net80211 does not provide a reason to us");
5140 	params.action = IEEE80211_AMPDU_TX_STOP_CONT; /* params.action = FLUSH, FLUSH_CONT */
5141 	params.buf_size = 0;
5142 	params.timeout = 0;
5143 	params.ssn = 0;
5144 	params.tid = tap->txa_tid;
5145 	params.amsdu = false;
5146 
5147 	IEEE80211_UNLOCK(ic);
5148 	wiphy_lock(hw->wiphy);
5149 	error = lkpi_80211_mo_ampdu_action(hw, vif, &params);
5150 	wiphy_unlock(hw->wiphy);
5151 	IEEE80211_LOCK(ic);
5152 	if (error != 0) {
5153 		ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p tap %p\n",
5154 		    __func__, error, ni, tap);
5155 		goto n80211;
5156 	}
5157 
5158 	IMPROVE_HT("anyting else?");
5159 
5160 n80211:
5161 	lhw->ic_addba_stop(ni, tap);
5162 }
5163 
5164 static void
5165 lkpi_ic_addba_response_timeout(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
5166 {
5167 	struct ieee80211com *ic;
5168 	struct lkpi_hw *lhw;
5169 
5170 	ic = ni->ni_ic;
5171 	lhw = ic->ic_softc;
5172 
5173 	IMPROVE_HT();
5174 
5175 	lhw->ic_addba_response_timeout(ni, tap);
5176 }
5177 
5178 static void
5179 lkpi_ic_bar_response(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap,
5180     int status)
5181 {
5182 	struct ieee80211com *ic;
5183 	struct lkpi_hw *lhw;
5184 
5185 	ic = ni->ni_ic;
5186 	lhw = ic->ic_softc;
5187 
5188 	IMPROVE_HT();
5189 
5190 	lhw->ic_bar_response(ni, tap, status);
5191 }
5192 
5193 static int
5194 lkpi_ic_ampdu_rx_start(struct ieee80211_node *ni, struct ieee80211_rx_ampdu *rap,
5195     int baparamset, int batimeout, int baseqctl)
5196 {
5197 	struct ieee80211com *ic;
5198 	struct lkpi_hw *lhw;
5199 	struct ieee80211_hw *hw;
5200 	struct ieee80211vap *vap;
5201 	struct lkpi_vif *lvif;
5202 	struct ieee80211_vif *vif;
5203 	struct lkpi_sta *lsta;
5204 	struct ieee80211_sta *sta;
5205 	struct ieee80211_ampdu_params params = { };
5206 	int error;
5207 
5208 	ic = ni->ni_ic;
5209 	lhw = ic->ic_softc;
5210 	hw = LHW_TO_HW(lhw);
5211 	vap = ni->ni_vap;
5212 	lvif = VAP_TO_LVIF(vap);
5213 	vif = LVIF_TO_VIF(lvif);
5214 	lsta = ni->ni_drv_data;
5215 	sta = LSTA_TO_STA(lsta);
5216 
5217 	IEEE80211_UNLOCK_ASSERT(ic);
5218 
5219 	if (!lsta->added_to_drv) {
5220 		ic_printf(ic, "%s: lsta %p ni %p vap %p, sta %p not added to firmware\n",
5221 		    __func__, lsta, ni, vap, sta);
5222 		return (-ENXIO);
5223 	}
5224 
5225 	params.sta = sta;
5226 	params.action = IEEE80211_AMPDU_RX_START;
5227 	params.buf_size = _IEEE80211_MASKSHIFT(le16toh(baparamset), IEEE80211_BAPS_BUFSIZ);
5228 	if (params.buf_size == 0)
5229 		params.buf_size = IEEE80211_MAX_AMPDU_BUF_HT;
5230 	else
5231 		params.buf_size = min(params.buf_size, IEEE80211_MAX_AMPDU_BUF_HT);
5232 	if (hw->max_rx_aggregation_subframes > 0 &&
5233 	    params.buf_size > hw->max_rx_aggregation_subframes)
5234 		params.buf_size = hw->max_rx_aggregation_subframes;
5235 	params.timeout = le16toh(batimeout);
5236 	params.ssn = _IEEE80211_MASKSHIFT(le16toh(baseqctl), IEEE80211_BASEQ_START);
5237 	params.tid = _IEEE80211_MASKSHIFT(le16toh(baparamset), IEEE80211_BAPS_TID);
5238 
5239 	/* Based on net80211::ampdu_rx_start(). */
5240 	if ((vap->iv_htcaps & IEEE80211_HTC_RX_AMSDU_AMPDU) &&
5241 	    (_IEEE80211_MASKSHIFT(baparamset, IEEE80211_BAPS_AMSDU)))
5242 		params.amsdu = true;
5243 	else
5244 		params.amsdu = false;
5245 
5246 	wiphy_lock(hw->wiphy);
5247 	error = lkpi_80211_mo_ampdu_action(hw, vif, &params);
5248 	wiphy_unlock(hw->wiphy);
5249 	if (error != 0) {
5250 		ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p rap %p\n",
5251 		    __func__, error, ni, rap);
5252 		return (error);
5253 	}
5254 
5255 	if (!ieee80211_hw_check(hw, SUPPORTS_REORDERING_BUFFER)) {
5256 		IMPROVE("%s: TODO: SUPPORTS_REORDERING_BUFFER not set; check net80211\n", __func__);
5257 	}
5258 
5259 	IMPROVE_HT("net80211 is missing the error check on return and assumes success");
5260 
5261 	error = lhw->ic_ampdu_rx_start(ni, rap, baparamset, batimeout, baseqctl);
5262 	return (error);
5263 }
5264 
5265 static void
5266 lkpi_ic_ampdu_rx_stop(struct ieee80211_node *ni, struct ieee80211_rx_ampdu *rap)
5267 {
5268 	struct ieee80211com *ic;
5269 	struct lkpi_hw *lhw;
5270 	struct ieee80211_hw *hw;
5271 	struct ieee80211vap *vap;
5272 	struct lkpi_vif *lvif;
5273 	struct ieee80211_vif *vif;
5274 	struct lkpi_sta *lsta;
5275 	struct ieee80211_sta *sta;
5276 	struct ieee80211_ampdu_params params = { };
5277 	int error;
5278 	uint8_t tid;
5279 	bool ic_locked;
5280 
5281 	ic = ni->ni_ic;
5282 	lhw = ic->ic_softc;
5283 
5284 	/*
5285 	 * We should not (cannot) call into mac80211 ops with AMPDU_RX_STOP if
5286 	 * we did not START.  Some drivers pass it down to firmware which will
5287 	 * simply barf and net80211 calls ieee80211_ht_node_cleanup() from
5288 	 * ieee80211_ht_node_init() amongst others which will iterate over all
5289 	 * tid and call ic_ampdu_rx_stop() unconditionally.
5290 	 * XXX net80211 should probably be more "gentle" in these cases and
5291 	 * track some state itself.
5292 	 */
5293 	if ((rap->rxa_flags & IEEE80211_AGGR_RUNNING) == 0)
5294 		goto net80211_only;
5295 
5296 	hw = LHW_TO_HW(lhw);
5297 	vap = ni->ni_vap;
5298 	lvif = VAP_TO_LVIF(vap);
5299 	vif = LVIF_TO_VIF(lvif);
5300 	lsta = ni->ni_drv_data;
5301 	sta = LSTA_TO_STA(lsta);
5302 
5303 	IMPROVE_HT("This really should be passed from ht_recv_action_ba_delba.");
5304 	for (tid = 0; tid < WME_NUM_TID; tid++) {
5305 		if (&ni->ni_rx_ampdu[tid] == rap)
5306 			break;
5307 	}
5308 
5309 	params.sta = sta;
5310 	params.action = IEEE80211_AMPDU_RX_STOP;
5311 	params.buf_size = 0;
5312 	params.timeout = 0;
5313 	params.ssn = 0;
5314 	params.tid = tid;
5315 	params.amsdu = false;
5316 
5317 	ic_locked = IEEE80211_IS_LOCKED(ic);
5318 	if (ic_locked)
5319 		IEEE80211_UNLOCK(ic);
5320 	wiphy_lock(hw->wiphy);
5321 	error = lkpi_80211_mo_ampdu_action(hw, vif, &params);
5322 	wiphy_unlock(hw->wiphy);
5323 	if (ic_locked)
5324 		IEEE80211_LOCK(ic);
5325 	if (error != 0)
5326 		ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p rap %p\n",
5327 		    __func__, error, ni, rap);
5328 
5329 net80211_only:
5330 	lhw->ic_ampdu_rx_stop(ni, rap);
5331 }
5332 #endif
5333 
5334 static void
5335 lkpi_ic_getradiocaps_ht(struct ieee80211com *ic, struct ieee80211_hw *hw,
5336     uint8_t *bands, int *chan_flags, enum nl80211_band band)
5337 {
5338 #ifdef LKPI_80211_HT
5339 	struct ieee80211_sta_ht_cap *ht_cap;
5340 
5341 	ht_cap = &hw->wiphy->bands[band]->ht_cap;
5342 	if (!ht_cap->ht_supported)
5343 		return;
5344 
5345 	switch (band) {
5346 	case NL80211_BAND_2GHZ:
5347 		setbit(bands, IEEE80211_MODE_11NG);
5348 		break;
5349 	case NL80211_BAND_5GHZ:
5350 		setbit(bands, IEEE80211_MODE_11NA);
5351 		break;
5352 	default:
5353 		IMPROVE("Unsupported band %d", band);
5354 		return;
5355 	}
5356 
5357 	ic->ic_htcaps = IEEE80211_HTC_HT;	/* HT operation */
5358 
5359 	/*
5360 	 * Rather than manually checking each flag and
5361 	 * translating IEEE80211_HT_CAP_ to IEEE80211_HTCAP_,
5362 	 * simply copy the 16bits.
5363 	 */
5364 	ic->ic_htcaps |= ht_cap->cap;
5365 
5366 	/* Then deal with the other flags. */
5367 	if (ieee80211_hw_check(hw, AMPDU_AGGREGATION))
5368 		ic->ic_htcaps |= IEEE80211_HTC_AMPDU;
5369 #ifdef __notyet__
5370 	if (ieee80211_hw_check(hw, TX_AMSDU))
5371 		ic->ic_htcaps |= IEEE80211_HTC_AMSDU;
5372 	if (ieee80211_hw_check(hw, SUPPORTS_AMSDU_IN_AMPDU))
5373 		ic->ic_htcaps |= (IEEE80211_HTC_RX_AMSDU_AMPDU |
5374 		    IEEE80211_HTC_TX_AMSDU_AMPDU);
5375 #endif
5376 
5377 	IMPROVE("PS, ampdu_*, ht_cap.mcs.tx_params, ...");
5378 	ic->ic_htcaps |= IEEE80211_HTCAP_SMPS_OFF;
5379 
5380 	/* Only add HT40 channels if supported. */
5381 	if ((ic->ic_htcaps & IEEE80211_HTCAP_CHWIDTH40) != 0 &&
5382 	    chan_flags != NULL)
5383 		*chan_flags |= NET80211_CBW_FLAG_HT40;
5384 #endif
5385 }
5386 
5387 static void
5388 lkpi_ic_getradiocaps(struct ieee80211com *ic, int maxchan,
5389     int *n, struct ieee80211_channel *c)
5390 {
5391 	struct lkpi_hw *lhw;
5392 	struct ieee80211_hw *hw;
5393 	struct linuxkpi_ieee80211_channel *channels;
5394 	uint8_t bands[IEEE80211_MODE_BYTES];
5395 	int chan_flags, error, i, nchans;
5396 
5397 	/* Channels */
5398 	lhw = ic->ic_softc;
5399 	hw = LHW_TO_HW(lhw);
5400 
5401 	/* NL80211_BAND_2GHZ */
5402 	nchans = 0;
5403 	if (hw->wiphy->bands[NL80211_BAND_2GHZ] != NULL)
5404 		nchans = hw->wiphy->bands[NL80211_BAND_2GHZ]->n_channels;
5405 	if (nchans > 0) {
5406 		memset(bands, 0, sizeof(bands));
5407 		chan_flags = 0;
5408 		setbit(bands, IEEE80211_MODE_11B);
5409 		/* XXX-BZ unclear how to check for 11g. */
5410 
5411 		IMPROVE("the bitrates may have flags?");
5412 		setbit(bands, IEEE80211_MODE_11G);
5413 
5414 		lkpi_ic_getradiocaps_ht(ic, hw, bands, &chan_flags,
5415 		    NL80211_BAND_2GHZ);
5416 
5417 		channels = hw->wiphy->bands[NL80211_BAND_2GHZ]->channels;
5418 		for (i = 0; i < nchans && *n < maxchan; i++) {
5419 			uint32_t nflags = 0;
5420 			int cflags = chan_flags;
5421 
5422 			if (channels[i].flags & IEEE80211_CHAN_DISABLED) {
5423 				ic_printf(ic, "%s: Skipping disabled chan "
5424 				    "[%u/%u/%#x]\n", __func__,
5425 				    channels[i].hw_value,
5426 				    channels[i].center_freq, channels[i].flags);
5427 				continue;
5428 			}
5429 			if (channels[i].flags & IEEE80211_CHAN_NO_IR)
5430 				nflags |= (IEEE80211_CHAN_NOADHOC|IEEE80211_CHAN_PASSIVE);
5431 			if (channels[i].flags & IEEE80211_CHAN_RADAR)
5432 				nflags |= IEEE80211_CHAN_DFS;
5433 			if (channels[i].flags & IEEE80211_CHAN_NO_160MHZ)
5434 				cflags &= ~(NET80211_CBW_FLAG_VHT160|NET80211_CBW_FLAG_VHT80P80);
5435 			if (channels[i].flags & IEEE80211_CHAN_NO_80MHZ)
5436 				cflags &= ~NET80211_CBW_FLAG_VHT80;
5437 			/* XXX how to map the remaining enum ieee80211_channel_flags? */
5438 			if (channels[i].flags & IEEE80211_CHAN_NO_HT40)
5439 				cflags &= ~NET80211_CBW_FLAG_HT40;
5440 
5441 			error = ieee80211_add_channel_cbw(c, maxchan, n,
5442 			    channels[i].hw_value, channels[i].center_freq,
5443 			    channels[i].max_power,
5444 			    nflags, bands, cflags);
5445 			/* net80211::ENOBUFS: *n >= maxchans */
5446 			if (error != 0 && error != ENOBUFS)
5447 				ic_printf(ic, "%s: Adding chan %u/%u/%#x/%#x/%#x/%#x "
5448 				    "returned error %d\n",
5449 				    __func__, channels[i].hw_value,
5450 				    channels[i].center_freq, channels[i].flags,
5451 				    nflags, chan_flags, cflags, error);
5452 			if (error != 0)
5453 				break;
5454 		}
5455 	}
5456 
5457 	/* NL80211_BAND_5GHZ */
5458 	nchans = 0;
5459 	if (hw->wiphy->bands[NL80211_BAND_5GHZ] != NULL)
5460 		nchans = hw->wiphy->bands[NL80211_BAND_5GHZ]->n_channels;
5461 	if (nchans > 0) {
5462 		memset(bands, 0, sizeof(bands));
5463 		chan_flags = 0;
5464 		setbit(bands, IEEE80211_MODE_11A);
5465 
5466 		lkpi_ic_getradiocaps_ht(ic, hw, bands, &chan_flags,
5467 		    NL80211_BAND_5GHZ);
5468 
5469 #ifdef LKPI_80211_VHT
5470 		if (hw->wiphy->bands[NL80211_BAND_5GHZ]->vht_cap.vht_supported) {
5471 
5472 			ic->ic_flags_ext |= IEEE80211_FEXT_VHT;
5473 			ic->ic_vht_cap.vht_cap_info =
5474 			    hw->wiphy->bands[NL80211_BAND_5GHZ]->vht_cap.cap;
5475 			ic->ic_vht_cap.supp_mcs =
5476 			    hw->wiphy->bands[NL80211_BAND_5GHZ]->vht_cap.vht_mcs;
5477 
5478 			setbit(bands, IEEE80211_MODE_VHT_5GHZ);
5479 			chan_flags |= NET80211_CBW_FLAG_VHT80;
5480 			if (IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_IS_160MHZ(
5481 			    ic->ic_vht_cap.vht_cap_info))
5482 				chan_flags |= NET80211_CBW_FLAG_VHT160;
5483 			if (IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_IS_160_80P80MHZ(
5484 			    ic->ic_vht_cap.vht_cap_info))
5485 				chan_flags |= NET80211_CBW_FLAG_VHT80P80;
5486 		}
5487 #endif
5488 
5489 		channels = hw->wiphy->bands[NL80211_BAND_5GHZ]->channels;
5490 		for (i = 0; i < nchans && *n < maxchan; i++) {
5491 			uint32_t nflags = 0;
5492 			int cflags = chan_flags;
5493 
5494 			if (channels[i].flags & IEEE80211_CHAN_DISABLED) {
5495 				ic_printf(ic, "%s: Skipping disabled chan "
5496 				    "[%u/%u/%#x]\n", __func__,
5497 				    channels[i].hw_value,
5498 				    channels[i].center_freq, channels[i].flags);
5499 				continue;
5500 			}
5501 			if (channels[i].flags & IEEE80211_CHAN_NO_IR)
5502 				nflags |= (IEEE80211_CHAN_NOADHOC|IEEE80211_CHAN_PASSIVE);
5503 			if (channels[i].flags & IEEE80211_CHAN_RADAR)
5504 				nflags |= IEEE80211_CHAN_DFS;
5505 			if (channels[i].flags & IEEE80211_CHAN_NO_160MHZ)
5506 				cflags &= ~(NET80211_CBW_FLAG_VHT160|NET80211_CBW_FLAG_VHT80P80);
5507 			if (channels[i].flags & IEEE80211_CHAN_NO_80MHZ)
5508 				cflags &= ~NET80211_CBW_FLAG_VHT80;
5509 			/* XXX hwo to map the remaining enum ieee80211_channel_flags? */
5510 			if (channels[i].flags & IEEE80211_CHAN_NO_HT40)
5511 				cflags &= ~NET80211_CBW_FLAG_HT40;
5512 
5513 			error = ieee80211_add_channel_cbw(c, maxchan, n,
5514 			    channels[i].hw_value, channels[i].center_freq,
5515 			    channels[i].max_power,
5516 			    nflags, bands, cflags);
5517 			/* net80211::ENOBUFS: *n >= maxchans */
5518 			if (error != 0 && error != ENOBUFS)
5519 				ic_printf(ic, "%s: Adding chan %u/%u/%#x/%#x/%#x/%#x "
5520 				    "returned error %d\n",
5521 				    __func__, channels[i].hw_value,
5522 				    channels[i].center_freq, channels[i].flags,
5523 				    nflags, chan_flags, cflags, error);
5524 			if (error != 0)
5525 				break;
5526 		}
5527 	}
5528 }
5529 
5530 static void *
5531 lkpi_ieee80211_ifalloc(void)
5532 {
5533 	struct ieee80211com *ic;
5534 
5535 	ic = malloc(sizeof(*ic), M_LKPI80211, M_WAITOK | M_ZERO);
5536 
5537 	/* Setting these happens later when we have device information. */
5538 	ic->ic_softc = NULL;
5539 	ic->ic_name = "linuxkpi";
5540 
5541 	return (ic);
5542 }
5543 
5544 struct ieee80211_hw *
5545 linuxkpi_ieee80211_alloc_hw(size_t priv_len, const struct ieee80211_ops *ops)
5546 {
5547 	struct ieee80211_hw *hw;
5548 	struct lkpi_hw *lhw;
5549 	struct wiphy *wiphy;
5550 	int ac;
5551 
5552 	/* Get us and the driver data also allocated. */
5553 	wiphy = wiphy_new(&linuxkpi_mac80211cfgops, sizeof(*lhw) + priv_len);
5554 	if (wiphy == NULL)
5555 		return (NULL);
5556 
5557 	lhw = wiphy_priv(wiphy);
5558 	lhw->ops = ops;
5559 
5560 	LKPI_80211_LHW_SCAN_LOCK_INIT(lhw);
5561 	LKPI_80211_LHW_TXQ_LOCK_INIT(lhw);
5562 	sx_init_flags(&lhw->lvif_sx, "lhw-lvif", SX_RECURSE | SX_DUPOK);
5563 	TAILQ_INIT(&lhw->lvif_head);
5564 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
5565 		lhw->txq_generation[ac] = 1;
5566 		TAILQ_INIT(&lhw->scheduled_txqs[ac]);
5567 	}
5568 
5569 	/* Chanctx_conf */
5570 	INIT_LIST_HEAD(&lhw->lchanctx_list);
5571 
5572 	/* Deferred RX path. */
5573 	LKPI_80211_LHW_RXQ_LOCK_INIT(lhw);
5574 	TASK_INIT(&lhw->rxq_task, 0, lkpi_80211_lhw_rxq_task, lhw);
5575 	mbufq_init(&lhw->rxq, IFQ_MAXLEN);
5576 	lhw->rxq_stopped = false;
5577 
5578 	/*
5579 	 * XXX-BZ TODO make sure there is a "_null" function to all ops
5580 	 * not initialized.
5581 	 */
5582 	hw = LHW_TO_HW(lhw);
5583 	hw->wiphy = wiphy;
5584 	hw->conf.flags |= IEEE80211_CONF_IDLE;
5585 	hw->priv = (void *)(lhw + 1);
5586 
5587 	/* BSD Specific. */
5588 	lhw->ic = lkpi_ieee80211_ifalloc();
5589 
5590 	IMPROVE();
5591 
5592 	return (hw);
5593 }
5594 
5595 void
5596 linuxkpi_ieee80211_iffree(struct ieee80211_hw *hw)
5597 {
5598 	struct lkpi_hw *lhw;
5599 	struct mbuf *m;
5600 
5601 	lhw = HW_TO_LHW(hw);
5602 	free(lhw->ic, M_LKPI80211);
5603 	lhw->ic = NULL;
5604 
5605 	/*
5606 	 * Drain the deferred RX path.
5607 	 */
5608 	LKPI_80211_LHW_RXQ_LOCK(lhw);
5609 	lhw->rxq_stopped = true;
5610 	LKPI_80211_LHW_RXQ_UNLOCK(lhw);
5611 
5612 	/* Drain taskq, won't be restarted due to rxq_stopped being set. */
5613 	while (taskqueue_cancel(taskqueue_thread, &lhw->rxq_task, NULL) != 0)
5614 		taskqueue_drain(taskqueue_thread, &lhw->rxq_task);
5615 
5616 	/* Flush mbufq (make sure to release ni refs!). */
5617 	m = mbufq_dequeue(&lhw->rxq);
5618 	while (m != NULL) {
5619 		struct m_tag *mtag;
5620 
5621 		mtag = m_tag_locate(m, MTAG_ABI_LKPI80211, LKPI80211_TAG_RXNI, NULL);
5622 		if (mtag != NULL) {
5623 			struct lkpi_80211_tag_rxni *rxni;
5624 
5625 			rxni = (struct lkpi_80211_tag_rxni *)(mtag + 1);
5626 			ieee80211_free_node(rxni->ni);
5627 		}
5628 		m_freem(m);
5629 		m = mbufq_dequeue(&lhw->rxq);
5630 	}
5631 	KASSERT(mbufq_empty(&lhw->rxq), ("%s: lhw %p has rxq len %d != 0\n",
5632 	    __func__, lhw, mbufq_len(&lhw->rxq)));
5633 	LKPI_80211_LHW_RXQ_LOCK_DESTROY(lhw);
5634 
5635 	/* Chanctx_conf. */
5636 	if (!list_empty_careful(&lhw->lchanctx_list)) {
5637 		struct lkpi_chanctx *lchanctx, *next;
5638 		struct ieee80211_chanctx_conf *chanctx_conf;
5639 
5640 		list_for_each_entry_safe(lchanctx, next, &lhw->lchanctx_list, entry) {
5641 			if (lchanctx->added_to_drv) {
5642 				/* In reality we should panic? */
5643 				chanctx_conf = &lchanctx->chanctx_conf;
5644 				lkpi_80211_mo_remove_chanctx(hw, chanctx_conf);
5645 			}
5646 			list_del(&lchanctx->entry);
5647 			free(lchanctx, M_LKPI80211);
5648 		}
5649 	}
5650 
5651 	/* Cleanup more of lhw here or in wiphy_free()? */
5652 	LKPI_80211_LHW_TXQ_LOCK_DESTROY(lhw);
5653 	LKPI_80211_LHW_SCAN_LOCK_DESTROY(lhw);
5654 	sx_destroy(&lhw->lvif_sx);
5655 	IMPROVE();
5656 }
5657 
5658 void
5659 linuxkpi_set_ieee80211_dev(struct ieee80211_hw *hw, char *name)
5660 {
5661 	struct lkpi_hw *lhw;
5662 	struct ieee80211com *ic;
5663 
5664 	lhw = HW_TO_LHW(hw);
5665 	ic = lhw->ic;
5666 
5667 	/* Now set a proper name before ieee80211_ifattach(). */
5668 	ic->ic_softc = lhw;
5669 	ic->ic_name = name;
5670 
5671 	/* XXX-BZ do we also need to set wiphy name? */
5672 }
5673 
5674 struct ieee80211_hw *
5675 linuxkpi_wiphy_to_ieee80211_hw(struct wiphy *wiphy)
5676 {
5677 	struct lkpi_hw *lhw;
5678 
5679 	lhw = wiphy_priv(wiphy);
5680 	return (LHW_TO_HW(lhw));
5681 }
5682 
5683 static void
5684 lkpi_radiotap_attach(struct lkpi_hw *lhw)
5685 {
5686 	struct ieee80211com *ic;
5687 
5688 	ic = lhw->ic;
5689 	ieee80211_radiotap_attach(ic,
5690 	    &lhw->rtap_tx.wt_ihdr, sizeof(lhw->rtap_tx),
5691 	    LKPI_RTAP_TX_FLAGS_PRESENT,
5692 	    &lhw->rtap_rx.wr_ihdr, sizeof(lhw->rtap_rx),
5693 	    LKPI_RTAP_RX_FLAGS_PRESENT);
5694 }
5695 
5696 int
5697 linuxkpi_ieee80211_ifattach(struct ieee80211_hw *hw)
5698 {
5699 	struct ieee80211com *ic;
5700 	struct lkpi_hw *lhw;
5701 	int band, i;
5702 
5703 	lhw = HW_TO_LHW(hw);
5704 	ic = lhw->ic;
5705 
5706 	/* We do it this late as wiphy->dev should be set for the name. */
5707 	lhw->workq = alloc_ordered_workqueue(wiphy_name(hw->wiphy), 0);
5708 	if (lhw->workq == NULL)
5709 		return (-EAGAIN);
5710 
5711 	/* XXX-BZ figure this out how they count his... */
5712 	if (!is_zero_ether_addr(hw->wiphy->perm_addr)) {
5713 		IEEE80211_ADDR_COPY(ic->ic_macaddr,
5714 		    hw->wiphy->perm_addr);
5715 	} else if (hw->wiphy->n_addresses > 0) {
5716 		/* We take the first one. */
5717 		IEEE80211_ADDR_COPY(ic->ic_macaddr,
5718 		    hw->wiphy->addresses[0].addr);
5719 	} else {
5720 		ic_printf(ic, "%s: warning, no hardware address!\n", __func__);
5721 	}
5722 
5723 #ifdef __not_yet__
5724 	/* See comment in lkpi_80211_txq_tx_one(). */
5725 	ic->ic_headroom = hw->extra_tx_headroom;
5726 #endif
5727 
5728 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
5729 	ic->ic_opmode = IEEE80211_M_STA;
5730 
5731 	/* Set device capabilities. */
5732 	/* XXX-BZ we need to get these from linux80211/drivers and convert. */
5733 	ic->ic_caps =
5734 	    IEEE80211_C_STA |
5735 	    IEEE80211_C_MONITOR |
5736 	    IEEE80211_C_WPA |		/* WPA/RSN */
5737 #ifdef LKPI_80211_WME
5738 	    IEEE80211_C_WME |
5739 #endif
5740 #if 0
5741 	    IEEE80211_C_PMGT |
5742 #endif
5743 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
5744 	    IEEE80211_C_SHPREAMBLE	/* short preamble supported */
5745 	    ;
5746 #if 0
5747 	/* Scanning is a different kind of beast to re-work. */
5748 	ic->ic_caps |= IEEE80211_C_BGSCAN;
5749 #endif
5750 	if (lhw->ops->hw_scan) {
5751 		/*
5752 		 * Advertise full-offload scanning.
5753 		 *
5754 		 * Not limiting to SINGLE_SCAN_ON_ALL_BANDS here as otherwise
5755 		 * we essentially disable hw_scan for all drivers not setting
5756 		 * the flag.
5757 		 */
5758 		ic->ic_flags_ext |= IEEE80211_FEXT_SCAN_OFFLOAD;
5759 		lhw->scan_flags |= LKPI_LHW_SCAN_HW;
5760 	}
5761 
5762 	/* Does HW support Fragmentation offload? */
5763 	if (ieee80211_hw_check(hw, SUPPORTS_TX_FRAG))
5764 		ic->ic_flags_ext |= IEEE80211_FEXT_FRAG_OFFLOAD;
5765 
5766 	/*
5767 	 * The wiphy variables report bitmasks of avail antennas.
5768 	 * (*get_antenna) get the current bitmask sets which can be
5769 	 * altered by (*set_antenna) for some drivers.
5770 	 * XXX-BZ will the count alone do us much good long-term in net80211?
5771 	 */
5772 	if (hw->wiphy->available_antennas_rx ||
5773 	    hw->wiphy->available_antennas_tx) {
5774 		uint32_t rxs, txs;
5775 
5776 		if (lkpi_80211_mo_get_antenna(hw, &txs, &rxs) == 0) {
5777 			ic->ic_rxstream = bitcount32(rxs);
5778 			ic->ic_txstream = bitcount32(txs);
5779 		}
5780 	}
5781 
5782 	ic->ic_cryptocaps = 0;
5783 #ifdef LKPI_80211_HW_CRYPTO
5784 	if (lkpi_hwcrypto && hw->wiphy->n_cipher_suites > 0) {
5785 		for (i = 0; i < hw->wiphy->n_cipher_suites; i++)
5786 			ic->ic_cryptocaps |= lkpi_l80211_to_net80211_cyphers(
5787 			    hw->wiphy->cipher_suites[i]);
5788 	}
5789 #endif
5790 
5791 	lkpi_ic_getradiocaps(ic, IEEE80211_CHAN_MAX, &ic->ic_nchans,
5792 	    ic->ic_channels);
5793 
5794 	ieee80211_ifattach(ic);
5795 
5796 	ic->ic_update_mcast = lkpi_ic_update_mcast;
5797 	ic->ic_update_promisc = lkpi_ic_update_promisc;
5798 	ic->ic_update_chw = lkpi_ic_update_chw;
5799 	ic->ic_parent = lkpi_ic_parent;
5800 	ic->ic_scan_start = lkpi_ic_scan_start;
5801 	ic->ic_scan_end = lkpi_ic_scan_end;
5802 	ic->ic_set_channel = lkpi_ic_set_channel;
5803 	ic->ic_transmit = lkpi_ic_transmit;
5804 	ic->ic_raw_xmit = lkpi_ic_raw_xmit;
5805 	ic->ic_vap_create = lkpi_ic_vap_create;
5806 	ic->ic_vap_delete = lkpi_ic_vap_delete;
5807 	ic->ic_getradiocaps = lkpi_ic_getradiocaps;
5808 	ic->ic_wme.wme_update = lkpi_ic_wme_update;
5809 
5810 	lhw->ic_scan_curchan = ic->ic_scan_curchan;
5811 	ic->ic_scan_curchan = lkpi_ic_scan_curchan;
5812 	lhw->ic_scan_mindwell = ic->ic_scan_mindwell;
5813 	ic->ic_scan_mindwell = lkpi_ic_scan_mindwell;
5814 
5815 	lhw->ic_node_alloc = ic->ic_node_alloc;
5816 	ic->ic_node_alloc = lkpi_ic_node_alloc;
5817 	lhw->ic_node_init = ic->ic_node_init;
5818 	ic->ic_node_init = lkpi_ic_node_init;
5819 	lhw->ic_node_cleanup = ic->ic_node_cleanup;
5820 	ic->ic_node_cleanup = lkpi_ic_node_cleanup;
5821 	lhw->ic_node_free = ic->ic_node_free;
5822 	ic->ic_node_free = lkpi_ic_node_free;
5823 
5824 #ifdef LKPI_80211_HT
5825 	/*
5826 	 * Only attach if the driver/firmware supports (*ampdu_action)().
5827 	 * Otherwise it is in the hands of net80211.
5828 	 */
5829 	if (lhw->ops->ampdu_action != NULL) {
5830 		lhw->ic_recv_action = ic->ic_recv_action;
5831 		ic->ic_recv_action = lkpi_ic_recv_action;
5832 		lhw->ic_send_action = ic->ic_send_action;
5833 		ic->ic_send_action = lkpi_ic_send_action;
5834 
5835 		lhw->ic_ampdu_enable = ic->ic_ampdu_enable;
5836 		ic->ic_ampdu_enable = lkpi_ic_ampdu_enable;
5837 
5838 		lhw->ic_addba_request = ic->ic_addba_request;
5839 		ic->ic_addba_request = lkpi_ic_addba_request;
5840 		lhw->ic_addba_response = ic->ic_addba_response;
5841 		ic->ic_addba_response = lkpi_ic_addba_response;
5842 		lhw->ic_addba_stop = ic->ic_addba_stop;
5843 		ic->ic_addba_stop = lkpi_ic_addba_stop;
5844 		lhw->ic_addba_response_timeout = ic->ic_addba_response_timeout;
5845 		ic->ic_addba_response_timeout = lkpi_ic_addba_response_timeout;
5846 
5847 		lhw->ic_bar_response = ic->ic_bar_response;
5848 		ic->ic_bar_response = lkpi_ic_bar_response;
5849 
5850 		lhw->ic_ampdu_rx_start = ic->ic_ampdu_rx_start;
5851 		ic->ic_ampdu_rx_start = lkpi_ic_ampdu_rx_start;
5852 		lhw->ic_ampdu_rx_stop = ic->ic_ampdu_rx_stop;
5853 		ic->ic_ampdu_rx_stop = lkpi_ic_ampdu_rx_stop;
5854 	}
5855 #endif
5856 
5857 	lkpi_radiotap_attach(lhw);
5858 
5859 	/*
5860 	 * Assign the first possible channel for now;  seems Realtek drivers
5861 	 * expect one.
5862 	 * Also remember the amount of bands we support and the most rates
5863 	 * in any band so we can scale [(ext) sup rates] IE(s) accordingly.
5864 	 */
5865 	lhw->supbands = lhw->max_rates = 0;
5866 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
5867 		struct ieee80211_supported_band *supband;
5868 		struct linuxkpi_ieee80211_channel *channels;
5869 
5870 		supband = hw->wiphy->bands[band];
5871 		if (supband == NULL || supband->n_channels == 0)
5872 			continue;
5873 
5874 		lhw->supbands++;
5875 		lhw->max_rates = max(lhw->max_rates, supband->n_bitrates);
5876 
5877 		/* If we have a channel, we need to keep counting supbands. */
5878 		if (hw->conf.chandef.chan != NULL)
5879 			continue;
5880 
5881 		channels = supband->channels;
5882 		for (i = 0; i < supband->n_channels; i++) {
5883 
5884 			if (channels[i].flags & IEEE80211_CHAN_DISABLED)
5885 				continue;
5886 
5887 			cfg80211_chandef_create(&hw->conf.chandef, &channels[i],
5888 #ifdef LKPI_80211_HT
5889 			    (ic->ic_flags_ht & IEEE80211_FHT_HT) ? NL80211_CHAN_HT20 :
5890 #endif
5891 			    NL80211_CHAN_NO_HT);
5892 			break;
5893 		}
5894 	}
5895 
5896 	IMPROVE("see net80211::ieee80211_chan_init vs. wiphy->bands[].bitrates possibly in lkpi_ic_getradiocaps?");
5897 
5898 	/* Make sure we do not support more than net80211 is willing to take. */
5899 	if (lhw->max_rates > IEEE80211_RATE_MAXSIZE) {
5900 		ic_printf(ic, "%s: limiting max_rates %d to %d!\n", __func__,
5901 		    lhw->max_rates, IEEE80211_RATE_MAXSIZE);
5902 		lhw->max_rates = IEEE80211_RATE_MAXSIZE;
5903 	}
5904 
5905 	/*
5906 	 * The maximum supported bitrates on any band + size for
5907 	 * DSSS Parameter Set give our per-band IE size.
5908 	 * SSID is the responsibility of the driver and goes on the side.
5909 	 * The user specified bits coming from the vap go into the
5910 	 * "common ies" fields.
5911 	 */
5912 	lhw->scan_ie_len = 2 + IEEE80211_RATE_SIZE;
5913 	if (lhw->max_rates > IEEE80211_RATE_SIZE)
5914 		lhw->scan_ie_len += 2 + (lhw->max_rates - IEEE80211_RATE_SIZE);
5915 
5916 	if (hw->wiphy->features & NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) {
5917 		/*
5918 		 * net80211 does not seem to support the DSSS Parameter Set but
5919 		 * some of the drivers insert it so calculate the extra fixed
5920 		 * space in.
5921 		 */
5922 		lhw->scan_ie_len += 2 + 1;
5923 	}
5924 
5925 #if defined(LKPI_80211_HT)
5926 	if ((ic->ic_htcaps & IEEE80211_HTC_HT) != 0)
5927 		lhw->scan_ie_len += sizeof(struct ieee80211_ie_htcap);
5928 #endif
5929 #if defined(LKPI_80211_VHT)
5930 	if (IEEE80211_CONF_VHT(ic))
5931 		lhw->scan_ie_len += 2 + sizeof(struct ieee80211_vht_cap);
5932 #endif
5933 
5934 	/* Reduce the max_scan_ie_len "left" by the amount we consume already. */
5935 	if (hw->wiphy->max_scan_ie_len > 0) {
5936 		if (lhw->scan_ie_len > hw->wiphy->max_scan_ie_len)
5937 			goto err;
5938 		hw->wiphy->max_scan_ie_len -= lhw->scan_ie_len;
5939 	}
5940 
5941 	if (bootverbose)
5942 		ieee80211_announce(ic);
5943 
5944 	return (0);
5945 err:
5946 	IMPROVE("TODO FIXME CLEANUP");
5947 	return (-EAGAIN);
5948 }
5949 
5950 void
5951 linuxkpi_ieee80211_ifdetach(struct ieee80211_hw *hw)
5952 {
5953 	struct lkpi_hw *lhw;
5954 	struct ieee80211com *ic;
5955 
5956 	lhw = HW_TO_LHW(hw);
5957 	ic = lhw->ic;
5958 	ieee80211_ifdetach(ic);
5959 }
5960 
5961 void
5962 linuxkpi_ieee80211_iterate_interfaces(struct ieee80211_hw *hw,
5963     enum ieee80211_iface_iter flags,
5964     void(*iterfunc)(void *, uint8_t *, struct ieee80211_vif *),
5965     void *arg)
5966 {
5967 	struct lkpi_hw *lhw;
5968 	struct lkpi_vif *lvif;
5969 	struct ieee80211_vif *vif;
5970 	bool active, atomic, nin_drv;
5971 
5972 	lhw = HW_TO_LHW(hw);
5973 
5974 	if (flags & ~(IEEE80211_IFACE_ITER_NORMAL|
5975 	    IEEE80211_IFACE_ITER_RESUME_ALL|
5976 	    IEEE80211_IFACE_SKIP_SDATA_NOT_IN_DRIVER|
5977 	    IEEE80211_IFACE_ITER_ACTIVE|IEEE80211_IFACE_ITER__ATOMIC)) {
5978 		ic_printf(lhw->ic, "XXX TODO %s flags(%#x) not yet supported.\n",
5979 		    __func__, flags);
5980 	}
5981 
5982 	active = (flags & IEEE80211_IFACE_ITER_ACTIVE) != 0;
5983 	atomic = (flags & IEEE80211_IFACE_ITER__ATOMIC) != 0;
5984 	nin_drv = (flags & IEEE80211_IFACE_SKIP_SDATA_NOT_IN_DRIVER) != 0;
5985 
5986 	if (atomic)
5987 		LKPI_80211_LHW_LVIF_LOCK(lhw);
5988 	TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
5989 		struct ieee80211vap *vap;
5990 
5991 		vif = LVIF_TO_VIF(lvif);
5992 
5993 		/*
5994 		 * If we want "active" interfaces, we need to distinguish on
5995 		 * whether the driver knows about them or not to be able to
5996 		 * handle the "resume" case correctly.  Skip the ones the
5997 		 * driver does not know about.
5998 		 */
5999 		if (active && !lvif->added_to_drv &&
6000 		    (flags & IEEE80211_IFACE_ITER_RESUME_ALL) != 0)
6001 			continue;
6002 
6003 		/*
6004 		 * If we shall skip interfaces not added to the driver do so
6005 		 * if we haven't yet.
6006 		 */
6007 		if (nin_drv && !lvif->added_to_drv)
6008 			continue;
6009 
6010 		/*
6011 		 * Run the iterator function if we are either not asking
6012 		 * asking for active only or if the VAP is "running".
6013 		 */
6014 		/* XXX-BZ probably should have state in the lvif as well. */
6015 		vap = LVIF_TO_VAP(lvif);
6016 		if (!active || (vap->iv_state != IEEE80211_S_INIT))
6017 			iterfunc(arg, vif->addr, vif);
6018 	}
6019 	if (atomic)
6020 		LKPI_80211_LHW_LVIF_UNLOCK(lhw);
6021 }
6022 
6023 static void
6024 lkpi_ieee80211_iterate_keys(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
6025     ieee80211_keyix keyix, struct lkpi_sta *lsta,
6026     void(*iterfunc)(struct ieee80211_hw *, struct ieee80211_vif *,
6027 	struct ieee80211_sta *, struct ieee80211_key_conf *, void *),
6028     void *arg)
6029 {
6030 	if (!lsta->added_to_drv)
6031 		return;
6032 
6033 	if (lsta->kc[keyix] == NULL)
6034 		return;
6035 
6036 	iterfunc(hw, vif, LSTA_TO_STA(lsta), lsta->kc[keyix], arg);
6037 }
6038 
6039 void
6040 linuxkpi_ieee80211_iterate_keys(struct ieee80211_hw *hw,
6041     struct ieee80211_vif *vif,
6042     void(*iterfunc)(struct ieee80211_hw *, struct ieee80211_vif *,
6043         struct ieee80211_sta *, struct ieee80211_key_conf *, void *),
6044     void *arg, bool rcu)
6045 {
6046 	struct lkpi_sta *lsta;
6047 	struct lkpi_vif *lvif;
6048 
6049 	lvif = VIF_TO_LVIF(vif);
6050 
6051 	if (rcu) {
6052 		rcu_read_lock_held();		/* XXX-BZ is this correct? */
6053 
6054 		if (vif == NULL) {
6055 			TODO();
6056 		} else {
6057 			list_for_each_entry_rcu(lsta, &lvif->lsta_list, lsta_list) {
6058 				for (ieee80211_keyix keyix = 0; keyix < nitems(lsta->kc);
6059 				    keyix++)
6060 					lkpi_ieee80211_iterate_keys(hw, vif,
6061 					    keyix, lsta, iterfunc, arg);
6062 			}
6063 		}
6064 	} else {
6065 		TODO("Used by suspend/resume; order of keys as installed to "
6066 		"firmware is important; we'll need to rewrite some code for that");
6067 		lockdep_assert_wiphy(hw->wiphy);
6068 
6069 		if (vif == NULL) {
6070 			TODO();
6071 		} else {
6072 			list_for_each_entry(lsta, &lvif->lsta_list, lsta_list) {
6073 				for (ieee80211_keyix keyix = 0; keyix < nitems(lsta->kc);
6074 				    keyix++)
6075 					lkpi_ieee80211_iterate_keys(hw, vif,
6076 					    keyix, lsta, iterfunc, arg);
6077 			}
6078 		}
6079 	}
6080 }
6081 
6082 void
6083 linuxkpi_ieee80211_iterate_chan_contexts(struct ieee80211_hw *hw,
6084     void(*iterfunc)(struct ieee80211_hw *, struct ieee80211_chanctx_conf *,
6085 	void *),
6086     void *arg)
6087 {
6088 	struct lkpi_hw *lhw;
6089 	struct lkpi_chanctx *lchanctx;
6090 
6091 	KASSERT(hw != NULL && iterfunc != NULL,
6092 	    ("%s: hw %p iterfunc %p arg %p\n", __func__, hw, iterfunc, arg));
6093 
6094 	lhw = HW_TO_LHW(hw);
6095 
6096 	rcu_read_lock();
6097 	list_for_each_entry_rcu(lchanctx, &lhw->lchanctx_list, entry) {
6098 		if (!lchanctx->added_to_drv)
6099 			continue;
6100 		iterfunc(hw, &lchanctx->chanctx_conf, arg);
6101 	}
6102 	rcu_read_unlock();
6103 }
6104 
6105 void
6106 linuxkpi_ieee80211_iterate_stations_atomic(struct ieee80211_hw *hw,
6107    void (*iterfunc)(void *, struct ieee80211_sta *), void *arg)
6108 {
6109 	struct lkpi_hw *lhw;
6110 	struct lkpi_vif *lvif;
6111 	struct lkpi_sta *lsta;
6112 	struct ieee80211_sta *sta;
6113 
6114 	KASSERT(hw != NULL && iterfunc != NULL,
6115 	    ("%s: hw %p iterfunc %p arg %p\n", __func__, hw, iterfunc, arg));
6116 
6117 	lhw = HW_TO_LHW(hw);
6118 
6119 	LKPI_80211_LHW_LVIF_LOCK(lhw);
6120 	TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
6121 
6122 		rcu_read_lock();
6123 		list_for_each_entry_rcu(lsta, &lvif->lsta_list, lsta_list) {
6124 			if (!lsta->added_to_drv)
6125 				continue;
6126 			sta = LSTA_TO_STA(lsta);
6127 			iterfunc(arg, sta);
6128 		}
6129 		rcu_read_unlock();
6130 	}
6131 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
6132 }
6133 
6134 struct linuxkpi_ieee80211_regdomain *
6135 lkpi_get_linuxkpi_ieee80211_regdomain(size_t n)
6136 {
6137 	struct linuxkpi_ieee80211_regdomain *regd;
6138 
6139 	regd = kzalloc(sizeof(*regd) + n * sizeof(struct ieee80211_reg_rule),
6140 	    GFP_KERNEL);
6141 	return (regd);
6142 }
6143 
6144 int
6145 linuxkpi_regulatory_set_wiphy_regd_sync(struct wiphy *wiphy,
6146     struct linuxkpi_ieee80211_regdomain *regd)
6147 {
6148 	struct lkpi_hw *lhw;
6149 	struct ieee80211com *ic;
6150 	struct ieee80211_regdomain *rd;
6151 
6152 	lhw = wiphy_priv(wiphy);
6153 	ic = lhw->ic;
6154 
6155 	rd = &ic->ic_regdomain;
6156 	if (rd->isocc[0] == '\0') {
6157 		rd->isocc[0] = regd->alpha2[0];
6158 		rd->isocc[1] = regd->alpha2[1];
6159 	}
6160 
6161 	TODO();
6162 	/* XXX-BZ finish the rest. */
6163 
6164 	return (0);
6165 }
6166 
6167 void
6168 linuxkpi_ieee80211_scan_completed(struct ieee80211_hw *hw,
6169     struct cfg80211_scan_info *info)
6170 {
6171 	struct lkpi_hw *lhw;
6172 	struct ieee80211com *ic;
6173 	struct ieee80211_scan_state *ss;
6174 
6175 	lhw = wiphy_priv(hw->wiphy);
6176 	ic = lhw->ic;
6177 	ss = ic->ic_scan;
6178 
6179 	ieee80211_scan_done(ss->ss_vap);
6180 
6181 	LKPI_80211_LHW_SCAN_LOCK(lhw);
6182 	free(lhw->hw_req, M_LKPI80211);
6183 	lhw->hw_req = NULL;
6184 	lhw->scan_flags &= ~LKPI_LHW_SCAN_RUNNING;
6185 	wakeup(lhw);
6186 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
6187 
6188 	return;
6189 }
6190 
6191 static void
6192 lkpi_80211_lhw_rxq_rx_one(struct lkpi_hw *lhw, struct mbuf *m)
6193 {
6194 	struct ieee80211_node *ni;
6195 	struct m_tag *mtag;
6196 	int ok;
6197 
6198 	ni = NULL;
6199         mtag = m_tag_locate(m, MTAG_ABI_LKPI80211, LKPI80211_TAG_RXNI, NULL);
6200 	if (mtag != NULL) {
6201 		struct lkpi_80211_tag_rxni *rxni;
6202 
6203 		rxni = (struct lkpi_80211_tag_rxni *)(mtag + 1);
6204 		ni = rxni->ni;
6205 	}
6206 
6207 	if (ni != NULL) {
6208 		ok = ieee80211_input_mimo(ni, m);
6209 		ieee80211_free_node(ni);		/* Release the reference. */
6210 		if (ok < 0)
6211 			m_freem(m);
6212 	} else {
6213 		ok = ieee80211_input_mimo_all(lhw->ic, m);
6214 		/* mbuf got consumed. */
6215 	}
6216 
6217 #ifdef LINUXKPI_DEBUG_80211
6218 	if (linuxkpi_debug_80211 & D80211_TRACE_RX)
6219 		printf("TRACE-RX: %s: handled frame type %#0x\n", __func__, ok);
6220 #endif
6221 }
6222 
6223 static void
6224 lkpi_80211_lhw_rxq_task(void *ctx, int pending)
6225 {
6226 	struct lkpi_hw *lhw;
6227 	struct mbufq mq;
6228 	struct mbuf *m;
6229 
6230 	lhw = ctx;
6231 
6232 #ifdef LINUXKPI_DEBUG_80211
6233 	if (linuxkpi_debug_80211 & D80211_TRACE_RX)
6234 		printf("TRACE-RX: %s: lhw %p pending %d mbuf_qlen %d\n",
6235 		    __func__, lhw, pending, mbufq_len(&lhw->rxq));
6236 #endif
6237 
6238 	mbufq_init(&mq, IFQ_MAXLEN);
6239 
6240 	LKPI_80211_LHW_RXQ_LOCK(lhw);
6241 	mbufq_concat(&mq, &lhw->rxq);
6242 	LKPI_80211_LHW_RXQ_UNLOCK(lhw);
6243 
6244 	m = mbufq_dequeue(&mq);
6245 	while (m != NULL) {
6246 		lkpi_80211_lhw_rxq_rx_one(lhw, m);
6247 		m = mbufq_dequeue(&mq);
6248 	}
6249 }
6250 
6251 static void
6252 lkpi_convert_rx_status(struct ieee80211_hw *hw,
6253     struct ieee80211_rx_status *rx_status,
6254     struct ieee80211_rx_stats *rx_stats,
6255     uint8_t *rssip)
6256 {
6257 	struct ieee80211_supported_band *supband;
6258 	int i;
6259 	uint8_t rssi;
6260 
6261 	memset(rx_stats, 0, sizeof(*rx_stats));
6262 	rx_stats->r_flags = IEEE80211_R_NF | IEEE80211_R_RSSI;
6263 	/* XXX-BZ correct hardcoded noise floor, survey data? */
6264 	rx_stats->c_nf = -96;
6265 	if (ieee80211_hw_check(hw, SIGNAL_DBM) &&
6266 	    !(rx_status->flag & RX_FLAG_NO_SIGNAL_VAL))
6267 		rssi = rx_status->signal;
6268 	else
6269 		rssi = rx_stats->c_nf;
6270 	/*
6271 	 * net80211 signal strength data are in .5 dBm units relative to
6272 	 * the current noise floor (see comment in ieee80211_node.h).
6273 	 */
6274 	rssi -= rx_stats->c_nf;
6275 	if (rssip != NULL)
6276 		*rssip = rssi;
6277 	rx_stats->c_rssi = rssi * 2;
6278 	rx_stats->r_flags |= IEEE80211_R_BAND;
6279 	rx_stats->c_band =
6280 	    lkpi_nl80211_band_to_net80211_band(rx_status->band);
6281 	rx_stats->r_flags |= IEEE80211_R_FREQ | IEEE80211_R_IEEE;
6282 	rx_stats->c_freq = rx_status->freq;
6283 	rx_stats->c_ieee = ieee80211_mhz2ieee(rx_stats->c_freq, rx_stats->c_band);
6284 
6285 	rx_stats->c_rx_tsf = rx_status->mactime;
6286 
6287 	/* XXX RX_FLAG_MACTIME_IS_RTAP_TS64 ? */
6288 	if ((rx_status->flag & RX_FLAG_MACTIME) ==
6289 	    (RX_FLAG_MACTIME_START|RX_FLAG_MACTIME_END)) {
6290 		rx_stats->r_flags |= IEEE80211_R_TSF64;
6291 		/* XXX RX_FLAG_MACTIME_PLCP_START ? */
6292 		if ((rx_status->flag & RX_FLAG_MACTIME) == RX_FLAG_MACTIME_START)
6293 			rx_stats->r_flags |= IEEE80211_R_TSF_START;
6294 		if ((rx_status->flag & RX_FLAG_MACTIME) == RX_FLAG_MACTIME_END)
6295 			rx_stats->r_flags |= IEEE80211_R_TSF_END;
6296 		/* XXX-BZ if TSF_END will net80211 do the unwind of time? */
6297 	}
6298 
6299 	if (rx_status->chains != 0) {
6300 		int cc;
6301 		int8_t crssi;
6302 
6303 		rx_stats->c_chain = rx_status->chains;
6304 		rx_stats->r_flags |= IEEE80211_R_C_CHAIN;
6305 
6306 		cc = 0;
6307 		for (i = 0; i < nitems(rx_status->chain_signal); i++) {
6308 			if (!(rx_status->chains & BIT(i)))
6309 				continue;
6310 			crssi = rx_status->chain_signal[i];
6311 			crssi -= rx_stats->c_nf;
6312 			rx_stats->c_rssi_ctl[i] = crssi * 2;
6313 			rx_stats->c_rssi_ext[i] = crssi * 2;	/* XXX _ext ??? ATH thing? */
6314 			/* We currently only have the global noise floor value. */
6315 			rx_stats->c_nf_ctl[i] = rx_stats->c_nf;
6316 			rx_stats->c_nf_ext[i] = rx_stats->c_nf;
6317 			cc++;
6318 		}
6319 		if (cc > 0)
6320 			 rx_stats->r_flags |= (IEEE80211_R_C_NF | IEEE80211_R_C_RSSI);
6321 	}
6322 
6323 	/* XXX-NET80211 We are not going to populate c_phytype! */
6324 
6325 	switch (rx_status->encoding) {
6326 	case RX_ENC_LEGACY:
6327 		supband = hw->wiphy->bands[rx_status->band];
6328 		if (supband != NULL)
6329 			rx_stats->c_rate = supband->bitrates[rx_status->rate_idx].bitrate;
6330 		/* Is there a LinuxKPI way of reporting IEEE80211_RX_F_CCK / _OFDM? */
6331 		break;
6332 	case RX_ENC_HT:
6333 		rx_stats->c_pktflags |= IEEE80211_RX_F_HT;
6334 		if ((rx_status->enc_flags & RX_ENC_FLAG_SHORT_GI) != 0)
6335 			rx_stats->c_pktflags |= IEEE80211_RX_F_SHORTGI;
6336 		rx_stats->c_rate = rx_status->rate_idx;		/* mcs */
6337 		break;
6338 	case RX_ENC_VHT:
6339 		rx_stats->c_pktflags |= IEEE80211_RX_F_VHT;
6340 		if ((rx_status->enc_flags & RX_ENC_FLAG_SHORT_GI) != 0)
6341 			rx_stats->c_pktflags |= IEEE80211_RX_F_SHORTGI;
6342 		rx_stats->c_rate = rx_status->rate_idx;		/* mcs */
6343 		rx_stats->c_vhtnss = rx_status->nss;
6344 		break;
6345 	case RX_ENC_HE:
6346 	case RX_ENC_EHT:
6347 		TODO("net80211 has not matching encoding for %u", rx_status->encoding);
6348 		break;
6349 	}
6350 
6351 	switch (rx_status->bw) {
6352 	case RATE_INFO_BW_20:
6353 		rx_stats->c_width = IEEE80211_RX_FW_20MHZ;
6354 		break;
6355 	case RATE_INFO_BW_40:
6356 		rx_stats->c_width = IEEE80211_RX_FW_40MHZ;
6357 		break;
6358 	case RATE_INFO_BW_80:
6359 		rx_stats->c_width = IEEE80211_RX_FW_80MHZ;
6360 		break;
6361 	case RATE_INFO_BW_160:
6362 		rx_stats->c_width = IEEE80211_RX_FW_160MHZ;
6363 		break;
6364 	case RATE_INFO_BW_320:
6365 	case RATE_INFO_BW_HE_RU:
6366 	case RATE_INFO_BW_EHT_RU:
6367 	case RATE_INFO_BW_5:
6368 	case RATE_INFO_BW_10:
6369 		TODO("net80211 has not matching bandwidth for %u", rx_status->bw);
6370 		break;
6371 	}
6372 
6373 	if ((rx_status->enc_flags & RX_ENC_FLAG_LDPC) != 0)
6374 		rx_stats->c_pktflags |= IEEE80211_RX_F_LDPC;
6375 	if ((rx_status->enc_flags & RX_ENC_FLAG_STBC_MASK) != 0)
6376 		 rx_stats->c_pktflags |= IEEE80211_RX_F_STBC;
6377 
6378 	/*
6379 	 * We only need these for LKPI_80211_HW_CRYPTO in theory but in
6380 	 * case the hardware does something we do not expect always leave
6381 	 * these enabled.  Leaving this commant as documentation for the || 1.
6382 	 */
6383 #if defined(LKPI_80211_HW_CRYPTO) || 1
6384 	if (rx_status->flag & RX_FLAG_DECRYPTED) {
6385 		rx_stats->c_pktflags |= IEEE80211_RX_F_DECRYPTED;
6386 		/* Only valid if decrypted is set. */
6387 		if (rx_status->flag & RX_FLAG_PN_VALIDATED)
6388 			rx_stats->c_pktflags |= IEEE80211_RX_F_PN_VALIDATED;
6389 	}
6390 	if (rx_status->flag & RX_FLAG_MMIC_STRIPPED)
6391 		rx_stats->c_pktflags |= IEEE80211_RX_F_MMIC_STRIP;
6392 	if (rx_status->flag & RX_FLAG_MMIC_ERROR)
6393 		rx_stats->c_pktflags |= IEEE80211_RX_F_FAIL_MMIC;
6394 	if (rx_status->flag & RX_FLAG_MIC_STRIPPED)
6395 		rx_stats->c_pktflags |= IEEE80211_RX_F_MIC_STRIP;
6396 	if (rx_status->flag & RX_FLAG_IV_STRIPPED)
6397 		rx_stats->c_pktflags |= IEEE80211_RX_F_IV_STRIP;
6398 	if (rx_status->flag & RX_FLAG_FAILED_FCS_CRC)
6399 		rx_stats->c_pktflags |= IEEE80211_RX_F_FAIL_FCSCRC;
6400 #endif
6401 }
6402 
6403 /* For %list see comment towards the end of the function. */
6404 void
6405 linuxkpi_ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
6406     struct ieee80211_sta *sta, struct napi_struct *napi __unused,
6407     struct list_head *list __unused)
6408 {
6409 	struct lkpi_hw *lhw;
6410 	struct ieee80211com *ic;
6411 	struct mbuf *m;
6412 	struct skb_shared_info *shinfo;
6413 	struct ieee80211_rx_status *rx_status;
6414 	struct ieee80211_rx_stats rx_stats;
6415 	struct ieee80211_node *ni;
6416 	struct ieee80211vap *vap;
6417 	struct ieee80211_hdr *hdr;
6418 	struct lkpi_sta *lsta;
6419 	int i, offset, ok;
6420 	uint8_t rssi;
6421 	bool is_beacon;
6422 
6423 	if (skb->len < 2) {
6424 		/* Need 80211 stats here. */
6425 		IMPROVE();
6426 		goto err;
6427 	}
6428 
6429 	/*
6430 	 * For now do the data copy; we can later improve things. Might even
6431 	 * have an mbuf backing the skb data then?
6432 	 */
6433 	m = m_get2(skb->len, M_NOWAIT, MT_DATA, M_PKTHDR);
6434 	if (m == NULL)
6435 		goto err;
6436 	m_copyback(m, 0, skb->tail - skb->data, skb->data);
6437 
6438 	shinfo = skb_shinfo(skb);
6439 	offset = m->m_len;
6440 	for (i = 0; i < shinfo->nr_frags; i++) {
6441 		m_copyback(m, offset, shinfo->frags[i].size,
6442 		    (uint8_t *)linux_page_address(shinfo->frags[i].page) +
6443 		    shinfo->frags[i].offset);
6444 		offset += shinfo->frags[i].size;
6445 	}
6446 
6447 	rx_status = IEEE80211_SKB_RXCB(skb);
6448 
6449 	hdr = (void *)skb->data;
6450 	is_beacon = ieee80211_is_beacon(hdr->frame_control);
6451 
6452 #ifdef LINUXKPI_DEBUG_80211
6453 	if (is_beacon && (linuxkpi_debug_80211 & D80211_TRACE_RX_BEACONS) == 0)
6454 		goto no_trace_beacons;
6455 
6456 	if (linuxkpi_debug_80211 & D80211_TRACE_RX)
6457 		printf("TRACE-RX: %s: skb %p a/l/d/t-len (%u/%u/%u/%u) "
6458 		    "h %p d %p t %p e %p sh %p (%u) m %p plen %u len %u%s\n",
6459 		    __func__, skb, skb->_alloc_len, skb->len, skb->data_len,
6460 		    skb->truesize, skb->head, skb->data, skb->tail, skb->end,
6461 		    shinfo, shinfo->nr_frags,
6462 		    m, m->m_pkthdr.len, m->m_len, is_beacon ? " beacon" : "");
6463 
6464 	if (linuxkpi_debug_80211 & D80211_TRACE_RX_DUMP)
6465 		hexdump(mtod(m, const void *), m->m_len, "RX (raw) ", 0);
6466 
6467 	/* Implement a dump_rxcb() !!! */
6468 	if (linuxkpi_debug_80211 & D80211_TRACE_RX)
6469 		printf("TRACE-RX: %s: RXCB: %ju %ju %u, %b, %u, %#0x, %#0x, "
6470 		    "%u band %u, %u { %d %d %d %d }, %d, %#x %#x %#x %#x %u %u %u\n",
6471 			__func__,
6472 			(uintmax_t)rx_status->boottime_ns,
6473 			(uintmax_t)rx_status->mactime,
6474 			rx_status->device_timestamp,
6475 			rx_status->flag, IEEE80211_RX_STATUS_FLAGS_BITS,
6476 			rx_status->freq,
6477 			rx_status->bw,
6478 			rx_status->encoding,
6479 			rx_status->ampdu_reference,
6480 			rx_status->band,
6481 			rx_status->chains,
6482 			rx_status->chain_signal[0],
6483 			rx_status->chain_signal[1],
6484 			rx_status->chain_signal[2],
6485 			rx_status->chain_signal[3],
6486 			rx_status->signal,
6487 			rx_status->enc_flags,
6488 			rx_status->he_dcm,
6489 			rx_status->he_gi,
6490 			rx_status->he_ru,
6491 			rx_status->zero_length_psdu_type,
6492 			rx_status->nss,
6493 			rx_status->rate_idx);
6494 no_trace_beacons:
6495 #endif
6496 
6497 	rssi = 0;
6498 	lkpi_convert_rx_status(hw, rx_status, &rx_stats, &rssi);
6499 
6500 	lhw = HW_TO_LHW(hw);
6501 	ic = lhw->ic;
6502 
6503 	ok = ieee80211_add_rx_params(m, &rx_stats);
6504 	if (ok == 0) {
6505 		m_freem(m);
6506 		counter_u64_add(ic->ic_ierrors, 1);
6507 		goto err;
6508 	}
6509 
6510 	lsta = NULL;
6511 	if (sta != NULL) {
6512 		lsta = STA_TO_LSTA(sta);
6513 		ni = ieee80211_ref_node(lsta->ni);
6514 	} else {
6515 		struct ieee80211_frame_min *wh;
6516 
6517 		wh = mtod(m, struct ieee80211_frame_min *);
6518 		ni = ieee80211_find_rxnode(ic, wh);
6519 		if (ni != NULL)
6520 			lsta = ni->ni_drv_data;
6521 	}
6522 
6523 	if (ni != NULL)
6524 		vap = ni->ni_vap;
6525 	else
6526 		/*
6527 		 * XXX-BZ can we improve this by looking at the frame hdr
6528 		 * or other meta-data passed up?
6529 		 */
6530 		vap = TAILQ_FIRST(&ic->ic_vaps);
6531 
6532 #ifdef LINUXKPI_DEBUG_80211
6533 	if (linuxkpi_debug_80211 & D80211_TRACE_RX)
6534 		printf("TRACE-RX: %s: sta %p lsta %p state %d ni %p vap %p%s\n",
6535 		    __func__, sta, lsta, (lsta != NULL) ? lsta->state : -1,
6536 		    ni, vap, is_beacon ? " beacon" : "");
6537 #endif
6538 
6539 	if (ni != NULL && vap != NULL && is_beacon &&
6540 	    rx_status->device_timestamp > 0 &&
6541 	    m->m_pkthdr.len >= sizeof(struct ieee80211_frame)) {
6542 		struct lkpi_vif *lvif;
6543 		struct ieee80211_vif *vif;
6544 		struct ieee80211_frame *wh;
6545 
6546 		wh = mtod(m, struct ieee80211_frame *);
6547 		if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_bssid))
6548 			goto skip_device_ts;
6549 
6550 		lvif = VAP_TO_LVIF(vap);
6551 		vif = LVIF_TO_VIF(lvif);
6552 
6553 		IMPROVE("TIMING_BEACON_ONLY?");
6554 		/* mac80211 specific (not net80211) so keep it here. */
6555 		vif->bss_conf.sync_device_ts = rx_status->device_timestamp;
6556 		/*
6557 		 * net80211 should take care of the other information (sync_tsf,
6558 		 * sync_dtim_count) as otherwise we need to parse the beacon.
6559 		 */
6560 skip_device_ts:
6561 		;
6562 	}
6563 
6564 	if (vap != NULL && vap->iv_state > IEEE80211_S_INIT &&
6565 	    ieee80211_radiotap_active_vap(vap)) {
6566 		struct lkpi_radiotap_rx_hdr *rtap;
6567 
6568 		rtap = &lhw->rtap_rx;
6569 		rtap->wr_tsft = rx_status->device_timestamp;
6570 		rtap->wr_flags = 0;
6571 		if (rx_status->enc_flags & RX_ENC_FLAG_SHORTPRE)
6572 			rtap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6573 		if (rx_status->enc_flags & RX_ENC_FLAG_SHORT_GI)
6574 			rtap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTGI;
6575 #if 0	/* .. or it does not given we strip it below. */
6576 		if (ieee80211_hw_check(hw, RX_INCLUDES_FCS))
6577 			rtap->wr_flags |= IEEE80211_RADIOTAP_F_FCS;
6578 #endif
6579 		if (rx_status->flag & RX_FLAG_FAILED_FCS_CRC)
6580 			rtap->wr_flags |= IEEE80211_RADIOTAP_F_BADFCS;
6581 		rtap->wr_rate = 0;
6582 		IMPROVE();
6583 		/* XXX TODO status->encoding / rate_index / bw */
6584 		rtap->wr_chan_freq = htole16(rx_stats.c_freq);
6585 		if (ic->ic_curchan->ic_ieee == rx_stats.c_ieee)
6586 			rtap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
6587 		rtap->wr_dbm_antsignal = rssi;
6588 		rtap->wr_dbm_antnoise = rx_stats.c_nf;
6589 	}
6590 
6591 	if (ieee80211_hw_check(hw, RX_INCLUDES_FCS))
6592 		m_adj(m, -IEEE80211_CRC_LEN);
6593 
6594 #if 0
6595 	if (list != NULL) {
6596 		/*
6597 		* Normally this would be queued up and delivered by
6598 		* netif_receive_skb_list(), napi_gro_receive(), or the like.
6599 		* See mt76::mac80211.c as only current possible consumer.
6600 		*/
6601 		IMPROVE("we simply pass the packet to net80211 to deal with.");
6602 	}
6603 #endif
6604 
6605 	/*
6606 	 * Attach meta-information to the mbuf for the deferred RX path.
6607 	 * Currently this is best-effort.  Should we need to be hard,
6608 	 * drop the frame and goto err;
6609 	 */
6610 	if (ni != NULL) {
6611 		struct m_tag *mtag;
6612 		struct lkpi_80211_tag_rxni *rxni;
6613 
6614 		mtag = m_tag_alloc(MTAG_ABI_LKPI80211, LKPI80211_TAG_RXNI,
6615 		    sizeof(*rxni), IEEE80211_M_NOWAIT);
6616 		if (mtag != NULL) {
6617 			rxni = (struct lkpi_80211_tag_rxni *)(mtag + 1);
6618 			rxni->ni = ni;		/* We hold a reference. */
6619 			m_tag_prepend(m, mtag);
6620 		}
6621 	}
6622 
6623 	LKPI_80211_LHW_RXQ_LOCK(lhw);
6624 	if (lhw->rxq_stopped) {
6625 		LKPI_80211_LHW_RXQ_UNLOCK(lhw);
6626 		m_freem(m);
6627 		goto err;
6628 	}
6629 
6630 	mbufq_enqueue(&lhw->rxq, m);
6631 	taskqueue_enqueue(taskqueue_thread, &lhw->rxq_task);
6632 	LKPI_80211_LHW_RXQ_UNLOCK(lhw);
6633 
6634 	IMPROVE();
6635 
6636 err:
6637 	/* The skb is ours so we can free it :-) */
6638 	kfree_skb(skb);
6639 }
6640 
6641 uint8_t
6642 linuxkpi_ieee80211_get_tid(struct ieee80211_hdr *hdr, bool nonqos_ok)
6643 {
6644 	const struct ieee80211_frame *wh;
6645 	uint8_t tid;
6646 
6647 	/* Linux seems to assume this is a QOS-Data-Frame */
6648 	KASSERT(nonqos_ok || ieee80211_is_data_qos(hdr->frame_control),
6649 	   ("%s: hdr %p fc %#06x not qos_data\n", __func__, hdr,
6650 	   hdr->frame_control));
6651 
6652 	wh = (const struct ieee80211_frame *)hdr;
6653 	tid = ieee80211_gettid(wh);
6654 	KASSERT(nonqos_ok || tid == (tid & IEEE80211_QOS_TID), ("%s: tid %u "
6655 	   "not expected (%u?)\n", __func__, tid, IEEE80211_NONQOS_TID));
6656 
6657 	return (tid);
6658 }
6659 
6660 /* -------------------------------------------------------------------------- */
6661 
6662 static void
6663 lkpi_wiphy_work(struct work_struct *work)
6664 {
6665 	struct lkpi_wiphy *lwiphy;
6666 	struct wiphy *wiphy;
6667 	struct wiphy_work *wk;
6668 
6669 	lwiphy = container_of(work, struct lkpi_wiphy, wwk);
6670 	wiphy = LWIPHY_TO_WIPHY(lwiphy);
6671 
6672 	wiphy_lock(wiphy);
6673 
6674 	LKPI_80211_LWIPHY_WORK_LOCK(lwiphy);
6675 	wk = list_first_entry_or_null(&lwiphy->wwk_list, struct wiphy_work, entry);
6676 	/* If there is nothing we do nothing. */
6677 	if (wk == NULL) {
6678 		LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
6679 		wiphy_unlock(wiphy);
6680 		return;
6681 	}
6682 	list_del_init(&wk->entry);
6683 
6684 	/* More work to do? */
6685 	if (!list_empty(&lwiphy->wwk_list))
6686 		schedule_work(work);
6687 	LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
6688 
6689 	/* Finally call the (*wiphy_work_fn)() function. */
6690 	wk->fn(wiphy, wk);
6691 
6692 	wiphy_unlock(wiphy);
6693 }
6694 
6695 void
6696 linuxkpi_wiphy_work_queue(struct wiphy *wiphy, struct wiphy_work *wwk)
6697 {
6698 	struct lkpi_wiphy *lwiphy;
6699 
6700 	lwiphy = WIPHY_TO_LWIPHY(wiphy);
6701 
6702 	LKPI_80211_LWIPHY_WORK_LOCK(lwiphy);
6703 	/* Do not double-queue. */
6704 	if (list_empty(&wwk->entry))
6705 		list_add_tail(&wwk->entry, &lwiphy->wwk_list);
6706 	LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
6707 
6708 	/*
6709 	 * See how ieee80211_queue_work() work continues in Linux or if things
6710 	 * migrate here over time?
6711 	 * Use a system queue from linux/workqueue.h for now.
6712 	 */
6713 	queue_work(system_wq, &lwiphy->wwk);
6714 }
6715 
6716 void
6717 linuxkpi_wiphy_work_cancel(struct wiphy *wiphy, struct wiphy_work *wwk)
6718 {
6719 	struct lkpi_wiphy *lwiphy;
6720 
6721 	lwiphy = WIPHY_TO_LWIPHY(wiphy);
6722 
6723 	LKPI_80211_LWIPHY_WORK_LOCK(lwiphy);
6724 	/* Only cancel if queued. */
6725 	if (!list_empty(&wwk->entry))
6726 		list_del_init(&wwk->entry);
6727 	LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
6728 }
6729 
6730 void
6731 linuxkpi_wiphy_work_flush(struct wiphy *wiphy, struct wiphy_work *wwk)
6732 {
6733 	struct lkpi_wiphy *lwiphy;
6734 	struct wiphy_work *wk;
6735 
6736 	lwiphy = WIPHY_TO_LWIPHY(wiphy);
6737 	LKPI_80211_LWIPHY_WORK_LOCK(lwiphy);
6738 	/* If wwk is unset, flush everything; called when wiphy is shut down. */
6739 	if (wwk != NULL && list_empty(&wwk->entry)) {
6740 		LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
6741 		return;
6742 	}
6743 
6744 	while (!list_empty(&lwiphy->wwk_list)) {
6745 
6746 		wk = list_first_entry(&lwiphy->wwk_list, struct wiphy_work,
6747 		    entry);
6748 		list_del_init(&wk->entry);
6749 		LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
6750 		wk->fn(wiphy, wk);
6751 		LKPI_80211_LWIPHY_WORK_LOCK(lwiphy);
6752 		if (wk == wwk)
6753 			break;
6754 	}
6755 	LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
6756 }
6757 
6758 void
6759 lkpi_wiphy_delayed_work_timer(struct timer_list *tl)
6760 {
6761 	struct wiphy_delayed_work *wdwk;
6762 
6763 	wdwk = from_timer(wdwk, tl, timer);
6764         wiphy_work_queue(wdwk->wiphy, &wdwk->work);
6765 }
6766 
6767 void
6768 linuxkpi_wiphy_delayed_work_queue(struct wiphy *wiphy,
6769     struct wiphy_delayed_work *wdwk, unsigned long delay)
6770 {
6771 	if (delay == 0) {
6772 		/* Run right away. */
6773 		del_timer(&wdwk->timer);
6774 		wiphy_work_queue(wiphy, &wdwk->work);
6775 	} else {
6776 		wdwk->wiphy = wiphy;
6777 		mod_timer(&wdwk->timer, jiffies + delay);
6778 	}
6779 }
6780 
6781 void
6782 linuxkpi_wiphy_delayed_work_cancel(struct wiphy *wiphy,
6783     struct wiphy_delayed_work *wdwk)
6784 {
6785 	del_timer_sync(&wdwk->timer);
6786 	wiphy_work_cancel(wiphy, &wdwk->work);
6787 }
6788 
6789 /* -------------------------------------------------------------------------- */
6790 
6791 struct wiphy *
6792 linuxkpi_wiphy_new(const struct cfg80211_ops *ops, size_t priv_len)
6793 {
6794 	struct lkpi_wiphy *lwiphy;
6795 	struct wiphy *wiphy;
6796 
6797 	lwiphy = kzalloc(sizeof(*lwiphy) + priv_len, GFP_KERNEL);
6798 	if (lwiphy == NULL)
6799 		return (NULL);
6800 	lwiphy->ops = ops;
6801 
6802 	LKPI_80211_LWIPHY_WORK_LOCK_INIT(lwiphy);
6803 	INIT_LIST_HEAD(&lwiphy->wwk_list);
6804 	INIT_WORK(&lwiphy->wwk, lkpi_wiphy_work);
6805 
6806 	wiphy = LWIPHY_TO_WIPHY(lwiphy);
6807 
6808 	mutex_init(&wiphy->mtx);
6809 	TODO();
6810 
6811 	return (wiphy);
6812 }
6813 
6814 void
6815 linuxkpi_wiphy_free(struct wiphy *wiphy)
6816 {
6817 	struct lkpi_wiphy *lwiphy;
6818 
6819 	if (wiphy == NULL)
6820 		return;
6821 
6822 	linuxkpi_wiphy_work_flush(wiphy, NULL);
6823 	mutex_destroy(&wiphy->mtx);
6824 
6825 	lwiphy = WIPHY_TO_LWIPHY(wiphy);
6826 	LKPI_80211_LWIPHY_WORK_LOCK_DESTROY(lwiphy);
6827 
6828 	kfree(lwiphy);
6829 }
6830 
6831 static uint32_t
6832 lkpi_cfg80211_calculate_bitrate_ht(struct rate_info *rate)
6833 {
6834 	TODO("cfg80211_calculate_bitrate_ht");
6835 	return (rate->legacy);
6836 }
6837 
6838 static uint32_t
6839 lkpi_cfg80211_calculate_bitrate_vht(struct rate_info *rate)
6840 {
6841 	TODO("cfg80211_calculate_bitrate_vht");
6842 	return (rate->legacy);
6843 }
6844 
6845 uint32_t
6846 linuxkpi_cfg80211_calculate_bitrate(struct rate_info *rate)
6847 {
6848 
6849 	/* Beware: order! */
6850 	if (rate->flags & RATE_INFO_FLAGS_MCS)
6851 		return (lkpi_cfg80211_calculate_bitrate_ht(rate));
6852 
6853 	if (rate->flags & RATE_INFO_FLAGS_VHT_MCS)
6854 		return (lkpi_cfg80211_calculate_bitrate_vht(rate));
6855 
6856 	IMPROVE("HE/EHT/...");
6857 
6858 	return (rate->legacy);
6859 }
6860 
6861 uint32_t
6862 linuxkpi_ieee80211_channel_to_frequency(uint32_t channel,
6863     enum nl80211_band band)
6864 {
6865 
6866 	switch (band) {
6867 	case NL80211_BAND_2GHZ:
6868 		return (ieee80211_ieee2mhz(channel, IEEE80211_CHAN_2GHZ));
6869 		break;
6870 	case NL80211_BAND_5GHZ:
6871 		return (ieee80211_ieee2mhz(channel, IEEE80211_CHAN_5GHZ));
6872 		break;
6873 	default:
6874 		/* XXX abort, retry, error, panic? */
6875 		break;
6876 	}
6877 
6878 	return (0);
6879 }
6880 
6881 uint32_t
6882 linuxkpi_ieee80211_frequency_to_channel(uint32_t freq, uint32_t flags __unused)
6883 {
6884 
6885 	return (ieee80211_mhz2ieee(freq, 0));
6886 }
6887 
6888 #if 0
6889 static struct lkpi_sta *
6890 lkpi_find_lsta_by_ni(struct lkpi_vif *lvif, struct ieee80211_node *ni)
6891 {
6892 	struct lkpi_sta *lsta, *temp;
6893 
6894 	rcu_read_lock();
6895 	list_for_each_entry_rcu(lsta, &lvif->lsta_list, lsta_list) {
6896 		if (lsta->ni == ni) {
6897 			rcu_read_unlock();
6898 			return (lsta);
6899 		}
6900 	}
6901 	rcu_read_unlock();
6902 
6903 	return (NULL);
6904 }
6905 #endif
6906 
6907 struct ieee80211_sta *
6908 linuxkpi_ieee80211_find_sta(struct ieee80211_vif *vif, const u8 *peer)
6909 {
6910 	struct lkpi_vif *lvif;
6911 	struct lkpi_sta *lsta;
6912 	struct ieee80211_sta *sta;
6913 
6914 	lvif = VIF_TO_LVIF(vif);
6915 
6916 	rcu_read_lock();
6917 	list_for_each_entry_rcu(lsta, &lvif->lsta_list, lsta_list) {
6918 		sta = LSTA_TO_STA(lsta);
6919 		if (IEEE80211_ADDR_EQ(sta->addr, peer)) {
6920 			rcu_read_unlock();
6921 			return (sta);
6922 		}
6923 	}
6924 	rcu_read_unlock();
6925 	return (NULL);
6926 }
6927 
6928 struct ieee80211_sta *
6929 linuxkpi_ieee80211_find_sta_by_ifaddr(struct ieee80211_hw *hw,
6930     const uint8_t *addr, const uint8_t *ourvifaddr)
6931 {
6932 	struct lkpi_hw *lhw;
6933 	struct lkpi_vif *lvif;
6934 	struct lkpi_sta *lsta;
6935 	struct ieee80211_vif *vif;
6936 	struct ieee80211_sta *sta;
6937 
6938 	lhw = wiphy_priv(hw->wiphy);
6939 	sta = NULL;
6940 
6941 	LKPI_80211_LHW_LVIF_LOCK(lhw);
6942 	TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
6943 
6944 		/* XXX-BZ check our address from the vif. */
6945 
6946 		vif = LVIF_TO_VIF(lvif);
6947 		if (ourvifaddr != NULL &&
6948 		    !IEEE80211_ADDR_EQ(vif->addr, ourvifaddr))
6949 			continue;
6950 		sta = linuxkpi_ieee80211_find_sta(vif, addr);
6951 		if (sta != NULL)
6952 			break;
6953 	}
6954 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
6955 
6956 	if (sta != NULL) {
6957 		lsta = STA_TO_LSTA(sta);
6958 		if (!lsta->added_to_drv)
6959 			return (NULL);
6960 	}
6961 
6962 	return (sta);
6963 }
6964 
6965 struct sk_buff *
6966 linuxkpi_ieee80211_tx_dequeue(struct ieee80211_hw *hw,
6967     struct ieee80211_txq *txq)
6968 {
6969 	struct lkpi_txq *ltxq;
6970 	struct lkpi_vif *lvif;
6971 	struct sk_buff *skb;
6972 
6973 	skb = NULL;
6974 	ltxq = TXQ_TO_LTXQ(txq);
6975 	ltxq->seen_dequeue = true;
6976 
6977 	if (ltxq->stopped)
6978 		goto stopped;
6979 
6980 	lvif = VIF_TO_LVIF(ltxq->txq.vif);
6981 	if (lvif->hw_queue_stopped[ltxq->txq.ac]) {
6982 		ltxq->stopped = true;
6983 		goto stopped;
6984 	}
6985 
6986 	IMPROVE("hw(TX_FRAG_LIST)");
6987 
6988 	LKPI_80211_LTXQ_LOCK(ltxq);
6989 	skb = skb_dequeue(&ltxq->skbq);
6990 	LKPI_80211_LTXQ_UNLOCK(ltxq);
6991 
6992 stopped:
6993 	return (skb);
6994 }
6995 
6996 void
6997 linuxkpi_ieee80211_txq_get_depth(struct ieee80211_txq *txq,
6998     unsigned long *frame_cnt, unsigned long *byte_cnt)
6999 {
7000 	struct lkpi_txq *ltxq;
7001 	struct sk_buff *skb;
7002 	unsigned long fc, bc;
7003 
7004 	ltxq = TXQ_TO_LTXQ(txq);
7005 
7006 	fc = bc = 0;
7007 	LKPI_80211_LTXQ_LOCK(ltxq);
7008 	skb_queue_walk(&ltxq->skbq, skb) {
7009 		fc++;
7010 		bc += skb->len;
7011 	}
7012 	LKPI_80211_LTXQ_UNLOCK(ltxq);
7013 	if (frame_cnt)
7014 		*frame_cnt = fc;
7015 	if (byte_cnt)
7016 		*byte_cnt = bc;
7017 
7018 	/* Validate that this is doing the correct thing. */
7019 	/* Should we keep track on en/dequeue? */
7020 	IMPROVE();
7021 }
7022 
7023 /*
7024  * We are called from ieee80211_free_txskb() or ieee80211_tx_status().
7025  * The latter tries to derive the success status from the info flags
7026  * passed back from the driver.  rawx_mit() saves the ni on the m and the
7027  * m on the skb for us to be able to give feedback to net80211.
7028  */
7029 static void
7030 _lkpi_ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb,
7031     int status)
7032 {
7033 	struct ieee80211_node *ni;
7034 	struct mbuf *m;
7035 
7036 	m = skb->m;
7037 	skb->m = NULL;
7038 
7039 	if (m != NULL) {
7040 		ni = m->m_pkthdr.PH_loc.ptr;
7041 		/* Status: 0 is ok, != 0 is error. */
7042 		ieee80211_tx_complete(ni, m, status);
7043 		/* ni & mbuf were consumed. */
7044 	}
7045 }
7046 
7047 void
7048 linuxkpi_ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb,
7049     int status)
7050 {
7051 
7052 	_lkpi_ieee80211_free_txskb(hw, skb, status);
7053 	kfree_skb(skb);
7054 }
7055 
7056 void
7057 linuxkpi_ieee80211_tx_status_ext(struct ieee80211_hw *hw,
7058     struct ieee80211_tx_status *txstat)
7059 {
7060 	struct sk_buff *skb;
7061 	struct ieee80211_tx_info *info;
7062 	struct ieee80211_ratectl_tx_status txs;
7063 	struct ieee80211_node *ni;
7064 	int status;
7065 
7066 	skb = txstat->skb;
7067 	if (skb->m != NULL) {
7068 		struct mbuf *m;
7069 
7070 		m = skb->m;
7071 		ni = m->m_pkthdr.PH_loc.ptr;
7072 		memset(&txs, 0, sizeof(txs));
7073 	} else {
7074 		ni = NULL;
7075 	}
7076 
7077 	info = txstat->info;
7078 	if (info->flags & IEEE80211_TX_STAT_ACK) {
7079 		status = 0;	/* No error. */
7080 		txs.status = IEEE80211_RATECTL_TX_SUCCESS;
7081 	} else {
7082 		status = 1;
7083 		txs.status = IEEE80211_RATECTL_TX_FAIL_UNSPECIFIED;
7084 	}
7085 
7086 	if (ni != NULL) {
7087 		txs.pktlen = skb->len;
7088 		txs.flags |= IEEE80211_RATECTL_STATUS_PKTLEN;
7089 		if (info->status.rates[0].count > 1) {
7090 			txs.long_retries = info->status.rates[0].count - 1;	/* 1 + retries in drivers. */
7091 			txs.flags |= IEEE80211_RATECTL_STATUS_LONG_RETRY;
7092 		}
7093 #if 0		/* Unused in net80211 currently. */
7094 		/* XXX-BZ convert check .flags for MCS/VHT/.. */
7095 		txs.final_rate = info->status.rates[0].idx;
7096 		txs.flags |= IEEE80211_RATECTL_STATUS_FINAL_RATE;
7097 #endif
7098 		if (info->status.flags & IEEE80211_TX_STATUS_ACK_SIGNAL_VALID) {
7099 			txs.rssi = info->status.ack_signal;		/* XXX-BZ CONVERT? */
7100 			txs.flags |= IEEE80211_RATECTL_STATUS_RSSI;
7101 		}
7102 
7103 		IMPROVE("only update rate if needed but that requires us to get a proper rate from mo_sta_statistics");
7104 		ieee80211_ratectl_tx_complete(ni, &txs);
7105 		ieee80211_ratectl_rate(ni->ni_vap->iv_bss, NULL, 0);
7106 
7107 #ifdef LINUXKPI_DEBUG_80211
7108 		if (linuxkpi_debug_80211 & D80211_TRACE_TX) {
7109 			printf("TX-RATE: %s: long_retries %d\n", __func__,
7110 			    txs.long_retries);
7111 		}
7112 #endif
7113 	}
7114 
7115 #ifdef LINUXKPI_DEBUG_80211
7116 	if (linuxkpi_debug_80211 & D80211_TRACE_TX)
7117 		printf("TX-STATUS: %s: hw %p skb %p status %d : flags %#x "
7118 		    "band %u hw_queue %u tx_time_est %d : "
7119 		    "rates [ %u %u %#x, %u %u %#x, %u %u %#x, %u %u %#x ] "
7120 		    "ack_signal %u ampdu_ack_len %u ampdu_len %u antenna %u "
7121 		    "tx_time %u flags %#x "
7122 		    "status_driver_data [ %p %p ]\n",
7123 		    __func__, hw, skb, status, info->flags,
7124 		    info->band, info->hw_queue, info->tx_time_est,
7125 		    info->status.rates[0].idx, info->status.rates[0].count,
7126 		    info->status.rates[0].flags,
7127 		    info->status.rates[1].idx, info->status.rates[1].count,
7128 		    info->status.rates[1].flags,
7129 		    info->status.rates[2].idx, info->status.rates[2].count,
7130 		    info->status.rates[2].flags,
7131 		    info->status.rates[3].idx, info->status.rates[3].count,
7132 		    info->status.rates[3].flags,
7133 		    info->status.ack_signal, info->status.ampdu_ack_len,
7134 		    info->status.ampdu_len, info->status.antenna,
7135 		    info->status.tx_time, info->status.flags,
7136 		    info->status.status_driver_data[0],
7137 		    info->status.status_driver_data[1]);
7138 #endif
7139 
7140 	if (txstat->free_list) {
7141 		_lkpi_ieee80211_free_txskb(hw, skb, status);
7142 		list_add_tail(&skb->list, txstat->free_list);
7143 	} else {
7144 		linuxkpi_ieee80211_free_txskb(hw, skb, status);
7145 	}
7146 }
7147 
7148 void
7149 linuxkpi_ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
7150 {
7151 	struct ieee80211_tx_status status;
7152 
7153 	memset(&status, 0, sizeof(status));
7154 	status.info = IEEE80211_SKB_CB(skb);
7155 	status.skb = skb;
7156 	/* sta, n_rates, rates, free_list? */
7157 
7158 	ieee80211_tx_status_ext(hw, &status);
7159 }
7160 
7161 /*
7162  * This is an internal bandaid for the moment for the way we glue
7163  * skbs and mbufs together for TX.  Once we have skbs backed by
7164  * mbufs this should go away.
7165  * This is a public function but kept on the private KPI (lkpi_)
7166  * and is not exposed by a header file.
7167  */
7168 static void
7169 lkpi_ieee80211_free_skb_mbuf(void *p)
7170 {
7171 	struct ieee80211_node *ni;
7172 	struct mbuf *m;
7173 
7174 	if (p == NULL)
7175 		return;
7176 
7177 	m = (struct mbuf *)p;
7178 	M_ASSERTPKTHDR(m);
7179 
7180 	ni = m->m_pkthdr.PH_loc.ptr;
7181 	m->m_pkthdr.PH_loc.ptr = NULL;
7182 	if (ni != NULL)
7183 		ieee80211_free_node(ni);
7184 	m_freem(m);
7185 }
7186 
7187 void
7188 linuxkpi_ieee80211_queue_delayed_work(struct ieee80211_hw *hw,
7189     struct delayed_work *w, int delay)
7190 {
7191 	struct lkpi_hw *lhw;
7192 
7193 	/* Need to make sure hw is in a stable (non-suspended) state. */
7194 	IMPROVE();
7195 
7196 	lhw = HW_TO_LHW(hw);
7197 	queue_delayed_work(lhw->workq, w, delay);
7198 }
7199 
7200 void
7201 linuxkpi_ieee80211_queue_work(struct ieee80211_hw *hw,
7202     struct work_struct *w)
7203 {
7204 	struct lkpi_hw *lhw;
7205 
7206 	/* Need to make sure hw is in a stable (non-suspended) state. */
7207 	IMPROVE();
7208 
7209 	lhw = HW_TO_LHW(hw);
7210 	queue_work(lhw->workq, w);
7211 }
7212 
7213 struct sk_buff *
7214 linuxkpi_ieee80211_probereq_get(struct ieee80211_hw *hw, uint8_t *addr,
7215     uint8_t *ssid, size_t ssid_len, size_t tailroom)
7216 {
7217 	struct sk_buff *skb;
7218 	struct ieee80211_frame *wh;
7219 	uint8_t *p;
7220 	size_t len;
7221 
7222 	len = sizeof(*wh);
7223 	len += 2 + ssid_len;
7224 
7225 	skb = dev_alloc_skb(hw->extra_tx_headroom + len + tailroom);
7226 	if (skb == NULL)
7227 		return (NULL);
7228 
7229 	skb_reserve(skb, hw->extra_tx_headroom);
7230 
7231 	wh = skb_put_zero(skb, sizeof(*wh));
7232 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0;
7233 	wh->i_fc[0] |= IEEE80211_FC0_SUBTYPE_PROBE_REQ | IEEE80211_FC0_TYPE_MGT;
7234 	IEEE80211_ADDR_COPY(wh->i_addr1, ieee80211broadcastaddr);
7235 	IEEE80211_ADDR_COPY(wh->i_addr2, addr);
7236 	IEEE80211_ADDR_COPY(wh->i_addr3, ieee80211broadcastaddr);
7237 
7238 	p = skb_put(skb, 2 + ssid_len);
7239 	*p++ = IEEE80211_ELEMID_SSID;
7240 	*p++ = ssid_len;
7241 	if (ssid_len > 0)
7242 		memcpy(p, ssid, ssid_len);
7243 
7244 	return (skb);
7245 }
7246 
7247 struct sk_buff *
7248 linuxkpi_ieee80211_pspoll_get(struct ieee80211_hw *hw,
7249     struct ieee80211_vif *vif)
7250 {
7251 	struct lkpi_vif *lvif;
7252 	struct ieee80211vap *vap;
7253 	struct sk_buff *skb;
7254 	struct ieee80211_frame_pspoll *psp;
7255 	uint16_t v;
7256 
7257 	skb = dev_alloc_skb(hw->extra_tx_headroom + sizeof(*psp));
7258 	if (skb == NULL)
7259 		return (NULL);
7260 
7261 	skb_reserve(skb, hw->extra_tx_headroom);
7262 
7263 	lvif = VIF_TO_LVIF(vif);
7264 	vap = LVIF_TO_VAP(lvif);
7265 
7266 	psp = skb_put_zero(skb, sizeof(*psp));
7267 	psp->i_fc[0] = IEEE80211_FC0_VERSION_0;
7268 	psp->i_fc[0] |= IEEE80211_FC0_SUBTYPE_PS_POLL | IEEE80211_FC0_TYPE_CTL;
7269 	v = htole16(vif->cfg.aid | 1<<15 | 1<<16);
7270 	memcpy(&psp->i_aid, &v, sizeof(v));
7271 	IEEE80211_ADDR_COPY(psp->i_bssid, vap->iv_bss->ni_macaddr);
7272 	IEEE80211_ADDR_COPY(psp->i_ta, vif->addr);
7273 
7274 	return (skb);
7275 }
7276 
7277 struct sk_buff *
7278 linuxkpi_ieee80211_nullfunc_get(struct ieee80211_hw *hw,
7279     struct ieee80211_vif *vif, int linkid, bool qos)
7280 {
7281 	struct lkpi_vif *lvif;
7282 	struct ieee80211vap *vap;
7283 	struct sk_buff *skb;
7284 	struct ieee80211_frame *nullf;
7285 
7286 	IMPROVE("linkid");
7287 
7288 	skb = dev_alloc_skb(hw->extra_tx_headroom + sizeof(*nullf));
7289 	if (skb == NULL)
7290 		return (NULL);
7291 
7292 	skb_reserve(skb, hw->extra_tx_headroom);
7293 
7294 	lvif = VIF_TO_LVIF(vif);
7295 	vap = LVIF_TO_VAP(lvif);
7296 
7297 	nullf = skb_put_zero(skb, sizeof(*nullf));
7298 	nullf->i_fc[0] = IEEE80211_FC0_VERSION_0;
7299 	nullf->i_fc[0] |= IEEE80211_FC0_SUBTYPE_NODATA | IEEE80211_FC0_TYPE_DATA;
7300 	nullf->i_fc[1] = IEEE80211_FC1_DIR_TODS;
7301 
7302 	IEEE80211_ADDR_COPY(nullf->i_addr1, vap->iv_bss->ni_bssid);
7303 	IEEE80211_ADDR_COPY(nullf->i_addr2, vif->addr);
7304 	IEEE80211_ADDR_COPY(nullf->i_addr3, vap->iv_bss->ni_macaddr);
7305 
7306 	return (skb);
7307 }
7308 
7309 struct wireless_dev *
7310 linuxkpi_ieee80211_vif_to_wdev(struct ieee80211_vif *vif)
7311 {
7312 	struct lkpi_vif *lvif;
7313 
7314 	lvif = VIF_TO_LVIF(vif);
7315 	return (&lvif->wdev);
7316 }
7317 
7318 void
7319 linuxkpi_ieee80211_connection_loss(struct ieee80211_vif *vif)
7320 {
7321 	struct lkpi_vif *lvif;
7322 	struct ieee80211vap *vap;
7323 	enum ieee80211_state nstate;
7324 	int arg;
7325 
7326 	lvif = VIF_TO_LVIF(vif);
7327 	vap = LVIF_TO_VAP(lvif);
7328 
7329 	/*
7330 	 * Go to init; otherwise we need to elaborately check state and
7331 	 * handle accordingly, e.g., if in RUN we could call iv_bmiss.
7332 	 * Let the statemachine handle all neccessary changes.
7333 	 */
7334 	nstate = IEEE80211_S_INIT;
7335 	arg = 0;	/* Not a valid reason. */
7336 
7337 	ic_printf(vap->iv_ic, "%s: vif %p vap %p state %s\n", __func__,
7338 	    vif, vap, ieee80211_state_name[vap->iv_state]);
7339 	ieee80211_new_state(vap, nstate, arg);
7340 }
7341 
7342 void
7343 linuxkpi_ieee80211_beacon_loss(struct ieee80211_vif *vif)
7344 {
7345 	struct lkpi_vif *lvif;
7346 	struct ieee80211vap *vap;
7347 
7348 	lvif = VIF_TO_LVIF(vif);
7349 	vap = LVIF_TO_VAP(lvif);
7350 
7351 	ic_printf(vap->iv_ic, "%s: vif %p vap %p state %s\n", __func__,
7352 	    vif, vap, ieee80211_state_name[vap->iv_state]);
7353 	ieee80211_beacon_miss(vap->iv_ic);
7354 }
7355 
7356 /* -------------------------------------------------------------------------- */
7357 
7358 void
7359 linuxkpi_ieee80211_stop_queue(struct ieee80211_hw *hw, int qnum)
7360 {
7361 	struct lkpi_hw *lhw;
7362 	struct lkpi_vif *lvif;
7363 	struct ieee80211_vif *vif;
7364 	int ac_count, ac;
7365 
7366 	KASSERT(qnum < hw->queues, ("%s: qnum %d >= hw->queues %d, hw %p\n",
7367 	    __func__, qnum, hw->queues, hw));
7368 
7369 	lhw = wiphy_priv(hw->wiphy);
7370 
7371 	/* See lkpi_ic_vap_create(). */
7372 	if (hw->queues >= IEEE80211_NUM_ACS)
7373 		ac_count = IEEE80211_NUM_ACS;
7374 	else
7375 		ac_count = 1;
7376 
7377 	LKPI_80211_LHW_LVIF_LOCK(lhw);
7378 	TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
7379 
7380 		vif = LVIF_TO_VIF(lvif);
7381 		for (ac = 0; ac < ac_count; ac++) {
7382 			IMPROVE_TXQ("LOCKING");
7383 			if (qnum == vif->hw_queue[ac]) {
7384 #ifdef LINUXKPI_DEBUG_80211
7385 				/*
7386 				 * For now log this to better understand
7387 				 * how this is supposed to work.
7388 				 */
7389 				if (lvif->hw_queue_stopped[ac] &&
7390 				    (linuxkpi_debug_80211 & D80211_IMPROVE_TXQ) != 0)
7391 					ic_printf(lhw->ic, "%s:%d: lhw %p hw %p "
7392 					    "lvif %p vif %p ac %d qnum %d already "
7393 					    "stopped\n", __func__, __LINE__,
7394 					    lhw, hw, lvif, vif, ac, qnum);
7395 #endif
7396 				lvif->hw_queue_stopped[ac] = true;
7397 			}
7398 		}
7399 	}
7400 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
7401 }
7402 
7403 void
7404 linuxkpi_ieee80211_stop_queues(struct ieee80211_hw *hw)
7405 {
7406 	int i;
7407 
7408 	IMPROVE_TXQ("Locking; do we need further info?");
7409 	for (i = 0; i < hw->queues; i++)
7410 		linuxkpi_ieee80211_stop_queue(hw, i);
7411 }
7412 
7413 
7414 static void
7415 lkpi_ieee80211_wake_queues(struct ieee80211_hw *hw, int hwq)
7416 {
7417 	struct lkpi_hw *lhw;
7418 	struct lkpi_vif *lvif;
7419 	struct lkpi_sta *lsta;
7420 	int ac_count, ac, tid;
7421 
7422 	/* See lkpi_ic_vap_create(). */
7423 	if (hw->queues >= IEEE80211_NUM_ACS)
7424 		ac_count = IEEE80211_NUM_ACS;
7425 	else
7426 		ac_count = 1;
7427 
7428 	lhw = wiphy_priv(hw->wiphy);
7429 
7430 	IMPROVE_TXQ("Locking");
7431 	LKPI_80211_LHW_LVIF_LOCK(lhw);
7432 	TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
7433 		struct ieee80211_vif *vif;
7434 
7435 		vif = LVIF_TO_VIF(lvif);
7436 		for (ac = 0; ac < ac_count; ac++) {
7437 
7438 			if (hwq == vif->hw_queue[ac]) {
7439 
7440 				/* XXX-BZ what about software scan? */
7441 
7442 #ifdef LINUXKPI_DEBUG_80211
7443 				/*
7444 				 * For now log this to better understand
7445 				 * how this is supposed to work.
7446 				 */
7447 				if (!lvif->hw_queue_stopped[ac] &&
7448 				    (linuxkpi_debug_80211 & D80211_IMPROVE_TXQ) != 0)
7449 					ic_printf(lhw->ic, "%s:%d: lhw %p hw %p "
7450 					    "lvif %p vif %p ac %d hw_q not stopped\n",
7451 					    __func__, __LINE__,
7452 					    lhw, hw, lvif, vif, ac);
7453 #endif
7454 				lvif->hw_queue_stopped[ac] = false;
7455 
7456 				rcu_read_lock();
7457 				list_for_each_entry_rcu(lsta, &lvif->lsta_list, lsta_list) {
7458 					struct ieee80211_sta *sta;
7459 
7460 					sta = LSTA_TO_STA(lsta);
7461 					for (tid = 0; tid < nitems(sta->txq); tid++) {
7462 						struct lkpi_txq *ltxq;
7463 
7464 						if (sta->txq[tid] == NULL)
7465 							continue;
7466 
7467 						if (sta->txq[tid]->ac != ac)
7468 							continue;
7469 
7470 						ltxq = TXQ_TO_LTXQ(sta->txq[tid]);
7471 						if (!ltxq->stopped)
7472 							continue;
7473 
7474 						ltxq->stopped = false;
7475 
7476 						/* XXX-BZ see when this explodes with all the locking. taskq? */
7477 						lkpi_80211_mo_wake_tx_queue(hw, sta->txq[tid]);
7478 					}
7479 				}
7480 				rcu_read_unlock();
7481 			}
7482 		}
7483 	}
7484 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
7485 }
7486 
7487 void
7488 linuxkpi_ieee80211_wake_queues(struct ieee80211_hw *hw)
7489 {
7490 	int i;
7491 
7492 	IMPROVE_TXQ("Is this all/enough here?");
7493 	for (i = 0; i < hw->queues; i++)
7494 		lkpi_ieee80211_wake_queues(hw, i);
7495 }
7496 
7497 void
7498 linuxkpi_ieee80211_wake_queue(struct ieee80211_hw *hw, int qnum)
7499 {
7500 
7501 	KASSERT(qnum < hw->queues, ("%s: qnum %d >= hw->queues %d, hw %p\n",
7502 	    __func__, qnum, hw->queues, hw));
7503 
7504 	lkpi_ieee80211_wake_queues(hw, qnum);
7505 }
7506 
7507 /* This is just hardware queues. */
7508 void
7509 linuxkpi_ieee80211_txq_schedule_start(struct ieee80211_hw *hw, uint8_t ac)
7510 {
7511 	struct lkpi_hw *lhw;
7512 
7513 	lhw = HW_TO_LHW(hw);
7514 
7515 	IMPROVE_TXQ("Are there reasons why we wouldn't schedule?");
7516 	IMPROVE_TXQ("LOCKING");
7517 	if (++lhw->txq_generation[ac] == 0)
7518 		lhw->txq_generation[ac]++;
7519 }
7520 
7521 struct ieee80211_txq *
7522 linuxkpi_ieee80211_next_txq(struct ieee80211_hw *hw, uint8_t ac)
7523 {
7524 	struct lkpi_hw *lhw;
7525 	struct ieee80211_txq *txq;
7526 	struct lkpi_txq *ltxq;
7527 
7528 	lhw = HW_TO_LHW(hw);
7529 	txq = NULL;
7530 
7531 	IMPROVE_TXQ("LOCKING");
7532 
7533 	/* Check that we are scheduled. */
7534 	if (lhw->txq_generation[ac] == 0)
7535 		goto out;
7536 
7537 	ltxq = TAILQ_FIRST(&lhw->scheduled_txqs[ac]);
7538 	if (ltxq == NULL)
7539 		goto out;
7540 	if (ltxq->txq_generation == lhw->txq_generation[ac])
7541 		goto out;
7542 
7543 	ltxq->txq_generation = lhw->txq_generation[ac];
7544 	TAILQ_REMOVE(&lhw->scheduled_txqs[ac], ltxq, txq_entry);
7545 	txq = &ltxq->txq;
7546 	TAILQ_ELEM_INIT(ltxq, txq_entry);
7547 
7548 out:
7549 	return (txq);
7550 }
7551 
7552 void linuxkpi_ieee80211_schedule_txq(struct ieee80211_hw *hw,
7553     struct ieee80211_txq *txq, bool withoutpkts)
7554 {
7555 	struct lkpi_hw *lhw;
7556 	struct lkpi_txq *ltxq;
7557 	bool ltxq_empty;
7558 
7559 	ltxq = TXQ_TO_LTXQ(txq);
7560 
7561 	IMPROVE_TXQ("LOCKING");
7562 
7563 	/* Only schedule if work to do or asked to anyway. */
7564 	LKPI_80211_LTXQ_LOCK(ltxq);
7565 	ltxq_empty = skb_queue_empty(&ltxq->skbq);
7566 	LKPI_80211_LTXQ_UNLOCK(ltxq);
7567 	if (!withoutpkts && ltxq_empty)
7568 		goto out;
7569 
7570 	/*
7571 	 * Make sure we do not double-schedule. We do this by checking tqe_prev,
7572 	 * the previous entry in our tailq. tqe_prev is always valid if this entry
7573 	 * is queued, tqe_next may be NULL if this is the only element in the list.
7574 	 */
7575 	if (ltxq->txq_entry.tqe_prev != NULL)
7576 		goto out;
7577 
7578 	lhw = HW_TO_LHW(hw);
7579 	TAILQ_INSERT_TAIL(&lhw->scheduled_txqs[txq->ac], ltxq, txq_entry);
7580 out:
7581 	return;
7582 }
7583 
7584 void
7585 linuxkpi_ieee80211_handle_wake_tx_queue(struct ieee80211_hw *hw,
7586     struct ieee80211_txq *txq)
7587 {
7588 	struct lkpi_hw *lhw;
7589 	struct ieee80211_txq *ntxq;
7590 	struct ieee80211_tx_control control;
7591         struct sk_buff *skb;
7592 
7593 	lhw = HW_TO_LHW(hw);
7594 
7595 	LKPI_80211_LHW_TXQ_LOCK(lhw);
7596 	ieee80211_txq_schedule_start(hw, txq->ac);
7597 	do {
7598 		ntxq = ieee80211_next_txq(hw, txq->ac);
7599 		if (ntxq == NULL)
7600 			break;
7601 
7602 		memset(&control, 0, sizeof(control));
7603 		control.sta = ntxq->sta;
7604 		do {
7605 			skb = linuxkpi_ieee80211_tx_dequeue(hw, ntxq);
7606 			if (skb == NULL)
7607 				break;
7608 			lkpi_80211_mo_tx(hw, &control, skb);
7609 		} while(1);
7610 
7611 		ieee80211_return_txq(hw, ntxq, false);
7612 	} while (1);
7613 	ieee80211_txq_schedule_end(hw, txq->ac);
7614 	LKPI_80211_LHW_TXQ_UNLOCK(lhw);
7615 }
7616 
7617 /* -------------------------------------------------------------------------- */
7618 
7619 struct lkpi_cfg80211_bss {
7620 	u_int refcnt;
7621 	struct cfg80211_bss bss;
7622 };
7623 
7624 struct lkpi_cfg80211_get_bss_iter_lookup {
7625 	struct wiphy *wiphy;
7626 	struct linuxkpi_ieee80211_channel *chan;
7627 	const uint8_t *bssid;
7628 	const uint8_t *ssid;
7629 	size_t ssid_len;
7630 	enum ieee80211_bss_type bss_type;
7631 	enum ieee80211_privacy privacy;
7632 
7633 	/*
7634 	 * Something to store a copy of the result as the net80211 scan cache
7635 	 * is not refoucnted so a scan entry might go away any time.
7636 	 */
7637 	bool match;
7638 	struct cfg80211_bss *bss;
7639 };
7640 
7641 static void
7642 lkpi_cfg80211_get_bss_iterf(void *arg, const struct ieee80211_scan_entry *se)
7643 {
7644 	struct lkpi_cfg80211_get_bss_iter_lookup *lookup;
7645 	size_t ielen;
7646 
7647 	lookup = arg;
7648 
7649 	/* Do not try to find another match. */
7650 	if (lookup->match)
7651 		return;
7652 
7653 	/* Nothing to store result. */
7654 	if (lookup->bss == NULL)
7655 		return;
7656 
7657 	if (lookup->privacy != IEEE80211_PRIVACY_ANY) {
7658 		/* if (se->se_capinfo & IEEE80211_CAPINFO_PRIVACY) */
7659 		/* We have no idea what to compare to as the drivers only request ANY */
7660 		return;
7661 	}
7662 
7663 	if (lookup->bss_type != IEEE80211_BSS_TYPE_ANY) {
7664 		/* if (se->se_capinfo & (IEEE80211_CAPINFO_IBSS|IEEE80211_CAPINFO_ESS)) */
7665 		/* We have no idea what to compare to as the drivers only request ANY */
7666 		return;
7667 	}
7668 
7669 	if (lookup->chan != NULL) {
7670 		struct linuxkpi_ieee80211_channel *chan;
7671 
7672 		chan = linuxkpi_ieee80211_get_channel(lookup->wiphy,
7673 		    se->se_chan->ic_freq);
7674 		if (chan == NULL || chan != lookup->chan)
7675 			return;
7676 	}
7677 
7678 	if (lookup->bssid && !IEEE80211_ADDR_EQ(lookup->bssid, se->se_bssid))
7679 		return;
7680 
7681 	if (lookup->ssid) {
7682 		if (lookup->ssid_len != se->se_ssid[1] ||
7683 		    se->se_ssid[1] == 0)
7684 			return;
7685 		if (memcmp(lookup->ssid, se->se_ssid+2, lookup->ssid_len) != 0)
7686 			return;
7687 	}
7688 
7689 	ielen = se->se_ies.len;
7690 
7691 	lookup->bss->ies = malloc(sizeof(*lookup->bss->ies) + ielen,
7692 	    M_LKPI80211, M_NOWAIT | M_ZERO);
7693 	if (lookup->bss->ies == NULL)
7694 		return;
7695 
7696 	lookup->bss->ies->data = (uint8_t *)lookup->bss->ies + sizeof(*lookup->bss->ies);
7697 	lookup->bss->ies->len = ielen;
7698 	if (ielen)
7699 		memcpy(lookup->bss->ies->data, se->se_ies.data, ielen);
7700 
7701 	lookup->match = true;
7702 }
7703 
7704 struct cfg80211_bss *
7705 linuxkpi_cfg80211_get_bss(struct wiphy *wiphy, struct linuxkpi_ieee80211_channel *chan,
7706     const uint8_t *bssid, const uint8_t *ssid, size_t ssid_len,
7707     enum ieee80211_bss_type bss_type, enum ieee80211_privacy privacy)
7708 {
7709 	struct lkpi_cfg80211_bss *lbss;
7710 	struct lkpi_cfg80211_get_bss_iter_lookup lookup;
7711 	struct lkpi_hw *lhw;
7712 	struct ieee80211vap *vap;
7713 
7714 	lhw = wiphy_priv(wiphy);
7715 
7716 	/* Let's hope we can alloc. */
7717 	lbss = malloc(sizeof(*lbss), M_LKPI80211, M_NOWAIT | M_ZERO);
7718 	if (lbss == NULL) {
7719 		ic_printf(lhw->ic, "%s: alloc failed.\n", __func__);
7720 		return (NULL);
7721 	}
7722 
7723 	lookup.wiphy = wiphy;
7724 	lookup.chan = chan;
7725 	lookup.bssid = bssid;
7726 	lookup.ssid = ssid;
7727 	lookup.ssid_len = ssid_len;
7728 	lookup.bss_type = bss_type;
7729 	lookup.privacy = privacy;
7730 	lookup.match = false;
7731 	lookup.bss = &lbss->bss;
7732 
7733 	IMPROVE("Iterate over all VAPs comparing perm_addr and addresses?");
7734 	vap = TAILQ_FIRST(&lhw->ic->ic_vaps);
7735 	ieee80211_scan_iterate(vap, lkpi_cfg80211_get_bss_iterf, &lookup);
7736 	if (!lookup.match) {
7737 		free(lbss, M_LKPI80211);
7738 		return (NULL);
7739 	}
7740 
7741 	refcount_init(&lbss->refcnt, 1);
7742 	return (&lbss->bss);
7743 }
7744 
7745 void
7746 linuxkpi_cfg80211_put_bss(struct wiphy *wiphy, struct cfg80211_bss *bss)
7747 {
7748 	struct lkpi_cfg80211_bss *lbss;
7749 
7750 	lbss = container_of(bss, struct lkpi_cfg80211_bss, bss);
7751 
7752 	/* Free everything again on refcount ... */
7753 	if (refcount_release(&lbss->refcnt)) {
7754 		free(lbss->bss.ies, M_LKPI80211);
7755 		free(lbss, M_LKPI80211);
7756 	}
7757 }
7758 
7759 void
7760 linuxkpi_cfg80211_bss_flush(struct wiphy *wiphy)
7761 {
7762 	struct lkpi_hw *lhw;
7763 	struct ieee80211com *ic;
7764 	struct ieee80211vap *vap;
7765 
7766 	lhw = wiphy_priv(wiphy);
7767 	ic = lhw->ic;
7768 
7769 	/*
7770 	 * If we haven't called ieee80211_ifattach() yet
7771 	 * or there is no VAP, there are no scans to flush.
7772 	 */
7773 	if (ic == NULL ||
7774 	    (lhw->sc_flags & LKPI_MAC80211_DRV_STARTED) == 0)
7775 		return;
7776 
7777 	/* Should only happen on the current one? Not seen it late enough. */
7778 	IEEE80211_LOCK(ic);
7779 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
7780 		ieee80211_scan_flush(vap);
7781 	IEEE80211_UNLOCK(ic);
7782 }
7783 
7784 /* -------------------------------------------------------------------------- */
7785 
7786 /*
7787  * hw->conf get initialized/set in various places for us:
7788  * - linuxkpi_ieee80211_alloc_hw(): flags
7789  * - linuxkpi_ieee80211_ifattach(): chandef
7790  * - lkpi_ic_vap_create(): listen_interval
7791  * - lkpi_ic_set_channel(): chandef, flags
7792  */
7793 
7794 int lkpi_80211_update_chandef(struct ieee80211_hw *hw,
7795     struct ieee80211_chanctx_conf *new)
7796 {
7797 	struct cfg80211_chan_def *cd;
7798 	uint32_t changed;
7799 	int error;
7800 
7801 	changed = 0;
7802 	if (new == NULL || new->def.chan == NULL)
7803 		cd = NULL;
7804 	else
7805 		cd = &new->def;
7806 
7807 	if (cd && cd->chan != hw->conf.chandef.chan) {
7808 		/* Copy; the chan pointer is fine and will stay valid. */
7809 		hw->conf.chandef = *cd;
7810 		changed |= IEEE80211_CONF_CHANGE_CHANNEL;
7811 	}
7812 	IMPROVE("IEEE80211_CONF_CHANGE_PS, IEEE80211_CONF_CHANGE_POWER");
7813 
7814 	if (changed == 0)
7815 		return (0);
7816 
7817 	error = lkpi_80211_mo_config(hw, changed);
7818 	return (error);
7819 }
7820 
7821 /* -------------------------------------------------------------------------- */
7822 
7823 MODULE_VERSION(linuxkpi_wlan, 1);
7824 MODULE_DEPEND(linuxkpi_wlan, linuxkpi, 1, 1, 1);
7825 MODULE_DEPEND(linuxkpi_wlan, wlan, 1, 1, 1);
7826