xref: /freebsd/sys/compat/linuxkpi/common/src/linux_80211.c (revision 166a7344df582f98a88f2b37b7aa3dc4558c9438)
1 /*-
2  * Copyright (c) 2020-2026 The FreeBSD Foundation
3  * Copyright (c) 2020-2025 Bjoern A. Zeeb
4  *
5  * This software was developed by Björn Zeeb under sponsorship from
6  * the FreeBSD Foundation.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  */
29 
30 /*
31  * Public functions are called linuxkpi_*().
32  * Internal (static) functions are called lkpi_*().
33  *
34  * The internal structures holding metadata over public structures are also
35  * called lkpi_xxx (usually with a member at the end called xxx).
36  * Note: we do not replicate the structure names but the general variable names
37  * for these (e.g., struct hw -> struct lkpi_hw, struct sta -> struct lkpi_sta).
38  * There are macros to access one from the other.
39  * We call the internal versions lxxx (e.g., hw -> lhw, sta -> lsta).
40  */
41 
42 /*
43  * TODO:
44  * - lots :)
45  * - HW_CRYPTO: we need a "keystore" and an ordered list for suspend/resume.
46  */
47 
48 #include <sys/param.h>
49 #include <sys/types.h>
50 #include <sys/kernel.h>
51 #include <sys/errno.h>
52 #include <sys/malloc.h>
53 #include <sys/module.h>
54 #include <sys/mutex.h>
55 #include <sys/sbuf.h>
56 #include <sys/socket.h>
57 #include <sys/sysctl.h>
58 #include <sys/queue.h>
59 #include <sys/taskqueue.h>
60 #include <sys/libkern.h>
61 
62 #include <net/if.h>
63 #include <net/if_var.h>
64 #include <net/if_media.h>
65 #include <net/ethernet.h>
66 
67 #include <net80211/ieee80211_var.h>
68 #include <net80211/ieee80211_proto.h>
69 #include <net80211/ieee80211_ratectl.h>
70 #include <net80211/ieee80211_radiotap.h>
71 #include <net80211/ieee80211_vht.h>
72 
73 #define	LINUXKPI_NET80211
74 #include <net/mac80211.h>
75 
76 #include <linux/workqueue.h>
77 #include <linux/rculist.h>
78 #include "linux_80211.h"
79 
80 /* #define	LKPI_80211_USE_SCANLIST */
81 /* #define	LKPI_80211_BGSCAN */
82 #define	LKPI_80211_WME
83 #define	LKPI_80211_HW_CRYPTO
84 #define	LKPI_80211_HT
85 #define	LKPI_80211_VHT
86 
87 #if defined(LKPI_80211_VHT) && !defined(LKPI_80211_HT)
88 #define	LKPI_80211_HT
89 #endif
90 #if defined(LKPI_80211_HT) && !defined(LKPI_80211_HW_CRYPTO)
91 #define	LKPI_80211_HW_CRYPTO
92 #endif
93 
94 static MALLOC_DEFINE(M_LKPI80211, "lkpi80211", "LinuxKPI 80211 compat");
95 
96 /* XXX-BZ really want this and others in queue.h */
97 #define	TAILQ_ELEM_INIT(elm, field) do {				\
98 	(elm)->field.tqe_next = NULL;					\
99 	(elm)->field.tqe_prev = NULL;					\
100 } while (0)
101 
102 /* -------------------------------------------------------------------------- */
103 
104 SYSCTL_DECL(_compat_linuxkpi);
105 SYSCTL_NODE(_compat_linuxkpi, OID_AUTO, 80211, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
106     "LinuxKPI 802.11 compatibility layer");
107 
108 static bool lkpi_order_scanlist = false;
109 SYSCTL_BOOL(_compat_linuxkpi_80211, OID_AUTO, order_scanlist, CTLFLAG_RW,
110     &lkpi_order_scanlist, 0, "Enable LinuxKPI 802.11 scan list shuffeling");
111 
112 #if defined(LKPI_80211_HW_CRYPTO)
113 static bool lkpi_hwcrypto = false;
114 SYSCTL_BOOL(_compat_linuxkpi_80211, OID_AUTO, hw_crypto, CTLFLAG_RDTUN,
115     &lkpi_hwcrypto, 0, "Enable LinuxKPI 802.11 hardware crypto offload");
116 
117 static bool lkpi_hwcrypto_tkip = false;
118 SYSCTL_BOOL(_compat_linuxkpi_80211, OID_AUTO, tkip, CTLFLAG_RDTUN,
119     &lkpi_hwcrypto_tkip, 0, "Enable LinuxKPI 802.11 TKIP crypto offload");
120 #endif
121 
122 /* Keep public for as long as header files are using it too. */
123 int linuxkpi_debug_80211;
124 
125 #ifdef LINUXKPI_DEBUG_80211
126 SYSCTL_INT(_compat_linuxkpi_80211, OID_AUTO, debug, CTLFLAG_RWTUN,
127     &linuxkpi_debug_80211, 0, "LinuxKPI 802.11 debug level");
128 
129 #define	UNIMPLEMENTED		if (linuxkpi_debug_80211 & D80211_TODO)		\
130     printf("XXX-TODO %s:%d: UNIMPLEMENTED\n", __func__, __LINE__)
131 #define	TRACEOK(_fmt, ...)	if (linuxkpi_debug_80211 & D80211_TRACEOK)	\
132     printf("%s:%d: TRACEPOINT " _fmt "\n", __func__, __LINE__, ##__VA_ARGS__)
133 #else
134 #define	UNIMPLEMENTED		do { } while (0)
135 #define	TRACEOK(...)		do { } while (0)
136 #endif
137 
138 /* #define	PREP_TX_INFO_DURATION	(IEEE80211_TRANS_WAIT * 1000) */
139 #ifndef PREP_TX_INFO_DURATION
140 #define	PREP_TX_INFO_DURATION	0 /* Let the driver do its thing. */
141 #endif
142 
143 /* This is DSAP | SSAP | CTRL | ProtoID/OrgCode{3}. */
144 const uint8_t rfc1042_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
145 
146 /* IEEE 802.11-05/0257r1 */
147 const uint8_t bridge_tunnel_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
148 
149 /* IEEE 802.11e Table 20i-UP-to-AC mappings. */
150 static const uint8_t ieee80211e_up_to_ac[] = {
151 	IEEE80211_AC_BE,
152 	IEEE80211_AC_BK,
153 	IEEE80211_AC_BK,
154 	IEEE80211_AC_BE,
155 	IEEE80211_AC_VI,
156 	IEEE80211_AC_VI,
157 	IEEE80211_AC_VO,
158 	IEEE80211_AC_VO,
159 #if 0
160 	IEEE80211_AC_VO, /* We treat MGMT as TID 8, which is set as AC_VO */
161 #endif
162 };
163 
164 const struct cfg80211_ops linuxkpi_mac80211cfgops = {
165 	/*
166 	 * XXX TODO need a "glue layer" to link cfg80211 ops to
167 	 * mac80211 and to the driver or net80211.
168 	 * Can we pass some on 1:1? Need to compare the (*f)().
169 	 */
170 };
171 
172 #if 0
173 static struct lkpi_sta *lkpi_find_lsta_by_ni(struct lkpi_vif *,
174     struct ieee80211_node *);
175 #endif
176 static void lkpi_sw_scan_task(void *, int);
177 static void lkpi_80211_txq_tx_one(struct lkpi_sta *, struct mbuf *);
178 static void lkpi_80211_txq_task(void *, int);
179 static void lkpi_80211_lhw_rxq_task(void *, int);
180 static void lkpi_ieee80211_free_skb_mbuf(void *);
181 #ifdef LKPI_80211_WME
182 static int lkpi_wme_update(struct lkpi_hw *, struct ieee80211vap *, bool);
183 #endif
184 static int lkpi_80211_update_chandef(struct ieee80211_hw *,
185     struct ieee80211_chanctx_conf *);
186 static void lkpi_ieee80211_wake_queues_locked(struct ieee80211_hw *);
187 
188 static const char *
189 lkpi_rate_info_bw_to_str(enum rate_info_bw bw)
190 {
191 
192 	switch (bw) {
193 
194         case RATE_INFO_BW_20:
195 		return ("20");
196 		break;
197         case RATE_INFO_BW_5:
198 		return ("5");
199 		break;
200         case RATE_INFO_BW_10:
201 		return ("10");
202 		break;
203         case RATE_INFO_BW_40:
204 		return ("40");
205 		break;
206         case RATE_INFO_BW_80:
207 		return ("80");
208 		break;
209         case RATE_INFO_BW_160:
210 		return ("160");
211 		break;
212         case RATE_INFO_BW_HE_RU:
213 		IMPROVE("nl80211_he_ru_alloc");
214 		return ("HE_RU");
215 		break;
216         case RATE_INFO_BW_320:
217 		return ("320");
218 		break;
219         case RATE_INFO_BW_EHT_RU:
220 		IMPROVE("nl80211_eht_ru_alloc");
221 		return ("EHT_RU");
222 		break;
223 	default:
224 		return ("?");
225 		break;
226 	}
227 }
228 
229 static void
230 lkpi_nl80211_sta_info_to_str(struct sbuf *s, const char *prefix,
231     const uint64_t flags)
232 {
233 	int bit, i;
234 
235 	sbuf_printf(s, "%s %#010jx", prefix, flags);
236 
237 	i = 0;
238 	for (bit = 0; bit < BITS_PER_TYPE(flags); bit++) {
239 
240 		if ((flags & BIT_ULL(bit)) == 0)
241 			continue;
242 
243 #define	EXPAND_CASE(_flag)						\
244 	case NL80211_STA_INFO_ ## _flag:				\
245 		sbuf_printf(s, "%c%s", (i == 0) ? '<' : ',', #_flag);	\
246 		i++;							\
247 		break;
248 
249 		switch (bit) {
250 		EXPAND_CASE(BEACON_RX)
251 		EXPAND_CASE(BEACON_SIGNAL_AVG)
252 		EXPAND_CASE(BSS_PARAM)
253 		EXPAND_CASE(CHAIN_SIGNAL)
254 		EXPAND_CASE(CHAIN_SIGNAL_AVG)
255 		EXPAND_CASE(CONNECTED_TIME)
256 		EXPAND_CASE(INACTIVE_TIME)
257 		EXPAND_CASE(SIGNAL)
258 		EXPAND_CASE(SIGNAL_AVG)
259 		EXPAND_CASE(STA_FLAGS)
260 		EXPAND_CASE(RX_BITRATE)
261 		EXPAND_CASE(RX_PACKETS)
262 		EXPAND_CASE(RX_BYTES)
263 		EXPAND_CASE(RX_DROP_MISC)
264 		EXPAND_CASE(TX_BITRATE)
265 		EXPAND_CASE(TX_PACKETS)
266 		EXPAND_CASE(TX_BYTES)
267 		EXPAND_CASE(TX_BYTES64)
268 		EXPAND_CASE(RX_BYTES64)
269 		EXPAND_CASE(TX_FAILED)
270 		EXPAND_CASE(TX_RETRIES)
271 		EXPAND_CASE(RX_DURATION)
272 		EXPAND_CASE(TX_DURATION)
273 		EXPAND_CASE(ACK_SIGNAL)
274 		EXPAND_CASE(ACK_SIGNAL_AVG)
275 		default:
276 			sbuf_printf(s, "%c?%d", (i == 0) ? '<' : ',', bit);
277 			break;
278 		}
279 	}
280 #undef	EXPAND_CASE
281 	if (i > 0)
282 		sbuf_printf(s, ">");
283 	sbuf_printf(s, "\n");
284 }
285 
286 static void
287 lkpi_80211_dump_lvif_stas(struct lkpi_vif *lvif, struct sbuf *s, bool dump_queues)
288 {
289 	struct lkpi_hw *lhw;
290 	struct ieee80211_hw *hw;
291 	struct ieee80211vap *vap;
292 	struct ieee80211_vif *vif;
293 	struct lkpi_sta *lsta;
294 	struct ieee80211_sta *sta;
295 	struct station_info sinfo;
296 	int error;
297 	uint8_t tid;
298 
299 	vif = LVIF_TO_VIF(lvif);
300 	vap = LVIF_TO_VAP(lvif);
301 	lhw = vap->iv_ic->ic_softc;
302 	hw = LHW_TO_HW(lhw);
303 
304 	wiphy_lock(hw->wiphy);
305 	list_for_each_entry(lsta, &lvif->lsta_list, lsta_list) {
306 		sta = LSTA_TO_STA(lsta);
307 
308 		sbuf_putc(s, '\n');
309 		sbuf_printf(s, "lsta %p sta %p added_to_drv %d\n", lsta, sta, lsta->added_to_drv);
310 
311 		memset(&sinfo, 0, sizeof(sinfo));
312 		error = lkpi_80211_mo_sta_statistics(hw, vif, sta, &sinfo);
313 		if (error == EEXIST)	/* Not added to driver. */
314 			continue;
315 		if (error == ENOTSUPP) {
316 			sbuf_printf(s, " sta_statistics not supported\n");
317 			continue;
318 		}
319 		if (error != 0) {
320 			sbuf_printf(s, " sta_statistics failed: %d\n", error);
321 			continue;
322 		}
323 
324 		/* If no RX_BITRATE is reported, try to fill it in from the lsta sinfo. */
325 		if ((sinfo.filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) == 0 &&
326 		    (lsta->sinfo.filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) != 0) {
327 			memcpy(&sinfo.rxrate, &lsta->sinfo.rxrate, sizeof(sinfo.rxrate));
328 			sinfo.filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
329 		}
330 		/* If no CHAIN_SIGNAL is reported,  try to fill it in from the lsta sinfo. */
331 		if ((sinfo.filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) == 0 &&
332 		    (lsta->sinfo.filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) != 0) {
333 			sinfo.chains = lsta->sinfo.chains;
334 			memcpy(sinfo.chain_signal, lsta->sinfo.chain_signal,
335 			    sizeof(sinfo.chain_signal));
336 			sinfo.filled |= BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL);
337 		}
338 
339 		lkpi_nl80211_sta_info_to_str(s, " nl80211_sta_info (valid fields)", sinfo.filled);
340 		sbuf_printf(s, " connected_time %u inactive_time %u\n",
341 		    sinfo.connected_time, sinfo.inactive_time);
342 		sbuf_printf(s, " rx_bytes %ju rx_packets %u rx_dropped_misc %u\n",
343 		    (uintmax_t)sinfo.rx_bytes, sinfo.rx_packets, sinfo.rx_dropped_misc);
344 		sbuf_printf(s, " rx_duration %ju rx_beacon %u rx_beacon_signal_avg %d\n",
345 		    (uintmax_t)sinfo.rx_duration, sinfo.rx_beacon, (int8_t)sinfo.rx_beacon_signal_avg);
346 
347 		sbuf_printf(s, " tx_bytes %ju tx_packets %u tx_failed %u\n",
348 		    (uintmax_t)sinfo.tx_bytes, sinfo.tx_packets, sinfo.tx_failed);
349 		sbuf_printf(s, " tx_duration %ju tx_retries %u\n",
350 		    (uintmax_t)sinfo.tx_duration, sinfo.tx_retries);
351 
352 		sbuf_printf(s, " signal %d signal_avg %d ack_signal %d avg_ack_signal %d\n",
353 		    sinfo.signal, sinfo.signal_avg, sinfo.ack_signal, sinfo.avg_ack_signal);
354 		sbuf_printf(s, " generation %d assoc_req_ies_len %zu chains %#04x\n",
355 		    sinfo.generation, sinfo.assoc_req_ies_len, sinfo.chains);
356 
357 		for (int i = 0; i < nitems(sinfo.chain_signal) && i < IEEE80211_MAX_CHAINS; i++) {
358 			if (!(sinfo.chains & BIT(i)))
359 				continue;
360 			sbuf_printf(s, "  chain[%d] signal %d signal_avg %d\n",
361 			    i, (int8_t)sinfo.chain_signal[i], (int8_t)sinfo.chain_signal_avg[i]);
362 		}
363 
364 		/* assoc_req_ies, bss_param, sta_flags */
365 
366 		sbuf_printf(s, " rxrate: flags %b bw %u(%s) legacy %u kbit/s mcs %u nss %u\n",
367 		    sinfo.rxrate.flags, CFG80211_RATE_INFO_FLAGS_BITS,
368 		    sinfo.rxrate.bw, lkpi_rate_info_bw_to_str(sinfo.rxrate.bw),
369 		    sinfo.rxrate.legacy * 100,
370 		    sinfo.rxrate.mcs, sinfo.rxrate.nss);
371 		sbuf_printf(s, "         he_dcm %u he_gi %u he_ru_alloc %u eht_gi %u\n",
372 		    sinfo.rxrate.he_dcm, sinfo.rxrate.he_gi, sinfo.rxrate.he_ru_alloc,
373 		    sinfo.rxrate.eht_gi);
374 		sbuf_printf(s, " txrate: flags %b bw %u(%s) legacy %u kbit/s mcs %u nss %u\n",
375 		    sinfo.txrate.flags, CFG80211_RATE_INFO_FLAGS_BITS,
376 		    sinfo.txrate.bw, lkpi_rate_info_bw_to_str(sinfo.txrate.bw),
377 		    sinfo.txrate.legacy * 100,
378 		    sinfo.txrate.mcs, sinfo.txrate.nss);
379 		sbuf_printf(s, "         he_dcm %u he_gi %u he_ru_alloc %u eht_gi %u\n",
380 		    sinfo.txrate.he_dcm, sinfo.txrate.he_gi, sinfo.txrate.he_ru_alloc,
381 		    sinfo.txrate.eht_gi);
382 
383 		if (!dump_queues)
384 			continue;
385 
386 		/* Dump queue information. */
387 		sbuf_printf(s, " Queue information:\n");
388 		sbuf_printf(s, "  frms direct tx %ju\n", lsta->frms_tx);
389 		for (tid = 0; tid <= IEEE80211_NUM_TIDS; tid++) {
390 			struct lkpi_txq *ltxq;
391 
392 			if (sta->txq[tid] == NULL) {
393 				sbuf_printf(s, "  tid %-2u NOQ\n", tid);
394 				continue;
395 			}
396 
397 			ltxq = TXQ_TO_LTXQ(sta->txq[tid]);
398 #ifdef __notyet__
399 			sbuf_printf(s, "  tid %-2u flags: %b "
400 			    "txq_generation %u skbq len %d\n",
401 			    tid, ltxq->flags, LKPI_TXQ_FLAGS_BITS,
402 			    ltxq->txq_generation,
403 			    skb_queue_len_lockless(&ltxq->skbq));
404 #else
405 			sbuf_printf(s, "  tid %-2u "
406 			    "txq_generation %u skbq len %d\n",
407 			    tid,
408 			    ltxq->txq_generation,
409 			    skb_queue_len_lockless(&ltxq->skbq));
410 #endif
411 			sbuf_printf(s, "         frms_enqueued %ju frms_dequeued %ju "
412 			    "frms_tx %ju\n",
413 			    ltxq->frms_enqueued, ltxq->frms_dequeued, ltxq->frms_tx);
414 		}
415 	}
416 	wiphy_unlock(hw->wiphy);
417 }
418 
419 static int
420 lkpi_80211_dump_stas(SYSCTL_HANDLER_ARGS)
421 {
422 	struct lkpi_vif *lvif;
423 	struct sbuf s;
424 
425 	if (req->newptr)
426 		return (EPERM);
427 
428 	lvif = (struct lkpi_vif *)arg1;
429 
430 	sbuf_new_for_sysctl(&s, NULL, 1024, req);
431 
432 	lkpi_80211_dump_lvif_stas(lvif, &s, false);
433 
434 	sbuf_finish(&s);
435 	sbuf_delete(&s);
436 
437 	return (0);
438 }
439 
440 static int
441 lkpi_80211_dump_sta_queues(SYSCTL_HANDLER_ARGS)
442 {
443 	struct lkpi_vif *lvif;
444 	struct sbuf s;
445 
446 	if (req->newptr)
447 		return (EPERM);
448 
449 	lvif = (struct lkpi_vif *)arg1;
450 
451 	sbuf_new_for_sysctl(&s, NULL, 1024, req);
452 
453 	lkpi_80211_dump_lvif_stas(lvif, &s, true);
454 
455 	sbuf_finish(&s);
456 	sbuf_delete(&s);
457 
458 	return (0);
459 }
460 
461 static enum ieee80211_sta_rx_bandwidth
462 lkpi_cw_to_rx_bw(enum nl80211_chan_width cw)
463 {
464 	switch (cw) {
465 	case NL80211_CHAN_WIDTH_320:
466 		return (IEEE80211_STA_RX_BW_320);
467 	case NL80211_CHAN_WIDTH_160:
468 	case NL80211_CHAN_WIDTH_80P80:
469 		return (IEEE80211_STA_RX_BW_160);
470 	case NL80211_CHAN_WIDTH_80:
471 		return (IEEE80211_STA_RX_BW_80);
472 	case NL80211_CHAN_WIDTH_40:
473 		return (IEEE80211_STA_RX_BW_40);
474 	case NL80211_CHAN_WIDTH_20:
475 	case NL80211_CHAN_WIDTH_20_NOHT:
476 		return (IEEE80211_STA_RX_BW_20);
477 	case NL80211_CHAN_WIDTH_5:
478 	case NL80211_CHAN_WIDTH_10:
479 		/* Unsupported input. */
480 		return (IEEE80211_STA_RX_BW_20);
481 	}
482 }
483 
484 static enum nl80211_chan_width
485 lkpi_rx_bw_to_cw(enum ieee80211_sta_rx_bandwidth rx_bw)
486 {
487 	switch (rx_bw) {
488 	case IEEE80211_STA_RX_BW_20:
489 		return (NL80211_CHAN_WIDTH_20);	/* _NOHT */
490 	case IEEE80211_STA_RX_BW_40:
491 		return (NL80211_CHAN_WIDTH_40);
492 	case IEEE80211_STA_RX_BW_80:
493 		return (NL80211_CHAN_WIDTH_80);
494 	case IEEE80211_STA_RX_BW_160:
495 		return (NL80211_CHAN_WIDTH_160); /* 80P80 */
496 	case IEEE80211_STA_RX_BW_320:
497 		return (NL80211_CHAN_WIDTH_320);
498 	}
499 }
500 
501 static void
502 lkpi_sync_chanctx_cw_from_rx_bw(struct ieee80211_hw *hw,
503     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
504 {
505 	struct ieee80211_chanctx_conf *chanctx_conf;
506 	enum ieee80211_sta_rx_bandwidth old_bw;
507 	uint32_t changed;
508 
509 	chanctx_conf = rcu_dereference_protected(vif->bss_conf.chanctx_conf,
510 	    lockdep_is_held(&hw->wiphy->mtx));
511 	if (chanctx_conf == NULL)
512 		return;
513 
514 	old_bw = lkpi_cw_to_rx_bw(chanctx_conf->def.width);
515 	if (old_bw == sta->deflink.bandwidth)
516 		return;
517 
518 	chanctx_conf->def.width = lkpi_rx_bw_to_cw(sta->deflink.bandwidth);
519 	if (chanctx_conf->def.width == NL80211_CHAN_WIDTH_20 &&
520 	    !sta->deflink.ht_cap.ht_supported)
521 		chanctx_conf->def.width = NL80211_CHAN_WIDTH_20_NOHT;
522 
523 	chanctx_conf->min_def = chanctx_conf->def;
524 
525 	vif->bss_conf.chanreq.oper.width = chanctx_conf->def.width;
526 
527 	changed = IEEE80211_CHANCTX_CHANGE_MIN_WIDTH;
528 	changed |= IEEE80211_CHANCTX_CHANGE_WIDTH;
529 	lkpi_80211_mo_change_chanctx(hw, chanctx_conf, changed);
530 }
531 
532 #if defined(LKPI_80211_HT)
533 static void
534 lkpi_sta_sync_ht_from_ni(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
535     struct ieee80211_sta *sta, struct ieee80211_node *ni)
536 {
537 	struct ieee80211vap *vap;
538 	uint8_t *ie;
539 	struct ieee80211_ht_cap *htcap;
540 	struct ieee80211_sta_ht_cap *ht_cap, *sta_ht_cap;
541 	enum nl80211_band band;
542 	int i, rx_nss;
543 
544 	if ((ni->ni_flags & IEEE80211_NODE_HT) == 0) {
545 		sta->deflink.ht_cap.ht_supported = false;
546 		return;
547 	}
548 
549 	sta->deflink.ht_cap.ht_supported = true;
550 
551 	/* htcap->ampdu_params_info */
552 	vap = ni->ni_vap;
553 	sta->deflink.ht_cap.ampdu_density = _IEEE80211_MASKSHIFT(ni->ni_htparam, IEEE80211_HTCAP_MPDUDENSITY);
554 	if (sta->deflink.ht_cap.ampdu_density > vap->iv_ampdu_density)
555 		sta->deflink.ht_cap.ampdu_density = vap->iv_ampdu_density;
556 	sta->deflink.ht_cap.ampdu_factor = _IEEE80211_MASKSHIFT(ni->ni_htparam, IEEE80211_HTCAP_MAXRXAMPDU);
557 	if (sta->deflink.ht_cap.ampdu_factor > vap->iv_ampdu_rxmax)
558 		sta->deflink.ht_cap.ampdu_factor = vap->iv_ampdu_rxmax;
559 
560 	ie = ni->ni_ies.htcap_ie;
561 	KASSERT(ie != NULL, ("%s: HT but no htcap_ie on ni %p\n", __func__, ni));
562 	if (ie[0] == IEEE80211_ELEMID_VENDOR)
563 		ie += 4;
564 	ie += 2;
565 	htcap = (struct ieee80211_ht_cap *)ie;
566 	sta->deflink.ht_cap.cap = htcap->cap_info;
567 	sta->deflink.ht_cap.mcs = htcap->mcs;
568 
569 	/*
570 	 * 802.11n-2009 20.6 Parameters for HT MCSs gives the mandatory/
571 	 * optional MCS for Nss=1..4.  We need to check the first four
572 	 * MCS sets from the Rx MCS Bitmask; then there is MCS 32 and
573 	 * MCS33.. is UEQM.
574 	 */
575 	band = vif->bss_conf.chanctx_conf->def.chan->band;
576 	ht_cap = &hw->wiphy->bands[band]->ht_cap;
577 	sta_ht_cap = &sta->deflink.ht_cap;
578 	rx_nss = 0;
579 	for (i = 0; i < 4; i++) {
580 		TRACEOK("HT rx_mask[%d] sta %#04x & hw %#04x", i,
581 		    sta_ht_cap->mcs.rx_mask[i], ht_cap->mcs.rx_mask[i]);
582 		sta_ht_cap->mcs.rx_mask[i] =
583 			sta_ht_cap->mcs.rx_mask[i] & ht_cap->mcs.rx_mask[i];
584 		/* XXX-BZ masking unequal modulation? */
585 
586 		if (sta_ht_cap->mcs.rx_mask[i] != 0)
587 			rx_nss++;
588 	}
589 	if (rx_nss > 0) {
590 		TRACEOK("HT rx_nss = max(%d, %d)", rx_nss, sta->deflink.rx_nss);
591 		sta->deflink.rx_nss = MAX(rx_nss, sta->deflink.rx_nss);
592 	} else {
593 		sta->deflink.ht_cap.ht_supported = false;
594 		return;
595 	}
596 
597 	if ((sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) != 0 &&
598 	    IEEE80211_IS_CHAN_HT40(ni->ni_chan))
599 		sta->deflink.bandwidth = IEEE80211_STA_RX_BW_40;
600 	else
601 		sta->deflink.bandwidth = IEEE80211_STA_RX_BW_20;
602 
603 	IMPROVE("sta->wme");
604 
605 	if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_MAX_AMSDU)
606 		sta->deflink.agg.max_amsdu_len = IEEE80211_MAX_MPDU_LEN_HT_7935;
607 	else
608 		sta->deflink.agg.max_amsdu_len = IEEE80211_MAX_MPDU_LEN_HT_3839;
609 	sta->deflink.agg.max_rc_amsdu_len = IEEE80211_MAX_MPDU_LEN_HT_BA;
610 #ifdef __handled_by_driver__	/* iwlwifi only? actually unused? */
611 	for (i = 0; i < nitems(sta.deflink.agg.max_tid_amsdu_len); i++) {
612 		sta->deflink.agg.max_tid_amsdu_len[j] = ;
613 	}
614 #endif
615 }
616 #endif
617 
618 #if defined(LKPI_80211_VHT)
619 static void
620 lkpi_sta_sync_vht_from_ni(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
621     struct ieee80211_sta *sta, struct ieee80211_node *ni)
622 {
623 	struct ieee80211_sta_vht_cap *vht_cap, *sta_vht_cap;;
624 	enum ieee80211_sta_rx_bandwidth bw;
625 	enum nl80211_band band;
626 	uint32_t width;
627 	int rx_nss;
628 	uint16_t rx_map, tx_map;
629 
630 	if ((ni->ni_flags & IEEE80211_NODE_VHT) == 0 ||
631 	    !IEEE80211_IS_CHAN_VHT_5GHZ(ni->ni_chan)) {
632 		sta->deflink.vht_cap.vht_supported = false;
633 		return;
634 	}
635 
636 	sta->deflink.vht_cap.vht_supported = true;
637 
638 	sta->deflink.vht_cap.cap = ni->ni_vhtcap;
639 	sta->deflink.vht_cap.vht_mcs = ni->ni_vht_mcsinfo;
640 
641 	/*
642 	 * If VHT20/40 are selected do not update the bandwidth
643 	 * from HT but stya on VHT.
644 	 */
645 	if (ni->ni_vht_chanwidth == IEEE80211_VHT_CHANWIDTH_USE_HT)
646 		goto skip_bw;
647 
648 	bw = sta->deflink.bandwidth;
649 	width = (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK);
650 	switch (width) {
651 	/* Deprecated. */
652 	case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ:
653 	case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ:
654 		bw = IEEE80211_STA_RX_BW_160;
655 		break;
656 	default:
657 		/* Check if we do support 160Mhz somehow after all. */
658 		if ((sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_EXT_NSS_BW_MASK) != 0)
659 			bw = IEEE80211_STA_RX_BW_160;
660 		else
661 			bw = IEEE80211_STA_RX_BW_80;
662 	}
663 	/*
664 	 * While we can set what is possibly supported we also need to be
665 	 * on a channel which supports that bandwidth; e.g., we can support
666 	 * VHT160 but the AP only does VHT80.
667 	 * Further ni_chan will also have filtered out what we disabled
668 	 * by configuration.
669 	 * Once net80211 channel selection is fixed for 802.11-2020 and
670 	 * VHT160 we can possibly spare ourselves the above.
671 	 */
672 	if (bw == IEEE80211_STA_RX_BW_160 &&
673 	    !IEEE80211_IS_CHAN_VHT160(ni->ni_chan) &&
674 	    !IEEE80211_IS_CHAN_VHT80P80(ni->ni_chan))
675 		bw = IEEE80211_STA_RX_BW_80;
676 	if (bw == IEEE80211_STA_RX_BW_80 &&
677 	    !IEEE80211_IS_CHAN_VHT80(ni->ni_chan))
678 		bw = sta->deflink.bandwidth;
679 	sta->deflink.bandwidth = bw;
680 skip_bw:
681 
682 	band = vif->bss_conf.chanctx_conf->def.chan->band;
683 	vht_cap = &hw->wiphy->bands[band]->vht_cap;
684 	sta_vht_cap = &sta->deflink.vht_cap;
685 
686 	rx_nss = 0;
687 	rx_map = tx_map = 0;
688 	for (int i = 7; i >= 0; i--) {
689 		uint8_t card, sta;
690 
691 		card = (vht_cap->vht_mcs.rx_mcs_map >> (2 * i)) & 0x3;
692 		sta  = (sta_vht_cap->vht_mcs.rx_mcs_map >> (2 * i)) & 0x3;
693 		if (sta != IEEE80211_VHT_MCS_NOT_SUPPORTED) {
694 			if (card == IEEE80211_VHT_MCS_NOT_SUPPORTED)
695 				sta = IEEE80211_VHT_MCS_NOT_SUPPORTED;
696 			else {
697 				sta = MIN(sta, card);
698 				if (rx_nss == 0)
699 					rx_nss = i + 1;
700 			}
701 		}
702 		rx_map |= (sta << (2 * i));
703 
704 		card = (vht_cap->vht_mcs.tx_mcs_map >> (2 * i)) & 0x3;
705 		sta  = (sta_vht_cap->vht_mcs.tx_mcs_map >> (2 * i)) & 0x3;
706 		if (sta != IEEE80211_VHT_MCS_NOT_SUPPORTED) {
707 			if (card == IEEE80211_VHT_MCS_NOT_SUPPORTED)
708 				sta = IEEE80211_VHT_MCS_NOT_SUPPORTED;
709 			else
710 				sta = MIN(sta, card);
711 		}
712 		tx_map |= (sta << (2 * i));
713 	}
714 	TRACEOK("VHT rx_mcs_map %#010x->%#010x, tx_mcs_map %#010x->%#010x, rx_nss = %d",
715 	    sta_vht_cap->vht_mcs.rx_mcs_map, rx_map,
716 	    sta_vht_cap->vht_mcs.tx_mcs_map, tx_map, rx_nss);
717 	sta_vht_cap->vht_mcs.rx_mcs_map = rx_map;
718 	sta_vht_cap->vht_mcs.tx_mcs_map = tx_map;
719 	if (rx_nss > 0) {
720 		TRACEOK("VHT rx_nss = max(%d, %d)", rx_nss, sta->deflink.rx_nss);
721 		sta->deflink.rx_nss = MAX(rx_nss, sta->deflink.rx_nss);
722 	} else {
723 		sta->deflink.vht_cap.vht_supported = false;
724 		return;
725 	}
726 
727 	switch (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MAX_MPDU_MASK) {
728 	case IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454:
729 		sta->deflink.agg.max_amsdu_len = IEEE80211_MAX_MPDU_LEN_VHT_11454;
730 		break;
731 	case IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991:
732 		sta->deflink.agg.max_amsdu_len = IEEE80211_MAX_MPDU_LEN_VHT_7991;
733 		break;
734 	case IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895:
735 	default:
736 		sta->deflink.agg.max_amsdu_len = IEEE80211_MAX_MPDU_LEN_VHT_3895;
737 		break;
738 	}
739 }
740 #endif
741 
742 static void
743 lkpi_sta_sync_from_ni(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
744     struct ieee80211_sta *sta, struct ieee80211_node *ni, bool updchnctx)
745 {
746 
747 	/*
748 	 * Ensure rx_nss is at least 1 as otherwise drivers run into
749 	 * unexpected problems.
750 	 */
751 	sta->deflink.rx_nss = 1;
752 
753 #if defined(LKPI_80211_HT)
754 	lkpi_sta_sync_ht_from_ni(hw, vif, sta, ni);
755 #endif
756 #if defined(LKPI_80211_VHT)
757 	lkpi_sta_sync_vht_from_ni(hw, vif, sta, ni);
758 #endif
759 
760 	/*
761 	 * We are also called from node allocation which net80211
762 	 * can do even on `ifconfig down`; in that case the chanctx
763 	 * may still be valid and we get a discrepancy between
764 	 * sta and chanctx.  Thus do not try to update the chanctx
765 	 * when called from lkpi_lsta_alloc().
766 	 */
767 	if (updchnctx)
768 		lkpi_sync_chanctx_cw_from_rx_bw(hw, vif, sta);
769 }
770 
771 #if 0
772 static uint8_t
773 lkpi_get_max_rx_chains(struct ieee80211_node *ni)
774 {
775 	uint8_t chains;
776 #if defined(LKPI_80211_HT) || defined(LKPI_80211_VHT)
777 	struct lkpi_sta *lsta;
778 	struct ieee80211_sta *sta;
779 
780 	lsta = ni->ni_drv_data;
781 	sta = LSTA_TO_STA(lsta);
782 #endif
783 
784 	chains = 1;
785 #if defined(LKPI_80211_HT)
786 	IMPROVE("We should factor counting MCS/NSS out for sync and here");
787 	if (sta->deflink.ht_cap.ht_supported)
788 		chains = MAX(chains, sta->deflink.rx_nss);
789 #endif
790 
791 #if defined(LKPI_80211_VHT)
792 	if (sta->deflink.vht_cap.vht_supported)
793 		chains = MAX(chains, sta->deflink.rx_nss);
794 #endif
795 
796 	return (chains);
797 }
798 #endif
799 
800 static void
801 lkpi_lsta_dump(struct lkpi_sta *lsta, struct ieee80211_node *ni,
802     const char *_f, int _l)
803 {
804 
805 #ifdef LINUXKPI_DEBUG_80211
806 	if ((linuxkpi_debug_80211 & D80211_TRACE_STA) == 0)
807 		return;
808 	if (lsta == NULL)
809 		return;
810 
811 	printf("%s:%d lsta %p ni %p sta %p\n",
812 	    _f, _l, lsta, ni, &lsta->sta);
813 	if (ni != NULL)
814 		ieee80211_dump_node(NULL, ni);
815 	printf("\ttxq_task txq len %d mtx\n", mbufq_len(&lsta->txq));
816 	printf("\tkc %p state %d added_to_drv %d in_mgd %d\n",
817 		&lsta->kc[0], lsta->state, lsta->added_to_drv, lsta->in_mgd);
818 #endif
819 }
820 
821 static void
822 lkpi_lsta_remove(struct lkpi_sta *lsta, struct lkpi_vif *lvif)
823 {
824 
825 	lockdep_assert_wiphy(lsta->hw->wiphy);
826 
827 	KASSERT(!list_empty(&lsta->lsta_list),
828 	    ("%s: lsta %p ni %p\n", __func__, lsta, lsta->ni));
829 	list_del_init(&lsta->lsta_list);
830 }
831 
832 static struct lkpi_sta *
833 lkpi_lsta_alloc(struct ieee80211vap *vap, const uint8_t mac[IEEE80211_ADDR_LEN],
834     struct ieee80211_hw *hw, struct ieee80211_node *ni)
835 {
836 	struct lkpi_sta *lsta;
837 	struct lkpi_vif *lvif;
838 	struct ieee80211_vif *vif;
839 	struct ieee80211_sta *sta;
840 	int band, i, tid;
841 
842 	lsta = malloc(sizeof(*lsta) + hw->sta_data_size, M_LKPI80211,
843 	    M_NOWAIT | M_ZERO);
844 	if (lsta == NULL)
845 		return (NULL);
846 
847 	lsta->hw = hw;
848 	lsta->added_to_drv = false;
849 	lsta->state = IEEE80211_STA_NOTEXIST;
850 	/*
851 	 * Link the ni to the lsta here without taking a reference.
852 	 * For one we would have to take the reference in node_init()
853 	 * as ieee80211_alloc_node() will initialise the refcount after us.
854 	 * For the other a ni and an lsta are 1:1 mapped and always together
855 	 * from [ic_]node_alloc() to [ic_]node_free() so we are essentally
856 	 * using the ni references for the lsta as well despite it being
857 	 * two separate allocations.
858 	 */
859 	lsta->ni = ni;
860 	/* The back-pointer "drv_data" to net80211_node let's us get lsta. */
861 	ni->ni_drv_data = lsta;
862 
863 	lvif = VAP_TO_LVIF(vap);
864 	vif = LVIF_TO_VIF(lvif);
865 	sta = LSTA_TO_STA(lsta);
866 
867 	IEEE80211_ADDR_COPY(sta->addr, mac);
868 
869 	/* TXQ */
870 	for (tid = 0; tid < nitems(sta->txq); tid++) {
871 		struct lkpi_txq *ltxq;
872 
873 		/* We are not limiting ourselves to hw.queues here. */
874 		ltxq = malloc(sizeof(*ltxq) + hw->txq_data_size,
875 		    M_LKPI80211, M_NOWAIT | M_ZERO);
876 		if (ltxq == NULL)
877 			goto cleanup;
878 		/* iwlwifi//mvm/sta.c::tid_to_mac80211_ac[] */
879 		if (tid == IEEE80211_NUM_TIDS) {
880 			if (!ieee80211_hw_check(hw, STA_MMPDU_TXQ)) {
881 				free(ltxq, M_LKPI80211);
882 				continue;
883 			}
884 			IMPROVE("AP/if we support non-STA here too");
885 			ltxq->txq.ac = IEEE80211_AC_VO;
886 		} else {
887 			ltxq->txq.ac = ieee80211e_up_to_ac[tid & 7];
888 		}
889 		ltxq->seen_dequeue = false;
890 		ltxq->stopped = false;
891 		ltxq->txq.vif = vif;
892 		ltxq->txq.tid = tid;
893 		ltxq->txq.sta = sta;
894 		TAILQ_ELEM_INIT(ltxq, txq_entry);
895 		skb_queue_head_init(&ltxq->skbq);
896 		LKPI_80211_LTXQ_LOCK_INIT(ltxq);
897 		sta->txq[tid] = &ltxq->txq;
898 	}
899 
900 	/* Deflink information. */
901 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
902 		struct ieee80211_supported_band *supband;
903 		uint32_t rate_mandatory;;
904 
905 		supband = hw->wiphy->bands[band];
906 		if (supband == NULL)
907 			continue;
908 
909 		switch (band) {
910 		case NL80211_BAND_2GHZ:
911 			/* We have to assume 11g support here. */
912 			rate_mandatory = IEEE80211_RATE_MANDATORY_G |
913 			    IEEE80211_RATE_MANDATORY_B;
914 			break;
915 		case NL80211_BAND_5GHZ:
916 			rate_mandatory = IEEE80211_RATE_MANDATORY_A;
917 			break;
918 		default:
919 			continue;
920 		}
921 
922 		for (i = 0; i < supband->n_bitrates; i++) {
923 			if ((supband->bitrates[i].flags & rate_mandatory) != 0)
924 				sta->deflink.supp_rates[band] |= BIT(i);
925 		}
926 	}
927 
928 	sta->deflink.smps_mode = IEEE80211_SMPS_OFF;
929 	sta->deflink.bandwidth = IEEE80211_STA_RX_BW_20;
930 	sta->deflink.agg.max_rc_amsdu_len = IEEE80211_MAX_MPDU_LEN_HT_BA;
931 	sta->deflink.rx_nss = 1;
932 	sta->deflink.sta = sta;
933 
934 	lkpi_sta_sync_from_ni(hw, vif, sta, ni, false);
935 
936 	IMPROVE("he, eht, bw_320, ... smps_mode, ..");
937 
938 	/* Link configuration. */
939 	IEEE80211_ADDR_COPY(sta->deflink.addr, sta->addr);
940 	sta->link[0] = &sta->deflink;
941 	for (i = 1; i < nitems(sta->link); i++) {
942 		IMPROVE("more links; only link[0] = deflink currently.");
943 	}
944 	IMPROVE("11be");
945 	sta->mlo = false;
946 
947 	/* Deferred TX path. */
948 	LKPI_80211_LSTA_TXQ_LOCK_INIT(lsta);
949 	TASK_INIT(&lsta->txq_task, 0, lkpi_80211_txq_task, lsta);
950 	mbufq_init(&lsta->txq, 32 * NAPI_POLL_WEIGHT);
951 	lsta->txq_ready = true;
952 
953 	return (lsta);
954 
955 cleanup:
956 	for (; tid >= 0; tid--) {
957 		struct lkpi_txq *ltxq;
958 
959 		ltxq = TXQ_TO_LTXQ(sta->txq[tid]);
960 		LKPI_80211_LTXQ_LOCK_DESTROY(ltxq);
961 		free(sta->txq[tid], M_LKPI80211);
962 	}
963 	free(lsta, M_LKPI80211);
964 	return (NULL);
965 }
966 
967 static void
968 lkpi_lsta_free(struct lkpi_sta *lsta, struct ieee80211_node *ni)
969 {
970 	struct mbuf *m;
971 
972 	if (lsta->added_to_drv)
973 		panic("%s: Trying to free an lsta still known to firmware: "
974 		    "lsta %p ni %p added_to_drv %d\n",
975 		    __func__, lsta, ni, lsta->added_to_drv);
976 
977 	/* XXX-BZ free resources, ... */
978 	IMPROVE();
979 
980 	/* Drain sta->txq[] */
981 
982 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
983 	lsta->txq_ready = false;
984 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
985 
986 	/* Drain taskq, won't be restarted until added_to_drv is set again. */
987 	while (taskqueue_cancel(taskqueue_thread, &lsta->txq_task, NULL) != 0)
988 		taskqueue_drain(taskqueue_thread, &lsta->txq_task);
989 
990 	/* Flush mbufq (make sure to release ni refs!). */
991 	m = mbufq_dequeue(&lsta->txq);
992 	while (m != NULL) {
993 		struct ieee80211_node *nim;
994 
995 		nim = (struct ieee80211_node *)m->m_pkthdr.rcvif;
996 		if (nim != NULL)
997 			ieee80211_free_node(nim);
998 		m_freem(m);
999 		m = mbufq_dequeue(&lsta->txq);
1000 	}
1001 	KASSERT(mbufq_empty(&lsta->txq), ("%s: lsta %p has txq len %d != 0\n",
1002 	    __func__, lsta, mbufq_len(&lsta->txq)));
1003 	LKPI_80211_LSTA_TXQ_LOCK_DESTROY(lsta);
1004 
1005 	/* Remove lsta from vif; that is done by the state machine.  Should assert it? */
1006 
1007 	IMPROVE("Make sure everything is cleaned up.");
1008 
1009 	/* Free lsta. */
1010 	lsta->ni = NULL;
1011 	ni->ni_drv_data = NULL;
1012 	free(lsta, M_LKPI80211);
1013 }
1014 
1015 
1016 static enum nl80211_band
1017 lkpi_net80211_chan_to_nl80211_band(struct ieee80211_channel *c)
1018 {
1019 
1020 	if (IEEE80211_IS_CHAN_2GHZ(c))
1021 		return (NL80211_BAND_2GHZ);
1022 	else if (IEEE80211_IS_CHAN_5GHZ(c))
1023 		return (NL80211_BAND_5GHZ);
1024 #ifdef __notyet__
1025 	else if ()
1026 		return (NL80211_BAND_6GHZ);
1027 	else if ()
1028 		return (NL80211_BAND_60GHZ);
1029 	else if (IEEE80211_IS_CHAN_GSM(c))
1030 		return (NL80211_BAND_XXX);
1031 #endif
1032 	else
1033 		panic("%s: unsupported band. c %p flags %#x\n",
1034 		    __func__, c, c->ic_flags);
1035 }
1036 
1037 static uint32_t
1038 lkpi_nl80211_band_to_net80211_band(enum nl80211_band band)
1039 {
1040 
1041 	/* XXX-BZ this is just silly; net80211 is too convoluted. */
1042 	/* IEEE80211_CHAN_A / _G / .. doesn't really work either. */
1043 	switch (band) {
1044 	case NL80211_BAND_2GHZ:
1045 		return (IEEE80211_CHAN_2GHZ);
1046 		break;
1047 	case NL80211_BAND_5GHZ:
1048 		return (IEEE80211_CHAN_5GHZ);
1049 		break;
1050 	case NL80211_BAND_60GHZ:
1051 		break;
1052 	case NL80211_BAND_6GHZ:
1053 		break;
1054 	default:
1055 		panic("%s: unsupported band %u\n", __func__, band);
1056 		break;
1057 	}
1058 
1059 	IMPROVE();
1060 	return (0x00);
1061 }
1062 
1063 #ifdef LINUXKPI_DEBUG_80211
1064 static const char *
1065 lkpi_nl80211_band_name(enum nl80211_band band)
1066 {
1067 	switch (band) {
1068 	case NL80211_BAND_2GHZ:
1069 		return "2Ghz";
1070 		break;
1071 	case NL80211_BAND_5GHZ:
1072 		return "5Ghz";
1073 		break;
1074 	case NL80211_BAND_60GHZ:
1075 		return "60Ghz";
1076 		break;
1077 	case NL80211_BAND_6GHZ:
1078 		return "6Ghz";
1079 		break;
1080 	default:
1081 		panic("%s: unsupported band %u\n", __func__, band);
1082 		break;
1083 	}
1084 }
1085 #endif
1086 
1087 #if 0
1088 static enum ieee80211_ac_numbers
1089 lkpi_ac_net_to_l80211(int ac)
1090 {
1091 
1092 	switch (ac) {
1093 	case WME_AC_VO:
1094 		return (IEEE80211_AC_VO);
1095 	case WME_AC_VI:
1096 		return (IEEE80211_AC_VI);
1097 	case WME_AC_BE:
1098 		return (IEEE80211_AC_BE);
1099 	case WME_AC_BK:
1100 		return (IEEE80211_AC_BK);
1101 	default:
1102 		printf("%s: invalid WME_AC_* input: ac = %d\n", __func__, ac);
1103 		return (IEEE80211_AC_BE);
1104 	}
1105 }
1106 #endif
1107 
1108 static enum nl80211_iftype
1109 lkpi_opmode_to_vif_type(enum ieee80211_opmode opmode)
1110 {
1111 
1112 	switch (opmode) {
1113 	case IEEE80211_M_IBSS:
1114 		return (NL80211_IFTYPE_ADHOC);
1115 		break;
1116 	case IEEE80211_M_STA:
1117 		return (NL80211_IFTYPE_STATION);
1118 		break;
1119 	case IEEE80211_M_WDS:
1120 		return (NL80211_IFTYPE_WDS);
1121 		break;
1122 	case IEEE80211_M_HOSTAP:
1123 		return (NL80211_IFTYPE_AP);
1124 		break;
1125 	case IEEE80211_M_MONITOR:
1126 		return (NL80211_IFTYPE_MONITOR);
1127 		break;
1128 	case IEEE80211_M_MBSS:
1129 		return (NL80211_IFTYPE_MESH_POINT);
1130 		break;
1131 	case IEEE80211_M_AHDEMO:
1132 		/* FALLTHROUGH */
1133 	default:
1134 		printf("ERROR: %s: unsupported opmode %d\n", __func__, opmode);
1135 		/* FALLTHROUGH */
1136 	}
1137 	return (NL80211_IFTYPE_UNSPECIFIED);
1138 }
1139 
1140 #ifdef LKPI_80211_HW_CRYPTO
1141 static const char *
1142 lkpi_cipher_suite_to_name(uint32_t wlan_cipher_suite)
1143 {
1144 	switch (wlan_cipher_suite) {
1145 	case WLAN_CIPHER_SUITE_WEP40:
1146 		return ("WEP40");
1147 	case WLAN_CIPHER_SUITE_WEP104:
1148 		return ("WEP104");
1149 	case WLAN_CIPHER_SUITE_TKIP:
1150 		return ("TKIP");
1151 	case WLAN_CIPHER_SUITE_CCMP:
1152 		return ("CCMP");
1153 	case WLAN_CIPHER_SUITE_CCMP_256:
1154 		return ("CCMP_256");
1155 	case WLAN_CIPHER_SUITE_GCMP:
1156 		return ("GCMP");
1157 	case WLAN_CIPHER_SUITE_GCMP_256:
1158 		return ("GCMP_256");
1159 	case WLAN_CIPHER_SUITE_AES_CMAC:
1160 		return ("AES_CMAC");
1161 	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
1162 		return ("BIP_CMAC_256");
1163 	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
1164 		return ("BIP_GMAC_128");
1165 	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
1166 		return ("BIP_GMAC_256");
1167 	default:
1168 		return ("??");
1169 	}
1170 }
1171 
1172 static uint32_t
1173 lkpi_l80211_to_net80211_cyphers(struct ieee80211com *ic,
1174     uint32_t wlan_cipher_suite)
1175 {
1176 	switch (wlan_cipher_suite) {
1177 	case WLAN_CIPHER_SUITE_WEP40:
1178 		return (IEEE80211_CRYPTO_WEP);
1179 	case WLAN_CIPHER_SUITE_WEP104:
1180 		return (IEEE80211_CRYPTO_WEP);
1181 	case WLAN_CIPHER_SUITE_TKIP:
1182 		return (IEEE80211_CRYPTO_TKIP);
1183 	case WLAN_CIPHER_SUITE_CCMP:
1184 		return (IEEE80211_CRYPTO_AES_CCM);
1185 	case WLAN_CIPHER_SUITE_CCMP_256:
1186 		return (IEEE80211_CRYPTO_AES_CCM_256);
1187 	case WLAN_CIPHER_SUITE_GCMP:
1188 		return (IEEE80211_CRYPTO_AES_GCM_128);
1189 	case WLAN_CIPHER_SUITE_GCMP_256:
1190 		return (IEEE80211_CRYPTO_AES_GCM_256);
1191 	case WLAN_CIPHER_SUITE_AES_CMAC:
1192 		return (IEEE80211_CRYPTO_BIP_CMAC_128);
1193 	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
1194 		return (IEEE80211_CRYPTO_BIP_CMAC_256);
1195 	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
1196 		return (IEEE80211_CRYPTO_BIP_GMAC_128);
1197 	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
1198 		return (IEEE80211_CRYPTO_BIP_GMAC_256);
1199 	default:
1200 		ic_printf(ic, "%s: unknown WLAN Cipher Suite %#08x | %u (%s)\n",
1201 		    __func__,
1202 		    wlan_cipher_suite >> 8, wlan_cipher_suite & 0xff,
1203 		    lkpi_cipher_suite_to_name(wlan_cipher_suite));
1204 		return (0);
1205 	}
1206 }
1207 
1208 static uint32_t
1209 lkpi_net80211_to_l80211_cipher_suite(uint32_t cipher, uint8_t keylen)
1210 {
1211 
1212 	switch (cipher) {
1213 	case IEEE80211_CIPHER_WEP:
1214 		if (keylen == (40/NBBY))
1215 			return (WLAN_CIPHER_SUITE_WEP40);
1216 		else if (keylen == (104/NBBY))
1217 			return (WLAN_CIPHER_SUITE_WEP104);
1218 		else {
1219 			printf("%s: WEP with unsupported keylen %d\n",
1220 			    __func__, keylen * NBBY);
1221 			return (0);
1222 		}
1223 		break;
1224 	case IEEE80211_CIPHER_TKIP:
1225 		return (WLAN_CIPHER_SUITE_TKIP);
1226 	case IEEE80211_CIPHER_AES_CCM:
1227 		return (WLAN_CIPHER_SUITE_CCMP);
1228 	case IEEE80211_CIPHER_AES_CCM_256:
1229 		return (WLAN_CIPHER_SUITE_CCMP_256);
1230 	case IEEE80211_CIPHER_AES_GCM_128:
1231 		return (WLAN_CIPHER_SUITE_GCMP);
1232 	case IEEE80211_CIPHER_AES_GCM_256:
1233 		return (WLAN_CIPHER_SUITE_GCMP_256);
1234 	case IEEE80211_CIPHER_BIP_CMAC_128:
1235 		return (WLAN_CIPHER_SUITE_AES_CMAC);
1236 	case IEEE80211_CIPHER_BIP_CMAC_256:
1237 		return (WLAN_CIPHER_SUITE_BIP_CMAC_256);
1238 	case IEEE80211_CIPHER_BIP_GMAC_128:
1239 		return (WLAN_CIPHER_SUITE_BIP_GMAC_128);
1240 	case IEEE80211_CIPHER_BIP_GMAC_256:
1241 		return (WLAN_CIPHER_SUITE_BIP_GMAC_256);
1242 
1243 	case IEEE80211_CIPHER_AES_OCB:
1244 	case IEEE80211_CIPHER_TKIPMIC:
1245 		/*
1246 		 * TKIP w/ hw MIC support
1247 		 * (gone wrong; should really be a crypto flag in net80211).
1248 		 */
1249 	case IEEE80211_CIPHER_CKIP:
1250 	case IEEE80211_CIPHER_NONE:
1251 		printf("%s: unsupported cipher %#010x\n", __func__, cipher);
1252 		break;
1253 	default:
1254 		printf("%s: unknown cipher %#010x\n", __func__, cipher);
1255 	};
1256 	return (0);
1257 }
1258 #endif
1259 
1260 #ifdef __notyet__
1261 static enum ieee80211_sta_state
1262 lkpi_net80211_state_to_sta_state(enum ieee80211_state state)
1263 {
1264 
1265 	/*
1266 	 * XXX-BZ The net80211 states are "try to ..", the lkpi8011 states are
1267 	 * "done".  Also ASSOC/AUTHORIZED are both "RUN" then?
1268 	 */
1269 	switch (state) {
1270 	case IEEE80211_S_INIT:
1271 		return (IEEE80211_STA_NOTEXIST);
1272 	case IEEE80211_S_SCAN:
1273 		return (IEEE80211_STA_NONE);
1274 	case IEEE80211_S_AUTH:
1275 		return (IEEE80211_STA_AUTH);
1276 	case IEEE80211_S_ASSOC:
1277 		return (IEEE80211_STA_ASSOC);
1278 	case IEEE80211_S_RUN:
1279 		return (IEEE80211_STA_AUTHORIZED);
1280 	case IEEE80211_S_CAC:
1281 	case IEEE80211_S_CSA:
1282 	case IEEE80211_S_SLEEP:
1283 	default:
1284 		UNIMPLEMENTED;
1285 	};
1286 
1287 	return (IEEE80211_STA_NOTEXIST);
1288 }
1289 #endif
1290 
1291 static struct linuxkpi_ieee80211_channel *
1292 lkpi_find_lkpi80211_chan(struct lkpi_hw *lhw,
1293     struct ieee80211_channel *c)
1294 {
1295 	struct ieee80211_hw *hw;
1296 	struct linuxkpi_ieee80211_channel *channels;
1297 	enum nl80211_band band;
1298 	int i, nchans;
1299 
1300 	hw = LHW_TO_HW(lhw);
1301 	band = lkpi_net80211_chan_to_nl80211_band(c);
1302 	if (hw->wiphy->bands[band] == NULL)
1303 		return (NULL);
1304 
1305 	nchans = hw->wiphy->bands[band]->n_channels;
1306 	if (nchans <= 0)
1307 		return (NULL);
1308 
1309 	channels = hw->wiphy->bands[band]->channels;
1310 	for (i = 0; i < nchans; i++) {
1311 		if (channels[i].center_freq == c->ic_freq)
1312 			return (&channels[i]);
1313 	}
1314 
1315 	return (NULL);
1316 }
1317 
1318 #if 0
1319 static struct linuxkpi_ieee80211_channel *
1320 lkpi_get_lkpi80211_chan(struct ieee80211com *ic, struct ieee80211_node *ni)
1321 {
1322 	struct linuxkpi_ieee80211_channel *chan;
1323 	struct ieee80211_channel *c;
1324 	struct lkpi_hw *lhw;
1325 
1326 	chan = NULL;
1327 	if (ni != NULL && ni->ni_chan != IEEE80211_CHAN_ANYC)
1328 		c = ni->ni_chan;
1329 	else if (ic->ic_bsschan != IEEE80211_CHAN_ANYC)
1330 		c = ic->ic_bsschan;
1331 	else if (ic->ic_curchan != IEEE80211_CHAN_ANYC)
1332 		c = ic->ic_curchan;
1333 	else
1334 		c = NULL;
1335 
1336 	if (c != NULL && c != IEEE80211_CHAN_ANYC) {
1337 		lhw = ic->ic_softc;
1338 		chan = lkpi_find_lkpi80211_chan(lhw, c);
1339 	}
1340 
1341 	return (chan);
1342 }
1343 #endif
1344 
1345 struct linuxkpi_ieee80211_channel *
1346 linuxkpi_ieee80211_get_channel(struct wiphy *wiphy, uint32_t freq)
1347 {
1348 	enum nl80211_band band;
1349 
1350 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
1351 		struct ieee80211_supported_band *supband;
1352 		struct linuxkpi_ieee80211_channel *channels;
1353 		int i;
1354 
1355 		supband = wiphy->bands[band];
1356 		if (supband == NULL || supband->n_channels == 0)
1357 			continue;
1358 
1359 		channels = supband->channels;
1360 		for (i = 0; i < supband->n_channels; i++) {
1361 			if (channels[i].center_freq == freq)
1362 				return (&channels[i]);
1363 		}
1364 	}
1365 
1366 	return (NULL);
1367 }
1368 
1369 #ifdef LKPI_80211_HW_CRYPTO
1370 static int
1371 lkpi_sta_del_keys(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
1372     struct lkpi_sta *lsta)
1373 {
1374 	int error;
1375 
1376 	if (!lkpi_hwcrypto)
1377 		return (0);
1378 
1379 	lockdep_assert_wiphy(hw->wiphy);
1380 
1381 	if (vif->cfg.assoc && lsta->state == IEEE80211_STA_AUTHORIZED) {
1382 		if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1383 			ic_printf(lsta->ni->ni_ic,
1384 			    "%d %lu %s: vif still assoc; not deleting keys\n",
1385 			    curthread->td_tid, jiffies, __func__);
1386 		return (0);
1387 	}
1388 
1389 	ieee80211_ref_node(lsta->ni);
1390 
1391 	error = 0;
1392 	for (ieee80211_keyix keyix = 0; keyix < nitems(lsta->kc); keyix++) {
1393 		struct ieee80211_key_conf *kc;
1394 		int err;
1395 
1396 		if (lsta->kc[keyix] == NULL)
1397 			continue;
1398 		kc = lsta->kc[keyix];
1399 
1400 #ifdef LINUXKPI_DEBUG_80211
1401 		if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1402 			ic_printf(lsta->ni->ni_ic, "%d %lu %s: running set_key cmd %d(%s) for "
1403 			    "sta %6D: keyidx %u hw_key_idx %u flags %b\n",
1404 			    curthread->td_tid, jiffies, __func__,
1405 			    DISABLE_KEY, "DISABLE", lsta->sta.addr, ":",
1406 			    kc->keyidx, kc->hw_key_idx, kc->flags, IEEE80211_KEY_FLAG_BITS);
1407 #endif
1408 
1409 		err = lkpi_80211_mo_set_key(hw, DISABLE_KEY, vif,
1410 		    LSTA_TO_STA(lsta), kc);
1411 		if (err != 0) {
1412 			ic_printf(lsta->ni->ni_ic, "%d %lu %s: set_key cmd %d(%s) for "
1413 			    "sta %6D failed: %d\n", curthread->td_tid, jiffies, __func__,
1414 			    DISABLE_KEY, "DISABLE", lsta->sta.addr, ":", err);
1415 			error++;
1416 
1417 			/*
1418 			 * If we free the key here we will never be able to get it
1419 			 * removed from the driver/fw which will likely make us
1420 			 * crash (firmware).
1421 			 */
1422 			continue;
1423 		}
1424 #ifdef LINUXKPI_DEBUG_80211
1425 		if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1426 			ic_printf(lsta->ni->ni_ic, "%d %lu %s: set_key cmd %d(%s) for "
1427 			    "sta %6D succeeded: keyidx %u hw_key_idx %u flags %b\n",
1428 			    curthread->td_tid, jiffies, __func__,
1429 			    DISABLE_KEY, "DISABLE", lsta->sta.addr, ":",
1430 			    kc->keyidx, kc->hw_key_idx, kc->flags, IEEE80211_KEY_FLAG_BITS);
1431 #endif
1432 
1433 		lsta->kc[keyix] = NULL;
1434 		free(kc, M_LKPI80211);
1435 	}
1436 	ieee80211_free_node(lsta->ni);
1437 	return (error);
1438 }
1439 
1440 /* XXX-BZ one day we should replace this iterating over VIFs, or node list? */
1441 /* See also lkpi_sta_del_keys() these days. */
1442 static int
1443 lkpi_iv_key_delete(struct ieee80211vap *vap, const struct ieee80211_key *k)
1444 {
1445 	struct ieee80211com *ic;
1446 	struct lkpi_hw *lhw;
1447 	struct ieee80211_hw *hw;
1448 	struct lkpi_vif *lvif;
1449 	struct lkpi_sta *lsta;
1450 	struct ieee80211_vif *vif;
1451 	struct ieee80211_sta *sta;
1452 	struct ieee80211_node *ni;
1453 	struct ieee80211_key_conf *kc;
1454 	int error;
1455 
1456 	ic = vap->iv_ic;
1457 	lhw = ic->ic_softc;
1458 	hw = LHW_TO_HW(lhw);
1459 	lvif = VAP_TO_LVIF(vap);
1460 	vif = LVIF_TO_VIF(lvif);
1461 
1462 	/*
1463 	 * Make sure we do not make it here without going through
1464 	 * lkpi_iv_key_update_begin() first.
1465 	 */
1466 	lockdep_assert_wiphy(hw->wiphy);
1467 
1468 	ni = ieee80211_ref_node(vap->iv_bss);
1469 	lsta = ni->ni_drv_data;
1470 	if (lsta == NULL) {
1471 		ic_printf(ic, "%s: ni %p (%6D) with lsta NULL\n",
1472 		    __func__, ni, ni->ni_bssid, ":");
1473 		ieee80211_free_node(ni);
1474 		return (0);
1475 	}
1476 
1477 	/*
1478 	 * While we are assoc we may still send packets.  We cannot delete the
1479 	 * keys as otherwise packets could go out unencrypted.  Some firmware
1480 	 * does not like this and will fire an assert.
1481 	 * net80211 needs to drive this better but given we want the disassoc
1482 	 * frame out and have to unlock we are open to a race currently.
1483 	 * This check should prevent problems.
1484 	 * How to test: run 800Mbit/s UDP traffic and during that restart your
1485 	 * supplicant.  You want to survive that.
1486 	 */
1487 	if (vif->cfg.assoc && lsta->state == IEEE80211_STA_AUTHORIZED) {
1488 		if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1489 			ic_printf(ic, "%d %lu %s: vif still assoc; not deleting keys\n",
1490 			    curthread->td_tid, jiffies, __func__);
1491 		ieee80211_free_node(ni);
1492 		return (0);
1493 	}
1494 
1495 	if (IEEE80211_KEY_UNDEFINED(k)) {
1496 		ic_printf(ic, "%s: vap %p key %p is undefined: %p %u\n",
1497 		    __func__, vap, k, k->wk_cipher, k->wk_keyix);
1498 		ieee80211_free_node(ni);
1499 		return (0);
1500 	}
1501 
1502 	if (vap->iv_bss == NULL) {
1503 		ic_printf(ic, "%s: iv_bss %p for vap %p is NULL\n",
1504 		    __func__, vap->iv_bss, vap);
1505 		ieee80211_free_node(ni);
1506 		return (0);
1507 	}
1508 	sta = LSTA_TO_STA(lsta);
1509 
1510 	if (lsta->kc[k->wk_keyix] == NULL) {
1511 #ifdef LINUXKPI_DEBUG_80211
1512 		if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1513 			ic_printf(ic, "%d %lu %s: sta %6D and no key information, "
1514 			    "keyidx %u wk_macaddr %6D; returning success\n",
1515 			    curthread->td_tid, jiffies, __func__, sta->addr, ":",
1516 			    k->wk_keyix, k->wk_macaddr, ":");
1517 #endif
1518 		ieee80211_free_node(ni);
1519 		return (1);
1520 	}
1521 	kc = lsta->kc[k->wk_keyix];
1522 
1523 #ifdef LINUXKPI_DEBUG_80211
1524 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1525 		ic_printf(ic, "%d %lu %s: running set_key cmd %d(%s) for sta %6D: "
1526 		    "keyidx %u hw_key_idx %u flags %b\n",
1527 		    curthread->td_tid, jiffies, __func__,
1528 		    DISABLE_KEY, "DISABLE", sta->addr, ":",
1529 		    kc->keyidx, kc->hw_key_idx, kc->flags, IEEE80211_KEY_FLAG_BITS);
1530 #endif
1531 
1532 	error = lkpi_80211_mo_set_key(hw, DISABLE_KEY, vif, sta, kc);
1533 	if (error != 0) {
1534 		ic_printf(ic, "%d %lu %s: set_key cmd %d(%s) for sta %6D failed: %d\n",
1535 		    curthread->td_tid, jiffies, __func__,
1536 		    DISABLE_KEY, "DISABLE", sta->addr, ":", error);
1537 		error = 0;
1538 		goto out;
1539 	}
1540 
1541 #ifdef LINUXKPI_DEBUG_80211
1542 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1543 		ic_printf(ic, "%d %lu %s: set_key cmd %d(%s) for sta %6D succeeded: "
1544 		    "keyidx %u hw_key_idx %u flags %b\n",
1545 		    curthread->td_tid, jiffies, __func__,
1546 		    DISABLE_KEY, "DISABLE", sta->addr, ":",
1547 		    kc->keyidx, kc->hw_key_idx, kc->flags, IEEE80211_KEY_FLAG_BITS);
1548 #endif
1549 	lsta->kc[k->wk_keyix] = NULL;
1550 	free(kc, M_LKPI80211);
1551 	error = 1;
1552 out:
1553 	ieee80211_free_node(ni);
1554 	return (error);
1555 }
1556 
1557 static int
1558 lkpi_iv_key_set(struct ieee80211vap *vap, const struct ieee80211_key *k)
1559 {
1560 	struct ieee80211com *ic;
1561 	struct lkpi_hw *lhw;
1562 	struct ieee80211_hw *hw;
1563 	struct lkpi_vif *lvif;
1564 	struct lkpi_sta *lsta;
1565 	struct ieee80211_vif *vif;
1566 	struct ieee80211_sta *sta;
1567 	struct ieee80211_node *ni;
1568 	struct ieee80211_key_conf *kc;
1569 	uint32_t lcipher;
1570 	uint16_t exp_flags;
1571 	uint8_t keylen;
1572 	int error;
1573 
1574 	ic = vap->iv_ic;
1575 	lhw = ic->ic_softc;
1576 	hw = LHW_TO_HW(lhw);
1577 
1578 	/*
1579 	 * Make sure we do not make it here without going through
1580 	 * lkpi_iv_key_update_begin() first.
1581 	 */
1582 	lockdep_assert_wiphy(hw->wiphy);
1583 
1584 	if (IEEE80211_KEY_UNDEFINED(k)) {
1585 		ic_printf(ic, "%s: vap %p key %p is undefined: %p %u\n",
1586 		    __func__, vap, k, k->wk_cipher, k->wk_keyix);
1587 		return (0);
1588 	}
1589 
1590 	if (vap->iv_bss == NULL) {
1591 		ic_printf(ic, "%s: iv_bss %p for vap %p is NULL\n",
1592 		    __func__, vap->iv_bss, vap);
1593 		return (0);
1594 	}
1595 	ni = ieee80211_ref_node(vap->iv_bss);
1596 	lsta = ni->ni_drv_data;
1597 	if (lsta == NULL) {
1598 		ic_printf(ic, "%s: ni %p (%6D) with lsta NULL\n",
1599 		    __func__, ni, ni->ni_bssid, ":");
1600 		ieee80211_free_node(ni);
1601 		return (0);
1602 	}
1603 	sta = LSTA_TO_STA(lsta);
1604 
1605 	keylen = k->wk_keylen;
1606 	lcipher = lkpi_net80211_to_l80211_cipher_suite(
1607 	    k->wk_cipher->ic_cipher, k->wk_keylen);
1608 	switch (lcipher) {
1609 	case WLAN_CIPHER_SUITE_TKIP:
1610 		keylen += 2 * k->wk_cipher->ic_miclen;
1611 		break;
1612 	case WLAN_CIPHER_SUITE_CCMP:
1613 	case WLAN_CIPHER_SUITE_GCMP:
1614 		break;
1615 	default:
1616 		ic_printf(ic, "%s: CIPHER SUITE %#x (%s) not supported\n",
1617 		    __func__, lcipher, lkpi_cipher_suite_to_name(lcipher));
1618 		IMPROVE();
1619 		ieee80211_free_node(ni);
1620 		return (0);
1621 	}
1622 
1623 	if (lsta->kc[k->wk_keyix] != NULL) {
1624 		IMPROVE("Still in firmware? Del first. Can we assert this cannot happen?");
1625 		ic_printf(ic, "%s: sta %6D found with key information\n",
1626 		    __func__, sta->addr, ":");
1627 		kc = lsta->kc[k->wk_keyix];
1628 		lsta->kc[k->wk_keyix] = NULL;
1629 		free(kc, M_LKPI80211);
1630 		kc = NULL;	/* safeguard */
1631 	}
1632 
1633 	kc = malloc(sizeof(*kc) + keylen, M_LKPI80211, M_WAITOK | M_ZERO);
1634 	kc->_k = k;		/* Save the pointer to net80211. */
1635 	kc->cipher = lcipher;
1636 	kc->keyidx = k->wk_keyix;
1637 #if 0
1638 	kc->hw_key_idx = /* set by hw and needs to be passed for TX */;
1639 #endif
1640 	atomic64_set(&kc->tx_pn, k->wk_keytsc);
1641 	kc->keylen = k->wk_keylen;
1642 	memcpy(kc->key, k->wk_key, k->wk_keylen);
1643 
1644 	if (k->wk_flags & (IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV))
1645 		kc->flags |= IEEE80211_KEY_FLAG_PAIRWISE;
1646 	if (k->wk_flags & IEEE80211_KEY_GROUP)
1647 		kc->flags &= ~IEEE80211_KEY_FLAG_PAIRWISE;
1648 
1649 	kc->iv_len = k->wk_cipher->ic_header;
1650 	kc->icv_len = k->wk_cipher->ic_trailer;
1651 
1652 	switch (kc->cipher) {
1653 	case WLAN_CIPHER_SUITE_TKIP:
1654 		memcpy(kc->key + NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY, k->wk_txmic, k->wk_cipher->ic_miclen);
1655 		memcpy(kc->key + NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY, k->wk_rxmic, k->wk_cipher->ic_miclen);
1656 		break;
1657 	case WLAN_CIPHER_SUITE_CCMP:
1658 	case WLAN_CIPHER_SUITE_GCMP:
1659 		break;
1660 	default:
1661 		/* currently UNREACH */
1662 		IMPROVE();
1663 		break;
1664 	};
1665 	lsta->kc[k->wk_keyix] = kc;
1666 
1667 #ifdef LINUXKPI_DEBUG_80211
1668 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1669 		ic_printf(ic, "%d %lu %s: running set_key cmd %d(%s) for sta %6D: "
1670 		    "kc %p keyidx %u hw_key_idx %u keylen %u flags %b\n",
1671 		    curthread->td_tid, jiffies, __func__,
1672 		    SET_KEY, "SET", sta->addr, ":", kc, kc->keyidx, kc->hw_key_idx,
1673 		    kc->keylen, kc->flags, IEEE80211_KEY_FLAG_BITS);
1674 #endif
1675 
1676 	lvif = VAP_TO_LVIF(vap);
1677 	vif = LVIF_TO_VIF(lvif);
1678 	error = lkpi_80211_mo_set_key(hw, SET_KEY, vif, sta, kc);
1679 	if (error != 0) {
1680 		ic_printf(ic, "%d %lu %s: set_key cmd %d(%s) for sta %6D failed: %d\n",
1681 		    curthread->td_tid, jiffies, __func__,
1682 		    SET_KEY, "SET", sta->addr, ":", error);
1683 		lsta->kc[k->wk_keyix] = NULL;
1684 		free(kc, M_LKPI80211);
1685 		ieee80211_free_node(ni);
1686 		return (0);
1687 	}
1688 
1689 #ifdef LINUXKPI_DEBUG_80211
1690 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1691 		ic_printf(ic, "%d %lu %s: set_key cmd %d(%s) for sta %6D succeeded: "
1692 		    "kc %p keyidx %u hw_key_idx %u flags %b\n",
1693 		    curthread->td_tid, jiffies, __func__,
1694 		    SET_KEY, "SET", sta->addr, ":",
1695 		    kc, kc->keyidx, kc->hw_key_idx, kc->flags, IEEE80211_KEY_FLAG_BITS);
1696 #endif
1697 
1698 	exp_flags = 0;
1699 	switch (kc->cipher) {
1700 	case WLAN_CIPHER_SUITE_TKIP:
1701 		exp_flags = (IEEE80211_KEY_FLAG_PAIRWISE |
1702 			IEEE80211_KEY_FLAG_PUT_IV_SPACE |
1703 			IEEE80211_KEY_FLAG_GENERATE_MMIC |
1704 			IEEE80211_KEY_FLAG_PUT_MIC_SPACE);
1705 #define	TKIP_INVAL_COMBINATION						\
1706      (IEEE80211_KEY_FLAG_PUT_MIC_SPACE|IEEE80211_KEY_FLAG_GENERATE_MMIC)
1707 		if ((kc->flags & TKIP_INVAL_COMBINATION) == TKIP_INVAL_COMBINATION) {
1708 			ic_printf(ic, "%s: SET_KEY for %s returned invalid "
1709 			    "combination %b\n", __func__,
1710 			    lkpi_cipher_suite_to_name(kc->cipher),
1711 			    kc->flags, IEEE80211_KEY_FLAG_BITS);
1712 		}
1713 #undef	TKIP_INVAL_COMBINATION
1714 #ifdef __notyet__
1715 		/* Do flags surgery; special see linuxkpi_ieee80211_ifattach(). */
1716 		if ((kc->flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) != 0) {
1717 			k->wk_flags &= ~(IEEE80211_KEY_NOMICMGT|IEEE80211_KEY_NOMIC);
1718 			k->wk_flags |= IEEE80211_KEY_SWMIC;
1719 			ic->ic_cryptocaps &= ~IEEE80211_CRYPTO_TKIPMIC
1720 		}
1721 #endif
1722 		break;
1723 	case WLAN_CIPHER_SUITE_CCMP:
1724 	case WLAN_CIPHER_SUITE_GCMP:
1725 		exp_flags = (IEEE80211_KEY_FLAG_PAIRWISE |
1726 		    IEEE80211_KEY_FLAG_PUT_IV_SPACE |
1727 		    IEEE80211_KEY_FLAG_GENERATE_IV |
1728 		    IEEE80211_KEY_FLAG_GENERATE_IV_MGMT |	/* Only needs IV geeration for MGMT frames. */
1729 		    IEEE80211_KEY_FLAG_SW_MGMT_TX);		/* MFP in software */
1730 		break;
1731 	}
1732 	if ((kc->flags & ~exp_flags) != 0)
1733 		ic_printf(ic, "%s: SET_KEY for %s returned unexpected key flags: "
1734 		    " %#06x & ~%#06x = %b\n", __func__,
1735 		    lkpi_cipher_suite_to_name(kc->cipher), kc->flags, exp_flags,
1736 		    (kc->flags & ~exp_flags), IEEE80211_KEY_FLAG_BITS);
1737 
1738 #ifdef __notyet__
1739 	/* Do flags surgery. */
1740 	if ((kc->flags & IEEE80211_KEY_FLAG_GENERATE_IV_MGMT) == 0)
1741 		k->wk_flags |= IEEE80211_KEY_NOIVMGT;
1742 	if ((kc->flags & IEEE80211_KEY_FLAG_GENERATE_IV) == 0)
1743 		k->wk_flags |= IEEE80211_KEY_NOIV;
1744 #endif
1745 
1746 	ieee80211_free_node(ni);
1747 	return (1);
1748 }
1749 
1750 static void
1751 lkpi_iv_key_update_begin(struct ieee80211vap *vap)
1752 {
1753 	struct ieee80211_node_table *nt;
1754 	struct ieee80211com *ic;
1755 	struct lkpi_hw *lhw;
1756 	struct ieee80211_hw *hw;
1757 	struct lkpi_vif *lvif;
1758 	struct ieee80211_node *ni;
1759 	bool icislocked, ntislocked;
1760 
1761 	ic = vap->iv_ic;
1762 	lhw = ic->ic_softc;
1763 	hw = LHW_TO_HW(lhw);
1764 	lvif = VAP_TO_LVIF(vap);
1765 	nt = &ic->ic_sta;
1766 
1767 	icislocked = IEEE80211_IS_LOCKED(ic);
1768 	ntislocked = IEEE80211_NODE_IS_LOCKED(nt);
1769 
1770 #ifdef LINUXKPI_DEBUG_80211
1771 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1772 		ic_printf(ic, "%d %lu %s: vap %p ic %p %slocked nt %p %slocked "
1773 		    "lvif ic_unlocked %d nt_unlocked %d\n",
1774 		    curthread->td_tid, jiffies, __func__, vap,
1775 		    ic, icislocked ? "" : "un", nt, ntislocked ? "" : "un",
1776 		    lvif->ic_unlocked, lvif->nt_unlocked);
1777 #endif
1778 
1779 	/*
1780 	 * This is inconsistent net80211 locking to be fixed one day.
1781 	 */
1782 	/* Try to make sure the node does not go away while possibly unlocked. */
1783 	ni = NULL;
1784 	if (icislocked || ntislocked) {
1785 		if (vap->iv_bss != NULL)
1786 			ni = ieee80211_ref_node(vap->iv_bss);
1787 	}
1788 
1789 	if (icislocked)
1790 		IEEE80211_UNLOCK(ic);
1791 	if (ntislocked)
1792 		IEEE80211_NODE_UNLOCK(nt);
1793 
1794 	wiphy_lock(hw->wiphy);
1795 
1796 	KASSERT(lvif->key_update_iv_bss == NULL, ("%s: key_update_iv_bss not NULL %p",
1797 	    __func__, lvif->key_update_iv_bss));
1798 	lvif->key_update_iv_bss = ni;
1799 
1800 	/*
1801 	 * ic/nt_unlocked could be a bool given we are under the lock and there
1802 	 * must only be a single thread.
1803 	 * In case anything in the future disturbs the order the refcnt will
1804 	 * help us catching problems a lot easier.
1805 	 */
1806 	if (icislocked)
1807 		refcount_acquire(&lvif->ic_unlocked);
1808 	if (ntislocked)
1809 		refcount_acquire(&lvif->nt_unlocked);
1810 
1811 	/*
1812 	 * Stop the queues while doing key updates.
1813 	 */
1814 	ieee80211_stop_queues(hw);
1815 }
1816 
1817 static void
1818 lkpi_iv_key_update_end(struct ieee80211vap *vap)
1819 {
1820 	struct ieee80211_node_table *nt;
1821 	struct ieee80211com *ic;
1822 	struct lkpi_hw *lhw;
1823 	struct ieee80211_hw *hw;
1824 	struct lkpi_vif *lvif;
1825 	bool icislocked, ntislocked;
1826 
1827 	ic = vap->iv_ic;
1828 	lhw = ic->ic_softc;
1829 	hw = LHW_TO_HW(lhw);
1830 	lvif = VAP_TO_LVIF(vap);
1831 	nt = &ic->ic_sta;
1832 
1833 	/*
1834 	 * Re-enabled the queues after the key update.
1835 	 */
1836 	lkpi_ieee80211_wake_queues_locked(hw);
1837 
1838 	icislocked = IEEE80211_IS_LOCKED(ic);
1839 	MPASS(!icislocked);
1840 	ntislocked = IEEE80211_NODE_IS_LOCKED(nt);
1841 	MPASS(!ntislocked);
1842 
1843 #ifdef LINUXKPI_DEBUG_80211
1844 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1845 		ic_printf(ic, "%d %lu %s: vap %p ic %p %slocked nt %p %slocked "
1846 		    "lvif ic_unlocked %d nt_unlocked %d\n",
1847 		    curthread->td_tid, jiffies, __func__, vap,
1848 		    ic, icislocked ? "" : "un", nt, ntislocked ? "" : "un",
1849 		    lvif->ic_unlocked, lvif->nt_unlocked);
1850 #endif
1851 
1852 	/*
1853 	 * Check under lock; see comment in lkpi_iv_key_update_begin().
1854 	 * In case the refcnt gets out of sync locking in net80211 will
1855 	 * quickly barf as well (trying to unlock a lock not held).
1856 	 */
1857 	icislocked = refcount_release_if_last(&lvif->ic_unlocked);
1858 	ntislocked = refcount_release_if_last(&lvif->nt_unlocked);
1859 
1860 	if (lvif->key_update_iv_bss != NULL) {
1861 		ieee80211_free_node(lvif->key_update_iv_bss);
1862 		lvif->key_update_iv_bss = NULL;
1863 	}
1864 
1865 	wiphy_unlock(hw->wiphy);
1866 
1867 	/*
1868 	 * This is inconsistent net80211 locking to be fixed one day.
1869 	 * ic before nt to avoid a LOR.
1870 	 */
1871 	if (icislocked)
1872 		IEEE80211_LOCK(ic);
1873 	if (ntislocked)
1874 		IEEE80211_NODE_LOCK(nt);
1875 }
1876 #endif
1877 
1878 static void
1879 lkpi_cleanup_mcast_list_locked(struct lkpi_hw *lhw)
1880 {
1881 	struct list_head *le, *next;
1882 	struct netdev_hw_addr *addr;
1883 
1884 	if (lhw->mc_list.count != 0) {
1885 		list_for_each_safe(le, next, &lhw->mc_list.addr_list) {
1886 			addr = list_entry(le, struct netdev_hw_addr, addr_list);
1887 			list_del(le);
1888 			lhw->mc_list.count--;
1889 			free(addr, M_LKPI80211);
1890 		}
1891 	}
1892 	KASSERT(lhw->mc_list.count == 0, ("%s: mc_list %p count %d != 0\n",
1893 	    __func__, &lhw->mc_list, lhw->mc_list.count));
1894 }
1895 
1896 static u_int
1897 lkpi_ic_update_mcast_copy(void *arg, struct sockaddr_dl *sdl, u_int cnt)
1898 {
1899 	struct netdev_hw_addr_list *mc_list;
1900 	struct netdev_hw_addr *addr;
1901 
1902 	KASSERT(arg != NULL && sdl != NULL, ("%s: arg %p sdl %p cnt %u\n",
1903 	    __func__, arg, sdl, cnt));
1904 
1905 	mc_list = arg;
1906 	/* If it is on the list already skip it. */
1907 	netdev_hw_addr_list_for_each(addr, mc_list) {
1908 		if (!memcmp(addr->addr, LLADDR(sdl), sdl->sdl_alen))
1909 			return (0);
1910 	}
1911 
1912 	addr = malloc(sizeof(*addr), M_LKPI80211, M_NOWAIT | M_ZERO);
1913 	if (addr == NULL)
1914 		return (0);
1915 
1916 	INIT_LIST_HEAD(&addr->addr_list);
1917 	memcpy(addr->addr, LLADDR(sdl), sdl->sdl_alen);
1918 	/* XXX this should be a netdev function? */
1919 	list_add(&addr->addr_list, &mc_list->addr_list);
1920 	mc_list->count++;
1921 
1922 #ifdef LINUXKPI_DEBUG_80211
1923 	if (linuxkpi_debug_80211 & D80211_TRACE)
1924 		printf("%s:%d: mc_list count %d: added %6D\n",
1925 		    __func__, __LINE__, mc_list->count, addr->addr, ":");
1926 #endif
1927 
1928 	return (1);
1929 }
1930 
1931 static void
1932 lkpi_update_mcast_filter(struct ieee80211com *ic)
1933 {
1934 	struct lkpi_hw *lhw;
1935 	struct ieee80211_hw *hw;
1936 	u64 mc;
1937 	unsigned int changed_flags, flags;
1938 	bool scanning;
1939 
1940 	lhw = ic->ic_softc;
1941 
1942 	LKPI_80211_LHW_SCAN_LOCK(lhw);
1943 	scanning = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
1944 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
1945 
1946 	LKPI_80211_LHW_MC_LOCK(lhw);
1947 
1948 	flags = 0;
1949 	if (scanning)
1950 		flags |= FIF_BCN_PRBRESP_PROMISC;
1951 	/* The latter condition may not be as expected but seems wise. */
1952 	if (lhw->mc_all_multi || lhw->ops->prepare_multicast == NULL)
1953 		flags |= FIF_ALLMULTI;
1954 
1955 	hw = LHW_TO_HW(lhw);
1956 	mc = lkpi_80211_mo_prepare_multicast(hw, &lhw->mc_list);
1957 
1958 	changed_flags = (lhw->mc_flags ^ flags) & FIF_FLAGS_MASK;
1959 	lkpi_80211_mo_configure_filter(hw, changed_flags, &flags, mc);
1960 	lhw->mc_flags = flags;
1961 
1962 #ifdef LINUXKPI_DEBUG_80211
1963 	if (linuxkpi_debug_80211 & D80211_TRACE)
1964 		printf("%s: changed_flags %#06x count %d mc_flags %#010x\n",
1965 		    __func__, changed_flags, lhw->mc_list.count, lhw->mc_flags);
1966 #endif
1967 
1968 	LKPI_80211_LHW_MC_UNLOCK(lhw);
1969 }
1970 
1971 static enum ieee80211_bss_changed
1972 lkpi_update_dtim_tsf(struct ieee80211_vif *vif, struct ieee80211_node *ni,
1973     struct ieee80211vap *vap, const char *_f, int _l)
1974 {
1975 	enum ieee80211_bss_changed bss_changed;
1976 
1977 	bss_changed = 0;
1978 
1979 #ifdef LINUXKPI_DEBUG_80211
1980 	if (linuxkpi_debug_80211 & D80211_TRACE)
1981 		printf("%s:%d [%s:%d] assoc %d aid %d beacon_int %u "
1982 		    "dtim_period %u sync_dtim_count %u sync_tsf %ju "
1983 		    "sync_device_ts %u bss_changed %#010jx\n",
1984 			__func__, __LINE__, _f, _l,
1985 			vif->cfg.assoc, vif->cfg.aid,
1986 			vif->bss_conf.beacon_int, vif->bss_conf.dtim_period,
1987 			vif->bss_conf.sync_dtim_count,
1988 			(uintmax_t)vif->bss_conf.sync_tsf,
1989 			vif->bss_conf.sync_device_ts,
1990 			(uintmax_t)bss_changed);
1991 #endif
1992 
1993 	if (vif->bss_conf.beacon_int != ni->ni_intval) {
1994 		vif->bss_conf.beacon_int = ni->ni_intval;
1995 		/* iwlwifi FW bug workaround; iwl_mvm_mac_sta_state. */
1996 		if (vif->bss_conf.beacon_int < 16)
1997 			vif->bss_conf.beacon_int = 16;
1998 		bss_changed |= BSS_CHANGED_BEACON_INT;
1999 	}
2000 
2001 	/*
2002 	 * lkpi_iv_sta_recv_mgmt() will directly call into this function.
2003 	 * iwlwifi(4) in iwl_mvm_bss_info_changed_station_common() will
2004 	 * stop seesion protection the moment it sees
2005 	 * BSS_CHANGED_BEACON_INFO (with the expectations that it was
2006 	 * "a beacon from the associated AP"). It will also update
2007 	 * the beacon filter in that case.  This is the only place
2008 	 * we set the BSS_CHANGED_BEACON_INFO on the non-teardown
2009 	 * path so make sure we only do run this check once we are
2010 	 * assoc. (*iv_recv_mgmt)() will be called before we enter
2011 	 * here so the ni will be updated with information from the
2012 	 * beacon via net80211::sta_recv_mgmt().  We also need to
2013 	 * make sure we do not do it on every beacon we still may
2014 	 * get so only do if something changed.  vif->bss_conf.dtim_period
2015 	 * should be 0 as we start up (we also reset it on teardown).
2016 	 */
2017 	if (vif->cfg.assoc &&
2018 	    vif->bss_conf.dtim_period != ni->ni_dtim_period &&
2019 	    ni->ni_dtim_period > 0) {
2020 		vif->bss_conf.dtim_period = ni->ni_dtim_period;
2021 		bss_changed |= BSS_CHANGED_BEACON_INFO;
2022 	}
2023 
2024 	vif->bss_conf.sync_dtim_count = ni->ni_dtim_count;
2025 	vif->bss_conf.sync_tsf = le64toh(ni->ni_tstamp.tsf);
2026 	/* vif->bss_conf.sync_device_ts = set in linuxkpi_ieee80211_rx. */
2027 
2028 #ifdef LINUXKPI_DEBUG_80211
2029 	if (linuxkpi_debug_80211 & D80211_TRACE)
2030 		printf("%s:%d [%s:%d] assoc %d aid %d beacon_int %u "
2031 		    "dtim_period %u sync_dtim_count %u sync_tsf %ju "
2032 		    "sync_device_ts %u bss_changed %#010jx\n",
2033 			__func__, __LINE__, _f, _l,
2034 			vif->cfg.assoc, vif->cfg.aid,
2035 			vif->bss_conf.beacon_int, vif->bss_conf.dtim_period,
2036 			vif->bss_conf.sync_dtim_count,
2037 			(uintmax_t)vif->bss_conf.sync_tsf,
2038 			vif->bss_conf.sync_device_ts,
2039 			(uintmax_t)bss_changed);
2040 #endif
2041 
2042 	return (bss_changed);
2043 }
2044 
2045 static void
2046 lkpi_stop_hw_scan(struct lkpi_hw *lhw, struct ieee80211_vif *vif)
2047 {
2048 	struct ieee80211_hw *hw;
2049 	int error;
2050 	bool cancel;
2051 
2052 	TRACE_SCAN(lhw->ic, "scan_flags %b", lhw->scan_flags, LKPI_LHW_SCAN_BITS);
2053 
2054 	LKPI_80211_LHW_SCAN_LOCK(lhw);
2055 	cancel = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
2056 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
2057 	if (!cancel)
2058 		return;
2059 
2060 	hw = LHW_TO_HW(lhw);
2061 
2062 	IEEE80211_UNLOCK(lhw->ic);
2063 	wiphy_lock(hw->wiphy);
2064 	/* Need to cancel the scan. */
2065 	lkpi_80211_mo_cancel_hw_scan(hw, vif);
2066 	wiphy_unlock(hw->wiphy);
2067 
2068 	/* Need to make sure we see ieee80211_scan_completed. */
2069 	LKPI_80211_LHW_SCAN_LOCK(lhw);
2070 	if ((lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0)
2071 		error = msleep(lhw, &lhw->scan_mtx, 0, "lhwscanstop", hz/2);
2072 	cancel = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
2073 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
2074 
2075 	IEEE80211_LOCK(lhw->ic);
2076 
2077 	if (cancel)
2078 		ic_printf(lhw->ic, "%s: failed to cancel scan: %d (%p, %p)\n",
2079 		    __func__, error, lhw, vif);
2080 }
2081 
2082 static void
2083 lkpi_hw_conf_idle(struct ieee80211_hw *hw, bool new)
2084 {
2085 	struct lkpi_hw *lhw;
2086 	int error;
2087 	bool old;
2088 
2089 	old = hw->conf.flags & IEEE80211_CONF_IDLE;
2090 	if (old == new)
2091 		return;
2092 
2093 	hw->conf.flags ^= IEEE80211_CONF_IDLE;
2094 	error = lkpi_80211_mo_config(hw, IEEE80211_CONF_CHANGE_IDLE);
2095 	if (error != 0 && error != EOPNOTSUPP) {
2096 		lhw = HW_TO_LHW(hw);
2097 		ic_printf(lhw->ic, "ERROR: %s: config %#0x returned %d\n",
2098 		    __func__, IEEE80211_CONF_CHANGE_IDLE, error);
2099 	}
2100 }
2101 
2102 static enum ieee80211_bss_changed
2103 lkpi_disassoc(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
2104     struct lkpi_hw *lhw)
2105 {
2106 	enum ieee80211_bss_changed changed;
2107 	struct lkpi_vif *lvif;
2108 
2109 	changed = 0;
2110 	sta->aid = 0;
2111 	if (vif->cfg.assoc) {
2112 
2113 		vif->cfg.assoc = false;
2114 		vif->cfg.aid = 0;
2115 		changed |= BSS_CHANGED_ASSOC;
2116 		IMPROVE();
2117 
2118 		lkpi_update_mcast_filter(lhw->ic);
2119 
2120 		/*
2121 		 * Executing the bss_info_changed(BSS_CHANGED_ASSOC) with
2122 		 * assoc = false right away here will remove the sta from
2123 		 * firmware for iwlwifi.
2124 		 * We no longer do this but only return the BSS_CHNAGED value.
2125 		 * The caller is responsible for removing the sta gong to
2126 		 * IEEE80211_STA_NOTEXIST and then executing the
2127 		 * bss_info_changed() update.
2128 		 * See DOWN4 for more detailed comment.
2129 		 */
2130 
2131 		lvif = VIF_TO_LVIF(vif);
2132 		lvif->beacons = 0;
2133 	}
2134 
2135 	return (changed);
2136 }
2137 
2138 static void
2139 lkpi_wake_tx_queues(struct ieee80211_hw *hw, struct ieee80211_sta *sta,
2140     bool dequeue_seen, bool no_emptyq)
2141 {
2142 	struct lkpi_txq *ltxq;
2143 	int tid;
2144 	bool ltxq_empty;
2145 
2146 	/* Wake up all queues to know they are allocated in the driver. */
2147 	for (tid = 0; tid < nitems(sta->txq); tid++) {
2148 
2149 		if (tid == IEEE80211_NUM_TIDS) {
2150 			IMPROVE("station specific?");
2151 			if (!ieee80211_hw_check(hw, STA_MMPDU_TXQ))
2152 				continue;
2153 		} else if (tid >= hw->queues)
2154 			continue;
2155 
2156 		if (sta->txq[tid] == NULL)
2157 			continue;
2158 
2159 		ltxq = TXQ_TO_LTXQ(sta->txq[tid]);
2160 		if (dequeue_seen && !ltxq->seen_dequeue)
2161 			continue;
2162 
2163 		LKPI_80211_LTXQ_LOCK(ltxq);
2164 		ltxq_empty = skb_queue_empty(&ltxq->skbq);
2165 		LKPI_80211_LTXQ_UNLOCK(ltxq);
2166 		if (no_emptyq && ltxq_empty)
2167 			continue;
2168 
2169 		lkpi_80211_mo_wake_tx_queue(hw, sta->txq[tid], false);
2170 	}
2171 }
2172 
2173 /*
2174  * On the way down from RUN -> ASSOC -> AUTH we may send a DISASSOC or DEAUTH
2175  * packet.  The problem is that the state machine functions tend to hold the
2176  * LHW lock which will prevent lkpi_80211_txq_tx_one() from sending the packet.
2177  * We call this after dropping the ic lock and before acquiring the LHW lock.
2178  * we make sure no further packets are queued and if they are queued the task
2179  * will finish or be cancelled.  At the end if a packet is left we manually
2180  * send it.  scan_to_auth() would re-enable sending if the lsta would be
2181  * re-used.
2182  */
2183 static void
2184 lkpi_80211_flush_tx(struct lkpi_hw *lhw, struct lkpi_sta *lsta)
2185 {
2186 	struct ieee80211_hw *hw;
2187 	struct mbufq mq;
2188 	struct mbuf *m;
2189 	int len;
2190 
2191 	/* There is no lockdep_assert_not_held_wiphy(). */
2192 	hw = LHW_TO_HW(lhw);
2193 	lockdep_assert_not_held(&hw->wiphy->mtx);
2194 
2195 	/* Do not accept any new packets until scan_to_auth or lsta_free(). */
2196 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
2197 	lsta->txq_ready = false;
2198 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
2199 
2200 	while (taskqueue_cancel(taskqueue_thread, &lsta->txq_task, NULL) != 0)
2201 		taskqueue_drain(taskqueue_thread, &lsta->txq_task);
2202 
2203 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
2204 	len = mbufq_len(&lsta->txq);
2205 	if (len <= 0) {
2206 		LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
2207 		return;
2208 	}
2209 
2210 	mbufq_init(&mq, IFQ_MAXLEN);
2211 	mbufq_concat(&mq, &lsta->txq);
2212 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
2213 
2214 	m = mbufq_dequeue(&mq);
2215 	while (m != NULL) {
2216 		lkpi_80211_txq_tx_one(lsta, m);
2217 		m = mbufq_dequeue(&mq);
2218 	}
2219 }
2220 
2221 static void
2222 lkpi_init_chandef(struct cfg80211_chan_def *chandef,
2223     struct linuxkpi_ieee80211_channel *chan, struct ieee80211_channel *c,
2224     bool can_ht)
2225 {
2226 
2227 	cfg80211_chandef_create(chandef, chan,
2228 	    (can_ht) ? NL80211_CHAN_HT20 : NL80211_CHAN_NO_HT);
2229 	chandef->center_freq1 = ieee80211_get_channel_center_freq1(c);
2230 	chandef->center_freq2 = ieee80211_get_channel_center_freq2(c);
2231 
2232 	IMPROVE("Check ht/vht_cap from band not just chan? See lkpi_sta_sync_from_ni...");
2233 #ifdef LKPI_80211_HT
2234 	if (IEEE80211_IS_CHAN_HT(c)) {
2235 		if (IEEE80211_IS_CHAN_HT40(c))
2236 			chandef->width = NL80211_CHAN_WIDTH_40;
2237 		else
2238 			chandef->width = NL80211_CHAN_WIDTH_20;
2239 	}
2240 #endif
2241 #ifdef LKPI_80211_VHT
2242 	if (IEEE80211_IS_CHAN_VHT_5GHZ(c)) {
2243 		if (IEEE80211_IS_CHAN_VHT80P80(c))
2244 			chandef->width = NL80211_CHAN_WIDTH_80P80;
2245 		else if (IEEE80211_IS_CHAN_VHT160(c))
2246 			chandef->width = NL80211_CHAN_WIDTH_160;
2247 		else if (IEEE80211_IS_CHAN_VHT80(c))
2248 			chandef->width = NL80211_CHAN_WIDTH_80;
2249 	}
2250 #endif
2251 }
2252 
2253 static uint32_t
2254 lkpi_init_chanctx_conf(struct ieee80211_hw *hw,
2255     struct cfg80211_chan_def *chandef,
2256     struct ieee80211_chanctx_conf *chanctx_conf)
2257 {
2258 	uint32_t changed;
2259 
2260 	lockdep_assert_wiphy(hw->wiphy);
2261 
2262 	changed = 0;
2263 
2264 	chanctx_conf->rx_chains_static = 1;
2265 	chanctx_conf->rx_chains_dynamic = 1;
2266 	changed |= IEEE80211_CHANCTX_CHANGE_RX_CHAINS;
2267 
2268 	if (chanctx_conf->radar_enabled != hw->conf.radar_enabled) {
2269 		chanctx_conf->radar_enabled = hw->conf.radar_enabled;
2270 		changed |= IEEE80211_CHANCTX_CHANGE_RADAR;
2271 	}
2272 
2273 	chanctx_conf->def = *chandef;
2274 	changed |= IEEE80211_CHANCTX_CHANGE_WIDTH;
2275 
2276 	/* One day we should figure this out; is for iwlwifi-only. */
2277 	chanctx_conf->min_def = chanctx_conf->def;
2278 	changed |= IEEE80211_CHANCTX_CHANGE_MIN_WIDTH;
2279 
2280 	/* chanctx_conf->ap = */
2281 
2282 	return (changed);
2283 }
2284 
2285 static struct lkpi_chanctx *
2286 lkpi_alloc_lchanctx(struct ieee80211_hw *hw, struct lkpi_vif *lvif)
2287 {
2288 	struct lkpi_chanctx *lchanctx;
2289 
2290 	lchanctx = malloc(sizeof(*lchanctx) + hw->chanctx_data_size,
2291 	    M_LKPI80211, M_WAITOK | M_ZERO);
2292 	lchanctx->lvif = lvif;
2293 
2294 	return (lchanctx);
2295 }
2296 
2297 static struct lkpi_chanctx *
2298 lkpi_find_lchanctx_reserved(struct ieee80211_hw *hw, struct lkpi_vif *lvif)
2299 {
2300 	struct lkpi_hw *lhw;
2301 	struct lkpi_chanctx *lchanctx;
2302 	bool found;
2303 
2304 	lhw = HW_TO_LHW(hw);
2305 
2306 	found = false;
2307 	rcu_read_lock();
2308 	list_for_each_entry_rcu(lchanctx, &lhw->lchanctx_list_reserved, entry) {
2309 		if (lchanctx->lvif == lvif) {
2310 			found = true;
2311 			break;
2312 		}
2313 	}
2314 	rcu_read_unlock();
2315 
2316 	if (!found) {
2317 		lchanctx = lkpi_alloc_lchanctx(hw, lvif);
2318 		list_add_rcu(&lchanctx->entry, &lhw->lchanctx_list_reserved);
2319 	}
2320 
2321 	return (lchanctx);
2322 }
2323 
2324 static struct ieee80211_chanctx_conf *
2325 lkpi_get_chanctx_conf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
2326 {
2327 	struct ieee80211_chanctx_conf *chanctx_conf;
2328 
2329 	chanctx_conf = rcu_dereference_protected(vif->bss_conf.chanctx_conf,
2330 	    lockdep_is_held(&hw->wiphy->mtx));
2331 	if (chanctx_conf == NULL) {
2332 		struct lkpi_chanctx *lchanctx;
2333 		struct lkpi_vif *lvif;
2334 
2335 		lvif = VIF_TO_LVIF(vif);
2336 		lchanctx = lkpi_find_lchanctx_reserved(hw, lvif);
2337 		KASSERT(lchanctx != NULL, ("%s: hw %p, vif %p no lchanctx\n",
2338 		    __func__, hw, vif));
2339 		list_del(&lchanctx->entry);
2340 		chanctx_conf = &lchanctx->chanctx_conf;
2341 	}
2342 	/* else { IMPROVE("diff changes for changed, working on live copy, rcu"); } */
2343 
2344 	return (chanctx_conf);
2345 }
2346 
2347 static int
2348 lkpi_set_chanctx_conf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
2349     struct ieee80211_chanctx_conf *chanctx_conf,
2350     uint32_t changed, bool changed_set)
2351 {
2352 	struct lkpi_hw *lhw;
2353 	struct lkpi_chanctx *lchanctx;
2354 	int error;
2355 
2356 	if (vif->bss_conf.chanctx_conf == chanctx_conf) {
2357 		if (!changed_set) {
2358 			IMPROVE("OBSOLETE?");
2359 			changed = IEEE80211_CHANCTX_CHANGE_MIN_WIDTH;
2360 			changed |= IEEE80211_CHANCTX_CHANGE_RADAR;
2361 			changed |= IEEE80211_CHANCTX_CHANGE_RX_CHAINS;
2362 			changed |= IEEE80211_CHANCTX_CHANGE_WIDTH;
2363 		}
2364 		lkpi_80211_mo_change_chanctx(hw, chanctx_conf, changed);
2365 
2366 		return (0);
2367 	}
2368 
2369 	lhw = HW_TO_LHW(hw);
2370 
2371 	/* The device is no longer idle. */
2372 	IMPROVE("Once we do multi-vif, only do for 1st chanctx");
2373 	lkpi_hw_conf_idle(hw, false);
2374 
2375 	error = lkpi_80211_mo_add_chanctx(hw, chanctx_conf);
2376 	if (error != 0 && error != EOPNOTSUPP) {
2377 		ic_printf(lhw->ic, "%s:%d: mo_add_chanctx "
2378 		    "failed: %d\n", __func__, __LINE__, error);
2379 		return (error);
2380 	}
2381 
2382 	vif->bss_conf.chanreq.oper.chan = chanctx_conf->def.chan;
2383 	vif->bss_conf.chanreq.oper.width = chanctx_conf->def.width;
2384 	vif->bss_conf.chanreq.oper.center_freq1 =
2385 	    chanctx_conf->def.center_freq1;
2386 	vif->bss_conf.chanreq.oper.center_freq2 =
2387 	    chanctx_conf->def.center_freq2;
2388 
2389 	lchanctx = CHANCTX_CONF_TO_LCHANCTX(chanctx_conf);
2390 	list_add_rcu(&lchanctx->entry, &lhw->lchanctx_list);
2391 	rcu_assign_pointer(vif->bss_conf.chanctx_conf, chanctx_conf);
2392 
2393 	/* Assign vif chanctx. */
2394 	if (error == 0)
2395 		error = lkpi_80211_mo_assign_vif_chanctx(hw, vif,
2396 		    &vif->bss_conf, chanctx_conf);
2397 	if (error == EOPNOTSUPP)
2398 		error = 0;
2399 	if (error != 0) {
2400 		ic_printf(lhw->ic, "%s:%d: mo_assign_vif_chanctx "
2401 		    "failed: %d\n", __func__, __LINE__, error);
2402 		lkpi_80211_mo_remove_chanctx(hw, chanctx_conf);
2403 		rcu_assign_pointer(vif->bss_conf.chanctx_conf, NULL);
2404 		lchanctx = CHANCTX_CONF_TO_LCHANCTX(chanctx_conf);
2405 		list_del(&lchanctx->entry);
2406 		list_add_rcu(&lchanctx->entry, &lhw->lchanctx_list_reserved);
2407 	}
2408 
2409 	return (error);
2410 }
2411 
2412 static void
2413 lkpi_remove_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
2414 {
2415 	struct lkpi_hw *lhw;
2416 	struct ieee80211_chanctx_conf *chanctx_conf;
2417 	struct lkpi_chanctx *lchanctx;
2418 
2419 	lockdep_assert_wiphy(hw->wiphy);
2420 
2421 	chanctx_conf = rcu_dereference_protected(vif->bss_conf.chanctx_conf,
2422 	    lockdep_is_held(&hw->wiphy->mtx));
2423 
2424 	if (chanctx_conf == NULL)
2425 		return;
2426 
2427 	/* Remove vif context. */
2428 	lkpi_80211_mo_unassign_vif_chanctx(hw, vif, &vif->bss_conf, chanctx_conf);
2429 
2430 	lkpi_hw_conf_idle(hw, true);
2431 
2432 	/* Remove chan ctx. */
2433 	lkpi_80211_mo_remove_chanctx(hw, chanctx_conf);
2434 
2435 	/* Cleanup. */
2436 	rcu_assign_pointer(vif->bss_conf.chanctx_conf, NULL);
2437 	lchanctx = CHANCTX_CONF_TO_LCHANCTX(chanctx_conf);
2438 	list_del(&lchanctx->entry);
2439 	lhw = HW_TO_LHW(hw);
2440 	list_add_rcu(&lchanctx->entry, &lhw->lchanctx_list_reserved);
2441 }
2442 
2443 /* -------------------------------------------------------------------------- */
2444 
2445 /* Any other options belong here? Check more drivers. */
2446 #define	BSS_CHANGED_VIF_CFG_BITS					\
2447     (BSS_CHANGED_SSID | BSS_CHANGED_IDLE | BSS_CHANGED_PS | BSS_CHANGED_ASSOC | \
2448     BSS_CHANGED_ARP_FILTER | BSS_CHANGED_MLD_VALID_LINKS | BSS_CHANGED_MLD_TTLM)
2449 
2450 static void
2451 lkpi_bss_info_change(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
2452     enum ieee80211_bss_changed bss_changed)
2453 {
2454 	struct lkpi_vif *lvif;
2455 	enum ieee80211_bss_changed vif_cfg_bits, link_info_bits;
2456 
2457 	if (ieee80211_vif_is_mld(vif)) {
2458 		TODO("This likely needs a subset only; split up into 3 parts.");
2459 	}
2460 
2461 	/* Nothing to do? */
2462 	if (bss_changed == 0)
2463 		return;
2464 
2465 	/*
2466 	 * If the vif is not known to the driver there is nothing to notifiy for.
2467 	 * We MUST NOT check for !lvif_bss_synched here (the reasonable it seems)
2468 	 * as we need to execute the update(s) or we will have follow-up issues.
2469 	 */
2470 	lvif = VIF_TO_LVIF(vif);
2471 	if (!lvif->added_to_drv)
2472 		return;
2473 
2474 	/*
2475 	 * With the advent of MLO bss_conf got split up into vif and link
2476 	 * change notfications, while historically it was one.
2477 	 * We now need to support all possible models.
2478 	 */
2479 	vif_cfg_bits = bss_changed & BSS_CHANGED_VIF_CFG_BITS;
2480 	if (vif_cfg_bits != 0)
2481 		lkpi_80211_mo_vif_cfg_changed(hw, vif, vif_cfg_bits, false);
2482 
2483 	link_info_bits = bss_changed & ~(BSS_CHANGED_VIF_CFG_BITS);
2484 	if (link_info_bits != 0)
2485 		lkpi_80211_mo_link_info_changed(hw, vif, &vif->bss_conf,
2486 		    link_info_bits, 0, false);
2487 
2488 	lkpi_80211_mo_bss_info_changed(hw, vif, &vif->bss_conf, bss_changed);
2489 }
2490 
2491 /* -------------------------------------------------------------------------- */
2492 
2493 static int
2494 lkpi_sta_state_do_nada(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2495 {
2496 	return (0);
2497 }
2498 
2499 /* UP1 */
2500 static int
2501 lkpi_sta_init_to_scan(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2502 {
2503 	return (lkpi_sta_state_do_nada(vap, nstate, arg));
2504 }
2505 
2506 /* UP2 */
2507 static int
2508 lkpi_sta_scan_to_auth(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2509 {
2510 	struct linuxkpi_ieee80211_channel *chan;
2511 	struct cfg80211_chan_def chandef;
2512 	struct ieee80211_chanctx_conf *chanctx_conf;
2513 	struct lkpi_hw *lhw;
2514 	struct ieee80211_hw *hw;
2515 	struct lkpi_vif *lvif;
2516 	struct ieee80211_vif *vif;
2517 	struct ieee80211_node *ni;
2518 	struct lkpi_sta *lsta;
2519 	enum ieee80211_bss_changed bss_changed;
2520 	struct ieee80211_prep_tx_info prep_tx_info;
2521 	uint32_t changed;
2522 	int error;
2523 	bool synched, can_ht;
2524 
2525 	/*
2526 	 * In here we use vap->iv_bss until lvif->lvif_bss is set.
2527 	 * For all later (STATE >= AUTH) functions we need to use the lvif
2528 	 * cache which will be tracked even through (*iv_update_bss)().
2529 	 */
2530 
2531 	if (vap->iv_bss == NULL) {
2532 		ic_printf(vap->iv_ic, "%s: no iv_bss for vap %p\n", __func__, vap);
2533 		return (EINVAL);
2534 	}
2535 	/*
2536 	 * Keep the ni alive locally.  In theory (and practice) iv_bss can change
2537 	 * once we unlock here.  This is due to net80211 allowing state changes
2538 	 * and new join1() despite having an active node as well as due to
2539 	 * the fact that the iv_bss can be swapped under the hood in (*iv_update_bss).
2540 	 */
2541 	ni = ieee80211_ref_node(vap->iv_bss);
2542 	if (ni->ni_chan == NULL || ni->ni_chan == IEEE80211_CHAN_ANYC) {
2543 		ic_printf(vap->iv_ic, "%s: no channel set for iv_bss ni %p "
2544 		    "on vap %p\n", __func__, ni, vap);
2545 		ieee80211_free_node(ni);	/* Error handling for the local ni. */
2546 		return (EINVAL);
2547 	}
2548 
2549 	lhw = vap->iv_ic->ic_softc;
2550 	chan = lkpi_find_lkpi80211_chan(lhw, ni->ni_chan);
2551 	if (chan == NULL) {
2552 		ic_printf(vap->iv_ic, "%s: failed to get LKPI channel from "
2553 		    "iv_bss ni %p on vap %p\n", __func__, ni, vap);
2554 		ieee80211_free_node(ni);	/* Error handling for the local ni. */
2555 		return (ESRCH);
2556 	}
2557 
2558 	hw = LHW_TO_HW(lhw);
2559 	lvif = VAP_TO_LVIF(vap);
2560 	vif = LVIF_TO_VIF(lvif);
2561 
2562 	LKPI_80211_LVIF_LOCK(lvif);
2563 	/* XXX-BZ KASSERT later? */
2564 	if (lvif->lvif_bss_synched || lvif->lvif_bss != NULL) {
2565 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
2566 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
2567 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
2568 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
2569 		    lvif->lvif_bss_synched);
2570 		LKPI_80211_LVIF_UNLOCK(lvif);
2571 		ieee80211_free_node(ni);	/* Error handling for the local ni. */
2572 		return (EBUSY);
2573 	}
2574 	LKPI_80211_LVIF_UNLOCK(lvif);
2575 
2576 	IEEE80211_UNLOCK(vap->iv_ic);
2577 	wiphy_lock(hw->wiphy);
2578 
2579 	/* Add chanctx (or if exists, change it). */
2580 	chanctx_conf = lkpi_get_chanctx_conf(hw, vif);
2581 
2582 	KASSERT(ni->ni_chan != NULL && ni->ni_chan != IEEE80211_CHAN_ANYC,
2583 	   ("%s:%d: ni %p ni_chan %p\n", __func__, __LINE__, ni, ni->ni_chan));
2584 
2585 #ifdef LKPI_80211_HT
2586 	can_ht = (vap->iv_ic->ic_flags_ht & IEEE80211_FHT_HT) != 0;
2587 #else
2588 	can_ht = false;
2589 #endif
2590 	lkpi_init_chandef(&chandef, chan, ni->ni_chan, can_ht);
2591 	hw->conf.radar_enabled =
2592 	    ((chan->flags & IEEE80211_CHAN_RADAR) != 0) ? true : false;
2593 	hw->conf.chandef = chandef;
2594 	vif->bss_conf.chanreq.oper = hw->conf.chandef;
2595 	changed = lkpi_init_chanctx_conf(hw, &chandef, chanctx_conf);
2596 
2597 	/* Responder ... */
2598 
2599 	/* Set bss info (bss_info_changed). */
2600 	bss_changed = 0;
2601 	vif->bss_conf.bssid = ni->ni_bssid;
2602 	bss_changed |= BSS_CHANGED_BSSID;
2603 	vif->bss_conf.txpower = ni->ni_txpower;
2604 	bss_changed |= BSS_CHANGED_TXPOWER;
2605 	vif->cfg.idle = false;
2606 	bss_changed |= BSS_CHANGED_IDLE;
2607 
2608 	/* vif->bss_conf.basic_rates ? Where exactly? */
2609 
2610 	lvif->beacons = 0;
2611 	/* Should almost assert it is this. */
2612 	vif->cfg.assoc = false;
2613 	vif->cfg.aid = 0;
2614 
2615 	bss_changed |= lkpi_update_dtim_tsf(vif, ni, vap, __func__, __LINE__);
2616 
2617 	error = lkpi_set_chanctx_conf(hw, vif, chanctx_conf, changed, true);
2618 	if (error != 0)
2619 		goto out;
2620 
2621 	IMPROVE("update radiotap chan fields too");
2622 
2623 	/* RATES */
2624 	IMPROVE("bss info: not all needs to come now and rates are missing");
2625 	lkpi_bss_info_change(hw, vif, bss_changed);
2626 
2627 	/*
2628 	 * Given ni and lsta are 1:1 from alloc to free we can assert that
2629 	 * ni always has lsta data attach despite net80211 node swapping
2630 	 * under the hoods.
2631 	 */
2632 	KASSERT(ni->ni_drv_data != NULL, ("%s: ni %p ni_drv_data %p\n",
2633 	    __func__, ni, ni->ni_drv_data));
2634 	lsta = ni->ni_drv_data;
2635 
2636 	/* Insert the [l]sta into the list of known stations. */
2637 	list_add_tail(&lsta->lsta_list, &lvif->lsta_list);
2638 
2639 	/* Add (or adjust) sta and change state (from NOTEXIST) to NONE. */
2640 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
2641 	KASSERT(lsta->state == IEEE80211_STA_NOTEXIST, ("%s: lsta %p state not "
2642 	    "NOTEXIST: %#x\n", __func__, lsta, lsta->state));
2643 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_NONE);
2644 	if (error != 0) {
2645 		IMPROVE("do we need to undo the chan ctx?");
2646 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(NONE) "
2647 		    "failed: %d\n", __func__, __LINE__, error);
2648 		goto out;
2649 	}
2650 #if 0
2651 	lsta->added_to_drv = true;	/* mo manages. */
2652 #endif
2653 
2654 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
2655 
2656 #if 0
2657 	/*
2658 	 * Wakeup all queues now that sta is there so we have as much time to
2659 	 * possibly prepare the queue in the driver to be ready for the 1st
2660 	 * packet;  lkpi_80211_txq_tx_one() still has a workaround as there
2661 	 * is no guarantee or way to check.
2662 	 * XXX-BZ and by now we know that this does not work on all drivers
2663 	 * for all queues.
2664 	 */
2665 	lkpi_wake_tx_queues(hw, LSTA_TO_STA(lsta), false, false);
2666 #endif
2667 
2668 	/* Start mgd_prepare_tx. */
2669 	memset(&prep_tx_info, 0, sizeof(prep_tx_info));
2670 	prep_tx_info.duration = PREP_TX_INFO_DURATION;		/* SAE */
2671 	prep_tx_info.subtype = IEEE80211_STYPE_AUTH;
2672 	prep_tx_info.link_id = 0;
2673 	lkpi_80211_mo_mgd_prepare_tx(hw, vif, &prep_tx_info);
2674 	lsta->in_mgd = true;
2675 
2676 	/*
2677 	 * What is going to happen next:
2678 	 * - <twiddle> .. we should end up in "auth_to_assoc"
2679 	 * - event_callback
2680 	 * - update sta_state (NONE to AUTH)
2681 	 * - mgd_complete_tx
2682 	 * (ideally we'd do that on a callback for something else ...)
2683 	 */
2684 
2685 	wiphy_unlock(hw->wiphy);
2686 	IEEE80211_LOCK(vap->iv_ic);
2687 
2688 	LKPI_80211_LVIF_LOCK(lvif);
2689 	/* Re-check given (*iv_update_bss) could have happened while we were unlocked. */
2690 	if (lvif->lvif_bss_synched || lvif->lvif_bss != NULL ||
2691 	    lsta->ni != vap->iv_bss)
2692 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
2693 		    "lvif_bss->ni %p synched %d, ni %p lsta %p\n", __func__, __LINE__,
2694 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
2695 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
2696 		    lvif->lvif_bss_synched, ni, lsta);
2697 
2698 	/*
2699 	 * Reference the "ni" for caching the lsta/ni in lvif->lvif_bss.
2700 	 * Given we cache lsta we use lsta->ni instead of ni here (even though
2701 	 * lsta->ni == ni) to be distinct from the rest of the code where we do
2702 	 * assume that ni == vap->iv_bss which it may or may not be.
2703 	 * So do NOT use iv_bss here anymore as that may have diverged from our
2704 	 * function local ni already while ic was unlocked and would lead to
2705 	 * inconsistencies.  Go and see if we lost a race and do not update
2706 	 * lvif_bss_synched in that case.
2707 	 */
2708 	ieee80211_ref_node(lsta->ni);
2709 	lvif->lvif_bss = lsta;
2710 	if (lsta->ni == vap->iv_bss) {
2711 		lvif->lvif_bss_synched = synched = true;
2712 	} else {
2713 		/* Set to un-synched no matter what. */
2714 		lvif->lvif_bss_synched = synched = false;
2715 		/*
2716 		 * We do not error as someone has to take us down.
2717 		 * If we are followed by a 2nd, new net80211::join1() going to
2718 		 * AUTH lkpi_sta_a_to_a() will error, lkpi_sta_auth_to_{scan,init}()
2719 		 * will take the lvif->lvif_bss node down eventually.
2720 		 * What happens with the vap->iv_bss node will entirely be up
2721 		 * to net80211 as we never used the node beyond alloc()/free()
2722 		 * and we do not hold an extra reference for that anymore given
2723 		 * ni : lsta == 1:1.
2724 		 * Problem is if we do not error a MGMT/AUTH frame will be
2725 		 * sent from net80211::sta_newstate(); disable lsta queue below.
2726 		 */
2727 	}
2728 	LKPI_80211_LVIF_UNLOCK(lvif);
2729 	/*
2730 	 * Make sure in case the sta did not change and we re-added it,
2731 	 * that we can tx again but only if the vif/iv_bss are in sync.
2732 	 * Otherwise this should prevent the MGMT/AUTH frame from being
2733 	 * sent triggering a warning in iwlwifi.
2734 	 */
2735 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
2736 	lsta->txq_ready = synched;
2737 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
2738 	goto out_relocked;
2739 
2740 out:
2741 	wiphy_unlock(hw->wiphy);
2742 	IEEE80211_LOCK(vap->iv_ic);
2743 out_relocked:
2744 	/*
2745 	 * Release the reference that kept the ni stable locally
2746 	 * during the work of this function.
2747 	 */
2748 	if (ni != NULL)
2749 		ieee80211_free_node(ni);
2750 	return (error);
2751 }
2752 
2753 /* UP3.1 */
2754 static int
2755 lkpi_sta_auth_to_assoc(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2756 {
2757 	struct lkpi_hw *lhw;
2758 	struct ieee80211_hw *hw;
2759 	struct lkpi_vif *lvif;
2760 	struct ieee80211_vif *vif;
2761 	struct lkpi_sta *lsta;
2762 	struct ieee80211_prep_tx_info prep_tx_info;
2763 	int error;
2764 
2765 	lhw = vap->iv_ic->ic_softc;
2766 	hw = LHW_TO_HW(lhw);
2767 	lvif = VAP_TO_LVIF(vap);
2768 	vif = LVIF_TO_VIF(lvif);
2769 
2770 	IEEE80211_UNLOCK(vap->iv_ic);
2771 	wiphy_lock(hw->wiphy);
2772 
2773 	LKPI_80211_LVIF_LOCK(lvif);
2774 	/* XXX-BZ KASSERT later? */
2775 	if (!lvif->lvif_bss_synched || lvif->lvif_bss == NULL) {
2776 #ifdef LINUXKPI_DEBUG_80211
2777 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
2778 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
2779 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
2780 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
2781 		    lvif->lvif_bss_synched);
2782 #endif
2783 		error = ENOTRECOVERABLE;
2784 		LKPI_80211_LVIF_UNLOCK(lvif);
2785 		goto out;
2786 	}
2787 	lsta = lvif->lvif_bss;
2788 	LKPI_80211_LVIF_UNLOCK(lvif);
2789 
2790 	KASSERT(lsta != NULL, ("%s: lsta %p\n", __func__, lsta));
2791 
2792 	/* Finish auth. */
2793 	IMPROVE("event callback");
2794 
2795 	/* Update sta_state (NONE to AUTH). */
2796 	KASSERT(lsta->state == IEEE80211_STA_NONE, ("%s: lsta %p state not "
2797 	    "NONE: %#x\n", __func__, lsta, lsta->state));
2798 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_AUTH);
2799 	if (error != 0) {
2800 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(AUTH) "
2801 		    "failed: %d\n", __func__, __LINE__, error);
2802 		goto out;
2803 	}
2804 
2805 	/* End mgd_complete_tx. */
2806 	if (lsta->in_mgd) {
2807 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
2808 		prep_tx_info.subtype = IEEE80211_STYPE_AUTH;
2809 		prep_tx_info.success = true;
2810 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
2811 		lsta->in_mgd = false;
2812 	}
2813 
2814 	/* Now start assoc. unless nstate=RUN (auth_to_run). */
2815 
2816 	/* Start mgd_prepare_tx. */
2817 	if (nstate == IEEE80211_S_ASSOC && !lsta->in_mgd) {
2818 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
2819 		prep_tx_info.subtype = IEEE80211_STYPE_ASSOC_REQ;
2820 		prep_tx_info.link_id = 0;
2821 		lkpi_80211_mo_mgd_prepare_tx(hw, vif, &prep_tx_info);
2822 		lsta->in_mgd = true;
2823 	}
2824 
2825 #if 0
2826 	/* We do not yet have a packet to go out. */
2827 	/* Wake tx queue to get packet out. */
2828 	lkpi_wake_tx_queues(hw, LSTA_TO_STA(lsta), false, true);
2829 #endif
2830 
2831 	/*
2832 	 * <twiddle> .. we end up in "assoc_to_run"
2833 	 * - update sta_state (AUTH to ASSOC)
2834 	 * - conf_tx [all]
2835 	 * - bss_info_changed (assoc, aid, ssid, ..)
2836 	 * - change_chanctx (if needed)
2837 	 * - event_callback
2838 	 * - mgd_complete_tx
2839 	 */
2840 
2841 out:
2842 	wiphy_unlock(hw->wiphy);
2843 	IEEE80211_LOCK(vap->iv_ic);
2844 	return (error);
2845 }
2846 
2847 static int lkpi_sta_assoc_to_run(struct ieee80211vap *, enum ieee80211_state, int);
2848 
2849 /* UP3.2 */
2850 static int
2851 lkpi_sta_auth_to_run(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2852 {
2853 	int error;
2854 
2855 	error = lkpi_sta_auth_to_assoc(vap, nstate, arg);
2856 	if (error == 0)
2857 		error = lkpi_sta_assoc_to_run(vap, nstate, arg);
2858 	return (error);
2859 }
2860 
2861 /* UP4 */
2862 static int
2863 lkpi_sta_assoc_to_run(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2864 {
2865 	struct lkpi_hw *lhw;
2866 	struct ieee80211_hw *hw;
2867 	struct lkpi_vif *lvif;
2868 	struct ieee80211_vif *vif;
2869 	struct ieee80211_node *ni;
2870 	struct lkpi_sta *lsta;
2871 	struct ieee80211_sta *sta;
2872 	struct ieee80211_prep_tx_info prep_tx_info;
2873 	enum ieee80211_bss_changed bss_changed;
2874 	int error;
2875 
2876 	lhw = vap->iv_ic->ic_softc;
2877 	hw = LHW_TO_HW(lhw);
2878 	lvif = VAP_TO_LVIF(vap);
2879 	vif = LVIF_TO_VIF(lvif);
2880 
2881 	IEEE80211_UNLOCK(vap->iv_ic);
2882 	wiphy_lock(hw->wiphy);
2883 
2884 	LKPI_80211_LVIF_LOCK(lvif);
2885 	/* XXX-BZ KASSERT later? */
2886 	if (!lvif->lvif_bss_synched || lvif->lvif_bss == NULL) {
2887 #ifdef LINUXKPI_DEBUG_80211
2888 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
2889 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
2890 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
2891 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
2892 		    lvif->lvif_bss_synched);
2893 #endif
2894 		LKPI_80211_LVIF_UNLOCK(lvif);
2895 		error = ENOTRECOVERABLE;
2896 		goto out;
2897 	}
2898 	lsta = lvif->lvif_bss;
2899 	LKPI_80211_LVIF_UNLOCK(lvif);
2900 	KASSERT(lsta != NULL && lsta->ni != NULL, ("%s: lsta %p ni %p "
2901 	    "lvif %p vap %p\n", __func__,
2902 	    lsta, (lsta != NULL) ? lsta->ni : NULL, lvif, vap));
2903 
2904 	ni = lsta->ni;		/* Reference held for lvif_bss. */
2905 
2906 	IMPROVE("ponder some of this moved to ic_newassoc, scan_assoc_success, "
2907 	    "and to lesser extend ieee80211_notify_node_join");
2908 
2909 	/* Finish assoc. (even if this is auth_to_run!) */
2910 	/* Update sta_state (AUTH to ASSOC) and set aid. */
2911 	KASSERT(lsta->state == IEEE80211_STA_AUTH, ("%s: lsta %p state not "
2912 	    "AUTH: %#x\n", __func__, lsta, lsta->state));
2913 	sta = LSTA_TO_STA(lsta);
2914 	sta->aid = IEEE80211_NODE_AID(ni);
2915 #ifdef LKPI_80211_WME
2916 	if (vap->iv_flags & IEEE80211_F_WME)
2917 		sta->wme = true;
2918 #endif
2919 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_ASSOC);
2920 	if (error != 0) {
2921 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(ASSOC) "
2922 		    "failed: %d\n", __func__, __LINE__, error);
2923 		goto out;
2924 	}
2925 
2926 	IMPROVE("wme / conf_tx [all]");
2927 
2928 	/* Update bss info (bss_info_changed) (assoc, aid, ..). */
2929 	bss_changed = 0;
2930 #ifdef LKPI_80211_WME
2931 	bss_changed |= lkpi_wme_update(lhw, vap, true);
2932 #endif
2933 	if (!vif->cfg.assoc || vif->cfg.aid != IEEE80211_NODE_AID(ni)) {
2934 		lvif->beacons = 0;
2935 		vif->cfg.assoc = true;
2936 		vif->cfg.aid = IEEE80211_NODE_AID(ni);
2937 		bss_changed |= BSS_CHANGED_ASSOC;
2938 	}
2939 	/* We set SSID but this is not BSSID! */
2940 	vif->cfg.ssid_len = ni->ni_esslen;
2941 	memcpy(vif->cfg.ssid, ni->ni_essid, ni->ni_esslen);
2942 	if ((vap->iv_flags & IEEE80211_F_SHPREAMBLE) !=
2943 	    vif->bss_conf.use_short_preamble) {
2944 		vif->bss_conf.use_short_preamble ^= 1;
2945 		/* bss_changed |= BSS_CHANGED_??? */
2946 	}
2947 	if ((vap->iv_flags & IEEE80211_F_SHSLOT) !=
2948 	    vif->bss_conf.use_short_slot) {
2949 		vif->bss_conf.use_short_slot ^= 1;
2950 		/* bss_changed |= BSS_CHANGED_??? */
2951 	}
2952 	if ((ni->ni_flags & IEEE80211_NODE_QOS) !=
2953 	    vif->bss_conf.qos) {
2954 		vif->bss_conf.qos ^= 1;
2955 		bss_changed |= BSS_CHANGED_QOS;
2956 	}
2957 
2958 	bss_changed |= lkpi_update_dtim_tsf(vif, ni, vap, __func__, __LINE__);
2959 	lkpi_bss_info_change(hw, vif, bss_changed);
2960 
2961 	/* - change_chanctx (if needed)
2962 	 * - event_callback
2963 	 */
2964 
2965 	/* End mgd_complete_tx. (we do not have to check ostate == IEEE80211_S_ASSOC). */
2966 	if (lsta->in_mgd) {
2967 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
2968 		prep_tx_info.subtype = IEEE80211_STYPE_ASSOC_REQ;
2969 		prep_tx_info.success = true;	/* Needs vif->cfg.assoc set! */
2970 		prep_tx_info.link_id = 0;
2971 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
2972 		lsta->in_mgd = false;
2973 	}
2974 
2975 	/*
2976 	 * And then:
2977 	 * - (more packets)?
2978 	 * - set_key
2979 	 * - set_default_unicast_key
2980 	 * - set_key (?)
2981 	 * - ipv6_addr_change (?)
2982 	 */
2983 
2984 	if (!ieee80211_node_is_authorized(ni)) {
2985 		IMPROVE("net80211 does not consider node authorized");
2986 	}
2987 
2988 	IMPROVE("Is this the right spot, has net80211 done all updates already?");
2989 	lkpi_sta_sync_from_ni(hw, vif, sta, ni, true);
2990 
2991 	/* Update thresholds. */
2992 	hw->wiphy->frag_threshold = vap->iv_fragthreshold;
2993 	lkpi_80211_mo_set_frag_threshold(hw, vap->iv_fragthreshold);
2994 	hw->wiphy->rts_threshold = vap->iv_rtsthreshold;
2995 	lkpi_80211_mo_set_rts_threshold(hw, vap->iv_rtsthreshold);
2996 
2997 	/* Update sta_state (ASSOC to AUTHORIZED). */
2998 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
2999 	KASSERT(lsta->state == IEEE80211_STA_ASSOC, ("%s: lsta %p state not "
3000 	    "ASSOC: %#x\n", __func__, lsta, lsta->state));
3001 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_AUTHORIZED);
3002 	if (error != 0) {
3003 		IMPROVE("undo some changes?");
3004 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(AUTHORIZED) "
3005 		    "failed: %d\n", __func__, __LINE__, error);
3006 		goto out;
3007 	}
3008 
3009 	/* - drv_config (?)
3010 	 * - bss_info_changed
3011 	 * - set_rekey_data (?)
3012 	 *
3013 	 * And now we should be passing packets.
3014 	 */
3015 	IMPROVE("Need that bssid setting, and the keys");
3016 
3017 	bss_changed = 0;
3018 	bss_changed |= lkpi_update_dtim_tsf(vif, ni, vap, __func__, __LINE__);
3019 	lkpi_bss_info_change(hw, vif, bss_changed);
3020 
3021 	/* Prepare_multicast && configure_filter. */
3022 	lkpi_update_mcast_filter(vap->iv_ic);
3023 
3024 out:
3025 	wiphy_unlock(hw->wiphy);
3026 	IEEE80211_LOCK(vap->iv_ic);
3027 	return (error);
3028 }
3029 
3030 /*
3031  * DOWN1
3032  * "to assoc" means we are going back to State 2 from State 4[/3].
3033  * This means ni still is authenticated, so we keep sta, chanctx, ..
3034  * We will send a (Re)Assoc Request in case net80211 handles roadming.
3035  * Note: this can be called as part of a DEAUTH going to State 1 as well,
3036  * so for RoC prep_tx_info we need to check nstate (see run_to_{auth,scan,init}).
3037  */
3038 static int
3039 lkpi_sta_run_to_assoc(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3040 {
3041 	struct lkpi_hw *lhw;
3042 	struct ieee80211_hw *hw;
3043 	struct lkpi_vif *lvif;
3044 	struct ieee80211_vif *vif;
3045 	struct ieee80211_node *ni;
3046 	struct lkpi_sta *lsta;
3047 	struct ieee80211_sta *sta;
3048 	struct ieee80211_prep_tx_info prep_tx_info;
3049 #if 0
3050 	enum ieee80211_bss_changed bss_changed;
3051 #endif
3052 	struct ieee80211_rx_ampdu *rap;
3053 	int error;
3054 
3055 	lhw = vap->iv_ic->ic_softc;
3056 	hw = LHW_TO_HW(lhw);
3057 	lvif = VAP_TO_LVIF(vap);
3058 	vif = LVIF_TO_VIF(lvif);
3059 
3060 	IEEE80211_UNLOCK(vap->iv_ic);
3061 	wiphy_lock(hw->wiphy);
3062 
3063 	LKPI_80211_LVIF_LOCK(lvif);
3064 #ifdef LINUXKPI_DEBUG_80211
3065 	/* XXX-BZ KASSERT later; state going down so no action. */
3066 	if (lvif->lvif_bss == NULL)
3067 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
3068 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
3069 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
3070 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
3071 		    lvif->lvif_bss_synched);
3072 #endif
3073 	lsta = lvif->lvif_bss;
3074 	LKPI_80211_LVIF_UNLOCK(lvif);
3075 	KASSERT(lsta != NULL && lsta->ni != NULL, ("%s: lsta %p ni %p "
3076 	    "lvif %p vap %p\n", __func__,
3077 	    lsta, (lsta != NULL) ? lsta->ni : NULL, lvif, vap));
3078 
3079 	ni = lsta->ni;		/* Reference held for lvif_bss. */
3080 	sta = LSTA_TO_STA(lsta);
3081 
3082 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3083 
3084 	/* flush, drop. */
3085 	lkpi_80211_mo_flush(hw, vif,  nitems(sta->txq), true);
3086 
3087 	/* We should make this a KASSERT. */
3088 	if (lsta->in_mgd) {
3089 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p lsta %p in_mgd\n",
3090 		    __func__, __LINE__, lvif, vap, lsta);
3091 	}
3092 	/*
3093 	 * Problem is that we should hook into the tx/rx flow and not
3094 	 * try to re-model the state machine parts.  We may miss a SME
3095 	 * triggered frame this way.
3096 	 */
3097 	memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3098 	if (nstate == IEEE80211_S_ASSOC) {
3099 		if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
3100 			if (arg)
3101 				prep_tx_info.subtype = IEEE80211_STYPE_REASSOC_REQ;
3102 			else
3103 				prep_tx_info.subtype = IEEE80211_STYPE_ASSOC_REQ;
3104 		} else {
3105 			/* wpa_supplicant upon RTM_IEEE80211_LEAVE. */
3106 			prep_tx_info.subtype = IEEE80211_STYPE_DISASSOC;
3107 		}
3108 	} else
3109 		prep_tx_info.subtype = IEEE80211_STYPE_DEAUTH;
3110 	prep_tx_info.was_assoc = true;
3111 	prep_tx_info.link_id = 0;
3112 	lkpi_80211_mo_mgd_prepare_tx(hw, vif, &prep_tx_info);
3113 	lsta->in_mgd = true;
3114 
3115 	wiphy_unlock(hw->wiphy);
3116 	IEEE80211_LOCK(vap->iv_ic);
3117 
3118 	/* Call iv_newstate first so we get potential (RE-)ASSOC/DEAUTH? packet out. */
3119 	error = lvif->iv_newstate(vap, nstate, arg);
3120 	if (error != 0) {
3121 		ic_printf(vap->iv_ic, "%s:%d: iv_newstate(%p, %d, %d) "
3122 		    "failed: %d\n", __func__, __LINE__, vap, nstate, arg, error);
3123 		goto outni;
3124 	}
3125 
3126 	/* Stop any BA sessions if still active. */
3127 	for (int rapn = 0; rapn < WME_NUM_TID; rapn++) {
3128 		rap = &ni->ni_rx_ampdu[rapn];
3129 
3130 		if ((rap->rxa_flags & IEEE80211_AGGR_RUNNING) == 0)
3131 			continue;
3132 
3133 		vap->iv_ic->ic_ampdu_rx_stop(ni, rap);
3134 	}
3135 
3136 	IEEE80211_UNLOCK(vap->iv_ic);
3137 
3138 	/* Ensure the packets get out. */
3139 	lkpi_80211_flush_tx(lhw, lsta);
3140 
3141 	wiphy_lock(hw->wiphy);
3142 
3143 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3144 
3145 	/* Wake tx queues to get packet(s) out. */
3146 	lkpi_wake_tx_queues(hw, sta, false, true);
3147 
3148 	/* flush, no drop */
3149 	lkpi_80211_mo_flush(hw, vif,  nitems(sta->txq), false);
3150 
3151 	/* End mgd_complete_tx. */
3152 	/* We should make this a KASSERT. */
3153 	if (!lsta->in_mgd) {
3154 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p lsta %p !in_mgd\n",
3155 		    __func__, __LINE__, lvif, vap, lsta);
3156 	}
3157 	lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
3158 	lsta->in_mgd = false;
3159 
3160 #if 0
3161 	/* sync_rx_queues */
3162 	lkpi_80211_mo_sync_rx_queues(hw);
3163 
3164 	/* sta_pre_rcu_remove */
3165 	lkpi_80211_mo_sta_pre_rcu_remove(hw, vif, sta);
3166 #endif
3167 
3168 	/* Take the station down. */
3169 
3170 	/* Adjust sta and change state (from AUTHORIZED) to ASSOC. */
3171 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
3172 	KASSERT(lsta->state == IEEE80211_STA_AUTHORIZED, ("%s: lsta %p state not "
3173 	    "AUTHORIZED: %#x\n", __func__, lsta, lsta->state));
3174 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_ASSOC);
3175 	if (error != 0) {
3176 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(ASSOC) "
3177 		    "failed: %d\n", __func__, __LINE__, error);
3178 		goto out;
3179 	}
3180 
3181 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3182 
3183 #ifdef LKPI_80211_HW_CRYPTO
3184 	if (lkpi_hwcrypto) {
3185 		error = lkpi_sta_del_keys(hw, vif, lsta);
3186 		if (error != 0) {
3187 			ic_printf(vap->iv_ic, "%s:%d: lkpi_sta_del_keys "
3188 			    "failed: %d\n", __func__, __LINE__, error);
3189 			/*
3190 			 * Either drv/fw will crash or cleanup itself,
3191 			 * otherwise net80211 will delete the keys (at a
3192 			 * less appropriate time).
3193 			 */
3194 			/* goto out; */
3195 		}
3196 	}
3197 #endif
3198 
3199 	/* Update sta_state (ASSOC to AUTH). */
3200 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
3201 	KASSERT(lsta->state == IEEE80211_STA_ASSOC, ("%s: lsta %p state not "
3202 	    "ASSOC: %#x\n", __func__, lsta, lsta->state));
3203 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_AUTH);
3204 	if (error != 0) {
3205 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(AUTH) "
3206 		    "failed: %d\n", __func__, __LINE__, error);
3207 		goto out;
3208 	}
3209 
3210 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3211 
3212 #if 0
3213 	/* Update bss info (bss_info_changed) (assoc, aid, ..). */
3214 	/* See comment in DOWN4. */
3215 	lkpi_disassoc(sta, vif, lhw);
3216 #endif
3217 
3218 	error = EALREADY;
3219 out:
3220 	wiphy_unlock(hw->wiphy);
3221 	IEEE80211_LOCK(vap->iv_ic);
3222 outni:
3223 	return (error);
3224 }
3225 
3226 /*
3227  * DOWN2
3228  * We are in state 2 and go back to state 1 and will try to auth again
3229  * (to IEEE80211_S_AUTH in FreeBSD means "try to auth").  This should be
3230  * like scan_to_auth but that we keep the "ni" and with that chanctx/bssid,
3231  * which essentially makes this "a_to_a" in LinuxKPI.
3232  */
3233 static int
3234 lkpi_sta_assoc_to_auth(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3235 {
3236 	struct lkpi_hw *lhw;
3237 	struct ieee80211_hw *hw;
3238 	struct lkpi_vif *lvif;
3239 	struct ieee80211_vif *vif;
3240 	struct ieee80211_node *ni;
3241 	struct lkpi_sta *lsta;
3242 	struct ieee80211_prep_tx_info prep_tx_info;
3243 	int error;
3244 
3245 	lhw = vap->iv_ic->ic_softc;
3246 	hw = LHW_TO_HW(lhw);
3247 	lvif = VAP_TO_LVIF(vap);
3248 	vif = LVIF_TO_VIF(lvif);
3249 
3250 	IEEE80211_UNLOCK(vap->iv_ic);
3251 	wiphy_lock(hw->wiphy);
3252 
3253 	LKPI_80211_LVIF_LOCK(lvif);
3254 #ifdef LINUXKPI_DEBUG_80211
3255 	/* XXX-BZ KASSERT later; state going down so no action. */
3256 	if (lvif->lvif_bss == NULL)
3257 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
3258 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
3259 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
3260 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
3261 		    lvif->lvif_bss_synched);
3262 #endif
3263 	lsta = lvif->lvif_bss;
3264 	LKPI_80211_LVIF_UNLOCK(lvif);
3265 	KASSERT(lsta != NULL && lsta->ni != NULL, ("%s: lsta %p ni %p "
3266 	    "lvif %p vap %p\n", __func__,
3267 	    lsta, (lsta != NULL) ? lsta->ni : NULL, lvif, vap));
3268 
3269 	ni = lsta->ni;		/* Reference held for lvif_bss. */
3270 
3271 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3272 
3273 	/* End mgd_complete_tx. */
3274 	if (lsta->in_mgd && vap->iv_state == IEEE80211_S_ASSOC) {
3275 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3276 		prep_tx_info.subtype = IEEE80211_STYPE_ASSOC_REQ;
3277 		prep_tx_info.link_id = 0;
3278 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
3279 		lsta->in_mgd = false;
3280 	} else if (lsta->in_mgd) {
3281 		ic_printf(vap->iv_ic, "%s:%d: in_mgd %d (%s) -> %d (%s) %d\n",
3282 		    __func__, __LINE__,
3283 		    vap->iv_state, ieee80211_state_name[vap->iv_state],
3284 		    nstate, ieee80211_state_name[nstate], arg);
3285 	}
3286 
3287 	/* Take the station down. */
3288 	/* Update sta_state (AUTH to NONE). */
3289 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
3290 	KASSERT(lsta->state == IEEE80211_STA_AUTH, ("%s: lsta %p state not "
3291 	    "AUTH: %#x\n", __func__, lsta, lsta->state));
3292 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_NONE);
3293 	if (error != 0) {
3294 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(NONE) "
3295 		    "failed: %d\n", __func__, __LINE__, error);
3296 		goto out;
3297 	}
3298 
3299 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3300 
3301 out:
3302 	wiphy_unlock(hw->wiphy);
3303 	IEEE80211_LOCK(vap->iv_ic);
3304 	return (error);
3305 }
3306 
3307 /*
3308  * DOWN3
3309  * We are in state 1.  Either auth timed out (arg != 0) or we have an internal
3310  * state change forcing us to give up trying to authenticate.
3311  * Cleanup and remove chanctx, sta, ...
3312  */
3313 static int
3314 lkpi_sta_auth_to_scan(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3315 {
3316 	struct lkpi_hw *lhw;
3317 	struct ieee80211_hw *hw;
3318 	struct lkpi_vif *lvif;
3319 	struct ieee80211_vif *vif;
3320 	struct ieee80211_node *ni;
3321 	struct lkpi_sta *lsta;
3322 	struct ieee80211_sta *sta;
3323 	struct ieee80211_prep_tx_info prep_tx_info;
3324 	enum ieee80211_bss_changed bss_changed;
3325 	int error;
3326 
3327 	lhw = vap->iv_ic->ic_softc;
3328 	hw = LHW_TO_HW(lhw);
3329 	lvif = VAP_TO_LVIF(vap);
3330 	vif = LVIF_TO_VIF(lvif);
3331 
3332 	IEEE80211_UNLOCK(vap->iv_ic);
3333 	wiphy_lock(hw->wiphy);
3334 
3335 	LKPI_80211_LVIF_LOCK(lvif);
3336 	/*
3337 	 * XXX-BZ KASSERT later; state going down so no action in theory
3338 	 * but try to avoid a NULL-pointer derref for now and gracefully
3339 	 * fail for non-debug kernels.
3340 	 */
3341 	if (lvif->lvif_bss == NULL) {
3342 		ic_printf(vap->iv_ic, "%s:%d: ERROR: lvif %p vap %p iv_bss %p "
3343 		    "lvif_bss %p lvif_bss->ni %p synched %d; "
3344 		    "expect follow-up problems\n", __func__, __LINE__,
3345 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
3346 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
3347 		    lvif->lvif_bss_synched);
3348 		LKPI_80211_LVIF_UNLOCK(lvif);
3349 		/*
3350 		 * This will likely lead to a firmware crash (if there
3351 		 * was not one before already) and need a
3352 		 * ieee80211_restart_hw() but still better than a panic
3353 		 * for users as they can at least recover.
3354 		 */
3355 		error = ENOTRECOVERABLE;
3356 		goto out;
3357 	}
3358 	lsta = lvif->lvif_bss;
3359 	LKPI_80211_LVIF_UNLOCK(lvif);
3360 	KASSERT(lsta != NULL && lsta->ni != NULL, ("%s: lsta %p ni %p "
3361 	    "lvif %p vap %p\n", __func__,
3362 	    lsta, (lsta != NULL) ? lsta->ni : NULL, lvif, vap));
3363 	ni = lsta->ni;			/* Reference held for lvif_bss. */
3364 	sta = LSTA_TO_STA(lsta);
3365 
3366 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3367 
3368 	/* flush, drop. */
3369 	lkpi_80211_mo_flush(hw, vif,  nitems(sta->txq), true);
3370 
3371 	/* Wake tx queues to get packet(s) out. */
3372 	lkpi_wake_tx_queues(hw, sta, false, true);
3373 
3374 	/* flush, no drop */
3375 	lkpi_80211_mo_flush(hw, vif,  nitems(sta->txq), false);
3376 
3377 	/* End mgd_complete_tx. */
3378 	if (lsta->in_mgd) {
3379 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3380 		prep_tx_info.subtype = IEEE80211_STYPE_AUTH;
3381 		prep_tx_info.link_id = 0;
3382 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
3383 		lsta->in_mgd = false;
3384 	}
3385 
3386 	/* sync_rx_queues */
3387 	lkpi_80211_mo_sync_rx_queues(hw);
3388 
3389 #ifdef LKPI_80211_HW_CRYPTO
3390 	if (lkpi_hwcrypto) {
3391 		error = lkpi_sta_del_keys(hw, vif, lsta);
3392 		if (error != 0) {
3393 			ic_printf(vap->iv_ic, "%s:%d: lkpi_sta_del_keys "
3394 			    "failed: %d\n", __func__, __LINE__, error);
3395 			/*
3396 			 * Either drv/fw will crash or cleanup itself,
3397 			 * otherwise net80211 will delete the keys (at a
3398 			 * less appropriate time).
3399 			 */
3400 			/* goto out; */
3401 		}
3402 	}
3403 #endif
3404 
3405 	/* sta_pre_rcu_remove */
3406         lkpi_80211_mo_sta_pre_rcu_remove(hw, vif, sta);
3407 
3408 	synchronize_net();
3409 
3410 	/* Take the station down. */
3411 
3412 	bss_changed = 0;
3413 	/*
3414 	 * Start updating bss info (*bss_info_changed) (assoc, aid, ..).
3415 	 *
3416 	 * One would expect this to happen when going off AUTHORIZED but
3417 	 * not so.
3418 	 *
3419 	 * Immediately issuing the (*bss_info_changed) used to also remove the
3420 	 * sta from firmware for iwlwifi; or we have problems with the sta
3421 	 * silently not being removed and then crash upon the next sta add.
3422 	 * Neither seems to be the case or a problem still.
3423 	 *
3424 	 * Contrary for BE200 (iwlwifi/mld) if we do not issue the
3425 	 * (*vif_cfg_change) to tell FW that we are no longer assoc
3426 	 * it will crash now upon sta rm.  So the order now is as we once
3427 	 * expected it:
3428 	 *
3429 	 * 1) lkpi_disassoc(): set vif->cfg.assoc = false and .aid=0
3430 	 * 2) add the remaining BSS_CHANGED changes and call (*bss_info_changed)
3431 	 *    (which may be split up into (*vif_cfg_change) and
3432 	 *    (*link_info_changed) for more modern drivers).
3433 	 * 3) call the last sta_state update -> IEEE80211_STA_NOTEXIST
3434 	 *    (removes the sta given assoc is false) and tidy up our lists.
3435 	 * 4) call unassign_vif_chanctx
3436 	 * 5) call lkpi_hw_conf_idle
3437 	 * 6) call remove_chanctx
3438 	 *
3439 	 * Note: vif->driver_flags & IEEE80211_VIF_REMOVE_AP_AFTER_DISASSOC
3440 	 * might change this.
3441 	 */
3442 	bss_changed |= lkpi_disassoc(sta, vif, lhw);
3443 
3444 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3445 
3446 	IMPROVE("Any bss_info changes to announce?");
3447 	vif->bss_conf.qos = false;
3448 	bss_changed |= BSS_CHANGED_QOS;
3449 	vif->cfg.ssid_len = 0;
3450 	memset(vif->cfg.ssid, '\0', sizeof(vif->cfg.ssid));
3451 	bss_changed |= BSS_CHANGED_BSSID;
3452 	vif->bss_conf.use_short_preamble = false;
3453 	/* XXX BSS_CHANGED_???? */
3454 	vif->bss_conf.dtim_period = 0; /* go back to 0. */
3455 	bss_changed |= BSS_CHANGED_BEACON_INFO;
3456 	lkpi_bss_info_change(hw, vif, bss_changed);
3457 
3458 	/* Adjust sta and change state (from NONE) to NOTEXIST. */
3459 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
3460 	KASSERT(lsta->state == IEEE80211_STA_NONE, ("%s: lsta %p state not "
3461 	    "NONE: %#x, nstate %d arg %d\n", __func__, lsta, lsta->state, nstate, arg));
3462 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_NOTEXIST);
3463 	if (error != 0) {
3464 		IMPROVE("do we need to undo the chan ctx?");
3465 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(NOTEXIST) "
3466 		    "failed: %d\n", __func__, __LINE__, error);
3467 		goto out;
3468 	}
3469 
3470 	lkpi_lsta_remove(lsta, lvif);
3471 
3472 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3473 
3474 	LKPI_80211_LVIF_LOCK(lvif);
3475 	/* Remove ni reference for this cache of lsta. */
3476 	lvif->lvif_bss = NULL;
3477 	lvif->lvif_bss_synched = false;
3478 	LKPI_80211_LVIF_UNLOCK(lvif);
3479 
3480 	/* conf_tx */
3481 
3482 	lkpi_remove_chanctx(hw, vif);
3483 
3484 out:
3485 	wiphy_unlock(hw->wiphy);
3486 	IEEE80211_LOCK(vap->iv_ic);
3487 	if (error == 0) {
3488 		/*
3489 		 * We do this outside the wiphy lock as net80211::node_free() may call
3490 		 * into crypto code to delete keys and we have a recursed on
3491 		 * non-recursive sx panic.  Also only do this if we get here w/o error.
3492 		 *
3493 		 * The very last release the reference on the ni for the ni/lsta on
3494 		 * lvif->lvif_bss.  Upon return from this both ni and lsta are invalid
3495 		 * and potentially freed.
3496 		 */
3497 		ieee80211_free_node(ni);
3498 	}
3499 	return (error);
3500 }
3501 
3502 /* DOWN4 */
3503 static int
3504 lkpi_sta_scan_to_init(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3505 {
3506 	/* lkpi_iv_newstate() handles the stop scan case in common code. */
3507 	return (lkpi_sta_state_do_nada(vap, nstate, arg));
3508 }
3509 
3510 /* ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ */
3511 
3512 static int
3513 lkpi_sta_auth_to_init(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3514 {
3515 	int error;
3516 
3517 	error = lkpi_sta_auth_to_scan(vap, nstate, arg);
3518 	if (error == 0)
3519 		error = lkpi_sta_scan_to_init(vap, nstate, arg);
3520 	return (error);
3521 }
3522 
3523 /* auth_to_auth, assoc_to_assoc. */
3524 static int
3525 lkpi_sta_a_to_a(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3526 {
3527 	struct lkpi_hw *lhw;
3528 	struct ieee80211_hw *hw;
3529 	struct lkpi_vif *lvif;
3530 	struct ieee80211_vif *vif;
3531 	struct lkpi_sta *lsta;
3532 	struct ieee80211_prep_tx_info prep_tx_info;
3533 	int error;
3534 
3535 	lhw = vap->iv_ic->ic_softc;
3536 	hw = LHW_TO_HW(lhw);
3537 	lvif = VAP_TO_LVIF(vap);
3538 	vif = LVIF_TO_VIF(lvif);
3539 
3540 	IEEE80211_UNLOCK(vap->iv_ic);
3541 	wiphy_lock(hw->wiphy);
3542 
3543 	LKPI_80211_LVIF_LOCK(lvif);
3544 	/* XXX-BZ KASSERT later? */
3545 	if (!lvif->lvif_bss_synched || lvif->lvif_bss == NULL) {
3546 #ifdef LINUXKPI_DEBUG_80211
3547 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
3548 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
3549 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
3550 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
3551 		    lvif->lvif_bss_synched);
3552 #endif
3553 		LKPI_80211_LVIF_UNLOCK(lvif);
3554 		error = ENOTRECOVERABLE;
3555 		goto out;
3556 	}
3557 	lsta = lvif->lvif_bss;
3558 	LKPI_80211_LVIF_UNLOCK(lvif);
3559 
3560 	KASSERT(lsta != NULL, ("%s: lsta %p! lvif %p vap %p\n", __func__,
3561 	    lsta, lvif, vap));
3562 
3563 	IMPROVE("event callback?");
3564 
3565 	/* End mgd_complete_tx. */
3566 	if (lsta->in_mgd) {
3567 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3568 		if (vap->iv_state == IEEE80211_S_AUTH)
3569 			prep_tx_info.subtype = IEEE80211_STYPE_AUTH;
3570 		else
3571 			prep_tx_info.subtype = IEEE80211_STYPE_ASSOC_REQ;
3572 		prep_tx_info.link_id = 0;
3573 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
3574 		lsta->in_mgd = false;
3575 	}
3576 
3577 	/* Now start auth/assoc. */
3578 
3579 	/* Start mgd_prepare_tx. */
3580 	if (!lsta->in_mgd) {
3581 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3582 		if (nstate == IEEE80211_S_AUTH)
3583 			prep_tx_info.subtype = IEEE80211_STYPE_AUTH;
3584 		else
3585 			prep_tx_info.subtype = IEEE80211_STYPE_ASSOC_REQ;
3586 		prep_tx_info.link_id = 0;
3587 		lkpi_80211_mo_mgd_prepare_tx(hw, vif, &prep_tx_info);
3588 		lsta->in_mgd = true;
3589 	}
3590 
3591 	error = 0;
3592 out:
3593 	wiphy_unlock(hw->wiphy);
3594 	IEEE80211_LOCK(vap->iv_ic);
3595 
3596 	return (error);
3597 }
3598 
3599 static int
3600 lkpi_sta_assoc_to_scan(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3601 {
3602 	int error;
3603 
3604 	error = lkpi_sta_assoc_to_auth(vap, nstate, arg);
3605 	if (error != 0 && error != EALREADY)
3606 		return (error);
3607 
3608 	error = lkpi_sta_auth_to_scan(vap, nstate, arg);
3609 	return (error);
3610 }
3611 
3612 static int
3613 lkpi_sta_assoc_to_init(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3614 {
3615 	int error;
3616 
3617 	error = lkpi_sta_assoc_to_scan(vap, nstate, arg);
3618 	if (error != 0 && error != EALREADY)
3619 		return (error);
3620 
3621 	error = lkpi_sta_scan_to_init(vap, nstate, arg);	/* do_nada */
3622 	return (error);
3623 }
3624 
3625 static int
3626 lkpi_sta_run_to_init(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3627 {
3628 	int error;
3629 
3630 	error = lkpi_sta_run_to_assoc(vap, nstate, arg);
3631 	if (error != 0 && error != EALREADY)
3632 		return (error);
3633 
3634 	error = lkpi_sta_assoc_to_init(vap, nstate, arg);
3635 	return (error);
3636 }
3637 
3638 static int
3639 lkpi_sta_run_to_scan(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3640 {
3641 	int error;
3642 
3643 	error = lkpi_sta_run_to_assoc(vap, nstate, arg);
3644 	if (error != 0 && error != EALREADY)
3645 		return (error);
3646 
3647 	error = lkpi_sta_assoc_to_scan(vap, nstate, arg);
3648 	return (error);
3649 }
3650 
3651 static int
3652 lkpi_sta_run_to_auth(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3653 {
3654 	int error;
3655 
3656 	error = lkpi_sta_run_to_assoc(vap, nstate, arg);
3657 	if (error != 0 && error != EALREADY)
3658 		return (error);
3659 
3660 	error = lkpi_sta_assoc_to_auth(vap, nstate, arg);
3661 	return (error);
3662 }
3663 
3664 /* -------------------------------------------------------------------------- */
3665 
3666 /*
3667  * The matches the documented state changes in net80211::sta_newstate().
3668  * XXX (1) without CSA and SLEEP yet, * XXX (2) not all unhandled cases
3669  * there are "invalid" (so there is a room for failure here).
3670  */
3671 struct fsm_state {
3672 	/* INIT, SCAN, AUTH, ASSOC, CAC, RUN, CSA, SLEEP */
3673 	enum ieee80211_state ostate;
3674 	enum ieee80211_state nstate;
3675 	int (*handler)(struct ieee80211vap *, enum ieee80211_state, int);
3676 } sta_state_fsm[] = {
3677 	{ IEEE80211_S_INIT,	IEEE80211_S_INIT, lkpi_sta_state_do_nada },
3678 	{ IEEE80211_S_SCAN,	IEEE80211_S_INIT, lkpi_sta_state_do_nada },	/* DOWN4 scan_to_init */
3679 	{ IEEE80211_S_AUTH,	IEEE80211_S_INIT, lkpi_sta_auth_to_init },	/* not explicitly in sta_newstate() */
3680 	{ IEEE80211_S_ASSOC,	IEEE80211_S_INIT, lkpi_sta_assoc_to_init },	/* Send DEAUTH. */
3681 	{ IEEE80211_S_RUN,	IEEE80211_S_INIT, lkpi_sta_run_to_init },	/* Send DISASSOC. */
3682 
3683 	{ IEEE80211_S_INIT,	IEEE80211_S_SCAN, lkpi_sta_init_to_scan },	/* UP1 */
3684 	{ IEEE80211_S_SCAN,	IEEE80211_S_SCAN, lkpi_sta_state_do_nada },
3685 	{ IEEE80211_S_AUTH,	IEEE80211_S_SCAN, lkpi_sta_auth_to_scan },	/* DOWN3 */
3686 	{ IEEE80211_S_ASSOC,	IEEE80211_S_SCAN, lkpi_sta_assoc_to_scan },
3687 	{ IEEE80211_S_RUN,	IEEE80211_S_SCAN, lkpi_sta_run_to_scan },	/* Beacon miss. */
3688 
3689 	{ IEEE80211_S_INIT,	IEEE80211_S_AUTH, lkpi_sta_scan_to_auth },	/* Send AUTH. */
3690 	{ IEEE80211_S_SCAN,	IEEE80211_S_AUTH, lkpi_sta_scan_to_auth },	/* UP2 Send AUTH. */
3691 	{ IEEE80211_S_AUTH,	IEEE80211_S_AUTH, lkpi_sta_a_to_a },		/* Send ?AUTH. */
3692 	{ IEEE80211_S_ASSOC,	IEEE80211_S_AUTH, lkpi_sta_assoc_to_auth },	/* DOWN2 Send ?AUTH. */
3693 	{ IEEE80211_S_RUN,	IEEE80211_S_AUTH, lkpi_sta_run_to_auth },	/* Send ?AUTH. */
3694 
3695 	{ IEEE80211_S_AUTH,	IEEE80211_S_ASSOC, lkpi_sta_auth_to_assoc },	/* UP3.1 Send ASSOCREQ. */
3696 	{ IEEE80211_S_ASSOC,	IEEE80211_S_ASSOC, lkpi_sta_a_to_a },		/* Send ASSOCREQ. */
3697 	{ IEEE80211_S_RUN,	IEEE80211_S_ASSOC, lkpi_sta_run_to_assoc },	/* DOWN1 Send ASSOCREQ/REASSOCREQ. */
3698 
3699 	{ IEEE80211_S_AUTH,	IEEE80211_S_RUN, lkpi_sta_auth_to_run },	/* UP3.2 */
3700 	{ IEEE80211_S_ASSOC,	IEEE80211_S_RUN, lkpi_sta_assoc_to_run },	/* UP4 */
3701 	{ IEEE80211_S_RUN,	IEEE80211_S_RUN, lkpi_sta_state_do_nada },
3702 
3703 	/* Dummy at the end without handler. */
3704 	{ IEEE80211_S_INIT,	IEEE80211_S_INIT, NULL },
3705 };
3706 
3707 static int
3708 lkpi_iv_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3709 {
3710 	struct ieee80211com *ic;
3711 	struct lkpi_hw *lhw;
3712 	struct lkpi_vif *lvif;
3713 	struct ieee80211_vif *vif;
3714 	struct fsm_state *s;
3715 	enum ieee80211_state ostate;
3716 	int error;
3717 
3718 	ic = vap->iv_ic;
3719 	IEEE80211_LOCK_ASSERT(ic);
3720 	ostate = vap->iv_state;
3721 
3722 #ifdef LINUXKPI_DEBUG_80211
3723 	if (linuxkpi_debug_80211 & D80211_TRACE)
3724 		ic_printf(vap->iv_ic, "%s:%d: vap %p nstate %#x arg %#x\n",
3725 		    __func__, __LINE__, vap, nstate, arg);
3726 #endif
3727 
3728 	if (vap->iv_opmode == IEEE80211_M_STA) {
3729 
3730 		lhw = ic->ic_softc;
3731 		lvif = VAP_TO_LVIF(vap);
3732 		vif = LVIF_TO_VIF(lvif);
3733 
3734 		/* No need to replicate this in most state handlers. */
3735 		if (nstate > IEEE80211_S_SCAN)
3736 			lkpi_stop_hw_scan(lhw, vif);
3737 
3738 		s = sta_state_fsm;
3739 
3740 	} else {
3741 		ic_printf(vap->iv_ic, "%s: only station mode currently supported: "
3742 		    "vap %p iv_opmode %d\n", __func__, vap, vap->iv_opmode);
3743 		return (ENOSYS);
3744 	}
3745 
3746 	error = 0;
3747 	for (; s->handler != NULL; s++) {
3748 		if (ostate == s->ostate && nstate == s->nstate) {
3749 #ifdef LINUXKPI_DEBUG_80211
3750 			if (linuxkpi_debug_80211 & D80211_TRACE)
3751 				ic_printf(vap->iv_ic, "%s: new state %d (%s) ->"
3752 				    " %d (%s): arg %d.\n", __func__,
3753 				    ostate, ieee80211_state_name[ostate],
3754 				    nstate, ieee80211_state_name[nstate], arg);
3755 #endif
3756 			error = s->handler(vap, nstate, arg);
3757 			break;
3758 		}
3759 	}
3760 	IEEE80211_LOCK_ASSERT(vap->iv_ic);
3761 
3762 	if (s->handler == NULL) {
3763 		IMPROVE("turn this into a KASSERT\n");
3764 		ic_printf(vap->iv_ic, "%s: unsupported state transition "
3765 		    "%d (%s) -> %d (%s)\n", __func__,
3766 		    ostate, ieee80211_state_name[ostate],
3767 		    nstate, ieee80211_state_name[nstate]);
3768 		return (ENOSYS);
3769 	}
3770 
3771 	if (error == EALREADY) {
3772 #ifdef LINUXKPI_DEBUG_80211
3773 		if (linuxkpi_debug_80211 & D80211_TRACE)
3774 			ic_printf(vap->iv_ic, "%s: state transition %d (%s) -> "
3775 			    "%d (%s): iv_newstate already handled: %d.\n",
3776 			    __func__, ostate, ieee80211_state_name[ostate],
3777 			    nstate, ieee80211_state_name[nstate], error);
3778 #endif
3779 		return (0);
3780 	}
3781 
3782 	if (error != 0) {
3783 		ic_printf(vap->iv_ic, "%s: error %d during state transition "
3784 		    "%d (%s) -> %d (%s)\n", __func__, error,
3785 		    ostate, ieee80211_state_name[ostate],
3786 		    nstate, ieee80211_state_name[nstate]);
3787 		return (error);
3788 	}
3789 
3790 #ifdef LINUXKPI_DEBUG_80211
3791 	if (linuxkpi_debug_80211 & D80211_TRACE)
3792 		ic_printf(vap->iv_ic, "%s:%d: vap %p nstate %#x arg %#x "
3793 		    "calling net80211 parent\n",
3794 		    __func__, __LINE__, vap, nstate, arg);
3795 #endif
3796 
3797 	return (lvif->iv_newstate(vap, nstate, arg));
3798 }
3799 
3800 /* -------------------------------------------------------------------------- */
3801 
3802 /*
3803  * We overload (*iv_update_bss) as otherwise we have cases in, e.g.,
3804  * net80211::ieee80211_sta_join1() where vap->iv_bss gets replaced by a
3805  * new node without us knowing and thus our ni/lsta are out of sync.
3806  */
3807 static struct ieee80211_node *
3808 lkpi_iv_update_bss(struct ieee80211vap *vap, struct ieee80211_node *ni)
3809 {
3810 	struct lkpi_vif *lvif;
3811 	struct ieee80211_node *rni;
3812 
3813 	IEEE80211_LOCK_ASSERT(vap->iv_ic);
3814 
3815 	lvif = VAP_TO_LVIF(vap);
3816 
3817 	LKPI_80211_LVIF_LOCK(lvif);
3818 	lvif->lvif_bss_synched = false;
3819 	LKPI_80211_LVIF_UNLOCK(lvif);
3820 
3821 	rni = lvif->iv_update_bss(vap, ni);
3822 	return (rni);
3823 }
3824 
3825 #ifdef LKPI_80211_WME
3826 static int
3827 lkpi_wme_update(struct lkpi_hw *lhw, struct ieee80211vap *vap, bool planned)
3828 {
3829 	struct ieee80211com *ic;
3830 	struct ieee80211_hw *hw;
3831 	struct lkpi_vif *lvif;
3832 	struct ieee80211_vif *vif;
3833 	struct chanAccParams chp;
3834 	struct wmeParams wmeparr[WME_NUM_AC];
3835 	struct ieee80211_tx_queue_params txqp;
3836 	enum ieee80211_bss_changed bss_changed;
3837 	int error;
3838 	uint16_t ac;
3839 
3840 	hw = LHW_TO_HW(lhw);
3841 	lockdep_assert_wiphy(hw->wiphy);
3842 
3843 	IMPROVE();
3844 	KASSERT(WME_NUM_AC == IEEE80211_NUM_ACS, ("%s: WME_NUM_AC %d != "
3845 	    "IEEE80211_NUM_ACS %d\n", __func__, WME_NUM_AC, IEEE80211_NUM_ACS));
3846 
3847 	if (vap == NULL)
3848 		return (0);
3849 
3850 	if ((vap->iv_flags & IEEE80211_F_WME) == 0)
3851 		return (0);
3852 
3853 	if (lhw->ops->conf_tx == NULL)
3854 		return (0);
3855 
3856 	if (!planned && (vap->iv_state != IEEE80211_S_RUN)) {
3857 		lhw->update_wme = true;
3858 		return (0);
3859 	}
3860 	lhw->update_wme = false;
3861 
3862 	ic = lhw->ic;
3863 	ieee80211_wme_ic_getparams(ic, &chp);
3864 	IEEE80211_LOCK(ic);
3865 	for (ac = 0; ac < WME_NUM_AC; ac++)
3866 		wmeparr[ac] = chp.cap_wmeParams[ac];
3867 	IEEE80211_UNLOCK(ic);
3868 
3869 	lvif = VAP_TO_LVIF(vap);
3870 	vif = LVIF_TO_VIF(lvif);
3871 
3872 	/* Configure tx queues (conf_tx) & send BSS_CHANGED_QOS. */
3873 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
3874 		struct wmeParams *wmep;
3875 
3876 		wmep = &wmeparr[ac];
3877 		bzero(&txqp, sizeof(txqp));
3878 		txqp.cw_min = wmep->wmep_logcwmin;
3879 		txqp.cw_max = wmep->wmep_logcwmax;
3880 		txqp.txop = wmep->wmep_txopLimit;
3881 		txqp.aifs = wmep->wmep_aifsn;
3882 		error = lkpi_80211_mo_conf_tx(hw, vif, /* link_id */0, ac, &txqp);
3883 		if (error != 0)
3884 			ic_printf(ic, "%s: conf_tx ac %u failed %d\n",
3885 			    __func__, ac, error);
3886 	}
3887 	bss_changed = BSS_CHANGED_QOS;
3888 	if (!planned)
3889 		lkpi_bss_info_change(hw, vif, bss_changed);
3890 
3891 	return (bss_changed);
3892 }
3893 #endif
3894 
3895 static int
3896 lkpi_ic_wme_update(struct ieee80211com *ic)
3897 {
3898 #ifdef LKPI_80211_WME
3899 	struct ieee80211vap *vap;
3900 	struct lkpi_hw *lhw;
3901 	struct ieee80211_hw *hw;
3902 
3903 	IMPROVE("Use the per-VAP callback in net80211.");
3904 	vap = TAILQ_FIRST(&ic->ic_vaps);
3905 	if (vap == NULL)
3906 		return (0);
3907 
3908 	lhw = ic->ic_softc;
3909 	hw = LHW_TO_HW(lhw);
3910 
3911 	wiphy_lock(hw->wiphy);
3912 	lkpi_wme_update(lhw, vap, false);
3913 	wiphy_unlock(hw->wiphy);
3914 #endif
3915 	return (0);	/* unused */
3916 }
3917 
3918 static void
3919 lkpi_iv_sta_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0,
3920     int subtype, const struct ieee80211_rx_stats *rxs, int rssi, int nf)
3921 {
3922 	struct lkpi_hw *lhw;
3923 	struct ieee80211_hw *hw;
3924 	struct lkpi_vif *lvif;
3925 	struct ieee80211_vif *vif;
3926 	enum ieee80211_bss_changed bss_changed;
3927 
3928 	lvif = VAP_TO_LVIF(ni->ni_vap);
3929 	vif = LVIF_TO_VIF(lvif);
3930 
3931 	lvif->iv_recv_mgmt(ni, m0, subtype, rxs, rssi, nf);
3932 
3933 	switch (subtype) {
3934 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
3935 		break;
3936 	case IEEE80211_FC0_SUBTYPE_BEACON:
3937 		/*
3938 		 * Only count beacons when assoc. SCAN has its own logging.
3939 		 * This is for connection/beacon loss/session protection almost
3940 		 * over debugging when trying to get into a stable RUN state.
3941 		 */
3942 		if (vif->cfg.assoc)
3943 			lvif->beacons++;
3944 		break;
3945 	default:
3946 		return;
3947 	}
3948 
3949 	lhw = ni->ni_ic->ic_softc;
3950 	hw = LHW_TO_HW(lhw);
3951 
3952 	/*
3953 	 * If this direct call to mo_bss_info_changed will not work due to
3954 	 * locking, see if queue_work() is fast enough.
3955 	 */
3956 	bss_changed = lkpi_update_dtim_tsf(vif, ni, ni->ni_vap, __func__, __LINE__);
3957 	lkpi_bss_info_change(hw, vif, bss_changed);
3958 }
3959 
3960 /*
3961  * Change link-layer address on the vif (if the vap is not started/"UP").
3962  * This can happen if a user changes 'ether' using ifconfig.
3963  * The code is based on net80211/ieee80211_freebsd.c::wlan_iflladdr() but
3964  * we do use a per-[l]vif event handler to be sure we exist as we
3965  * cannot assume that from every vap derives a vif and we have a hard
3966  * time checking based on net80211 information.
3967  * Should this ever become a real problem we could add a callback function
3968  * to wlan_iflladdr() to be set optionally but that would be for a
3969  * single-consumer (or needs a list) -- was just too complicated for an
3970  * otherwise perfect mechanism FreeBSD already provides.
3971  */
3972 static void
3973 lkpi_vif_iflladdr(void *arg, struct ifnet *ifp)
3974 {
3975 	struct epoch_tracker et;
3976 	struct ieee80211_vif *vif;
3977 
3978 	NET_EPOCH_ENTER(et);
3979 	/* NB: identify vap's by if_transmit; left as an extra check. */
3980 	if (if_gettransmitfn(ifp) != ieee80211_vap_transmit ||
3981 	    (if_getflags(ifp) & IFF_UP) != 0) {
3982 		NET_EPOCH_EXIT(et);
3983 		return;
3984 	}
3985 
3986 	vif = arg;
3987 	IEEE80211_ADDR_COPY(vif->bss_conf.addr, if_getlladdr(ifp));
3988 	NET_EPOCH_EXIT(et);
3989 }
3990 
3991 static struct ieee80211vap *
3992 lkpi_ic_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ],
3993     int unit, enum ieee80211_opmode opmode, int flags,
3994     const uint8_t bssid[IEEE80211_ADDR_LEN],
3995     const uint8_t mac[IEEE80211_ADDR_LEN])
3996 {
3997 	struct lkpi_hw *lhw;
3998 	struct ieee80211_hw *hw;
3999 	struct lkpi_vif *lvif;
4000 	struct ieee80211vap *vap;
4001 	struct ieee80211_vif *vif;
4002 	struct ieee80211_tx_queue_params txqp;
4003 	enum ieee80211_bss_changed bss_changed;
4004 	struct sysctl_oid *node;
4005 	size_t len;
4006 	int error, i;
4007 	uint16_t ac;
4008 
4009 	if (!TAILQ_EMPTY(&ic->ic_vaps))	/* 1 so far. Add <n> once this works. */
4010 		return (NULL);
4011 
4012 	lhw = ic->ic_softc;
4013 	hw = LHW_TO_HW(lhw);
4014 
4015 	len = sizeof(*lvif);
4016 	len += hw->vif_data_size;	/* vif->drv_priv */
4017 
4018 	lvif = malloc(len, M_80211_VAP, M_WAITOK | M_ZERO);
4019 	mtx_init(&lvif->mtx, "lvif", NULL, MTX_DEF);
4020 	TASK_INIT(&lvif->sw_scan_task, 0, lkpi_sw_scan_task, lvif);
4021 	INIT_LIST_HEAD(&lvif->lsta_list);
4022 	lvif->lvif_bss = NULL;
4023 	refcount_init(&lvif->nt_unlocked, 0);
4024 	lvif->lvif_bss_synched = false;
4025 	vap = LVIF_TO_VAP(lvif);
4026 
4027 	vif = LVIF_TO_VIF(lvif);
4028 	memcpy(vif->addr, mac, IEEE80211_ADDR_LEN);
4029 	vif->p2p = false;
4030 	vif->probe_req_reg = false;
4031 	vif->type = lkpi_opmode_to_vif_type(opmode);
4032 	lvif->wdev.iftype = vif->type;
4033 	/* Need to fill in other fields as well. */
4034 	IMPROVE();
4035 
4036 	/* Create a chanctx to be used later. */
4037 	IMPROVE("lkpi_alloc_lchanctx reserved as many as can be");
4038 	(void) lkpi_find_lchanctx_reserved(hw, lvif);
4039 
4040 	/* XXX-BZ hardcoded for now! */
4041 #if 1
4042 	RCU_INIT_POINTER(vif->bss_conf.chanctx_conf, NULL);
4043 	vif->bss_conf.vif = vif;
4044 	/* vap->iv_myaddr is not set until net80211::vap_setup or vap_attach. */
4045 	IEEE80211_ADDR_COPY(vif->bss_conf.addr, mac);
4046 	lvif->lvif_ifllevent = EVENTHANDLER_REGISTER(iflladdr_event,
4047 	    lkpi_vif_iflladdr, vif, EVENTHANDLER_PRI_ANY);
4048 	vif->bss_conf.link_id = 0;	/* Non-MLO operation. */
4049 	vif->bss_conf.chanreq.oper.chan = lhw->dflt_chandef.chan;
4050 	vif->bss_conf.chanreq.oper.width = NL80211_CHAN_WIDTH_20_NOHT;
4051 	vif->bss_conf.use_short_preamble = false;	/* vap->iv_flags IEEE80211_F_SHPREAMBLE */
4052 	vif->bss_conf.use_short_slot = false;		/* vap->iv_flags IEEE80211_F_SHSLOT */
4053 	vif->bss_conf.qos = false;
4054 	vif->bss_conf.use_cts_prot = false;		/* vap->iv_protmode */
4055 	vif->bss_conf.ht_operation_mode = IEEE80211_HT_OP_MODE_PROTECTION_NONE;
4056 	vif->cfg.aid = 0;
4057 	vif->cfg.assoc = false;
4058 	vif->cfg.idle = true;
4059 	vif->cfg.ps = false;
4060 	IMPROVE("Check other fields and then figure out whats is left elsewhere of them");
4061 	/*
4062 	 * We need to initialize it to something as the bss_info_changed call
4063 	 * will try to copy from it in iwlwifi and NULL is a panic.
4064 	 * We will set the proper one in scan_to_auth() before being assoc.
4065 	 */
4066 	vif->bss_conf.bssid = ieee80211broadcastaddr;
4067 #endif
4068 #if 0
4069 	vif->bss_conf.dtim_period = 0; /* IEEE80211_DTIM_DEFAULT ; must stay 0. */
4070 	IEEE80211_ADDR_COPY(vif->bss_conf.bssid, bssid);
4071 	vif->bss_conf.beacon_int = ic->ic_bintval;
4072 	/* iwlwifi bug. */
4073 	if (vif->bss_conf.beacon_int < 16)
4074 		vif->bss_conf.beacon_int = 16;
4075 #endif
4076 
4077 	/* Link Config */
4078 	vif->link_conf[0] = &vif->bss_conf;
4079 	for (i = 0; i < nitems(vif->link_conf); i++) {
4080 		IMPROVE("more than 1 link one day");
4081 	}
4082 
4083 	/* Setup queue defaults; driver may override in (*add_interface). */
4084 	for (i = 0; i < IEEE80211_NUM_ACS; i++) {
4085 		if (ieee80211_hw_check(hw, QUEUE_CONTROL))
4086 			vif->hw_queue[i] = IEEE80211_INVAL_HW_QUEUE;
4087 		else if (hw->queues >= IEEE80211_NUM_ACS)
4088 			vif->hw_queue[i] = i;
4089 		else
4090 			vif->hw_queue[i] = 0;
4091 
4092 		/* Initialize the queue to running. Stopped? */
4093 		lvif->hw_queue_stopped[i] = false;
4094 	}
4095 	vif->cab_queue = IEEE80211_INVAL_HW_QUEUE;
4096 
4097 	IMPROVE();
4098 
4099 	wiphy_lock(hw->wiphy);
4100 	error = lkpi_80211_mo_start(hw);
4101 	if (error != 0) {
4102 		wiphy_unlock(hw->wiphy);
4103 		ic_printf(ic, "%s: failed to start hw: %d\n", __func__, error);
4104 		mtx_destroy(&lvif->mtx);
4105 		free(lvif, M_80211_VAP);
4106 		return (NULL);
4107 	}
4108 
4109 	error = lkpi_80211_mo_add_interface(hw, vif);
4110 	if (error != 0) {
4111 		IMPROVE();	/* XXX-BZ mo_stop()? */
4112 		wiphy_unlock(hw->wiphy);
4113 		ic_printf(ic, "%s: failed to add interface: %d\n", __func__, error);
4114 		mtx_destroy(&lvif->mtx);
4115 		free(lvif, M_80211_VAP);
4116 		return (NULL);
4117 	}
4118 	wiphy_unlock(hw->wiphy);
4119 
4120 	LKPI_80211_LHW_LVIF_LOCK(lhw);
4121 	TAILQ_INSERT_TAIL(&lhw->lvif_head, lvif, lvif_entry);
4122 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
4123 
4124 	/* Set bss_info. */
4125 	bss_changed = 0;
4126 	lkpi_bss_info_change(hw, vif, bss_changed);
4127 
4128 	/* Configure tx queues (conf_tx), default WME & send BSS_CHANGED_QOS. */
4129 	IMPROVE("Hardcoded values; to fix see 802.11-2016, 9.4.2.29 EDCA Parameter Set element");
4130 	wiphy_lock(hw->wiphy);
4131 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
4132 
4133 		bzero(&txqp, sizeof(txqp));
4134 		txqp.cw_min = 15;
4135 		txqp.cw_max = 1023;
4136 		txqp.txop = 0;
4137 		txqp.aifs = 2;
4138 		error = lkpi_80211_mo_conf_tx(hw, vif, /* link_id */0, ac, &txqp);
4139 		if (error != 0)
4140 			ic_printf(ic, "%s: conf_tx ac %u failed %d\n",
4141 			    __func__, ac, error);
4142 	}
4143 	wiphy_unlock(hw->wiphy);
4144 	bss_changed = BSS_CHANGED_QOS;
4145 	lkpi_bss_info_change(hw, vif, bss_changed);
4146 
4147 	/* Force MC init. */
4148 	lkpi_update_mcast_filter(ic);
4149 
4150 	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
4151 
4152 	/* Now we have a valid vap->iv_ifp.  Any checksum offloading goes below. */
4153 
4154 	IMPROVE();
4155 
4156 	/* Override with LinuxKPI method so we can drive mac80211/cfg80211. */
4157 	lvif->iv_newstate = vap->iv_newstate;
4158 	vap->iv_newstate = lkpi_iv_newstate;
4159 	lvif->iv_update_bss = vap->iv_update_bss;
4160 	vap->iv_update_bss = lkpi_iv_update_bss;
4161 	lvif->iv_recv_mgmt = vap->iv_recv_mgmt;
4162 	vap->iv_recv_mgmt = lkpi_iv_sta_recv_mgmt;
4163 
4164 #ifdef LKPI_80211_HW_CRYPTO
4165 	/* Key management. */
4166 	if (lkpi_hwcrypto && lhw->ops->set_key != NULL) {
4167 		vap->iv_key_set = lkpi_iv_key_set;
4168 		vap->iv_key_delete = lkpi_iv_key_delete;
4169 		vap->iv_key_update_begin = lkpi_iv_key_update_begin;
4170 		vap->iv_key_update_end = lkpi_iv_key_update_end;
4171 	}
4172 #endif
4173 
4174 #ifdef LKPI_80211_HT
4175 	/* Stay with the iv_ampdu_rxmax,limit / iv_ampdu_density defaults until later. */
4176 #endif
4177 
4178 	ieee80211_ratectl_init(vap);
4179 
4180 	/* Complete setup. */
4181 	ieee80211_vap_attach(vap, ieee80211_media_change,
4182 	    ieee80211_media_status, mac);
4183 
4184 #ifdef LKPI_80211_HT
4185 	/*
4186 	 * Modern chipset/fw/drv will do A-MPDU in drv/fw and fail
4187 	 * to do so if they cannot do the crypto too.
4188 	 */
4189 	if (!lkpi_hwcrypto && IEEE80211_CONF_AMPDU_OFFLOAD(ic))
4190 		vap->iv_flags_ht &= ~IEEE80211_FHT_AMPDU_RX;
4191 #endif
4192 
4193 	if (hw->max_listen_interval == 0)
4194 		hw->max_listen_interval = 7 * (ic->ic_lintval / ic->ic_bintval);
4195 	hw->conf.listen_interval = hw->max_listen_interval;
4196 
4197 	/* XXX-BZ do we need to be able to update these? */
4198 	hw->wiphy->frag_threshold = vap->iv_fragthreshold;
4199 	lkpi_80211_mo_set_frag_threshold(hw, vap->iv_fragthreshold);
4200 	hw->wiphy->rts_threshold = vap->iv_rtsthreshold;
4201 	lkpi_80211_mo_set_rts_threshold(hw, vap->iv_rtsthreshold);
4202 	/* any others? */
4203 
4204 	/* Add per-VIF/VAP sysctls. */
4205 	sysctl_ctx_init(&lvif->sysctl_ctx);
4206 
4207 	node = SYSCTL_ADD_NODE(&lvif->sysctl_ctx,
4208 	    SYSCTL_CHILDREN(&sysctl___compat_linuxkpi_80211),
4209 	    OID_AUTO, if_name(vap->iv_ifp),
4210 	    CTLFLAG_RD | CTLFLAG_SKIP | CTLFLAG_MPSAFE, NULL, "VIF Information");
4211 
4212 	SYSCTL_ADD_PROC(&lvif->sysctl_ctx,
4213 	    SYSCTL_CHILDREN(node), OID_AUTO, "dump_stas",
4214 	    CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_MPSAFE, lvif, 0,
4215 	    lkpi_80211_dump_stas, "A", "Dump sta statistics of this vif");
4216 	SYSCTL_ADD_PROC(&lvif->sysctl_ctx,
4217 	    SYSCTL_CHILDREN(node), OID_AUTO, "dump_stas_queues",
4218 	    CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_MPSAFE | CTLFLAG_SKIP, lvif, 0,
4219 	    lkpi_80211_dump_sta_queues, "A",
4220 	    "Dump queue statistics for any sta of this vif");
4221 
4222 	IMPROVE();
4223 
4224 	return (vap);
4225 }
4226 
4227 void
4228 linuxkpi_ieee80211_unregister_hw(struct ieee80211_hw *hw)
4229 {
4230 
4231 	wiphy_unregister(hw->wiphy);
4232 	linuxkpi_ieee80211_ifdetach(hw);
4233 
4234 	IMPROVE();
4235 }
4236 
4237 void
4238 linuxkpi_ieee80211_restart_hw(struct ieee80211_hw *hw)
4239 {
4240 
4241 	TODO();
4242 }
4243 
4244 static void
4245 lkpi_ic_vap_delete(struct ieee80211vap *vap)
4246 {
4247 	struct ieee80211com *ic;
4248 	struct lkpi_hw *lhw;
4249 	struct ieee80211_hw *hw;
4250 	struct lkpi_vif *lvif;
4251 	struct ieee80211_vif *vif;
4252 
4253 	lvif = VAP_TO_LVIF(vap);
4254 	vif = LVIF_TO_VIF(lvif);
4255 	ic = vap->iv_ic;
4256 	lhw = ic->ic_softc;
4257 	hw = LHW_TO_HW(lhw);
4258 
4259 	EVENTHANDLER_DEREGISTER(iflladdr_event, lvif->lvif_ifllevent);
4260 
4261 	/* Clear up per-VIF/VAP sysctls. */
4262 	sysctl_ctx_free(&lvif->sysctl_ctx);
4263 
4264 	ieee80211_draintask(ic, &lvif->sw_scan_task);
4265 
4266 	LKPI_80211_LHW_LVIF_LOCK(lhw);
4267 	TAILQ_REMOVE(&lhw->lvif_head, lvif, lvif_entry);
4268 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
4269 
4270 	ieee80211_ratectl_deinit(vap);
4271 	ieee80211_vap_detach(vap);
4272 
4273 	IMPROVE("clear up other bits in this state");
4274 
4275 	lkpi_80211_mo_remove_interface(hw, vif);
4276 
4277 	/* Single VAP, so we can do this here. */
4278 	lkpi_80211_mo_stop(hw, false);			/* XXX SUSPEND */
4279 
4280 	mtx_destroy(&lvif->mtx);
4281 	free(lvif, M_80211_VAP);
4282 }
4283 
4284 static void
4285 lkpi_ic_update_mcast(struct ieee80211com *ic)
4286 {
4287 	struct ieee80211vap *vap;
4288 	struct lkpi_hw *lhw;
4289 
4290 	lhw = ic->ic_softc;
4291 
4292 	LKPI_80211_LHW_MC_LOCK(lhw);
4293 	/* Cleanup anything on the current list. */
4294 	lkpi_cleanup_mcast_list_locked(lhw);
4295 
4296 	/* Build up the new list (or allmulti). */
4297 	if (ic->ic_allmulti == 0) {
4298 		TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
4299 			if_foreach_llmaddr(vap->iv_ifp,
4300 			    lkpi_ic_update_mcast_copy, &lhw->mc_list);
4301 		lhw->mc_all_multi = false;
4302 	} else {
4303 		lhw->mc_all_multi = true;
4304 	}
4305 	LKPI_80211_LHW_MC_UNLOCK(lhw);
4306 
4307 	lkpi_update_mcast_filter(ic);
4308 	TRACEOK();
4309 }
4310 
4311 static void
4312 lkpi_ic_update_promisc(struct ieee80211com *ic)
4313 {
4314 
4315 	UNIMPLEMENTED;
4316 }
4317 
4318 static void
4319 lkpi_ic_update_chw(struct ieee80211com *ic)
4320 {
4321 
4322 	UNIMPLEMENTED;
4323 }
4324 
4325 /* Start / stop device. */
4326 static void
4327 lkpi_ic_parent(struct ieee80211com *ic)
4328 {
4329 	struct lkpi_hw *lhw;
4330 	struct ieee80211_hw *hw;
4331 #ifdef HW_START_STOP
4332 	int error;
4333 #endif
4334 	bool start_all;
4335 
4336 	IMPROVE();
4337 
4338 	lhw = ic->ic_softc;
4339 	hw = LHW_TO_HW(lhw);
4340 	start_all = false;
4341 
4342 	/* IEEE80211_UNLOCK(ic); */
4343 	wiphy_lock(hw->wiphy);
4344 	if (ic->ic_nrunning > 0) {
4345 #ifdef HW_START_STOP
4346 		error = lkpi_80211_mo_start(hw);
4347 		if (error == 0)
4348 #endif
4349 			start_all = true;
4350 	} else {
4351 #ifdef HW_START_STOP
4352 		lkpi_80211_mo_stop(hw, false);		/* XXX SUSPEND */
4353 #endif
4354 	}
4355 	wiphy_unlock(hw->wiphy);
4356 	/* IEEE80211_LOCK(ic); */
4357 
4358 	if (start_all)
4359 		ieee80211_start_all(ic);
4360 }
4361 
4362 bool
4363 linuxkpi_ieee80211_is_ie_id_in_ie_buf(const u8 ie, const u8 *ie_ids,
4364     size_t ie_ids_len)
4365 {
4366 	int i;
4367 
4368 	for (i = 0; i < ie_ids_len; i++) {
4369 		if (ie == *ie_ids)
4370 			return (true);
4371 	}
4372 
4373 	return (false);
4374 }
4375 
4376 /* Return true if skipped; false if error. */
4377 bool
4378 linuxkpi_ieee80211_ie_advance(size_t *xp, const u8 *ies, size_t ies_len)
4379 {
4380 	size_t x;
4381 	uint8_t l;
4382 
4383 	x = *xp;
4384 
4385 	KASSERT(x < ies_len, ("%s: x %zu ies_len %zu ies %p\n",
4386 	    __func__, x, ies_len, ies));
4387 	l = ies[x + 1];
4388 	x += 2 + l;
4389 
4390 	if (x > ies_len)
4391 		return (false);
4392 
4393 	*xp = x;
4394 	return (true);
4395 }
4396 
4397 static uint8_t *
4398 lkpi_scan_ies_add(uint8_t *p, struct ieee80211_scan_ies *scan_ies,
4399     uint32_t band_mask, struct ieee80211vap *vap, struct ieee80211_hw *hw)
4400 {
4401 	struct ieee80211_supported_band *supband;
4402 	struct linuxkpi_ieee80211_channel *channels;
4403 	struct ieee80211com *ic;
4404 	const struct ieee80211_channel *chan;
4405 	const struct ieee80211_rateset *rs;
4406 	uint8_t *pb;
4407 	int band, i;
4408 
4409 	ic = vap->iv_ic;
4410 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
4411 		if ((band_mask & (1 << band)) == 0)
4412 			continue;
4413 
4414 		supband = hw->wiphy->bands[band];
4415 		/*
4416 		 * This should not happen;
4417 		 * band_mask is a bitmask of valid bands to scan on.
4418 		 */
4419 		if (supband == NULL || supband->n_channels == 0)
4420 			continue;
4421 
4422 		/* Find a first channel to get the mode and rates from. */
4423 		channels = supband->channels;
4424 		chan = NULL;
4425 		for (i = 0; i < supband->n_channels; i++) {
4426 			uint32_t flags;
4427 
4428 			if (channels[i].flags & IEEE80211_CHAN_DISABLED)
4429 				continue;
4430 
4431 			flags = 0;
4432 			switch (band) {
4433 			case NL80211_BAND_2GHZ:
4434 				flags |= IEEE80211_CHAN_G;
4435 				break;
4436 			case NL80211_BAND_5GHZ:
4437 				flags |= IEEE80211_CHAN_A;
4438 				break;
4439 			default:
4440 				panic("%s:%d: unupported band %d\n",
4441 				    __func__, __LINE__, band);
4442 			}
4443 
4444 			chan = ieee80211_find_channel(ic,
4445 			    channels[i].center_freq, flags);
4446 			if (chan != NULL)
4447 				break;
4448 		}
4449 
4450 		/* This really should not happen. */
4451 		if (chan == NULL)
4452 			continue;
4453 
4454 		pb = p;
4455 		rs = ieee80211_get_suprates(ic, chan);	/* calls chan2mode */
4456 		p = ieee80211_add_rates(p, rs);
4457 		p = ieee80211_add_xrates(p, rs);
4458 
4459 #if defined(LKPI_80211_HT)
4460 		if ((vap->iv_flags_ht & IEEE80211_FHT_HT) != 0) {
4461 			struct ieee80211_channel *c;
4462 
4463 			c = ieee80211_ht_adjust_channel(ic, ic->ic_curchan,
4464 			    vap->iv_flags_ht);
4465 			p = ieee80211_add_htcap_ch(p, vap, c);
4466 		}
4467 #endif
4468 #if defined(LKPI_80211_VHT)
4469 		if (band == NL80211_BAND_5GHZ &&
4470 		    (vap->iv_vht_flags & IEEE80211_FVHT_VHT) != 0) {
4471 			struct ieee80211_channel *c;
4472 
4473 			c = ieee80211_ht_adjust_channel(ic, ic->ic_curchan,
4474 			    vap->iv_flags_ht);
4475 			c = ieee80211_vht_adjust_channel(ic, c,
4476 			    vap->iv_vht_flags);
4477 			p = ieee80211_add_vhtcap_ch(p, vap, c);
4478 		}
4479 #endif
4480 
4481 		scan_ies->ies[band] = pb;
4482 		scan_ies->len[band] = p - pb;
4483 	}
4484 
4485 	/* Add common_ies */
4486 	pb = p;
4487 	if ((vap->iv_flags & IEEE80211_F_WPA1) != 0 &&
4488 	    vap->iv_wpa_ie != NULL) {
4489 		memcpy(p, vap->iv_wpa_ie, 2 + vap->iv_wpa_ie[1]);
4490 		p += 2 + vap->iv_wpa_ie[1];
4491 	}
4492 	if (vap->iv_appie_probereq != NULL) {
4493 		memcpy(p, vap->iv_appie_probereq->ie_data,
4494 		    vap->iv_appie_probereq->ie_len);
4495 		p += vap->iv_appie_probereq->ie_len;
4496 	}
4497 	scan_ies->common_ies = pb;
4498 	scan_ies->common_ie_len = p - pb;
4499 
4500 	return (p);
4501 }
4502 
4503 static void
4504 lkpi_enable_hw_scan(struct lkpi_hw *lhw)
4505 {
4506 
4507 	if (lhw->ops->hw_scan) {
4508 		/*
4509 		 * Advertise full-offload scanning.
4510 		 *
4511 		 * Not limiting to SINGLE_SCAN_ON_ALL_BANDS here as otherwise
4512 		 * we essentially disable hw_scan for all drivers not setting
4513 		 * the flag.
4514 		 */
4515 		lhw->ic->ic_flags_ext |= IEEE80211_FEXT_SCAN_OFFLOAD;
4516 		lhw->scan_flags |= LKPI_LHW_SCAN_HW;
4517 	}
4518 }
4519 
4520 #ifndef LKPI_80211_USE_SCANLIST
4521 static const uint32_t chan_pri[] = {
4522 	5180, 5500, 5745,
4523 	5260, 5580, 5660, 5825,
4524 	5220, 5300, 5540, 5620, 5700, 5785, 5865,
4525 	2437, 2412, 2422, 2462, 2472, 2432, 2452
4526 };
4527 
4528 static int
4529 lkpi_scan_chan_list_idx(const struct linuxkpi_ieee80211_channel *lc)
4530 {
4531 	int i;
4532 
4533 	for (i = 0; i < nitems(chan_pri); i++) {
4534 		if (lc->center_freq == chan_pri[i])
4535 			return (i);
4536 	}
4537 
4538 	return (-1);
4539 }
4540 
4541 static int
4542 lkpi_scan_chan_list_comp(const  struct linuxkpi_ieee80211_channel *lc1,
4543     const  struct linuxkpi_ieee80211_channel *lc2)
4544 {
4545 	int idx1, idx2;
4546 
4547 	/* Find index in list. */
4548 	idx1 = lkpi_scan_chan_list_idx(lc1);
4549 	idx2 = lkpi_scan_chan_list_idx(lc2);
4550 
4551 	if (idx1 == -1 && idx2 != -1)
4552 		return (1);
4553 	if (idx1 != -1 && idx2 == -1)
4554 		return (-1);
4555 
4556 	/* Neither on the list, use center_freq. */
4557 	if (idx1 == -1 && idx2 == -1)
4558 		return (lc1->center_freq - lc2->center_freq);
4559 
4560 	/* Whichever is first in the list. */
4561 	return (idx1 - idx2);
4562 }
4563 
4564 static void
4565 lkpi_scan_chan_list_resort(struct linuxkpi_ieee80211_channel **cpp, size_t nchan)
4566 {
4567 	struct linuxkpi_ieee80211_channel *lc, *nc;
4568 	size_t i, j;
4569 	int rc;
4570 
4571 	for (i = (nchan - 1); i > 0; i--) {
4572 		for (j = i; j > 0 ; j--) {
4573 			lc = *(cpp + j);
4574 			nc = *(cpp + j - 1);
4575 			rc = lkpi_scan_chan_list_comp(lc, nc);
4576 			if (rc < 0) {
4577 				*(cpp + j) = nc;
4578 				*(cpp + j - 1) = lc;
4579 			}
4580 		}
4581 	}
4582 }
4583 
4584 static bool
4585 lkpi_scan_chan(struct linuxkpi_ieee80211_channel *c,
4586     struct ieee80211com *ic, bool log)
4587 {
4588 
4589 	if ((c->flags & IEEE80211_CHAN_DISABLED) != 0) {
4590 		if (log)
4591 			TRACE_SCAN(ic, "Skipping disabled chan "
4592 			    "on band %s [%#x/%u/%#x]",
4593 			    lkpi_nl80211_band_name(c->band), c->hw_value,
4594 			    c->center_freq, c->flags);
4595 		return (false);
4596 	}
4597 	if (isclr(ic->ic_chan_active, ieee80211_mhz2ieee(c->center_freq,
4598 	    lkpi_nl80211_band_to_net80211_band(c->band)))) {
4599 		if (log)
4600 			TRACE_SCAN(ic, "Skipping !active chan "
4601 			    "on band %s [%#x/%u/%#x]",
4602 			    lkpi_nl80211_band_name(c->band), c->hw_value,
4603 			    c->center_freq, c->flags);
4604 		return (false);
4605 	}
4606 	return (true);
4607 }
4608 #endif
4609 
4610 static void
4611 lkpi_ic_scan_start(struct ieee80211com *ic)
4612 {
4613 	struct lkpi_hw *lhw;
4614 	struct ieee80211_hw *hw;
4615 	struct lkpi_vif *lvif;
4616 	struct ieee80211_vif *vif;
4617 	struct ieee80211_scan_state *ss;
4618 	struct ieee80211vap *vap;
4619 	int error;
4620 	bool is_hw_scan;
4621 
4622 	lhw = ic->ic_softc;
4623 	ss = ic->ic_scan;
4624 	vap = ss->ss_vap;
4625 	TRACE_SCAN(ic, "scan_flags %b", lhw->scan_flags, LKPI_LHW_SCAN_BITS);
4626 
4627 	LKPI_80211_LHW_SCAN_LOCK(lhw);
4628 	if ((lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0) {
4629 		/* A scan is still running. */
4630 		LKPI_80211_LHW_SCAN_UNLOCK(lhw);
4631 		TRACE_SCAN(ic, "Trying to start new scan while still running; "
4632 		    "cancelling new net80211 scan; scan_flags %b",
4633 		    lhw->scan_flags, LKPI_LHW_SCAN_BITS);
4634 		ieee80211_cancel_scan(vap);
4635 		return;
4636 	}
4637 	is_hw_scan = (lhw->scan_flags & LKPI_LHW_SCAN_HW) != 0;
4638 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
4639 
4640 #if 0
4641 	if (vap->iv_state != IEEE80211_S_SCAN) {
4642 		TODO("We need to be able to scan if not in S_SCAN");
4643 		TRACE_SCAN(ic, "scan_flags %b iv_state %d",
4644 		    lhw->scan_flags, LKPI_LHW_SCAN_BITS, vap->iv_state);
4645 		ieee80211_cancel_scan(vap);
4646 		return;
4647 	}
4648 #endif
4649 
4650 	hw = LHW_TO_HW(lhw);
4651 	if (!is_hw_scan) {
4652 		/* If hw_scan is cleared clear FEXT_SCAN_OFFLOAD too. */
4653 		vap->iv_flags_ext &= ~IEEE80211_FEXT_SCAN_OFFLOAD;
4654 
4655 		lvif = VAP_TO_LVIF(vap);
4656 		vif = LVIF_TO_VIF(lvif);
4657 
4658 		if (vap->iv_state == IEEE80211_S_SCAN)
4659 			lkpi_hw_conf_idle(hw, false);
4660 
4661 		LKPI_80211_LHW_SCAN_LOCK(lhw);
4662 		lhw->scan_flags |= LKPI_LHW_SCAN_RUNNING;
4663 		LKPI_80211_LHW_SCAN_UNLOCK(lhw);
4664 
4665 		lkpi_update_mcast_filter(ic);
4666 
4667 		TRACE_SCAN(vap->iv_ic, "Starting SW_SCAN: scan_flags %b",
4668 		    lhw->scan_flags, LKPI_LHW_SCAN_BITS);
4669 		lkpi_80211_mo_sw_scan_start(hw, vif, vif->addr);
4670 		/* net80211::scan_start() handled PS for us. */
4671 		IMPROVE();
4672 		/* XXX Also means it is too late to flush queues?
4673 		 * need to check iv_sta_ps or overload? */
4674 		/* XXX want to adjust ss end time/ maxdwell? */
4675 
4676 	} else {
4677 		struct ieee80211_scan_request *hw_req;
4678 		struct linuxkpi_ieee80211_channel *lc, **cpp;
4679 		struct cfg80211_ssid *ssids;
4680 		struct cfg80211_scan_6ghz_params *s6gp;
4681 		size_t chan_len, nchan, ssids_len, s6ghzlen;
4682 		int band, i, ssid_count, common_ie_len;
4683 #ifndef LKPI_80211_USE_SCANLIST
4684 		int n;
4685 #endif
4686 		uint32_t band_mask;
4687 		uint8_t *ie, *ieend;
4688 		bool running;
4689 
4690 		ssid_count = min(ss->ss_nssid, hw->wiphy->max_scan_ssids);
4691 		ssids_len = ssid_count * sizeof(*ssids);
4692 		s6ghzlen = 0 * (sizeof(*s6gp));			/* XXX-BZ */
4693 
4694 		band_mask = 0;
4695 		nchan = 0;
4696 		if (ieee80211_hw_check(hw, SINGLE_SCAN_ON_ALL_BANDS)) {
4697 #ifdef LKPI_80211_USE_SCANLIST
4698 		/* Avoid net80211 scan lists until it has proper scan offload support. */
4699 			for (i = ss->ss_next; i < ss->ss_last; i++) {
4700 				nchan++;
4701 				band = lkpi_net80211_chan_to_nl80211_band(
4702 				    ss->ss_chans[ss->ss_next + i]);
4703 				band_mask |= (1 << band);
4704 			}
4705 #else
4706 			/* Instead we scan for all channels all the time. */
4707 			for (band = 0; band < NUM_NL80211_BANDS; band++) {
4708 				switch (band) {
4709 				case NL80211_BAND_2GHZ:
4710 				case NL80211_BAND_5GHZ:
4711 					break;
4712 				default:
4713 					continue;
4714 				}
4715 				if (hw->wiphy->bands[band] != NULL) {
4716 					struct linuxkpi_ieee80211_channel *channels;
4717 					int n;
4718 
4719 					band_mask |= (1 << band);
4720 
4721 					channels = hw->wiphy->bands[band]->channels;
4722 					n = hw->wiphy->bands[band]->n_channels;
4723 					for (i = 0; i < n; i++) {
4724 						if (lkpi_scan_chan(&channels[i], ic, true))
4725 							nchan++;
4726 					}
4727 				}
4728 			}
4729 #endif
4730 		} else {
4731 			IMPROVE("individual band scans not yet supported, only scanning first band");
4732 			/* In theory net80211 should drive this. */
4733 			/* Probably we need to add local logic for now;
4734 			 * need to deal with scan_complete
4735 			 * and cancel_scan and keep local state.
4736 			 * Also cut the nchan down above.
4737 			 */
4738 			/* XXX-BZ ath10k does not set this but still does it? &$%^ */
4739 		}
4740 
4741 		chan_len = nchan * (sizeof(lc) + sizeof(*lc));
4742 
4743 		common_ie_len = 0;
4744 		if ((vap->iv_flags & IEEE80211_F_WPA1) != 0 &&
4745 		    vap->iv_wpa_ie != NULL)
4746 			common_ie_len += vap->iv_wpa_ie[1];
4747 		if (vap->iv_appie_probereq != NULL)
4748 			common_ie_len += vap->iv_appie_probereq->ie_len;
4749 
4750 		/* We would love to check this at an earlier stage... */
4751 		if (common_ie_len >  hw->wiphy->max_scan_ie_len) {
4752 			ic_printf(ic, "WARNING: %s: common_ie_len %d > "
4753 			    "wiphy->max_scan_ie_len %d\n", __func__,
4754 			    common_ie_len, hw->wiphy->max_scan_ie_len);
4755 		}
4756 
4757 		hw_req = malloc(sizeof(*hw_req) + ssids_len +
4758 		    s6ghzlen + chan_len + lhw->supbands * lhw->scan_ie_len +
4759 		    common_ie_len, M_LKPI80211, M_WAITOK | M_ZERO);
4760 
4761 		hw_req->req.flags = 0;			/* XXX ??? */
4762 		/* hw_req->req.wdev */
4763 		hw_req->req.wiphy = hw->wiphy;
4764 		hw_req->req.no_cck = false;		/* XXX */
4765 
4766 		/*
4767 		 * In general setting duration[_mandatory] seems to pessimise
4768 		 * default scanning behaviour.  We only use it for BGSCANnig
4769 		 * to keep the dwell times small.
4770 		 * Setting duration_mandatory makes this the maximum dwell
4771 		 * time (otherwise may be shorter).  Duration is in TU.
4772 		 */
4773 		if ((ic->ic_flags_ext & IEEE80211_FEXT_BGSCAN) != 0) {
4774 			unsigned long dwell;
4775 
4776 			if ((ic->ic_caps & IEEE80211_C_BGSCAN) == 0 ||
4777 			    (vap->iv_flags & IEEE80211_F_BGSCAN) == 0)
4778 				ic_printf(ic, "BGSCAN despite off: %b, %b, %b\n",
4779 				    ic->ic_flags_ext, IEEE80211_FEXT_BITS,
4780 				    vap->iv_flags, IEEE80211_F_BITS,
4781 				    ic->ic_caps, IEEE80211_C_BITS);
4782 
4783 			dwell = ss->ss_mindwell;
4784 			if (dwell == 0)
4785 				dwell = msecs_to_ticks(20);
4786 
4787 			hw_req->req.duration_mandatory = true;
4788 			hw_req->req.duration = TICKS_2_USEC(dwell) / 1024;
4789 		}
4790 
4791 #ifdef __notyet__
4792 		hw_req->req.flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
4793 		memcpy(hw_req->req.mac_addr, xxx, IEEE80211_ADDR_LEN);
4794 		memset(hw_req->req.mac_addr_mask, 0xxx, IEEE80211_ADDR_LEN);
4795 #endif
4796 		eth_broadcast_addr(hw_req->req.bssid);
4797 
4798 		hw_req->req.n_channels = nchan;
4799 		cpp = (struct linuxkpi_ieee80211_channel **)(hw_req + 1);
4800 		lc = (struct linuxkpi_ieee80211_channel *)(cpp + nchan);
4801 #ifdef LKPI_80211_USE_SCANLIST
4802 		for (i = 0; i < nchan; i++) {
4803 			*(cpp + i) =
4804 			    (struct linuxkpi_ieee80211_channel *)(lc + i);
4805 		}
4806 		/* Avoid net80211 scan lists until it has proper scan offload support. */
4807 		for (i = 0; i < nchan; i++) {
4808 			struct ieee80211_channel *c;
4809 
4810 			c = ss->ss_chans[ss->ss_next + i];
4811 			lc->center_freq = c->ic_freq;	/* XXX */
4812 			/* lc->flags */
4813 			lc->band = lkpi_net80211_chan_to_nl80211_band(c);
4814 			lc->max_power = c->ic_maxpower;
4815 			/* lc-> ... */
4816 			lc++;
4817 		}
4818 #else
4819 		/* Add bands in reverse order for scanning. */
4820 		n = 0;
4821 		for (band = NUM_NL80211_BANDS - 1; band >= 0; band--) {
4822 			struct ieee80211_supported_band *supband;
4823 			struct linuxkpi_ieee80211_channel *channels;
4824 
4825 			/* Band disabled for scanning? */
4826 			if ((band_mask & (1 << band)) == 0)
4827 				continue;
4828 
4829 			/* Nothing to scan in band? */
4830 			supband = hw->wiphy->bands[band];
4831 			if (supband == NULL || supband->n_channels == 0)
4832 				continue;
4833 
4834 			channels = supband->channels;
4835 			for (i = 0; i < supband->n_channels; i++) {
4836 				if (lkpi_scan_chan(&channels[i], ic, false))
4837 					*(cpp + n++) = &channels[i];
4838 			}
4839 		}
4840 		if (lkpi_order_scanlist)
4841 			lkpi_scan_chan_list_resort(cpp, nchan);
4842 
4843 		if ((linuxkpi_debug_80211 & D80211_SCAN) != 0) {
4844 			printf("%s:%d: %s SCAN Channel List (nchan=%zu): ",
4845 			    __func__, __LINE__, ic->ic_name, nchan);
4846 			for (i = 0; i < nchan; i++) {
4847 				struct linuxkpi_ieee80211_channel *xc;
4848 
4849 				xc = *(cpp + i);
4850 				printf(" %d(%d)",
4851 				    ieee80211_mhz2ieee(xc->center_freq,
4852 				        lkpi_nl80211_band_to_net80211_band(
4853 					xc->band)),
4854 				    xc->center_freq);
4855 			}
4856 			printf("\n");
4857 		}
4858 #endif
4859 
4860 		hw_req->req.n_ssids = ssid_count;
4861 		if (hw_req->req.n_ssids > 0) {
4862 			ssids = (struct cfg80211_ssid *)lc;
4863 			hw_req->req.ssids = ssids;
4864 			for (i = 0; i < ssid_count; i++) {
4865 				ssids->ssid_len = ss->ss_ssid[i].len;
4866 				memcpy(ssids->ssid, ss->ss_ssid[i].ssid,
4867 				    ss->ss_ssid[i].len);
4868 				ssids++;
4869 			}
4870 			s6gp = (struct cfg80211_scan_6ghz_params *)ssids;
4871 		} else {
4872 			s6gp = (struct cfg80211_scan_6ghz_params *)lc;
4873 		}
4874 
4875 		/* 6GHz one day. */
4876 		hw_req->req.n_6ghz_params = 0;
4877 		hw_req->req.scan_6ghz_params = NULL;
4878 		hw_req->req.scan_6ghz = false;	/* Weird boolean; not what you think. */
4879 		/* s6gp->... */
4880 
4881 		ie = ieend = (uint8_t *)s6gp;
4882 		/* Copy per-band IEs, copy common IEs */
4883 		ieend = lkpi_scan_ies_add(ie, &hw_req->ies, band_mask, vap, hw);
4884 		hw_req->req.ie = ie;
4885 		hw_req->req.ie_len = ieend - ie;
4886 		hw_req->req.scan_start = jiffies;
4887 
4888 		lvif = VAP_TO_LVIF(vap);
4889 		vif = LVIF_TO_VIF(lvif);
4890 
4891 		LKPI_80211_LHW_SCAN_LOCK(lhw);
4892 		/* Re-check under lock. */
4893 		running = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
4894 		if (!running) {
4895 			KASSERT(lhw->hw_req == NULL, ("%s: ic %p lhw %p hw_req %p "
4896 			    "!= NULL\n", __func__, ic, lhw, lhw->hw_req));
4897 
4898 			lhw->scan_flags |= LKPI_LHW_SCAN_RUNNING;
4899 			lhw->hw_req = hw_req;
4900 		}
4901 		LKPI_80211_LHW_SCAN_UNLOCK(lhw);
4902 		if (running) {
4903 			free(hw_req, M_LKPI80211);
4904 			TRACE_SCAN(ic, "Trying to start new scan while still "
4905 			    "running (2); cancelling new net80211 scan; "
4906 			    "scan_flags %b",
4907 			    lhw->scan_flags, LKPI_LHW_SCAN_BITS);
4908 			ieee80211_cancel_scan(vap);
4909 			return;
4910 		}
4911 
4912 		lkpi_update_mcast_filter(ic);
4913 		TRACE_SCAN(ic, "Starting HW_SCAN: scan_flags %b, "
4914 		    "ie_len %d, n_ssids %d, n_chan %d, common_ie_len %d [%d, %d]",
4915 		    lhw->scan_flags, LKPI_LHW_SCAN_BITS, hw_req->req.ie_len,
4916 		    hw_req->req.n_ssids, hw_req->req.n_channels,
4917 		    hw_req->ies.common_ie_len,
4918 		    hw_req->ies.len[NL80211_BAND_2GHZ],
4919 		    hw_req->ies.len[NL80211_BAND_5GHZ]);
4920 
4921 		error = lkpi_80211_mo_hw_scan(hw, vif, hw_req);
4922 		if (error != 0) {
4923 			bool scan_done;
4924 			int e;
4925 
4926 			TRACE_SCAN(ic, "hw_scan failed; scan_flags %b, error %d",
4927 			    lhw->scan_flags, LKPI_LHW_SCAN_BITS, error);
4928 			ieee80211_cancel_scan(vap);
4929 
4930 			/*
4931 			 * ieee80211_scan_completed must be called in either
4932 			 * case of error or none.  So let the free happen there
4933 			 * and only there.
4934 			 * That would be fine in theory but in practice drivers
4935 			 * behave differently:
4936 			 * ath10k does not return hw_scan until after scan_complete
4937 			 *        and can then still return an error.
4938 			 * rtw88 can return 1 or -EBUSY without scan_complete
4939 			 * iwlwifi can return various errors before scan starts
4940 			 * ...
4941 			 * So we cannot rely on that behaviour and have to check
4942 			 * and balance between both code paths.
4943 			 */
4944 			e = 0;
4945 			scan_done = true;
4946 			LKPI_80211_LHW_SCAN_LOCK(lhw);
4947 			if ((lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0) {
4948 
4949 				free(lhw->hw_req, M_LKPI80211);
4950 				lhw->hw_req = NULL;
4951 				/*
4952 				 * The ieee80211_cancel_scan() above runs in a
4953 				 * taskq and it may take ages for the previous
4954 				 * scan to clear;  starting a new one right away
4955 				 * we run into the problem that the old one is
4956 				 * still active.
4957 				 */
4958 				e = msleep(lhw, &lhw->scan_mtx, 0, "lhwscanstop", hz);
4959 				scan_done = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
4960 
4961 				/*
4962 				 * Now we can clear running if no one else did.
4963 				 */
4964 				lhw->scan_flags &= ~LKPI_LHW_SCAN_RUNNING;
4965 			}
4966 			LKPI_80211_LHW_SCAN_UNLOCK(lhw);
4967 			lkpi_update_mcast_filter(ic);
4968 			if (!scan_done) {
4969 				ic_printf(ic, "ERROR: %s: timeout/error to wait "
4970 				    "for ieee80211_cancel_scan: %d\n", __func__, e);
4971 				return;
4972 			}
4973 
4974 			/*
4975 			 * XXX-SIGH magic number.
4976 			 * rtw88 has a magic "return 1" if offloading scan is
4977 			 * not possible.  Fall back to sw scan in that case.
4978 			 */
4979 			if (error == 1) {
4980 				/*
4981 				 * We need to put this into some defered context
4982 				 * the net80211 scan may not be done yet
4983 				 * (ic_flags & IEEE80211_F_SCAN) and we cannot
4984 				 * wait here; if we do scan_curchan_task always
4985 				 * runs after our timeout to finalize the scan.
4986 				 */
4987 				ieee80211_runtask(ic, &lvif->sw_scan_task);
4988 				return;
4989 			}
4990 
4991 			ic_printf(ic, "ERROR: %s: hw_scan returned %d\n",
4992 			    __func__, error);
4993 		}
4994 	}
4995 }
4996 
4997 static void
4998 lkpi_sw_scan_task(void *arg, int pending __unused)
4999 {
5000 	struct lkpi_hw *lhw;
5001 	struct lkpi_vif *lvif;
5002 	struct ieee80211vap *vap;
5003 	struct ieee80211_scan_state *ss;
5004 
5005 	lvif = arg;
5006 	vap = LVIF_TO_VAP(lvif);
5007 	lhw = vap->iv_ic->ic_softc;
5008 	ss = vap->iv_ic->ic_scan;
5009 
5010 	LKPI_80211_LHW_SCAN_LOCK(lhw);
5011 	/*
5012 	 * We will re-enable this at scan_end calling lkpi_enable_hw_scan().
5013 	 * IEEE80211_FEXT_SCAN_OFFLOAD will be cleared by lkpi_ic_scan_start.
5014 	 */
5015 	lhw->scan_flags &= ~LKPI_LHW_SCAN_HW;
5016 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5017 
5018 	TRACE_SCAN(vap->iv_ic, "Triggering SW_SCAN: pending %d, scan_flags %b",
5019 	    pending, lhw->scan_flags, LKPI_LHW_SCAN_BITS);
5020 
5021 	/*
5022 	 * This will call ic_scan_start() and we will get into the right path
5023 	 * unless other scans started in between.
5024 	 */
5025 	ieee80211_start_scan(vap,
5026 	    IEEE80211_SCAN_ONCE,
5027 	    msecs_to_ticks(10000), /* 10000 ms (=~ 50 chan * 200 ms) */
5028 	    ss->ss_mindwell ? ss->ss_mindwell : msecs_to_ticks(20),
5029 	    ss->ss_maxdwell ? ss->ss_maxdwell : msecs_to_ticks(200),
5030 	    vap->iv_des_nssid, vap->iv_des_ssid);
5031 }
5032 
5033 static void
5034 lkpi_ic_scan_end(struct ieee80211com *ic)
5035 {
5036 	struct lkpi_hw *lhw;
5037 	bool is_hw_scan;
5038 
5039 	lhw = ic->ic_softc;
5040 	TRACE_SCAN(ic, "scan_flags %b", lhw->scan_flags, LKPI_LHW_SCAN_BITS);
5041 
5042 	LKPI_80211_LHW_SCAN_LOCK(lhw);
5043 	if ((lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) == 0) {
5044 		LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5045 		return;
5046 	}
5047 	is_hw_scan = (lhw->scan_flags & LKPI_LHW_SCAN_HW) != 0;
5048 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5049 
5050 	if (!is_hw_scan) {
5051 		struct ieee80211_scan_state *ss;
5052 		struct ieee80211vap *vap;
5053 		struct ieee80211_hw *hw;
5054 		struct lkpi_vif *lvif;
5055 		struct ieee80211_vif *vif;
5056 
5057 		ss = ic->ic_scan;
5058 		vap = ss->ss_vap;
5059 		hw = LHW_TO_HW(lhw);
5060 		lvif = VAP_TO_LVIF(vap);
5061 		vif = LVIF_TO_VIF(lvif);
5062 
5063 		lkpi_80211_mo_sw_scan_complete(hw, vif);
5064 
5065 		/* Send PS to stop buffering if n80211 does not for us? */
5066 
5067 		if (vap->iv_state == IEEE80211_S_SCAN)
5068 			lkpi_hw_conf_idle(hw, true);
5069 	}
5070 
5071 	/*
5072 	 * In case we disabled the hw_scan in lkpi_ic_scan_start() and
5073 	 * switched to swscan, re-enable hw_scan if available.
5074 	 */
5075 	lkpi_enable_hw_scan(lhw);
5076 
5077 	/* Clear the scanning chandef. */
5078 	memset(&lhw->scan_chandef, 0, sizeof(lhw->scan_chandef));
5079 
5080 	LKPI_80211_LHW_SCAN_LOCK(lhw);
5081 	wakeup(lhw);
5082 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5083 }
5084 
5085 static void
5086 lkpi_ic_scan_curchan(struct ieee80211_scan_state *ss,
5087     unsigned long maxdwell)
5088 {
5089 	struct lkpi_hw *lhw;
5090 	bool is_hw_scan;
5091 
5092 	lhw = ss->ss_ic->ic_softc;
5093 	TRACE_SCAN(ss->ss_ic, "scan_flags %b chan %d maxdwell %lu",
5094 	    lhw->scan_flags, LKPI_LHW_SCAN_BITS,
5095 	    ss->ss_ic->ic_curchan->ic_ieee, maxdwell);
5096 
5097 	LKPI_80211_LHW_SCAN_LOCK(lhw);
5098 	is_hw_scan = (lhw->scan_flags & LKPI_LHW_SCAN_HW) != 0;
5099 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5100 	if (!is_hw_scan)
5101 		lhw->ic_scan_curchan(ss, maxdwell);
5102 }
5103 
5104 static void
5105 lkpi_ic_scan_mindwell(struct ieee80211_scan_state *ss)
5106 {
5107 	struct lkpi_hw *lhw;
5108 	bool is_hw_scan;
5109 
5110 	lhw = ss->ss_ic->ic_softc;
5111 	TRACE_SCAN(ss->ss_ic, "scan_flags %b chan %d mindwell %lu",
5112 	    lhw->scan_flags, LKPI_LHW_SCAN_BITS,
5113 	    ss->ss_ic->ic_curchan->ic_ieee, ss->ss_mindwell);
5114 
5115 	LKPI_80211_LHW_SCAN_LOCK(lhw);
5116 	is_hw_scan = (lhw->scan_flags & LKPI_LHW_SCAN_HW) != 0;
5117 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5118 	if (!is_hw_scan)
5119 		lhw->ic_scan_mindwell(ss);
5120 }
5121 
5122 struct lkpi_ic_set_channel_iter_arg {
5123 	struct linuxkpi_ieee80211_channel *chan;
5124 	struct ieee80211_chanctx_conf *chanctx_conf;
5125 };
5126 
5127 static void
5128 lkpi_ic_set_channel_chanctx_iterf(struct ieee80211_hw *hw,
5129     struct ieee80211_chanctx_conf *chanctx_conf, void *arg)
5130 {
5131 	struct lkpi_ic_set_channel_iter_arg *chanctx_iter_arg;
5132 
5133 	chanctx_iter_arg = arg;
5134 	if (chanctx_iter_arg->chanctx_conf != NULL)
5135 		return;
5136 
5137 	if (chanctx_iter_arg->chan == chanctx_conf->def.chan)
5138 		chanctx_iter_arg->chanctx_conf = chanctx_conf;
5139 }
5140 
5141 static void
5142 lkpi_ic_set_channel(struct ieee80211com *ic)
5143 {
5144 	struct lkpi_hw *lhw;
5145 	struct ieee80211_hw *hw;
5146 	struct ieee80211_channel *c;
5147 	struct linuxkpi_ieee80211_channel *chan;
5148 	struct ieee80211_chanctx_conf *chanctx_conf;
5149 	uint32_t changed;
5150 	int error;
5151 	bool hw_scan, scan_running;
5152 
5153 	IEEE80211_UNLOCK_ASSERT(ic);
5154 
5155 	lhw = ic->ic_softc;
5156 
5157 	c = ic->ic_curchan;
5158 	if (c == NULL || c == IEEE80211_CHAN_ANYC) {
5159 		ic_printf(ic, "%s: Unset channel: c %p, ignoring update\n",
5160 		    __func__, c);
5161 		return;
5162 	}
5163 
5164 	chan = lkpi_find_lkpi80211_chan(lhw, c);
5165 	if (chan == NULL) {
5166 		ic_printf(ic, "%s: No channel found for c %p(%d) chan %p\n",
5167 		    __func__, c, c->ic_ieee, chan);
5168 		return;
5169 	}
5170 
5171 	/*
5172 	 * All net80211 callers call ieee80211_radiotap_chan_change().
5173 	 * That means we have nothing to do ourselves.
5174 	 */
5175 
5176 	/* If we have a hw_scan running do not switch channels. */
5177 	LKPI_80211_LHW_SCAN_LOCK(lhw);
5178 	scan_running = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
5179 	hw_scan = (lhw->scan_flags & LKPI_LHW_SCAN_HW) != 0;
5180 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5181 	if (scan_running && hw_scan) {
5182 		TRACE_SCAN(ic, "scan_flags %b chan %d nothing to do.",
5183 		    lhw->scan_flags, LKPI_LHW_SCAN_BITS,
5184 		    c->ic_ieee);
5185 		/* Let us hope we set tx power levels elsewhere. */
5186 		return;
5187 	}
5188 
5189 	hw = LHW_TO_HW(lhw);
5190 	wiphy_lock(hw->wiphy);
5191 	if (scan_running) {
5192 		struct ieee80211vap *vap;
5193 		struct lkpi_vif *lvif;
5194 		struct ieee80211_vif *vif;
5195 
5196 		/*
5197 		 * For now and for scanning just pick the first VIF.
5198 		 * net80211 will need to grow DBDC/link_id support
5199 		 * for us to find the vif/chanctx otherwise.
5200 		 */
5201 		vap = TAILQ_FIRST(&ic->ic_vaps);
5202 		lvif = VAP_TO_LVIF(vap);
5203 		vif = LVIF_TO_VIF(lvif);
5204 
5205 		/* We always set the chandef to no-HT for scanning. */
5206 		cfg80211_chandef_create(&lhw->scan_chandef, chan,
5207 		    NL80211_CHAN_NO_HT);
5208 
5209 		/*
5210 		 * This works for as long as we do not do BGSCANs; otherwise
5211 		 * it'll have to be offchan work.
5212 		 */
5213 		chanctx_conf = lkpi_get_chanctx_conf(hw, vif);
5214 		changed = lkpi_init_chanctx_conf(hw, &lhw->scan_chandef, chanctx_conf);
5215 		error = lkpi_set_chanctx_conf(hw, vif, chanctx_conf, changed, true);
5216 
5217 		TRACE_SCAN(ic, "scan_flags %b chan %d ???, error %d",
5218 		    lhw->scan_flags, LKPI_LHW_SCAN_BITS,
5219 		    c->ic_ieee, error);
5220 
5221 		IMPROVE("max power for scanning; TODO in lkpi_80211_update_chandef");
5222 
5223 	} else if (lhw->emulate_chanctx) {
5224 		/*
5225 		 * We do not set the channel here for normal chanctx operation.
5226 		 * That's just a setup to fail. scan_to_auth will setup all the
5227 		 * other neccessary options for this to work.
5228 		 */
5229 		struct lkpi_ic_set_channel_iter_arg chanctx_iter_arg = {
5230 			.chan		= chan,
5231 			.chanctx_conf	= NULL,
5232 		};
5233 		struct cfg80211_chan_def chandef;
5234 
5235 		lkpi_init_chandef(&chandef, chan, c, false);
5236 
5237 		ieee80211_iter_chan_contexts_mtx(hw,
5238 		    lkpi_ic_set_channel_chanctx_iterf, &chanctx_iter_arg);
5239 
5240 		if (chanctx_iter_arg.chanctx_conf == NULL) {
5241 			/* No chanctx found for this channel. */
5242 			struct ieee80211vap *vap;
5243 			struct lkpi_vif *lvif;
5244 			struct ieee80211_vif *vif;
5245 
5246 			/*
5247 			 * For now just pick the first VIF.
5248 			 * net80211 will need to grow DBDC/link_id support
5249 			 * for us to find the vif/chanctx otherwise.
5250 			 */
5251 			vap = TAILQ_FIRST(&ic->ic_vaps);
5252 			lvif = VAP_TO_LVIF(vap);
5253 			vif = LVIF_TO_VIF(lvif);
5254 
5255 			chanctx_conf = lkpi_get_chanctx_conf(hw, vif);
5256 			changed = lkpi_init_chanctx_conf(hw, &chandef, chanctx_conf);
5257 			IMPROVE("update HT, VHT, bw, ...");
5258 			error = lkpi_set_chanctx_conf(hw, vif, chanctx_conf, changed, true);
5259 
5260 		} else {
5261 			/*
5262 			 * We know we are on the same channel.
5263 			 * Do we really have to reset everything?
5264 			 */
5265 			IMPROVE("update HT, VHT, bw, ...");
5266 
5267 			chanctx_conf = chanctx_iter_arg.chanctx_conf;
5268 			changed = lkpi_init_chanctx_conf(hw, &chandef, chanctx_conf);
5269 			lkpi_80211_mo_change_chanctx(hw, chanctx_conf, changed);
5270 		}
5271 	}
5272 
5273 	/* Currently PS is hard coded off! Not sure it belongs here. */
5274 	IMPROVE("PS");
5275 	if (ieee80211_hw_check(hw, SUPPORTS_PS) &&
5276 	    (hw->conf.flags & IEEE80211_CONF_PS) != 0) {
5277 		hw->conf.flags &= ~IEEE80211_CONF_PS;
5278 		error = lkpi_80211_mo_config(hw, IEEE80211_CONF_CHANGE_PS);
5279 		if (error != 0 && error != EOPNOTSUPP)
5280 			ic_printf(ic, "ERROR: %s: config %#0x returned "
5281 			    "%d\n", __func__, IEEE80211_CONF_CHANGE_PS,
5282 			    error);
5283 	}
5284 
5285 	wiphy_unlock(hw->wiphy);
5286 }
5287 
5288 static struct ieee80211_node *
5289 lkpi_ic_node_alloc(struct ieee80211vap *vap,
5290     const uint8_t mac[IEEE80211_ADDR_LEN])
5291 {
5292 	struct ieee80211com *ic;
5293 	struct lkpi_hw *lhw;
5294 	struct ieee80211_node *ni;
5295 	struct ieee80211_hw *hw;
5296 	struct lkpi_sta *lsta;
5297 
5298 	ic = vap->iv_ic;
5299 	lhw = ic->ic_softc;
5300 
5301 	/* We keep allocations de-coupled so we can deal with the two worlds. */
5302 	if (lhw->ic_node_alloc == NULL)
5303 		return (NULL);
5304 
5305 	ni = lhw->ic_node_alloc(vap, mac);
5306 	if (ni == NULL)
5307 		return (NULL);
5308 
5309 	hw = LHW_TO_HW(lhw);
5310 	lsta = lkpi_lsta_alloc(vap, mac, hw, ni);
5311 	if (lsta == NULL) {
5312 		if (lhw->ic_node_free != NULL)
5313 			lhw->ic_node_free(ni);
5314 		return (NULL);
5315 	}
5316 
5317 	return (ni);
5318 }
5319 
5320 static int
5321 lkpi_ic_node_init(struct ieee80211_node *ni)
5322 {
5323 	struct ieee80211com *ic;
5324 	struct lkpi_hw *lhw;
5325 	int error;
5326 
5327 	ic = ni->ni_ic;
5328 	lhw = ic->ic_softc;
5329 
5330 	if (lhw->ic_node_init != NULL) {
5331 		error = lhw->ic_node_init(ni);
5332 		if (error != 0)
5333 			return (error);
5334 	}
5335 
5336 	/* XXX-BZ Sync other state over. */
5337 	IMPROVE();
5338 
5339 	return (0);
5340 }
5341 
5342 static void
5343 lkpi_ic_node_cleanup(struct ieee80211_node *ni)
5344 {
5345 	struct ieee80211com *ic;
5346 	struct lkpi_hw *lhw;
5347 
5348 	ic = ni->ni_ic;
5349 	lhw = ic->ic_softc;
5350 
5351 	/* XXX-BZ remove from driver, ... */
5352 	IMPROVE();
5353 
5354 	if (lhw->ic_node_cleanup != NULL)
5355 		lhw->ic_node_cleanup(ni);
5356 }
5357 
5358 static void
5359 lkpi_ic_node_free(struct ieee80211_node *ni)
5360 {
5361 	struct ieee80211com *ic;
5362 	struct lkpi_hw *lhw;
5363 	struct lkpi_sta *lsta;
5364 
5365 	ic = ni->ni_ic;
5366 	lhw = ic->ic_softc;
5367 	lsta = ni->ni_drv_data;
5368 
5369 	/* KASSERT lsta is not NULL here. Print ni/ni__refcnt. */
5370 
5371 	/*
5372 	 * Pass in the original ni just in case of error we could check that
5373 	 * it is the same as lsta->ni.
5374 	 */
5375 	lkpi_lsta_free(lsta, ni);
5376 
5377 	if (lhw->ic_node_free != NULL)
5378 		lhw->ic_node_free(ni);
5379 }
5380 
5381 /*
5382  * lkpi_xmit() called from both the (*ic_raw_xmit) as well as the (*ic_transmit)
5383  * call path.
5384  * Unfortunately they have slightly different invariants.  See
5385  * ieee80211_raw_output() and ieee80211_parent_xmitpkt().
5386  * Both take care of the ni reference in case of error, and otherwise during
5387  * the callback after transmit.
5388  * The difference is that in case of error (*ic_raw_xmit) needs us to release
5389  * the mbuf, while (*ic_transmit) will free the mbuf itself.
5390  */
5391 static int
5392 lkpi_xmit(struct ieee80211_node *ni, struct mbuf *m,
5393     const struct ieee80211_bpf_params *params __unused,
5394     bool freem)
5395 {
5396 	struct lkpi_sta *lsta;
5397 	int error;
5398 
5399 	lsta = ni->ni_drv_data;
5400 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
5401 #if 0
5402 	if (!lsta->added_to_drv || !lsta->txq_ready) {
5403 #else
5404 	/*
5405 	 * Backout this part of 886653492945f which breaks rtw88 or
5406 	 * in general drivers without (*sta_state)() but only the
5407 	 * legacy fallback to (*sta_add)().
5408 	 */
5409 	if (!lsta->txq_ready) {
5410 #endif
5411 		LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
5412 		if (freem)
5413 			m_free(m);
5414 		return (ENETDOWN);
5415 	}
5416 
5417 	/* Queue the packet and enqueue the task to handle it. */
5418 	error = mbufq_enqueue(&lsta->txq, m);
5419 	if (error != 0) {
5420 		LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
5421 		if (freem)
5422 			m_free(m);
5423 #ifdef LINUXKPI_DEBUG_80211
5424 		if (linuxkpi_debug_80211 & D80211_TRACE_TX)
5425 			ic_printf(ni->ni_ic, "%s: mbufq_enqueue failed: %d\n",
5426 			    __func__, error);
5427 #endif
5428 		return (ENETDOWN);
5429 	}
5430 	taskqueue_enqueue(taskqueue_thread, &lsta->txq_task);
5431 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
5432 
5433 #ifdef LINUXKPI_DEBUG_80211
5434 	if (linuxkpi_debug_80211 & D80211_TRACE_TX)
5435 		printf("%s:%d lsta %p ni %p %6D mbuf_qlen %d\n",
5436 		    __func__, __LINE__, lsta, ni, ni->ni_macaddr, ":",
5437 		    mbufq_len(&lsta->txq));
5438 #endif
5439 
5440 	return (0);
5441 }
5442 
5443 static int
5444 lkpi_ic_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
5445         const struct ieee80211_bpf_params *params __unused)
5446 {
5447 	return (lkpi_xmit(ni, m, NULL, true));
5448 }
5449 
5450 #ifdef LKPI_80211_HW_CRYPTO
5451 /*
5452  * This is a bit of a hack given we know we are operating on a
5453  * single frame and we know that hardware will deal with it.
5454  * But otherwise the enmic bit and the encrypt bit need to be
5455  * decoupled.
5456  */
5457 static int
5458 lkpi_hw_crypto_prepare_tkip(struct ieee80211_key *k,
5459     struct ieee80211_key_conf *kc, struct sk_buff *skb)
5460 {
5461 	struct ieee80211_hdr *hdr;
5462 	uint32_t hlen, hdrlen;
5463 	uint8_t *p;
5464 
5465 	/*
5466 	 * TKIP only happens on data.
5467 	 */
5468 	hdr = (void *)skb->data;
5469 	if (!ieee80211_is_data_present(hdr->frame_control))
5470 		return (0);
5471 
5472 	/*
5473 	 * "enmic" (though we do not do that).
5474 	 */
5475 	/* any conditions to not apply this? */
5476 	if (skb_tailroom(skb) < k->wk_cipher->ic_miclen)
5477 		return (ENOBUFS);
5478 
5479 	p = skb_put(skb, k->wk_cipher->ic_miclen);
5480 	if ((kc->flags & IEEE80211_KEY_FLAG_PUT_MIC_SPACE) != 0)
5481 		goto encrypt;
5482 
5483 	/*
5484 	 * (*enmic) which we hopefully do not have to do with hw accel.
5485 	 * That means if we make it here we have a problem.
5486 	 */
5487 	TODO("(*enmic)");
5488 	return (ENXIO);
5489 
5490 encrypt:
5491 	/*
5492 	 * "encrypt" (though we do not do that).
5493 	 */
5494 	/*
5495 	 * Check if we have anything to do as requested by driver
5496 	 * or if we are done?
5497 	 */
5498 	if ((kc->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) == 0 &&
5499 	    (kc->flags & IEEE80211_KEY_FLAG_GENERATE_IV) == 0)
5500 			return (0);
5501 
5502 	hlen = k->wk_cipher->ic_header;
5503 	if (skb_headroom(skb) < hlen)
5504 		return (ENOBUFS);
5505 
5506 	hdr = (void *)skb->data;
5507 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
5508 	p = skb_push(skb, hlen);
5509 	memmove(p, p + hlen, hdrlen);
5510 
5511 	/* If driver request space only we are done. */
5512 	if ((kc->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) != 0)
5513 		return (0);
5514 
5515 	p += hdrlen;
5516 	k->wk_cipher->ic_setiv(k, p);
5517 
5518 	/* If we make it hear we do sw encryption. */
5519 	TODO("sw encrypt");
5520 	return (ENXIO);
5521 }
5522 
5523 static int
5524 lkpi_hw_crypto_prepare_ccmp(struct ieee80211_key *k,
5525     struct ieee80211_key_conf *kc, struct sk_buff *skb)
5526 {
5527 	struct ieee80211_hdr *hdr;
5528 	uint32_t hlen, hdrlen;
5529 	uint8_t *p;
5530 
5531 	hdr = (void *)skb->data;
5532 
5533 	/*
5534 	 * Check if we have anythig to do as requested by driver
5535 	 * or if we are done?
5536 	 */
5537 	if ((kc->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) == 0 &&
5538 	    (kc->flags & IEEE80211_KEY_FLAG_GENERATE_IV) == 0 &&
5539 	    /* MFP */
5540 	    !((kc->flags & IEEE80211_KEY_FLAG_GENERATE_IV_MGMT) != 0 &&
5541 		ieee80211_is_mgmt(hdr->frame_control)))
5542 			return (0);
5543 
5544 	hlen = k->wk_cipher->ic_header;
5545 	if (skb_headroom(skb) < hlen)
5546 		return (ENOBUFS);
5547 
5548 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
5549 	p = skb_push(skb, hlen);
5550 	memmove(p, p + hlen, hdrlen);
5551 
5552 	/* If driver request space only we are done. */
5553 	if ((kc->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) != 0)
5554 		return (0);
5555 
5556 	p += hdrlen;
5557 	k->wk_cipher->ic_setiv(k, p);
5558 
5559 	return (0);
5560 }
5561 
5562 static int
5563 lkpi_hw_crypto_prepare(struct lkpi_sta *lsta, struct ieee80211_key *k,
5564     struct sk_buff *skb)
5565 {
5566 	struct ieee80211_tx_info *info;
5567 	struct ieee80211_key_conf *kc;
5568 
5569 	KASSERT(lsta != NULL, ("%s: lsta is NULL", __func__));
5570 	KASSERT(k != NULL, ("%s: key is NULL", __func__));
5571 	KASSERT(skb != NULL, ("%s: skb is NULL", __func__));
5572 
5573 	kc = lsta->kc[k->wk_keyix];
5574 
5575 	info = IEEE80211_SKB_CB(skb);
5576 	info->control.hw_key = kc;
5577 
5578 	/* MUST NOT happen. KASSERT? */
5579 	if (kc == NULL) {
5580 		ic_printf(lsta->ni->ni_ic, "%s: lsta %p k %p skb %p, "
5581 		    "kc is NULL on hw crypto offload\n", __func__, lsta, k, skb);
5582 		return (ENXIO);
5583 	}
5584 
5585 	switch (kc->cipher) {
5586 	case WLAN_CIPHER_SUITE_TKIP:
5587 		return (lkpi_hw_crypto_prepare_tkip(k, kc, skb));
5588 	case WLAN_CIPHER_SUITE_CCMP:
5589 		return (lkpi_hw_crypto_prepare_ccmp(k, kc, skb));
5590 	case WLAN_CIPHER_SUITE_GCMP:
5591 		return (lkpi_hw_crypto_prepare_ccmp(k, kc, skb));
5592 	case WLAN_CIPHER_SUITE_WEP40:
5593 	case WLAN_CIPHER_SUITE_WEP104:
5594 	case WLAN_CIPHER_SUITE_CCMP_256:
5595 	case WLAN_CIPHER_SUITE_GCMP_256:
5596 	case WLAN_CIPHER_SUITE_AES_CMAC:
5597 	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
5598 	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
5599 	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
5600 	default:
5601 		ic_printf(lsta->ni->ni_ic, "%s: lsta %p k %p kc %p skb %p, "
5602 		    "unsupported cipher suite %u (%s)\n", __func__, lsta, k, kc,
5603 		    skb, kc->cipher, lkpi_cipher_suite_to_name(kc->cipher));
5604 		return (EOPNOTSUPP);
5605 	}
5606 }
5607 
5608 static uint8_t
5609 lkpi_hw_crypto_tailroom(struct lkpi_sta *lsta, struct ieee80211_key *k)
5610 {
5611 	struct ieee80211_key_conf *kc;
5612 
5613 	kc = lsta->kc[k->wk_keyix];
5614 	if (kc == NULL)
5615 		return (0);
5616 
5617 	IMPROVE("which other flags need tailroom?");
5618 	if (kc->flags & (IEEE80211_KEY_FLAG_PUT_MIC_SPACE))
5619 		return (32);	/* Large enough to hold everything and pow2. */
5620 
5621 	return (0);
5622 }
5623 #endif
5624 
5625 static void
5626 lkpi_80211_txq_tx_one(struct lkpi_sta *lsta, struct mbuf *m)
5627 {
5628 	struct ieee80211_node *ni;
5629 	struct ieee80211_frame *wh;
5630 	struct ieee80211_key *k;
5631 	struct sk_buff *skb;
5632 	struct ieee80211com *ic;
5633 	struct lkpi_hw *lhw;
5634 	struct ieee80211_hw *hw;
5635 	struct lkpi_vif *lvif;
5636 	struct ieee80211_vif *vif;
5637 	struct ieee80211_channel *c;
5638 	struct ieee80211_tx_control control;
5639 	struct ieee80211_tx_info *info;
5640 	struct ieee80211_sta *sta;
5641 	struct ieee80211_hdr *hdr;
5642 	struct lkpi_txq *ltxq;
5643 	void *buf;
5644 	ieee80211_keyix keyix;
5645 	uint8_t ac, tid, tailroom;
5646 
5647 	M_ASSERTPKTHDR(m);
5648 #ifdef LINUXKPI_DEBUG_80211
5649 	if (linuxkpi_debug_80211 & D80211_TRACE_TX_DUMP)
5650 		hexdump(mtod(m, const void *), m->m_len, "RAW TX (plain) ", 0);
5651 #endif
5652 
5653 	ni = lsta->ni;
5654 	ieee80211_output_seqno_assign(ni, -1, m);
5655 
5656 	k = NULL;
5657 	keyix = IEEE80211_KEYIX_NONE;
5658 	wh = mtod(m, struct ieee80211_frame *);
5659 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
5660 
5661 #ifdef LKPI_80211_HW_CRYPTO
5662 		if (lkpi_hwcrypto) {
5663 			k = ieee80211_crypto_get_txkey(ni, m);
5664 			if (k != NULL && lsta->kc[k->wk_keyix] != NULL)
5665 				keyix = k->wk_keyix;
5666 		}
5667 #endif
5668 
5669 		/* Encrypt the frame if need be. */
5670 		if (keyix == IEEE80211_KEYIX_NONE) {
5671 			/* Retrieve key for TX && do software encryption. */
5672 			k = ieee80211_crypto_encap(ni, m);
5673 			if (k == NULL) {
5674 				ieee80211_free_node(ni);
5675 				m_freem(m);
5676 				return;
5677 			}
5678 		}
5679 	}
5680 
5681 	ic = ni->ni_ic;
5682 	lhw = ic->ic_softc;
5683 	hw = LHW_TO_HW(lhw);
5684 	c = ni->ni_chan;
5685 
5686 	if (ieee80211_radiotap_active_vap(ni->ni_vap)) {
5687 		struct lkpi_radiotap_tx_hdr *rtap;
5688 
5689 		rtap = &lhw->rtap_tx;
5690 		rtap->wt_flags = 0;
5691 		if (k != NULL)
5692 			rtap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
5693 		if (m->m_flags & M_FRAG)
5694 			rtap->wt_flags |= IEEE80211_RADIOTAP_F_FRAG;
5695 		IMPROVE();
5696 		rtap->wt_rate = 0;
5697 		if (c != NULL && c != IEEE80211_CHAN_ANYC) {
5698 			rtap->wt_chan_freq = htole16(c->ic_freq);
5699 			rtap->wt_chan_flags = htole16(c->ic_flags);
5700 		}
5701 
5702 		ieee80211_radiotap_tx(ni->ni_vap, m);
5703 	}
5704 
5705 #ifdef LKPI_80211_HW_CRYPTO
5706 	if (lkpi_hwcrypto && keyix != IEEE80211_KEYIX_NONE)
5707 		tailroom = lkpi_hw_crypto_tailroom(lsta, k);
5708 	else
5709 #endif
5710 		tailroom = 0;
5711 
5712 	/*
5713 	 * net80211 should handle hw->extra_tx_headroom.
5714 	 * Though for as long as we are copying we don't mind.
5715 	 * XXX-BZ rtw88 asks for too much headroom for ipv6+tcp:
5716 	 * https://lists.freebsd.org/archives/freebsd-transport/2022-February/000012.html
5717 	 */
5718 	skb = dev_alloc_skb(hw->extra_tx_headroom + tailroom + m->m_pkthdr.len);
5719 	if (skb == NULL) {
5720 		static uint8_t skb_alloc_failures = 0;
5721 
5722 		if (skb_alloc_failures++ == 0) {
5723 			int tid;
5724 
5725 			sta = LSTA_TO_STA(lsta);
5726 			ic_printf(ic, "ERROR %s: skb alloc failed %d + %d, lsta %p sta %p ni %p\n",
5727 			    __func__, hw->extra_tx_headroom, m->m_pkthdr.len, lsta, sta, ni);
5728 			for (tid = 0; tid < nitems(sta->txq); tid++) {
5729 				if (sta->txq[tid] == NULL)
5730 					continue;
5731 				ltxq = TXQ_TO_LTXQ(sta->txq[tid]);
5732 				ic_printf(ic, "  tid %d ltxq %p seen_dequeue %d stopped %d skb_queue_len %u\n",
5733 				    tid, ltxq, ltxq->seen_dequeue, ltxq->stopped, skb_queue_len(&ltxq->skbq));
5734 			}
5735 		}
5736 		ieee80211_free_node(ni);
5737 		m_freem(m);
5738 		return;
5739 	}
5740 	skb_reserve(skb, hw->extra_tx_headroom);
5741 
5742 	/* XXX-BZ we need a SKB version understanding mbuf. */
5743 	/* Save the mbuf for ieee80211_tx_complete(). */
5744 	skb->m_free_func = lkpi_ieee80211_free_skb_mbuf;
5745 	skb->m = m;
5746 #if 0
5747 	skb_put_data(skb, m->m_data, m->m_pkthdr.len);
5748 #else
5749 	buf = skb_put(skb, m->m_pkthdr.len);
5750 	m_copydata(m, 0, m->m_pkthdr.len, buf);
5751 #endif
5752 	/* Save the ni. */
5753 	m->m_pkthdr.PH_loc.ptr = ni;
5754 
5755 	lvif = VAP_TO_LVIF(ni->ni_vap);
5756 	vif = LVIF_TO_VIF(lvif);
5757 
5758 	hdr = (void *)skb->data;
5759 	tid = linuxkpi_ieee80211_get_tid(hdr, true);
5760 	if (tid == IEEE80211_NONQOS_TID) { /* == IEEE80211_NUM_TIDS */
5761 		if (!ieee80211_is_data(hdr->frame_control)) {
5762 			/* MGMT and CTRL frames go on TID 7/VO. */
5763 			skb->priority = 7;
5764 			ac = IEEE80211_AC_VO;
5765 		} else {
5766 			/* Other non-QOS traffic goes to BE. */
5767 			/* Contrary to net80211 we MUST NOT promote M_EAPOL. */
5768 			skb->priority = 0;
5769 			ac = IEEE80211_AC_BE;
5770 		}
5771 	} else {
5772 		skb->priority = tid & IEEE80211_QOS_CTL_TID_MASK;
5773 		ac = ieee80211e_up_to_ac[tid & 7];
5774 	}
5775 	skb_set_queue_mapping(skb, ac);
5776 
5777 	info = IEEE80211_SKB_CB(skb);
5778 	info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
5779 	/* Slight delay; probably only happens on scanning so fine? */
5780 	if (c == NULL || c == IEEE80211_CHAN_ANYC)
5781 		c = ic->ic_curchan;
5782 	info->band = lkpi_net80211_chan_to_nl80211_band(c);
5783 	info->hw_queue = vif->hw_queue[ac];
5784 	if ((m->m_flags & M_EAPOL) != 0) {
5785 		info->control.flags |= IEEE80211_TX_CTRL_PORT_CTRL_PROTO;
5786 		info->flags |= IEEE80211_TX_CTL_USE_MINRATE;	/* mt76 */
5787 	}
5788 	info->control.vif = vif;
5789 	/* XXX-BZ info->control.rates */
5790 #ifdef __notyet__
5791 #ifdef LKPI_80211_HT
5792 	info->control.rts_cts_rate_idx=
5793 	info->control.use_rts= /* RTS */
5794 	info->control.use_cts_prot= /* RTS/CTS*/
5795 #endif
5796 #endif
5797 
5798 	sta = LSTA_TO_STA(lsta);
5799 #ifdef LKPI_80211_HW_CRYPTO
5800 	if (lkpi_hwcrypto && keyix != IEEE80211_KEYIX_NONE) {
5801 		int error;
5802 
5803 		error = lkpi_hw_crypto_prepare(lsta, k, skb);
5804 		if (error != 0) {
5805 			/*
5806 			 * We only have to free the skb which will free the
5807 			 * mbuf and release the reference on the ni.
5808 			 */
5809 			dev_kfree_skb(skb);
5810 			return;
5811 		}
5812 		/* Reset header as data might have moved. */
5813 		hdr = (void *)skb->data;
5814 	}
5815 #endif
5816 
5817 	IMPROVE();
5818 
5819 	ltxq = NULL;
5820 	if (!ieee80211_is_data_present(hdr->frame_control)) {
5821 		if (vif->type == NL80211_IFTYPE_STATION &&
5822 		    lsta->added_to_drv &&
5823 		    sta->txq[IEEE80211_NUM_TIDS] != NULL)
5824 			ltxq = TXQ_TO_LTXQ(sta->txq[IEEE80211_NUM_TIDS]);
5825 	} else if (lsta->added_to_drv &&
5826 	    sta->txq[skb->priority] != NULL) {
5827 		ltxq = TXQ_TO_LTXQ(sta->txq[skb->priority]);
5828 	}
5829 	if (ltxq == NULL)
5830 		goto ops_tx;
5831 
5832 	KASSERT(ltxq != NULL, ("%s: lsta %p sta %p m %p skb %p "
5833 	    "ltxq %p != NULL\n", __func__, lsta, sta, m, skb, ltxq));
5834 
5835 	LKPI_80211_LTXQ_LOCK(ltxq);
5836 	skb_queue_tail(&ltxq->skbq, skb);
5837 	ltxq->frms_enqueued++;
5838 #ifdef LINUXKPI_DEBUG_80211
5839 	if (linuxkpi_debug_80211 & D80211_TRACE_TX)
5840 		printf("%s:%d mo_wake_tx_queue :: %d %lu lsta %p sta %p "
5841 		    "ni %p %6D skb %p lxtq %p { qlen %u, ac %d tid %u } "
5842 		    "WAKE_TX_Q ac %d prio %u qmap %u\n",
5843 		    __func__, __LINE__,
5844 		    curthread->td_tid, jiffies,
5845 		    lsta, sta, ni, ni->ni_macaddr, ":", skb, ltxq,
5846 		    skb_queue_len(&ltxq->skbq), ltxq->txq.ac,
5847 		    ltxq->txq.tid, ac, skb->priority, skb->qmap);
5848 #endif
5849 	LKPI_80211_LTXQ_UNLOCK(ltxq);
5850 	wiphy_lock(hw->wiphy);
5851 	lkpi_80211_mo_wake_tx_queue(hw, &ltxq->txq, true);
5852 	wiphy_unlock(hw->wiphy);
5853 	return;
5854 
5855 ops_tx:
5856 #ifdef LINUXKPI_DEBUG_80211
5857 	if (linuxkpi_debug_80211 & D80211_TRACE_TX)
5858 		printf("%s:%d mo_tx :: lsta %p sta %p ni %p %6D skb %p "
5859 		    "TX ac %d prio %u qmap %u\n",
5860 		    __func__, __LINE__, lsta, sta, ni, ni->ni_macaddr, ":",
5861 		    skb, ac, skb->priority, skb->qmap);
5862 #endif
5863 	memset(&control, 0, sizeof(control));
5864 	control.sta = sta;
5865 	wiphy_lock(hw->wiphy);
5866 	lkpi_80211_mo_tx(hw, &control, skb);
5867 	lsta->frms_tx++;
5868 	wiphy_unlock(hw->wiphy);
5869 }
5870 
5871 static void
5872 lkpi_80211_txq_task(void *ctx, int pending)
5873 {
5874 	struct lkpi_sta *lsta;
5875 	struct mbufq mq;
5876 	struct mbuf *m;
5877 	bool shall_tx;
5878 
5879 	lsta = ctx;
5880 
5881 #ifdef LINUXKPI_DEBUG_80211
5882 	if (linuxkpi_debug_80211 & D80211_TRACE_TX)
5883 		printf("%s:%d lsta %p ni %p %6D pending %d mbuf_qlen %d\n",
5884 		    __func__, __LINE__, lsta, lsta->ni, lsta->ni->ni_macaddr, ":",
5885 		    pending, mbufq_len(&lsta->txq));
5886 #endif
5887 
5888 	mbufq_init(&mq, IFQ_MAXLEN);
5889 
5890 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
5891 	/*
5892 	 * Do not re-check lsta->txq_ready here; we may have a pending
5893 	 * disassoc/deauth frame still.  On the contrary if txq_ready is
5894 	 * false we do not have a valid sta anymore in the firmware so no
5895 	 * point to try to TX.
5896 	 * We also use txq_ready as a semaphore and will drain the txq manually
5897 	 * if needed on our way towards SCAN/INIT in the state machine.
5898 	 */
5899 #if 0
5900 	shall_tx = lsta->added_to_drv && lsta->txq_ready;
5901 #else
5902 	/*
5903 	 * Backout this part of 886653492945f which breaks rtw88 or
5904 	 * in general drivers without (*sta_state)() but only the
5905 	 * legacy fallback to (*sta_add)().
5906 	 */
5907 	shall_tx = lsta->txq_ready;
5908 #endif
5909 	if (__predict_true(shall_tx))
5910 		mbufq_concat(&mq, &lsta->txq);
5911 	/*
5912 	 * else a state change will push the packets out manually or
5913 	 * lkpi_lsta_free() will drain the lsta->txq and free the mbufs.
5914 	 */
5915 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
5916 
5917 	m = mbufq_dequeue(&mq);
5918 	while (m != NULL) {
5919 		lkpi_80211_txq_tx_one(lsta, m);
5920 		m = mbufq_dequeue(&mq);
5921 	}
5922 }
5923 
5924 static int
5925 lkpi_ic_transmit(struct ieee80211com *ic, struct mbuf *m)
5926 {
5927 
5928 	/* XXX TODO */
5929 	IMPROVE();
5930 
5931 	/* Quick and dirty cheating hack. */
5932 	struct ieee80211_node *ni;
5933 
5934 	ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
5935 	return (lkpi_xmit(ni, m, NULL, false));
5936 }
5937 
5938 #ifdef LKPI_80211_HT
5939 static int
5940 lkpi_ic_recv_action(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
5941     const uint8_t *frm, const uint8_t *efrm)
5942 {
5943 	struct ieee80211com *ic;
5944 	struct lkpi_hw *lhw;
5945 
5946 	ic = ni->ni_ic;
5947 	lhw = ic->ic_softc;
5948 
5949 	IMPROVE_HT("recv_action called; nothing to do in lkpi; make debugging");
5950 
5951 	return (lhw->ic_recv_action(ni, wh, frm, efrm));
5952 }
5953 
5954 static int
5955 lkpi_ic_send_action(struct ieee80211_node *ni, int category, int action, void *sa)
5956 {
5957 	struct ieee80211com *ic;
5958 	struct lkpi_hw *lhw;
5959 
5960 	ic = ni->ni_ic;
5961 	lhw = ic->ic_softc;
5962 
5963 	IMPROVE_HT("send_action called; nothing to do in lkpi; make debugging");
5964 
5965 	return (lhw->ic_send_action(ni, category, action, sa));
5966 }
5967 
5968 
5969 static int
5970 lkpi_ic_ampdu_enable(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
5971 {
5972 	struct ieee80211com *ic;
5973 	struct lkpi_hw *lhw;
5974 
5975 	ic = ni->ni_ic;
5976 	lhw = ic->ic_softc;
5977 
5978 	IMPROVE_HT("ieee80211_ampdu_enable called; nothing to do in lkpi for now; make debugging");
5979 
5980 	return (lhw->ic_ampdu_enable(ni, tap));
5981 }
5982 
5983 /*
5984  * (*ic_addba_request)() is called by ieee80211_ampdu_request() before
5985  * calling send_action(CAT_BA, BA_ADDBA_REQUEST).
5986  *
5987  * NB: returns 0 on ERROR!
5988  */
5989 static int
5990 lkpi_ic_addba_request(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap,
5991     int dialogtoken, int baparamset, int batimeout)
5992 {
5993 	struct ieee80211com *ic;
5994 	struct lkpi_hw *lhw;
5995 	struct ieee80211_hw *hw;
5996 	struct ieee80211vap *vap;
5997 	struct lkpi_vif *lvif;
5998 	struct ieee80211_vif *vif;
5999 	struct lkpi_sta *lsta;
6000 	struct ieee80211_sta *sta;
6001 	struct ieee80211_ampdu_params params = { };
6002 	int error;
6003 
6004 	ic = ni->ni_ic;
6005 	lhw = ic->ic_softc;
6006 	hw = LHW_TO_HW(lhw);
6007 	vap = ni->ni_vap;
6008 	lvif = VAP_TO_LVIF(vap);
6009 	vif = LVIF_TO_VIF(lvif);
6010 	lsta = ni->ni_drv_data;
6011 	sta = LSTA_TO_STA(lsta);
6012 
6013 	if (!lsta->added_to_drv) {
6014 		ic_printf(ic, "%s: lsta %p ni %p, sta %p not added to firmware\n",
6015 		    __func__, lsta, ni, sta);
6016 		return (0);
6017 	}
6018 
6019 	params.sta = sta;
6020 	params.action = IEEE80211_AMPDU_TX_START;
6021 	/* Keep 0 here! */
6022 	params.buf_size = 0;
6023 	params.timeout = 0;
6024 	params.ssn = tap->txa_start & (IEEE80211_SEQ_RANGE-1);
6025 	params.tid = tap->txa_tid;
6026 	params.amsdu = false;
6027 
6028 	IEEE80211_UNLOCK(ic);
6029 	wiphy_lock(hw->wiphy);
6030 	error = lkpi_80211_mo_ampdu_action(hw, vif, &params);
6031 	wiphy_unlock(hw->wiphy);
6032 	IEEE80211_LOCK(ic);
6033 	if (error != 0) {
6034 		ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p tap %p\n",
6035 		    __func__, error, ni, tap);
6036 		return (0);
6037 	}
6038 
6039 	return (lhw->ic_addba_request(ni, tap, dialogtoken, baparamset, batimeout));
6040 }
6041 
6042 /*
6043  * (*ic_addba_response)() is called from ht_recv_action_ba_addba_response()
6044  * and calls the default ieee80211_addba_response() which always returns 1.
6045  *
6046  * NB: No error checking in net80211!
6047  * Staying with 0 is an error.
6048  */
6049 static int
6050 lkpi_ic_addba_response(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap,
6051     int status, int baparamset, int batimeout)
6052 {
6053 	struct ieee80211com *ic;
6054 	struct lkpi_hw *lhw;
6055 	struct ieee80211_hw *hw;
6056 	struct ieee80211vap *vap;
6057 	struct lkpi_vif *lvif;
6058 	struct ieee80211_vif *vif;
6059 	struct lkpi_sta *lsta;
6060 	struct ieee80211_sta *sta;
6061 	struct ieee80211_ampdu_params params = { };
6062 	int error;
6063 
6064 	ic = ni->ni_ic;
6065 	lhw = ic->ic_softc;
6066 	hw = LHW_TO_HW(lhw);
6067 	vap = ni->ni_vap;
6068 	lvif = VAP_TO_LVIF(vap);
6069 	vif = LVIF_TO_VIF(lvif);
6070 	lsta = ni->ni_drv_data;
6071 	sta = LSTA_TO_STA(lsta);
6072 
6073 	if (!lsta->added_to_drv) {
6074 		ic_printf(ic, "%s: lsta %p ni %p, sta %p not added to firmware\n",
6075 		    __func__, lsta, ni, sta);
6076 		return (0);
6077 	}
6078 
6079 	if (status == IEEE80211_STATUS_SUCCESS) {
6080 		params.sta = sta;
6081 		params.action = IEEE80211_AMPDU_TX_OPERATIONAL;
6082 		params.buf_size = tap->txa_wnd;
6083 		params.timeout = 0;
6084 		params.ssn = 0;
6085 		params.tid = tap->txa_tid;
6086 		if ((tap->txa_flags & IEEE80211_AGGR_AMSDU) != 0)
6087 			params.amsdu = true;
6088 		else
6089 			params.amsdu = false;
6090 	} else {
6091 		/* We need to free the allocated resources. */
6092 		params.sta = sta;
6093 		switch (status) {
6094 			/* params.action = FLUSH, FLUSH_CONT */
6095 		default:
6096 			params.action = IEEE80211_AMPDU_TX_STOP_CONT;
6097 			break;
6098 		}
6099 		params.buf_size = 0;
6100 		params.timeout = 0;
6101 		params.ssn = 0;
6102 		params.tid = tap->txa_tid;
6103 		params.amsdu = false;
6104 	}
6105 
6106 	IEEE80211_UNLOCK(ic);
6107 	wiphy_lock(hw->wiphy);
6108 	error = lkpi_80211_mo_ampdu_action(hw, vif, &params);
6109 	wiphy_unlock(hw->wiphy);
6110 	IEEE80211_LOCK(ic);
6111 	if (error != 0) {
6112 		ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p tap %p\n",
6113 		    __func__, error, ni, tap);
6114 		return (0);
6115 	}
6116 
6117 	IMPROVE_HT("who unleashes the TXQ? and when?, do we need to ni->ni_txseqs[tid] = tap->txa_start & 0xfff;");
6118 
6119 	return (lhw->ic_addba_response(ni, tap, status, baparamset, batimeout));
6120 }
6121 
6122 /*
6123  * (*ic_addba_stop)() is called from ampdu_tx_stop(), ht_recv_action_ba_delba(),
6124  * and ieee80211_ampdu_stop() and calls the default ieee80211_addba_stop().
6125  */
6126 static void
6127 lkpi_ic_addba_stop(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
6128 {
6129 	struct ieee80211com *ic;
6130 	struct lkpi_hw *lhw;
6131 	struct ieee80211_hw *hw;
6132 	struct ieee80211vap *vap;
6133 	struct lkpi_vif *lvif;
6134 	struct ieee80211_vif *vif;
6135 	struct lkpi_sta *lsta;
6136 	struct ieee80211_sta *sta;
6137 	struct ieee80211_ampdu_params params = { };
6138 	int error;
6139 
6140 	ic = ni->ni_ic;
6141 	lhw = ic->ic_softc;
6142 	hw = LHW_TO_HW(lhw);
6143 	vap = ni->ni_vap;
6144 	lvif = VAP_TO_LVIF(vap);
6145 	vif = LVIF_TO_VIF(lvif);
6146 	lsta = ni->ni_drv_data;
6147 	sta = LSTA_TO_STA(lsta);
6148 
6149 	if (!lsta->added_to_drv) {
6150 		ic_printf(ic, "%s: lsta %p ni %p, sta %p not added to firmware\n",
6151 		    __func__, lsta, ni, sta);
6152 		goto n80211;
6153 	}
6154 
6155 	/* We need to free the allocated resources. */
6156 	params.sta = sta;
6157 	IMPROVE("net80211 does not provide a reason to us");
6158 	params.action = IEEE80211_AMPDU_TX_STOP_CONT; /* params.action = FLUSH, FLUSH_CONT */
6159 	params.buf_size = 0;
6160 	params.timeout = 0;
6161 	params.ssn = 0;
6162 	params.tid = tap->txa_tid;
6163 	params.amsdu = false;
6164 
6165 	IEEE80211_UNLOCK(ic);
6166 	wiphy_lock(hw->wiphy);
6167 	error = lkpi_80211_mo_ampdu_action(hw, vif, &params);
6168 	wiphy_unlock(hw->wiphy);
6169 	IEEE80211_LOCK(ic);
6170 	if (error != 0) {
6171 		ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p tap %p\n",
6172 		    __func__, error, ni, tap);
6173 		goto n80211;
6174 	}
6175 
6176 	IMPROVE_HT("anyting else?");
6177 
6178 n80211:
6179 	lhw->ic_addba_stop(ni, tap);
6180 }
6181 
6182 static void
6183 lkpi_ic_addba_response_timeout(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
6184 {
6185 	struct ieee80211com *ic;
6186 	struct lkpi_hw *lhw;
6187 
6188 	ic = ni->ni_ic;
6189 	lhw = ic->ic_softc;
6190 
6191 	IMPROVE_HT();
6192 
6193 	lhw->ic_addba_response_timeout(ni, tap);
6194 }
6195 
6196 static void
6197 lkpi_ic_bar_response(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap,
6198     int status)
6199 {
6200 	struct ieee80211com *ic;
6201 	struct lkpi_hw *lhw;
6202 
6203 	ic = ni->ni_ic;
6204 	lhw = ic->ic_softc;
6205 
6206 	IMPROVE_HT();
6207 
6208 	lhw->ic_bar_response(ni, tap, status);
6209 }
6210 
6211 static int
6212 lkpi_ic_ampdu_rx_start(struct ieee80211_node *ni, struct ieee80211_rx_ampdu *rap,
6213     int baparamset, int batimeout, int baseqctl)
6214 {
6215 	struct ieee80211com *ic;
6216 	struct lkpi_hw *lhw;
6217 	struct ieee80211_hw *hw;
6218 	struct ieee80211vap *vap;
6219 	struct lkpi_vif *lvif;
6220 	struct ieee80211_vif *vif;
6221 	struct lkpi_sta *lsta;
6222 	struct ieee80211_sta *sta;
6223 	struct ieee80211_ampdu_params params = { };
6224 	int error;
6225 
6226 	ic = ni->ni_ic;
6227 	lhw = ic->ic_softc;
6228 	hw = LHW_TO_HW(lhw);
6229 	vap = ni->ni_vap;
6230 	lvif = VAP_TO_LVIF(vap);
6231 	vif = LVIF_TO_VIF(lvif);
6232 	lsta = ni->ni_drv_data;
6233 	sta = LSTA_TO_STA(lsta);
6234 
6235 	IEEE80211_UNLOCK_ASSERT(ic);
6236 
6237 	if (!lsta->added_to_drv) {
6238 		ic_printf(ic, "%s: lsta %p ni %p vap %p, sta %p not added to firmware\n",
6239 		    __func__, lsta, ni, vap, sta);
6240 		return (-ENXIO);
6241 	}
6242 
6243 	if (lsta->state != IEEE80211_STA_AUTHORIZED) {
6244 		ic_printf(ic, "%s: lsta %p ni %p vap %p, sta %p state %d not AUTHORIZED\n",
6245 		    __func__, lsta, ni, vap, sta, lsta->state);
6246 		return (-ENXIO);
6247 	}
6248 
6249 	params.sta = sta;
6250 	params.action = IEEE80211_AMPDU_RX_START;
6251 	params.buf_size = _IEEE80211_MASKSHIFT(le16toh(baparamset), IEEE80211_BAPS_BUFSIZ);
6252 	if (params.buf_size == 0)
6253 		params.buf_size = IEEE80211_MAX_AMPDU_BUF_HT;
6254 	else
6255 		params.buf_size = min(params.buf_size, IEEE80211_MAX_AMPDU_BUF_HT);
6256 	if (hw->max_rx_aggregation_subframes > 0 &&
6257 	    params.buf_size > hw->max_rx_aggregation_subframes)
6258 		params.buf_size = hw->max_rx_aggregation_subframes;
6259 	params.timeout = le16toh(batimeout);
6260 	params.ssn = _IEEE80211_MASKSHIFT(le16toh(baseqctl), IEEE80211_BASEQ_START);
6261 	params.tid = _IEEE80211_MASKSHIFT(le16toh(baparamset), IEEE80211_BAPS_TID);
6262 
6263 	/* Based on net80211::ampdu_rx_start(). */
6264 	if ((vap->iv_htcaps & IEEE80211_HTC_RX_AMSDU_AMPDU) &&
6265 	    (_IEEE80211_MASKSHIFT(baparamset, IEEE80211_BAPS_AMSDU)))
6266 		params.amsdu = true;
6267 	else
6268 		params.amsdu = false;
6269 
6270 	wiphy_lock(hw->wiphy);
6271 	error = lkpi_80211_mo_ampdu_action(hw, vif, &params);
6272 	wiphy_unlock(hw->wiphy);
6273 	if (error != 0) {
6274 		ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p rap %p\n",
6275 		    __func__, error, ni, rap);
6276 		return (error);
6277 	}
6278 
6279 	if (!ieee80211_hw_check(hw, SUPPORTS_REORDERING_BUFFER)) {
6280 		IMPROVE("%s: TODO: SUPPORTS_REORDERING_BUFFER not set; check net80211\n", __func__);
6281 	}
6282 
6283 	IMPROVE_HT("net80211 is missing the error check on return and assumes success");
6284 
6285 	error = lhw->ic_ampdu_rx_start(ni, rap, baparamset, batimeout, baseqctl);
6286 	return (error);
6287 }
6288 
6289 static void
6290 lkpi_ic_ampdu_rx_stop(struct ieee80211_node *ni, struct ieee80211_rx_ampdu *rap)
6291 {
6292 	struct ieee80211com *ic;
6293 	struct lkpi_hw *lhw;
6294 	struct ieee80211_hw *hw;
6295 	struct ieee80211vap *vap;
6296 	struct lkpi_vif *lvif;
6297 	struct ieee80211_vif *vif;
6298 	struct lkpi_sta *lsta;
6299 	struct ieee80211_sta *sta;
6300 	struct ieee80211_ampdu_params params = { };
6301 	int error;
6302 	uint8_t tid;
6303 	bool ic_locked;
6304 
6305 	ic = ni->ni_ic;
6306 	lhw = ic->ic_softc;
6307 
6308 	/*
6309 	 * We should not (cannot) call into mac80211 ops with AMPDU_RX_STOP if
6310 	 * we did not START.  Some drivers pass it down to firmware which will
6311 	 * simply barf and net80211 calls ieee80211_ht_node_cleanup() from
6312 	 * ieee80211_ht_node_init() amongst others which will iterate over all
6313 	 * tid and call ic_ampdu_rx_stop() unconditionally.
6314 	 * XXX net80211 should probably be more "gentle" in these cases and
6315 	 * track some state itself.
6316 	 */
6317 	if ((rap->rxa_flags & IEEE80211_AGGR_RUNNING) == 0)
6318 		goto net80211_only;
6319 
6320 	hw = LHW_TO_HW(lhw);
6321 	vap = ni->ni_vap;
6322 	lvif = VAP_TO_LVIF(vap);
6323 	vif = LVIF_TO_VIF(lvif);
6324 	lsta = ni->ni_drv_data;
6325 	if (lsta == NULL) {
6326 		ic_printf(ic, "%s: lsta %p ni %p vap %p, lsta is NULL\n",
6327 		    __func__, lsta, ni, vap);
6328 		goto net80211_only;
6329 	}
6330 	sta = LSTA_TO_STA(lsta);
6331 
6332 	if (!lsta->added_to_drv) {
6333 		ic_printf(ic, "%s: lsta %p ni %p vap %p, sta %p not added to firmware\n",
6334 		    __func__, lsta, ni, vap, sta);
6335 		goto net80211_only;
6336 	}
6337 
6338 	if (lsta->state != IEEE80211_STA_AUTHORIZED) {
6339 		ic_printf(ic, "%s: lsta %p ni %p vap %p, sta %p state %d not AUTHORIZED\n",
6340 		    __func__, lsta, ni, vap, sta, lsta->state);
6341 		goto net80211_only;
6342 	}
6343 
6344 	IMPROVE_HT("This really should be passed from ht_recv_action_ba_delba.");
6345 	for (tid = 0; tid < WME_NUM_TID; tid++) {
6346 		if (&ni->ni_rx_ampdu[tid] == rap)
6347 			break;
6348 	}
6349 	if (tid == WME_NUM_TID) {
6350 		ic_printf(ic, "%s: lsta %p ni %p vap %p, sta %p TID not found\n",
6351 		    __func__, lsta, ni, vap, sta);
6352 		goto net80211_only;
6353 	}
6354 
6355 	params.sta = sta;
6356 	params.action = IEEE80211_AMPDU_RX_STOP;
6357 	params.buf_size = 0;
6358 	params.timeout = 0;
6359 	params.ssn = 0;
6360 	params.tid = tid;
6361 	params.amsdu = false;
6362 
6363 	ic_locked = IEEE80211_IS_LOCKED(ic);
6364 	if (ic_locked)
6365 		IEEE80211_UNLOCK(ic);
6366 	wiphy_lock(hw->wiphy);
6367 	error = lkpi_80211_mo_ampdu_action(hw, vif, &params);
6368 	wiphy_unlock(hw->wiphy);
6369 	if (ic_locked)
6370 		IEEE80211_LOCK(ic);
6371 	if (error != 0)
6372 		ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p rap %p\n",
6373 		    __func__, error, ni, rap);
6374 
6375 net80211_only:
6376 	lhw->ic_ampdu_rx_stop(ni, rap);
6377 }
6378 #endif
6379 
6380 static void
6381 lkpi_ic_getradiocaps_ht(struct ieee80211com *ic, struct ieee80211_hw *hw,
6382     uint8_t *bands, int *chan_flags, enum nl80211_band band)
6383 {
6384 #ifdef LKPI_80211_HT
6385 	struct ieee80211_sta_ht_cap *ht_cap;
6386 
6387 	ht_cap = &hw->wiphy->bands[band]->ht_cap;
6388 	if (!ht_cap->ht_supported)
6389 		return;
6390 
6391 	switch (band) {
6392 	case NL80211_BAND_2GHZ:
6393 		setbit(bands, IEEE80211_MODE_11NG);
6394 		break;
6395 	case NL80211_BAND_5GHZ:
6396 		setbit(bands, IEEE80211_MODE_11NA);
6397 		break;
6398 	default:
6399 		IMPROVE("Unsupported band %d", band);
6400 		return;
6401 	}
6402 
6403 	ic->ic_htcaps = IEEE80211_HTC_HT;	/* HT operation */
6404 
6405 	/*
6406 	 * Rather than manually checking each flag and
6407 	 * translating IEEE80211_HT_CAP_ to IEEE80211_HTCAP_,
6408 	 * simply copy the 16bits.
6409 	 */
6410 	ic->ic_htcaps |= ht_cap->cap;
6411 
6412 	/* Then deal with the other flags. */
6413 	if (ieee80211_hw_check(hw, AMPDU_AGGREGATION))
6414 		ic->ic_htcaps |= IEEE80211_HTC_AMPDU;
6415 #ifdef __notyet__
6416 	if (ieee80211_hw_check(hw, TX_AMSDU))
6417 		ic->ic_htcaps |= IEEE80211_HTC_AMSDU;
6418 	if (ieee80211_hw_check(hw, SUPPORTS_AMSDU_IN_AMPDU))
6419 		ic->ic_htcaps |= (IEEE80211_HTC_RX_AMSDU_AMPDU |
6420 		    IEEE80211_HTC_TX_AMSDU_AMPDU);
6421 #endif
6422 
6423 	IMPROVE("PS, ampdu_*, ht_cap.mcs.tx_params, ...");
6424 
6425 	/* Only add HT40 channels if supported. */
6426 	if ((ic->ic_htcaps & IEEE80211_HTCAP_CHWIDTH40) != 0 &&
6427 	    chan_flags != NULL)
6428 		*chan_flags |= NET80211_CBW_FLAG_HT40;
6429 #endif
6430 }
6431 
6432 static void
6433 lkpi_ic_getradiocaps(struct ieee80211com *ic, int maxchan,
6434     int *n, struct ieee80211_channel *c)
6435 {
6436 	struct lkpi_hw *lhw;
6437 	struct ieee80211_hw *hw;
6438 	struct linuxkpi_ieee80211_channel *channels;
6439 	uint8_t bands[IEEE80211_MODE_BYTES];
6440 	int chan_flags, error, i, nchans;
6441 
6442 	/* Channels */
6443 	lhw = ic->ic_softc;
6444 	hw = LHW_TO_HW(lhw);
6445 
6446 	/* NL80211_BAND_2GHZ */
6447 	nchans = 0;
6448 	if (hw->wiphy->bands[NL80211_BAND_2GHZ] != NULL)
6449 		nchans = hw->wiphy->bands[NL80211_BAND_2GHZ]->n_channels;
6450 	if (nchans > 0) {
6451 		memset(bands, 0, sizeof(bands));
6452 		chan_flags = 0;
6453 		setbit(bands, IEEE80211_MODE_11B);
6454 		/* XXX-BZ unclear how to check for 11g. */
6455 
6456 		IMPROVE("the bitrates may have flags?");
6457 		setbit(bands, IEEE80211_MODE_11G);
6458 
6459 		lkpi_ic_getradiocaps_ht(ic, hw, bands, &chan_flags,
6460 		    NL80211_BAND_2GHZ);
6461 
6462 		channels = hw->wiphy->bands[NL80211_BAND_2GHZ]->channels;
6463 		for (i = 0; i < nchans && *n < maxchan; i++) {
6464 			uint32_t nflags = 0;
6465 			int cflags = chan_flags;
6466 
6467 			if (channels[i].flags & IEEE80211_CHAN_DISABLED) {
6468 				ic_printf(ic, "%s: Skipping disabled chan "
6469 				    "[%u/%u/%#x]\n", __func__,
6470 				    channels[i].hw_value,
6471 				    channels[i].center_freq, channels[i].flags);
6472 				continue;
6473 			}
6474 			if (channels[i].flags & IEEE80211_CHAN_NO_IR)
6475 				nflags |= (IEEE80211_CHAN_NOADHOC|IEEE80211_CHAN_PASSIVE);
6476 			if (channels[i].flags & IEEE80211_CHAN_RADAR)
6477 				nflags |= IEEE80211_CHAN_DFS;
6478 			if (channels[i].flags & IEEE80211_CHAN_NO_160MHZ)
6479 				cflags &= ~(NET80211_CBW_FLAG_VHT160|NET80211_CBW_FLAG_VHT80P80);
6480 			if (channels[i].flags & IEEE80211_CHAN_NO_80MHZ)
6481 				cflags &= ~NET80211_CBW_FLAG_VHT80;
6482 			/* XXX how to map the remaining enum ieee80211_channel_flags? */
6483 			if (channels[i].flags & IEEE80211_CHAN_NO_HT40)
6484 				cflags &= ~NET80211_CBW_FLAG_HT40;
6485 
6486 			error = ieee80211_add_channel_cbw(c, maxchan, n,
6487 			    ieee80211_mhz2ieee(channels[i].center_freq,
6488 				lkpi_nl80211_band_to_net80211_band(channels[i].band)),
6489 			    channels[i].center_freq, channels[i].max_power,
6490 			    nflags, bands, cflags);
6491 			/* net80211::ENOBUFS: *n >= maxchans */
6492 			if (error != 0 && error != ENOBUFS)
6493 				ic_printf(ic, "%s: Adding chan %u/%u/%#x/%#x/%#x/%#x "
6494 				    "returned error %d\n",
6495 				    __func__, channels[i].hw_value,
6496 				    channels[i].center_freq, channels[i].flags,
6497 				    nflags, chan_flags, cflags, error);
6498 			if (error != 0)
6499 				break;
6500 		}
6501 	}
6502 
6503 	/* NL80211_BAND_5GHZ */
6504 	nchans = 0;
6505 	if (hw->wiphy->bands[NL80211_BAND_5GHZ] != NULL)
6506 		nchans = hw->wiphy->bands[NL80211_BAND_5GHZ]->n_channels;
6507 	if (nchans > 0) {
6508 		memset(bands, 0, sizeof(bands));
6509 		chan_flags = 0;
6510 		setbit(bands, IEEE80211_MODE_11A);
6511 
6512 		lkpi_ic_getradiocaps_ht(ic, hw, bands, &chan_flags,
6513 		    NL80211_BAND_5GHZ);
6514 
6515 #ifdef LKPI_80211_VHT
6516 		if (hw->wiphy->bands[NL80211_BAND_5GHZ]->vht_cap.vht_supported) {
6517 
6518 			ic->ic_flags_ext |= IEEE80211_FEXT_VHT;
6519 			ic->ic_vht_cap.vht_cap_info =
6520 			    hw->wiphy->bands[NL80211_BAND_5GHZ]->vht_cap.cap;
6521 			ic->ic_vht_cap.supp_mcs =
6522 			    hw->wiphy->bands[NL80211_BAND_5GHZ]->vht_cap.vht_mcs;
6523 
6524 			setbit(bands, IEEE80211_MODE_VHT_5GHZ);
6525 			chan_flags |= NET80211_CBW_FLAG_VHT80;
6526 			if (IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_IS_160MHZ(
6527 			    ic->ic_vht_cap.vht_cap_info))
6528 				chan_flags |= NET80211_CBW_FLAG_VHT160;
6529 			if (IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_IS_160_80P80MHZ(
6530 			    ic->ic_vht_cap.vht_cap_info))
6531 				chan_flags |= NET80211_CBW_FLAG_VHT80P80;
6532 		}
6533 #endif
6534 
6535 		channels = hw->wiphy->bands[NL80211_BAND_5GHZ]->channels;
6536 		for (i = 0; i < nchans && *n < maxchan; i++) {
6537 			uint32_t nflags = 0;
6538 			int cflags = chan_flags;
6539 
6540 			if (channels[i].flags & IEEE80211_CHAN_DISABLED) {
6541 				ic_printf(ic, "%s: Skipping disabled chan "
6542 				    "[%u/%u/%#x]\n", __func__,
6543 				    channels[i].hw_value,
6544 				    channels[i].center_freq, channels[i].flags);
6545 				continue;
6546 			}
6547 			if (channels[i].flags & IEEE80211_CHAN_NO_IR)
6548 				nflags |= (IEEE80211_CHAN_NOADHOC|IEEE80211_CHAN_PASSIVE);
6549 			if (channels[i].flags & IEEE80211_CHAN_RADAR)
6550 				nflags |= IEEE80211_CHAN_DFS;
6551 			if (channels[i].flags & IEEE80211_CHAN_NO_160MHZ)
6552 				cflags &= ~(NET80211_CBW_FLAG_VHT160|NET80211_CBW_FLAG_VHT80P80);
6553 			if (channels[i].flags & IEEE80211_CHAN_NO_80MHZ)
6554 				cflags &= ~NET80211_CBW_FLAG_VHT80;
6555 			/* XXX hwo to map the remaining enum ieee80211_channel_flags? */
6556 			if (channels[i].flags & IEEE80211_CHAN_NO_HT40)
6557 				cflags &= ~NET80211_CBW_FLAG_HT40;
6558 
6559 			error = ieee80211_add_channel_cbw(c, maxchan, n,
6560 			    ieee80211_mhz2ieee(channels[i].center_freq,
6561 				lkpi_nl80211_band_to_net80211_band(channels[i].band)),
6562 			    channels[i].center_freq, channels[i].max_power,
6563 			    nflags, bands, cflags);
6564 			/* net80211::ENOBUFS: *n >= maxchans */
6565 			if (error != 0 && error != ENOBUFS)
6566 				ic_printf(ic, "%s: Adding chan %u/%u/%#x/%#x/%#x/%#x "
6567 				    "returned error %d\n",
6568 				    __func__, channels[i].hw_value,
6569 				    channels[i].center_freq, channels[i].flags,
6570 				    nflags, chan_flags, cflags, error);
6571 			if (error != 0)
6572 				break;
6573 		}
6574 	}
6575 }
6576 
6577 static void *
6578 lkpi_ieee80211_ifalloc(void)
6579 {
6580 	struct ieee80211com *ic;
6581 
6582 	ic = malloc(sizeof(*ic), M_LKPI80211, M_WAITOK | M_ZERO);
6583 
6584 	/* Setting these happens later when we have device information. */
6585 	ic->ic_softc = NULL;
6586 	ic->ic_name = "linuxkpi";
6587 
6588 	return (ic);
6589 }
6590 
6591 struct ieee80211_hw *
6592 linuxkpi_ieee80211_alloc_hw(size_t priv_len, const struct ieee80211_ops *ops)
6593 {
6594 	struct ieee80211_hw *hw;
6595 	struct lkpi_hw *lhw;
6596 	struct wiphy *wiphy;
6597 	int ac;
6598 	bool emuchanctx;
6599 
6600 	/*
6601 	 * Do certain checks before starting to allocate resources.
6602 	 * Store results in temporary variables.
6603 	 */
6604 
6605 	/* ac1d519c01ca introduced emulating chanctx changes. */
6606 	emuchanctx = false;
6607 	if (ops->add_chanctx == ieee80211_emulate_add_chanctx &&
6608 	    ops->change_chanctx == ieee80211_emulate_change_chanctx &&
6609 	    ops->remove_chanctx == ieee80211_emulate_remove_chanctx) {
6610 		/*
6611 		 * If we emulate the chanctx ops, we must not have
6612 		 * assign_vif_chanctx and unassign_vif_chanctx.
6613 		 */
6614 		if (ops->assign_vif_chanctx != NULL ||
6615 		    ops->unassign_vif_chanctx != NULL) {
6616 			/* Fail gracefully. */
6617 			printf("%s: emulate_chanctx but "
6618 			    "assign_vif_chanctx %p != NULL || "
6619 			    "unassign_vif_chanctx %p != NULL\n", __func__,
6620 			    ops->assign_vif_chanctx, ops->unassign_vif_chanctx);
6621 			return (NULL);
6622 		}
6623 		emuchanctx = true;
6624 	}
6625 	if (!emuchanctx && (ops->add_chanctx == ieee80211_emulate_add_chanctx ||
6626 	    ops->change_chanctx == ieee80211_emulate_change_chanctx ||
6627 	    ops->remove_chanctx == ieee80211_emulate_remove_chanctx)) {
6628 		printf("%s: not emulating chanctx changes but emulating "
6629 		    "function set: %d/%d/%d\n", __func__,
6630 		    ops->add_chanctx == ieee80211_emulate_add_chanctx,
6631 		    ops->change_chanctx == ieee80211_emulate_change_chanctx,
6632 		    ops->remove_chanctx == ieee80211_emulate_remove_chanctx);
6633 		return (NULL);
6634 	}
6635 	if (!emuchanctx && (ops->add_chanctx == NULL || ops->change_chanctx == NULL ||
6636 	    ops->remove_chanctx == NULL || ops->assign_vif_chanctx == NULL ||
6637 	    ops->unassign_vif_chanctx == NULL)) {
6638 		printf("%s: not all functions set for chanctx operations "
6639 		    "(emulating chanctx %d): %p/%p/%p %p/%p\n",
6640 		    __func__, emuchanctx,
6641 		    ops->add_chanctx, ops->change_chanctx, ops->remove_chanctx,
6642 		    ops->assign_vif_chanctx, ops->unassign_vif_chanctx);
6643 		return (NULL);
6644 	}
6645 
6646 	/* Get us and the driver data also allocated. */
6647 	wiphy = wiphy_new(&linuxkpi_mac80211cfgops, sizeof(*lhw) + priv_len);
6648 	if (wiphy == NULL)
6649 		return (NULL);
6650 
6651 	lhw = wiphy_priv(wiphy);
6652 	lhw->ops = ops;
6653 
6654 	LKPI_80211_LHW_SCAN_LOCK_INIT(lhw);
6655 	LKPI_80211_LHW_TXQ_LOCK_INIT(lhw);
6656 	spin_lock_init(&lhw->txq_lock);
6657 	sx_init_flags(&lhw->lvif_sx, "lhw-lvif", SX_RECURSE | SX_DUPOK);
6658 	LKPI_80211_LHW_MC_LOCK_INIT(lhw);
6659 	TAILQ_INIT(&lhw->lvif_head);
6660 	__hw_addr_init(&lhw->mc_list);
6661 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
6662 		spin_lock_init(&lhw->txq_scheduled_lock[ac]);
6663 		lhw->txq_generation[ac] = 1;
6664 		TAILQ_INIT(&lhw->txq_scheduled[ac]);
6665 	}
6666 
6667 	/* Chanctx_conf */
6668 	INIT_LIST_HEAD(&lhw->lchanctx_list);
6669 	INIT_LIST_HEAD(&lhw->lchanctx_list_reserved);
6670 	lhw->emulate_chanctx = emuchanctx;
6671 
6672 	/* Deferred RX path. */
6673 	LKPI_80211_LHW_RXQ_LOCK_INIT(lhw);
6674 	TASK_INIT(&lhw->rxq_task, 0, lkpi_80211_lhw_rxq_task, lhw);
6675 	mbufq_init(&lhw->rxq, 32 * NAPI_POLL_WEIGHT);
6676 	lhw->rxq_stopped = false;
6677 
6678 	/*
6679 	 * XXX-BZ TODO make sure there is a "_null" function to all ops
6680 	 * not initialized.
6681 	 */
6682 	hw = LHW_TO_HW(lhw);
6683 	hw->wiphy = wiphy;
6684 	hw->conf.flags |= IEEE80211_CONF_IDLE;
6685 	hw->priv = (void *)(lhw + 1);
6686 
6687 	/* BSD Specific. */
6688 	lhw->ic = lkpi_ieee80211_ifalloc();
6689 
6690 	if (lhw->emulate_chanctx)
6691 		ic_printf(lhw->ic, "Using chanctx emulation.\n");
6692 	IMPROVE();
6693 
6694 	return (hw);
6695 }
6696 
6697 void
6698 linuxkpi_ieee80211_iffree(struct ieee80211_hw *hw)
6699 {
6700 	struct lkpi_hw *lhw;
6701 	struct mbuf *m;
6702 	int ac;
6703 
6704 	lhw = HW_TO_LHW(hw);
6705 	free(lhw->ic, M_LKPI80211);
6706 	lhw->ic = NULL;
6707 
6708 	/*
6709 	 * Drain the deferred RX path.
6710 	 */
6711 	LKPI_80211_LHW_RXQ_LOCK(lhw);
6712 	lhw->rxq_stopped = true;
6713 	LKPI_80211_LHW_RXQ_UNLOCK(lhw);
6714 
6715 	/* Drain taskq, won't be restarted due to rxq_stopped being set. */
6716 	while (taskqueue_cancel(taskqueue_thread, &lhw->rxq_task, NULL) != 0)
6717 		taskqueue_drain(taskqueue_thread, &lhw->rxq_task);
6718 
6719 	/* Flush mbufq (make sure to release ni refs!). */
6720 	m = mbufq_dequeue(&lhw->rxq);
6721 	while (m != NULL) {
6722 #ifdef LKPI_80211_USE_MTAG
6723 		struct m_tag *mtag;
6724 
6725 		mtag = m_tag_locate(m, MTAG_ABI_LKPI80211, LKPI80211_TAG_RXNI, NULL);
6726 		if (mtag != NULL) {
6727 			struct lkpi_80211_tag_rxni *rxni;
6728 
6729 			rxni = (struct lkpi_80211_tag_rxni *)(mtag + 1);
6730 			ieee80211_free_node(rxni->ni);
6731 		}
6732 #else
6733 		if (m->m_pkthdr.PH_loc.ptr != NULL) {
6734 			struct ieee80211_node *ni;
6735 
6736 			ni = m->m_pkthdr.PH_loc.ptr;
6737 			ieee80211_free_node(ni);
6738 		}
6739 #endif
6740 		m_freem(m);
6741 		m = mbufq_dequeue(&lhw->rxq);
6742 	}
6743 	KASSERT(mbufq_empty(&lhw->rxq), ("%s: lhw %p has rxq len %d != 0\n",
6744 	    __func__, lhw, mbufq_len(&lhw->rxq)));
6745 	LKPI_80211_LHW_RXQ_LOCK_DESTROY(lhw);
6746 
6747 	wiphy_lock(hw->wiphy);
6748 	/* Chanctx_conf. */
6749 	if (!list_empty_careful(&lhw->lchanctx_list)) {
6750 		struct lkpi_chanctx *lchanctx, *next;
6751 		struct ieee80211_chanctx_conf *chanctx_conf;
6752 
6753 		list_for_each_entry_safe(lchanctx, next, &lhw->lchanctx_list, entry) {
6754 			if (lchanctx->added_to_drv) {
6755 				/* In reality we should panic? */
6756 				chanctx_conf = &lchanctx->chanctx_conf;
6757 				lkpi_80211_mo_remove_chanctx(hw, chanctx_conf);
6758 			}
6759 			list_del(&lchanctx->entry);
6760 			list_add_rcu(&lchanctx->entry, &lhw->lchanctx_list_reserved);
6761 		}
6762 	}
6763 	if (!list_empty_careful(&lhw->lchanctx_list_reserved)) {
6764 		struct lkpi_chanctx *lchanctx, *next;
6765 
6766 		list_for_each_entry_safe(lchanctx, next, &lhw->lchanctx_list_reserved, entry) {
6767 			list_del(&lchanctx->entry);
6768 			if (lchanctx->added_to_drv)
6769 				panic("%s: lchanctx %p on reserved list still added_to_drv\n",
6770 				    __func__, lchanctx);
6771 			free(lchanctx, M_LKPI80211);
6772 		}
6773 	}
6774 	wiphy_unlock(hw->wiphy);
6775 
6776 	LKPI_80211_LHW_MC_LOCK(lhw);
6777 	lkpi_cleanup_mcast_list_locked(lhw);
6778 	LKPI_80211_LHW_MC_UNLOCK(lhw);
6779 
6780 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
6781 		spin_lock_destroy(&lhw->txq_scheduled_lock[ac]);
6782 
6783 	/* Cleanup more of lhw here or in wiphy_free()? */
6784 	spin_lock_destroy(&lhw->txq_lock);
6785 	LKPI_80211_LHW_TXQ_LOCK_DESTROY(lhw);
6786 	LKPI_80211_LHW_SCAN_LOCK_DESTROY(lhw);
6787 	sx_destroy(&lhw->lvif_sx);
6788 	LKPI_80211_LHW_MC_LOCK_DESTROY(lhw)
6789 	IMPROVE();
6790 }
6791 
6792 void
6793 linuxkpi_set_ieee80211_dev(struct ieee80211_hw *hw)
6794 {
6795 	struct lkpi_hw *lhw;
6796 	struct ieee80211com *ic;
6797 	struct device *dev;
6798 
6799 	lhw = HW_TO_LHW(hw);
6800 	ic = lhw->ic;
6801 
6802 	/* Save the backpointer from net80211 to LinuxKPI. */
6803 	ic->ic_softc = lhw;
6804 
6805 	/*
6806 	 * Set a proper name before ieee80211_ifattach() if dev is set.
6807 	 * ath1xk also unset the dev so we need to check.
6808 	 */
6809 	dev = wiphy_dev(hw->wiphy);
6810 	if (dev != NULL) {
6811 		ic->ic_name = dev_name(dev);
6812 	} else {
6813 		TODO("adjust arguments to still have the old dev or go through "
6814 		    "the hoops of getting the bsddev from hw and detach; "
6815 		    "or do in XXX; check ath1kx drivers");
6816 	}
6817 
6818 	/* XXX-BZ do we also need to set wiphy name? */
6819 }
6820 
6821 struct ieee80211_hw *
6822 linuxkpi_wiphy_to_ieee80211_hw(struct wiphy *wiphy)
6823 {
6824 	struct lkpi_hw *lhw;
6825 
6826 	lhw = wiphy_priv(wiphy);
6827 	return (LHW_TO_HW(lhw));
6828 }
6829 
6830 static void
6831 lkpi_radiotap_attach(struct lkpi_hw *lhw)
6832 {
6833 	struct ieee80211com *ic;
6834 
6835 	ic = lhw->ic;
6836 	ieee80211_radiotap_attach(ic,
6837 	    &lhw->rtap_tx.wt_ihdr, sizeof(lhw->rtap_tx),
6838 	    LKPI_RTAP_TX_FLAGS_PRESENT,
6839 	    &lhw->rtap_rx.wr_ihdr, sizeof(lhw->rtap_rx),
6840 	    LKPI_RTAP_RX_FLAGS_PRESENT);
6841 }
6842 
6843 int
6844 linuxkpi_ieee80211_ifattach(struct ieee80211_hw *hw)
6845 {
6846 	struct ieee80211com *ic;
6847 	struct lkpi_hw *lhw;
6848 	int band, i;
6849 
6850 	lhw = HW_TO_LHW(hw);
6851 	ic = lhw->ic;
6852 
6853 	/* We do it this late as wiphy->dev should be set for the name. */
6854 	lhw->workq = alloc_ordered_workqueue(wiphy_name(hw->wiphy), 0);
6855 	if (lhw->workq == NULL)
6856 		return (-EAGAIN);
6857 
6858 	/* XXX-BZ figure this out how they count his... */
6859 	if (!is_zero_ether_addr(hw->wiphy->perm_addr)) {
6860 		IEEE80211_ADDR_COPY(ic->ic_macaddr,
6861 		    hw->wiphy->perm_addr);
6862 	} else if (hw->wiphy->n_addresses > 0) {
6863 		/* We take the first one. */
6864 		IEEE80211_ADDR_COPY(ic->ic_macaddr,
6865 		    hw->wiphy->addresses[0].addr);
6866 	} else {
6867 		ic_printf(ic, "%s: warning, no hardware address!\n", __func__);
6868 	}
6869 
6870 #ifdef __not_yet__
6871 	/* See comment in lkpi_80211_txq_tx_one(). */
6872 	ic->ic_headroom = hw->extra_tx_headroom;
6873 #endif
6874 
6875 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
6876 	ic->ic_opmode = IEEE80211_M_STA;
6877 
6878 	/* Set device capabilities. */
6879 	/* XXX-BZ we need to get these from linux80211/drivers and convert. */
6880 	ic->ic_caps =
6881 	    IEEE80211_C_STA |
6882 	    IEEE80211_C_MONITOR |
6883 	    IEEE80211_C_WPA |		/* WPA/RSN */
6884 #ifdef LKPI_80211_WME
6885 	    IEEE80211_C_WME |
6886 #endif
6887 #if 0
6888 	    IEEE80211_C_PMGT |
6889 #endif
6890 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
6891 	    IEEE80211_C_SHPREAMBLE	/* short preamble supported */
6892 	    ;
6893 
6894 #ifdef LKPI_80211_BGSCAN
6895 	if (lhw->ops->hw_scan)
6896 		ic->ic_caps |= IEEE80211_C_BGSCAN;
6897 #endif
6898 
6899 	lkpi_enable_hw_scan(lhw);
6900 
6901 	/* Does HW support Fragmentation offload? */
6902 	if (ieee80211_hw_check(hw, SUPPORTS_TX_FRAG))
6903 		ic->ic_flags_ext |= IEEE80211_FEXT_FRAG_OFFLOAD;
6904 
6905 	/* Does HW support full AMPDU[-TX] offload? */
6906 	if (ieee80211_hw_check(hw, AMPDU_AGGREGATION))
6907 		ic->ic_flags_ext |= IEEE80211_FEXT_AMPDU_OFFLOAD;
6908 #ifdef __notyet__
6909 	if (ieee80211_hw_check(hw, TX_AMSDU))
6910 	if (ieee80211_hw_check(hw, SUPPORTS_AMSDU_IN_AMPDU))
6911 #endif
6912 
6913 	/*
6914 	 * The wiphy variables report bitmasks of avail antennas.
6915 	 * (*get_antenna) get the current bitmask sets which can be
6916 	 * altered by (*set_antenna) for some drivers.
6917 	 * XXX-BZ will the count alone do us much good long-term in net80211?
6918 	 */
6919 	if (hw->wiphy->available_antennas_rx ||
6920 	    hw->wiphy->available_antennas_tx) {
6921 		uint32_t rxs, txs;
6922 
6923 		if (lkpi_80211_mo_get_antenna(hw, &txs, &rxs) == 0) {
6924 			ic->ic_rxstream = bitcount32(rxs);
6925 			ic->ic_txstream = bitcount32(txs);
6926 		}
6927 	}
6928 
6929 	ic->ic_cryptocaps = 0;
6930 #ifdef LKPI_80211_HW_CRYPTO
6931 	if (lkpi_hwcrypto && hw->wiphy->n_cipher_suites > 0) {
6932 		uint32_t hwciphers;
6933 
6934 		hwciphers = 0;
6935 		for (i = 0; i < hw->wiphy->n_cipher_suites; i++) {
6936 			uint32_t cs;
6937 
6938 			cs = lkpi_l80211_to_net80211_cyphers(
6939 			    ic, hw->wiphy->cipher_suites[i]);
6940 			if (cs == IEEE80211_CRYPTO_TKIP) {
6941 				/*
6942 				 * We do set this here.  We will only find out
6943 				 * when doing a SET_KEY operation depending on
6944 				 * what the driver returns.
6945 				 * net80211::ieee80211_crypto_newkey()
6946 				 * checks this so we will have to do flags
6947 				 * surgery later.
6948 				 */
6949 				cs |= IEEE80211_CRYPTO_TKIPMIC;
6950 			}
6951 			hwciphers |= cs;
6952 		}
6953 		/*
6954 		 * (20250415) nothing anywhere in the path checks we actually
6955 		 * support all these in net80211.
6956 		 * net80211 supports _256 variants but the ioctl does not.
6957 		 */
6958 		IMPROVE("as net80211 grows more support, enable them");
6959 		hwciphers &= (IEEE80211_CRYPTO_WEP |
6960 		    IEEE80211_CRYPTO_TKIP | IEEE80211_CRYPTO_TKIPMIC |
6961 		    IEEE80211_CRYPTO_AES_CCM | IEEE80211_CRYPTO_AES_GCM_128);
6962 		/*
6963 		 * We only support CCMP here, so further filter.
6964 		 * Also permit TKIP if turned on.
6965 		 */
6966 		hwciphers &= (IEEE80211_CRYPTO_AES_CCM |
6967 		    IEEE80211_CRYPTO_AES_GCM_128 |
6968 		    (lkpi_hwcrypto_tkip ? (IEEE80211_CRYPTO_TKIP |
6969 		    IEEE80211_CRYPTO_TKIPMIC) : 0));
6970 		ieee80211_set_hardware_ciphers(ic, hwciphers);
6971 	}
6972 #endif
6973 
6974 	lkpi_ic_getradiocaps(ic, IEEE80211_CHAN_MAX, &ic->ic_nchans,
6975 	    ic->ic_channels);
6976 
6977 	ieee80211_ifattach(ic);
6978 
6979 	ic->ic_update_mcast = lkpi_ic_update_mcast;
6980 	ic->ic_update_promisc = lkpi_ic_update_promisc;
6981 	ic->ic_update_chw = lkpi_ic_update_chw;
6982 	ic->ic_parent = lkpi_ic_parent;
6983 	ic->ic_scan_start = lkpi_ic_scan_start;
6984 	ic->ic_scan_end = lkpi_ic_scan_end;
6985 	ic->ic_set_channel = lkpi_ic_set_channel;
6986 	ic->ic_transmit = lkpi_ic_transmit;
6987 	ic->ic_raw_xmit = lkpi_ic_raw_xmit;
6988 	ic->ic_vap_create = lkpi_ic_vap_create;
6989 	ic->ic_vap_delete = lkpi_ic_vap_delete;
6990 	ic->ic_getradiocaps = lkpi_ic_getradiocaps;
6991 	ic->ic_wme.wme_update = lkpi_ic_wme_update;
6992 
6993 	lhw->ic_scan_curchan = ic->ic_scan_curchan;
6994 	ic->ic_scan_curchan = lkpi_ic_scan_curchan;
6995 	lhw->ic_scan_mindwell = ic->ic_scan_mindwell;
6996 	ic->ic_scan_mindwell = lkpi_ic_scan_mindwell;
6997 
6998 	lhw->ic_node_alloc = ic->ic_node_alloc;
6999 	ic->ic_node_alloc = lkpi_ic_node_alloc;
7000 	lhw->ic_node_init = ic->ic_node_init;
7001 	ic->ic_node_init = lkpi_ic_node_init;
7002 	lhw->ic_node_cleanup = ic->ic_node_cleanup;
7003 	ic->ic_node_cleanup = lkpi_ic_node_cleanup;
7004 	lhw->ic_node_free = ic->ic_node_free;
7005 	ic->ic_node_free = lkpi_ic_node_free;
7006 
7007 #ifdef LKPI_80211_HT
7008 	/*
7009 	 * Only attach if the driver/firmware supports (*ampdu_action)().
7010 	 * Otherwise it is in the hands of net80211.
7011 	 */
7012 	if (lhw->ops->ampdu_action != NULL) {
7013 		lhw->ic_recv_action = ic->ic_recv_action;
7014 		ic->ic_recv_action = lkpi_ic_recv_action;
7015 		lhw->ic_send_action = ic->ic_send_action;
7016 		ic->ic_send_action = lkpi_ic_send_action;
7017 
7018 		lhw->ic_ampdu_enable = ic->ic_ampdu_enable;
7019 		ic->ic_ampdu_enable = lkpi_ic_ampdu_enable;
7020 
7021 		lhw->ic_addba_request = ic->ic_addba_request;
7022 		ic->ic_addba_request = lkpi_ic_addba_request;
7023 		lhw->ic_addba_response = ic->ic_addba_response;
7024 		ic->ic_addba_response = lkpi_ic_addba_response;
7025 		lhw->ic_addba_stop = ic->ic_addba_stop;
7026 		ic->ic_addba_stop = lkpi_ic_addba_stop;
7027 		lhw->ic_addba_response_timeout = ic->ic_addba_response_timeout;
7028 		ic->ic_addba_response_timeout = lkpi_ic_addba_response_timeout;
7029 
7030 		lhw->ic_bar_response = ic->ic_bar_response;
7031 		ic->ic_bar_response = lkpi_ic_bar_response;
7032 
7033 		lhw->ic_ampdu_rx_start = ic->ic_ampdu_rx_start;
7034 		ic->ic_ampdu_rx_start = lkpi_ic_ampdu_rx_start;
7035 		lhw->ic_ampdu_rx_stop = ic->ic_ampdu_rx_stop;
7036 		ic->ic_ampdu_rx_stop = lkpi_ic_ampdu_rx_stop;
7037 	}
7038 #endif
7039 
7040 	lkpi_radiotap_attach(lhw);
7041 
7042 	/*
7043 	 * Assign the first possible channel for now;  seems Realtek drivers
7044 	 * expect one.
7045 	 * Also remember the amount of bands we support and the most rates
7046 	 * in any band so we can scale [(ext) sup rates] IE(s) accordingly.
7047 	 */
7048 	lhw->supbands = lhw->max_rates = 0;
7049 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
7050 		struct ieee80211_supported_band *supband;
7051 		struct linuxkpi_ieee80211_channel *channels;
7052 
7053 		supband = hw->wiphy->bands[band];
7054 		if (supband == NULL || supband->n_channels == 0)
7055 			continue;
7056 
7057 		lhw->supbands++;
7058 		lhw->max_rates = max(lhw->max_rates, supband->n_bitrates);
7059 
7060 		/* If we have a channel, we need to keep counting supbands. */
7061 		if (hw->conf.chandef.chan != NULL)
7062 			continue;
7063 
7064 		channels = supband->channels;
7065 		for (i = 0; i < supband->n_channels; i++) {
7066 
7067 			if (channels[i].flags & IEEE80211_CHAN_DISABLED)
7068 				continue;
7069 
7070 			cfg80211_chandef_create(&hw->conf.chandef, &channels[i],
7071 #ifdef LKPI_80211_HT
7072 			    (ic->ic_flags_ht & IEEE80211_FHT_HT) ? NL80211_CHAN_HT20 :
7073 #endif
7074 			    NL80211_CHAN_NO_HT);
7075 			lhw->dflt_chandef = hw->conf.chandef;
7076 			break;
7077 		}
7078 	}
7079 
7080 	IMPROVE("see net80211::ieee80211_chan_init vs. wiphy->bands[].bitrates possibly in lkpi_ic_getradiocaps?");
7081 
7082 	/* Make sure we do not support more than net80211 is willing to take. */
7083 	if (lhw->max_rates > IEEE80211_RATE_MAXSIZE) {
7084 		ic_printf(ic, "%s: limiting max_rates %d to %d!\n", __func__,
7085 		    lhw->max_rates, IEEE80211_RATE_MAXSIZE);
7086 		lhw->max_rates = IEEE80211_RATE_MAXSIZE;
7087 	}
7088 
7089 	/*
7090 	 * The maximum supported bitrates on any band + size for
7091 	 * DSSS Parameter Set give our per-band IE size.
7092 	 * SSID is the responsibility of the driver and goes on the side.
7093 	 * The user specified bits coming from the vap go into the
7094 	 * "common ies" fields.
7095 	 */
7096 	lhw->scan_ie_len = 2 + IEEE80211_RATE_SIZE;
7097 	if (lhw->max_rates > IEEE80211_RATE_SIZE)
7098 		lhw->scan_ie_len += 2 + (lhw->max_rates - IEEE80211_RATE_SIZE);
7099 
7100 	if (hw->wiphy->features & NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) {
7101 		/*
7102 		 * net80211 does not seem to support the DSSS Parameter Set but
7103 		 * some of the drivers insert it so calculate the extra fixed
7104 		 * space in.
7105 		 */
7106 		lhw->scan_ie_len += 2 + 1;
7107 	}
7108 
7109 #if defined(LKPI_80211_HT)
7110 	if ((ic->ic_htcaps & IEEE80211_HTC_HT) != 0)
7111 		lhw->scan_ie_len += sizeof(struct ieee80211_ie_htcap);
7112 #endif
7113 #if defined(LKPI_80211_VHT)
7114 	if (IEEE80211_CONF_VHT(ic))
7115 		lhw->scan_ie_len += 2 + sizeof(struct ieee80211_vht_cap);
7116 #endif
7117 
7118 	/* Reduce the max_scan_ie_len "left" by the amount we consume already. */
7119 	if (hw->wiphy->max_scan_ie_len > 0) {
7120 		if (lhw->scan_ie_len > hw->wiphy->max_scan_ie_len)
7121 			goto err;
7122 		hw->wiphy->max_scan_ie_len -= lhw->scan_ie_len;
7123 	}
7124 
7125 	if (bootverbose) {
7126 		if (hw->netdev_features != 0)
7127 			ic_printf(ic, "netdev_features %b\n",
7128 			    hw->netdev_features, NETIF_F_BITS);
7129 		ieee80211_announce(ic);
7130 	}
7131 
7132 	return (0);
7133 err:
7134 	IMPROVE("TODO FIXME CLEANUP");
7135 	return (-EAGAIN);
7136 }
7137 
7138 void
7139 linuxkpi_ieee80211_ifdetach(struct ieee80211_hw *hw)
7140 {
7141 	struct lkpi_hw *lhw;
7142 	struct ieee80211com *ic;
7143 
7144 	lhw = HW_TO_LHW(hw);
7145 	ic = lhw->ic;
7146 	ieee80211_ifdetach(ic);
7147 }
7148 
7149 void
7150 linuxkpi_ieee80211_iterate_interfaces(struct ieee80211_hw *hw,
7151     enum ieee80211_iface_iter flags,
7152     void(*iterfunc)(void *, uint8_t *, struct ieee80211_vif *),
7153     void *arg)
7154 {
7155 	struct lkpi_hw *lhw;
7156 	struct lkpi_vif *lvif;
7157 	struct ieee80211_vif *vif;
7158 	bool active, atomic, nin_drv;
7159 
7160 	lhw = HW_TO_LHW(hw);
7161 
7162 	if (flags & ~(IEEE80211_IFACE_ITER_NORMAL|
7163 	    IEEE80211_IFACE_ITER_RESUME_ALL|
7164 	    IEEE80211_IFACE_SKIP_SDATA_NOT_IN_DRIVER|
7165 	    IEEE80211_IFACE_ITER_ACTIVE|IEEE80211_IFACE_ITER__ATOMIC|
7166 	    IEEE80211_IFACE_ITER__MTX)) {
7167 		ic_printf(lhw->ic, "XXX TODO %s flags(%#x) not yet supported.\n",
7168 		    __func__, flags);
7169 	}
7170 
7171 	if ((flags & IEEE80211_IFACE_ITER__MTX) != 0)
7172 		lockdep_assert_wiphy(hw->wiphy);
7173 
7174 	active = (flags & IEEE80211_IFACE_ITER_ACTIVE) != 0;
7175 	atomic = (flags & IEEE80211_IFACE_ITER__ATOMIC) != 0;
7176 	nin_drv = (flags & IEEE80211_IFACE_SKIP_SDATA_NOT_IN_DRIVER) != 0;
7177 
7178 	if (atomic) {
7179 		IMPROVE("LKPI_80211_LHW_LVIF_LOCK atomic assume to be rcu?");
7180 		LKPI_80211_LHW_LVIF_LOCK(lhw);
7181 	}
7182 	TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
7183 		struct ieee80211vap *vap;
7184 
7185 		vif = LVIF_TO_VIF(lvif);
7186 
7187 		/*
7188 		 * If we want "active" interfaces, we need to distinguish on
7189 		 * whether the driver knows about them or not to be able to
7190 		 * handle the "resume" case correctly.  Skip the ones the
7191 		 * driver does not know about.
7192 		 */
7193 		if (active && !lvif->added_to_drv &&
7194 		    (flags & IEEE80211_IFACE_ITER_RESUME_ALL) != 0)
7195 			continue;
7196 
7197 		/*
7198 		 * If we shall skip interfaces not added to the driver do so
7199 		 * if we haven't yet.
7200 		 */
7201 		if (nin_drv && !lvif->added_to_drv)
7202 			continue;
7203 
7204 		/*
7205 		 * Run the iterator function if we are either not asking
7206 		 * asking for active only or if the VAP is "running".
7207 		 */
7208 		/* XXX-BZ probably should have state in the lvif as well. */
7209 		vap = LVIF_TO_VAP(lvif);
7210 		if (!active || (vap->iv_state != IEEE80211_S_INIT))
7211 			iterfunc(arg, vif->addr, vif);
7212 	}
7213 	if (atomic)
7214 		LKPI_80211_LHW_LVIF_UNLOCK(lhw);
7215 }
7216 
7217 static void
7218 lkpi_ieee80211_iterate_keys(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
7219     ieee80211_keyix keyix, struct lkpi_sta *lsta,
7220     void(*iterfunc)(struct ieee80211_hw *, struct ieee80211_vif *,
7221 	struct ieee80211_sta *, struct ieee80211_key_conf *, void *),
7222     void *arg)
7223 {
7224 #ifdef LINUXKPI_DEBUG_80211
7225 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
7226 		net80211_vap_printf(LVIF_TO_VAP(VIF_TO_LVIF(vif)),
7227 		    "%s:%d: lsta %6D added_to_drv %d kc[keyix %u] %p\n",
7228 		    __func__, __LINE__, LSTA_TO_STA(lsta)->addr, ":",
7229 		    lsta->added_to_drv, keyix, lsta->kc[keyix]);
7230 #endif
7231 
7232 	if (!lsta->added_to_drv)
7233 		return;
7234 
7235 	if (lsta->kc[keyix] == NULL)
7236 		return;
7237 
7238 	iterfunc(hw, vif, LSTA_TO_STA(lsta), lsta->kc[keyix], arg);
7239 }
7240 
7241 void
7242 linuxkpi_ieee80211_iterate_keys(struct ieee80211_hw *hw,
7243     struct ieee80211_vif *vif,
7244     void(*iterfunc)(struct ieee80211_hw *, struct ieee80211_vif *,
7245         struct ieee80211_sta *, struct ieee80211_key_conf *, void *),
7246     void *arg, bool rcu)
7247 {
7248 	struct lkpi_sta *lsta;
7249 	struct lkpi_vif *lvif;
7250 
7251 	lvif = VIF_TO_LVIF(vif);
7252 
7253 	if (rcu) {
7254 		rcu_read_lock_held();		/* XXX-BZ is this correct? */
7255 
7256 		if (vif == NULL) {
7257 			TODO();
7258 		} else {
7259 			list_for_each_entry_rcu(lsta, &lvif->lsta_list, lsta_list) {
7260 				for (ieee80211_keyix keyix = 0; keyix < nitems(lsta->kc);
7261 				    keyix++)
7262 					lkpi_ieee80211_iterate_keys(hw, vif,
7263 					    keyix, lsta, iterfunc, arg);
7264 			}
7265 		}
7266 	} else {
7267 		TODO("Used by suspend/resume; order of keys as installed to "
7268 		"firmware is important; we'll need to rewrite some code for that");
7269 		lockdep_assert_wiphy(hw->wiphy);
7270 
7271 		if (vif == NULL) {
7272 			TODO();
7273 		} else {
7274 			list_for_each_entry(lsta, &lvif->lsta_list, lsta_list) {
7275 				for (ieee80211_keyix keyix = 0; keyix < nitems(lsta->kc);
7276 				    keyix++)
7277 					lkpi_ieee80211_iterate_keys(hw, vif,
7278 					    keyix, lsta, iterfunc, arg);
7279 			}
7280 		}
7281 	}
7282 }
7283 
7284 void
7285 linuxkpi_ieee80211_iterate_chan_contexts(struct ieee80211_hw *hw,
7286     void(*iterfunc)(struct ieee80211_hw *, struct ieee80211_chanctx_conf *,
7287 	void *),
7288     void *arg)
7289 {
7290 	struct lkpi_hw *lhw;
7291 	struct lkpi_chanctx *lchanctx;
7292 
7293 	KASSERT(hw != NULL && iterfunc != NULL,
7294 	    ("%s: hw %p iterfunc %p arg %p\n", __func__, hw, iterfunc, arg));
7295 
7296 	lhw = HW_TO_LHW(hw);
7297 
7298 	rcu_read_lock();
7299 	list_for_each_entry_rcu(lchanctx, &lhw->lchanctx_list, entry) {
7300 		if (!lchanctx->added_to_drv)
7301 			continue;
7302 		iterfunc(hw, &lchanctx->chanctx_conf, arg);
7303 	}
7304 	rcu_read_unlock();
7305 }
7306 
7307 void
7308 linuxkpi_ieee80211_iterate_stations_atomic(struct ieee80211_hw *hw,
7309    void (*iterfunc)(void *, struct ieee80211_sta *), void *arg)
7310 {
7311 	struct lkpi_hw *lhw;
7312 	struct lkpi_vif *lvif;
7313 	struct lkpi_sta *lsta;
7314 	struct ieee80211_sta *sta;
7315 
7316 	KASSERT(hw != NULL && iterfunc != NULL,
7317 	    ("%s: hw %p iterfunc %p arg %p\n", __func__, hw, iterfunc, arg));
7318 
7319 	lhw = HW_TO_LHW(hw);
7320 
7321 	LKPI_80211_LHW_LVIF_LOCK(lhw);
7322 	TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
7323 
7324 		rcu_read_lock();
7325 		list_for_each_entry_rcu(lsta, &lvif->lsta_list, lsta_list) {
7326 			if (!lsta->added_to_drv)
7327 				continue;
7328 			sta = LSTA_TO_STA(lsta);
7329 			iterfunc(arg, sta);
7330 		}
7331 		rcu_read_unlock();
7332 	}
7333 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
7334 }
7335 
7336 struct linuxkpi_ieee80211_regdomain *
7337 lkpi_get_linuxkpi_ieee80211_regdomain(size_t n)
7338 {
7339 	struct linuxkpi_ieee80211_regdomain *regd;
7340 
7341 	regd = kzalloc(sizeof(*regd) + n * sizeof(struct ieee80211_reg_rule),
7342 	    GFP_KERNEL);
7343 	return (regd);
7344 }
7345 
7346 int
7347 linuxkpi_regulatory_set_wiphy_regd_sync(struct wiphy *wiphy,
7348     struct linuxkpi_ieee80211_regdomain *regd)
7349 {
7350 	struct lkpi_hw *lhw;
7351 	struct ieee80211com *ic;
7352 	struct ieee80211_regdomain *rd;
7353 
7354 	lhw = wiphy_priv(wiphy);
7355 	ic = lhw->ic;
7356 
7357 	rd = &ic->ic_regdomain;
7358 	if (rd->isocc[0] == '\0') {
7359 		rd->isocc[0] = regd->alpha2[0];
7360 		rd->isocc[1] = regd->alpha2[1];
7361 	}
7362 
7363 	TODO();
7364 	/* XXX-BZ finish the rest. */
7365 
7366 	return (0);
7367 }
7368 
7369 void
7370 linuxkpi_ieee80211_scan_completed(struct ieee80211_hw *hw,
7371     struct cfg80211_scan_info *info)
7372 {
7373 	struct lkpi_hw *lhw;
7374 	struct ieee80211com *ic;
7375 	struct ieee80211_scan_state *ss;
7376 
7377 	lhw = wiphy_priv(hw->wiphy);
7378 	ic = lhw->ic;
7379 	ss = ic->ic_scan;
7380 
7381 	TRACE_SCAN(ic, "scan_flags %b info { %ju, %6D, aborted %d }",
7382 	    lhw->scan_flags, LKPI_LHW_SCAN_BITS,
7383 	    (uintmax_t)info->scan_start_tsf, info->tsf_bssid, ":",
7384 	    info->aborted);
7385 
7386 	ieee80211_scan_done(ss->ss_vap);
7387 
7388 	LKPI_80211_LHW_SCAN_LOCK(lhw);
7389 	free(lhw->hw_req, M_LKPI80211);
7390 	lhw->hw_req = NULL;
7391 	lhw->scan_flags &= ~LKPI_LHW_SCAN_RUNNING;
7392 	/* The wakeup(lhw) will be called from lkpi_ic_scan_end(). */
7393 	/* wakeup(lhw); */
7394 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
7395 
7396 	return;
7397 }
7398 
7399 static void
7400 lkpi_80211_lhw_rxq_rx_one(struct lkpi_hw *lhw, struct mbuf *m)
7401 {
7402 	struct ieee80211_node *ni;
7403 #ifdef LKPI_80211_USE_MTAG
7404 	struct m_tag *mtag;
7405 #endif
7406 	int ok;
7407 
7408 	ni = NULL;
7409 #ifdef LKPI_80211_USE_MTAG
7410         mtag = m_tag_locate(m, MTAG_ABI_LKPI80211, LKPI80211_TAG_RXNI, NULL);
7411 	if (mtag != NULL) {
7412 		struct lkpi_80211_tag_rxni *rxni;
7413 
7414 		rxni = (struct lkpi_80211_tag_rxni *)(mtag + 1);
7415 		ni = rxni->ni;
7416 	}
7417 #else
7418 	if (m->m_pkthdr.PH_loc.ptr != NULL) {
7419 		ni = m->m_pkthdr.PH_loc.ptr;
7420 		m->m_pkthdr.PH_loc.ptr = NULL;
7421 	}
7422 #endif
7423 
7424 	if (ni != NULL) {
7425 		ok = ieee80211_input_mimo(ni, m);
7426 		ieee80211_free_node(ni);		/* Release the reference. */
7427 		if (ok < 0)
7428 			m_freem(m);
7429 	} else {
7430 		ok = ieee80211_input_mimo_all(lhw->ic, m);
7431 		/* mbuf got consumed. */
7432 	}
7433 
7434 #ifdef LINUXKPI_DEBUG_80211
7435 	if (linuxkpi_debug_80211 & D80211_TRACE_RX)
7436 		printf("TRACE-RX: %s: handled frame type %#0x\n", __func__, ok);
7437 #endif
7438 }
7439 
7440 static void
7441 lkpi_80211_lhw_rxq_task(void *ctx, int pending)
7442 {
7443 	struct lkpi_hw *lhw;
7444 	struct mbufq mq;
7445 	struct mbuf *m;
7446 
7447 	lhw = ctx;
7448 
7449 #ifdef LINUXKPI_DEBUG_80211
7450 	if (linuxkpi_debug_80211 & D80211_TRACE_RX)
7451 		printf("TRACE-RX: %s: lhw %p pending %d mbuf_qlen %d\n",
7452 		    __func__, lhw, pending, mbufq_len(&lhw->rxq));
7453 #endif
7454 
7455 	mbufq_init(&mq, IFQ_MAXLEN);
7456 
7457 	LKPI_80211_LHW_RXQ_LOCK(lhw);
7458 	mbufq_concat(&mq, &lhw->rxq);
7459 	LKPI_80211_LHW_RXQ_UNLOCK(lhw);
7460 
7461 	m = mbufq_dequeue(&mq);
7462 	while (m != NULL) {
7463 		lkpi_80211_lhw_rxq_rx_one(lhw, m);
7464 		m = mbufq_dequeue(&mq);
7465 	}
7466 }
7467 
7468 static void
7469 lkpi_convert_rx_status(struct ieee80211_hw *hw, struct lkpi_sta *lsta,
7470     struct ieee80211_rx_status *rx_status,
7471     struct ieee80211_rx_stats *rx_stats,
7472     uint8_t *rssip)
7473 {
7474 	struct ieee80211_supported_band *supband;
7475 	struct rate_info rxrate;
7476 	int i;
7477 	uint8_t rssi;
7478 
7479 	memset(&rxrate, 0, sizeof(rxrate));
7480 	memset(rx_stats, 0, sizeof(*rx_stats));
7481 	rx_stats->r_flags = IEEE80211_R_NF | IEEE80211_R_RSSI;
7482 	/* XXX-BZ correct hardcoded noise floor, survey data? */
7483 	rx_stats->c_nf = -96;
7484 	if (ieee80211_hw_check(hw, SIGNAL_DBM) &&
7485 	    !(rx_status->flag & RX_FLAG_NO_SIGNAL_VAL))
7486 		rssi = rx_status->signal;
7487 	else
7488 		rssi = rx_stats->c_nf;
7489 	/*
7490 	 * net80211 signal strength data are in .5 dBm units relative to
7491 	 * the current noise floor (see comment in ieee80211_node.h).
7492 	 */
7493 	rssi -= rx_stats->c_nf;
7494 	if (rssip != NULL)
7495 		*rssip = rssi;
7496 	rx_stats->c_rssi = rssi * 2;
7497 	rx_stats->r_flags |= IEEE80211_R_BAND;
7498 	rx_stats->c_band =
7499 	    lkpi_nl80211_band_to_net80211_band(rx_status->band);
7500 	rx_stats->r_flags |= IEEE80211_R_FREQ | IEEE80211_R_IEEE;
7501 	rx_stats->c_freq = rx_status->freq;
7502 	rx_stats->c_ieee = ieee80211_mhz2ieee(rx_stats->c_freq, rx_stats->c_band);
7503 
7504 	rx_stats->c_rx_tsf = rx_status->mactime;
7505 
7506 	/* XXX RX_FLAG_MACTIME_IS_RTAP_TS64 ? */
7507 	if ((rx_status->flag & RX_FLAG_MACTIME) ==
7508 	    (RX_FLAG_MACTIME_START|RX_FLAG_MACTIME_END)) {
7509 		rx_stats->r_flags |= IEEE80211_R_TSF64;
7510 		/* XXX RX_FLAG_MACTIME_PLCP_START ? */
7511 		if ((rx_status->flag & RX_FLAG_MACTIME) == RX_FLAG_MACTIME_START)
7512 			rx_stats->r_flags |= IEEE80211_R_TSF_START;
7513 		if ((rx_status->flag & RX_FLAG_MACTIME) == RX_FLAG_MACTIME_END)
7514 			rx_stats->r_flags |= IEEE80211_R_TSF_END;
7515 		/* XXX-BZ if TSF_END will net80211 do the unwind of time? */
7516 	}
7517 
7518 	if (rx_status->chains != 0) {
7519 		int cc;
7520 		int8_t crssi;
7521 
7522 		rx_stats->c_chain = rx_status->chains;
7523 		rx_stats->r_flags |= IEEE80211_R_C_CHAIN;
7524 
7525 		cc = 0;
7526 		for (i = 0; i < nitems(rx_status->chain_signal); i++) {
7527 			if (!(rx_status->chains & BIT(i)))
7528 				continue;
7529 			crssi = rx_status->chain_signal[i];
7530 			crssi -= rx_stats->c_nf;
7531 			rx_stats->c_rssi_ctl[i] = crssi * 2;
7532 			rx_stats->c_rssi_ext[i] = crssi * 2;	/* XXX _ext ??? ATH thing? */
7533 			/* We currently only have the global noise floor value. */
7534 			rx_stats->c_nf_ctl[i] = rx_stats->c_nf;
7535 			rx_stats->c_nf_ext[i] = rx_stats->c_nf;
7536 			cc++;
7537 		}
7538 		if (cc > 0)
7539 			 rx_stats->r_flags |= (IEEE80211_R_C_NF | IEEE80211_R_C_RSSI);
7540 	}
7541 
7542 	/* XXX-NET80211 We are not going to populate c_phytype! */
7543 
7544 	switch (rx_status->encoding) {
7545 	case RX_ENC_LEGACY:
7546 	{
7547 		uint32_t legacy = 0;
7548 
7549 		supband = hw->wiphy->bands[rx_status->band];
7550 		if (supband != NULL)
7551 			legacy = supband->bitrates[rx_status->rate_idx].bitrate;
7552 		rx_stats->c_rate = legacy;
7553 		rxrate.legacy = legacy;
7554 		/* Is there a LinuxKPI way of reporting IEEE80211_RX_F_CCK / _OFDM? */
7555 		break;
7556 	}
7557 	case RX_ENC_HT:
7558 		rx_stats->c_pktflags |= IEEE80211_RX_F_HT;
7559 		rx_stats->c_rate = rx_status->rate_idx;		/* mcs */
7560 		rxrate.flags |= RATE_INFO_FLAGS_MCS;
7561 		rxrate.mcs = rx_status->rate_idx;
7562 		if ((rx_status->enc_flags & RX_ENC_FLAG_SHORT_GI) != 0) {
7563 			rx_stats->c_pktflags |= IEEE80211_RX_F_SHORTGI;
7564 			rxrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
7565 		}
7566 		break;
7567 	case RX_ENC_VHT:
7568 		rx_stats->c_pktflags |= IEEE80211_RX_F_VHT;
7569 		rx_stats->c_rate = rx_status->rate_idx;		/* mcs */
7570 		rx_stats->c_vhtnss = rx_status->nss;
7571 		rxrate.flags |= RATE_INFO_FLAGS_VHT_MCS;
7572 		rxrate.mcs = rx_status->rate_idx;
7573 		rxrate.nss = rx_status->nss;
7574 		if ((rx_status->enc_flags & RX_ENC_FLAG_SHORT_GI) != 0) {
7575 			rx_stats->c_pktflags |= IEEE80211_RX_F_SHORTGI;
7576 			rxrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
7577 		}
7578 		break;
7579 	case RX_ENC_HE:
7580 		rxrate.flags |= RATE_INFO_FLAGS_HE_MCS;
7581 		rxrate.mcs = rx_status->rate_idx;
7582 		rxrate.nss = rx_status->nss;
7583 		/* XXX TODO */
7584 		TODO("net80211 has not matching encoding for %u", rx_status->encoding);
7585 		break;
7586 	case RX_ENC_EHT:
7587 		rxrate.flags |= RATE_INFO_FLAGS_EHT_MCS;
7588 		rxrate.mcs = rx_status->rate_idx;
7589 		rxrate.nss = rx_status->nss;
7590 		/* XXX TODO */
7591 		TODO("net80211 has not matching encoding for %u", rx_status->encoding);
7592 		break;
7593 	}
7594 
7595 	rxrate.bw = rx_status->bw;
7596 	switch (rx_status->bw) {
7597 	case RATE_INFO_BW_20:
7598 		rx_stats->c_width = IEEE80211_RX_FW_20MHZ;
7599 		break;
7600 	case RATE_INFO_BW_40:
7601 		rx_stats->c_width = IEEE80211_RX_FW_40MHZ;
7602 		break;
7603 	case RATE_INFO_BW_80:
7604 		rx_stats->c_width = IEEE80211_RX_FW_80MHZ;
7605 		break;
7606 	case RATE_INFO_BW_160:
7607 		rx_stats->c_width = IEEE80211_RX_FW_160MHZ;
7608 		break;
7609 	case RATE_INFO_BW_320:
7610 	case RATE_INFO_BW_HE_RU:
7611 	case RATE_INFO_BW_EHT_RU:
7612 	case RATE_INFO_BW_5:
7613 	case RATE_INFO_BW_10:
7614 		TODO("net80211 has not matching bandwidth for %u", rx_status->bw);
7615 		break;
7616 	}
7617 
7618 	if ((rx_status->enc_flags & RX_ENC_FLAG_LDPC) != 0)
7619 		rx_stats->c_pktflags |= IEEE80211_RX_F_LDPC;
7620 	if ((rx_status->enc_flags & RX_ENC_FLAG_STBC_MASK) != 0)
7621 		 rx_stats->c_pktflags |= IEEE80211_RX_F_STBC;
7622 
7623 	/*
7624 	 * We only need these for LKPI_80211_HW_CRYPTO in theory but in
7625 	 * case the hardware does something we do not expect always leave
7626 	 * these enabled.  Leaving this commant as documentation for the || 1.
7627 	 */
7628 #if defined(LKPI_80211_HW_CRYPTO) || 1
7629 	if (rx_status->flag & RX_FLAG_DECRYPTED) {
7630 		rx_stats->c_pktflags |= IEEE80211_RX_F_DECRYPTED;
7631 		/* Only valid if decrypted is set. */
7632 		if (rx_status->flag & RX_FLAG_PN_VALIDATED)
7633 			rx_stats->c_pktflags |= IEEE80211_RX_F_PN_VALIDATED;
7634 	}
7635 	if (rx_status->flag & RX_FLAG_IV_STRIPPED)
7636 		rx_stats->c_pktflags |= IEEE80211_RX_F_IV_STRIP;
7637 	if (rx_status->flag & RX_FLAG_ICV_STRIPPED)
7638 		rx_stats->c_pktflags |= IEEE80211_RX_F_ICV_STRIP;
7639 	if (rx_status->flag & RX_FLAG_MIC_STRIPPED)
7640 		rx_stats->c_pktflags |= IEEE80211_RX_F_MIC_STRIP;
7641 	if (rx_status->flag & RX_FLAG_MMIC_STRIPPED)
7642 		rx_stats->c_pktflags |= IEEE80211_RX_F_MMIC_STRIP;
7643 	if (rx_status->flag & RX_FLAG_MMIC_ERROR)
7644 		rx_stats->c_pktflags |= IEEE80211_RX_F_FAIL_MMIC;
7645 	if (rx_status->flag & RX_FLAG_FAILED_FCS_CRC)
7646 		rx_stats->c_pktflags |= IEEE80211_RX_F_FAIL_FCSCRC;
7647 #endif
7648 
7649 	/* Fill in some sinfo bits to fill gaps not reported byt the driver. */
7650 	if (lsta != NULL) {
7651 		memcpy(&lsta->sinfo.rxrate, &rxrate, sizeof(rxrate));
7652 		lsta->sinfo.filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
7653 
7654 		if (rx_status->chains != 0) {
7655 			lsta->sinfo.chains = rx_status->chains;
7656 			memcpy(lsta->sinfo.chain_signal, rx_status->chain_signal,
7657 			    sizeof(lsta->sinfo.chain_signal));
7658 			lsta->sinfo.filled |= BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL);
7659 		}
7660 	}
7661 }
7662 
7663 #ifdef LINUXKPI_DEBUG_80211
7664 static void
7665 lkpi_rx_log_beacon(struct mbuf *m, struct lkpi_hw *lhw,
7666     struct ieee80211_rx_status *rx_status)
7667 {
7668 	struct ieee80211_mgmt *f;
7669 	uint8_t *e;
7670 	char ssid[IEEE80211_NWID_LEN * 4 + 1];
7671 
7672 	memset(ssid, '\0', sizeof(ssid));
7673 
7674 	f = mtod(m, struct ieee80211_mgmt *);
7675 	e = f->u.beacon.variable;
7676 	/*
7677 	 * Usually SSID is right after the fixed part and for debugging we will
7678 	 * be fine should we miss it if it is not.
7679 	 */
7680 	while ((e - (uint8_t *)f) < m->m_len) {
7681 		if (*e == IEEE80211_ELEMID_SSID)
7682 			break;
7683 		e += (2 + *(e + 1));
7684 	}
7685 	if (*e == IEEE80211_ELEMID_SSID) {
7686 		int i, len;
7687 		char *p;
7688 
7689 		p = ssid;
7690 		len = m->m_len - ((e + 2) - (uint8_t *)f);
7691 		if (len > *(e + 1))
7692 			len = *(e + 1);
7693 		e += 2;
7694 		for (i = 0; i < len; i++) {
7695 			/* Printable character? */
7696 			if (*e >= 0x20 && *e < 0x7f) {
7697 				*p++ = *e++;
7698 			} else {
7699 				snprintf(p, 5, "%#04x", *e++);
7700 				p += 4;
7701 			}
7702 		}
7703 		*p = '\0';
7704 	}
7705 
7706 	/* We print skb, skb->data, m as we are seeing 'ghost beacons'. */
7707 	TRACE_SCAN_BEACON(lhw->ic, "Beacon: scan_flags %b, band %s freq %u chan %-4d "
7708 	    "len %d { %#06x %#06x %6D %6D %6D %#06x %ju %u %#06x SSID '%s' }",
7709 	    lhw->scan_flags, LKPI_LHW_SCAN_BITS,
7710 	    lkpi_nl80211_band_name(rx_status->band), rx_status->freq,
7711 	    linuxkpi_ieee80211_frequency_to_channel(rx_status->freq, 0),
7712 	    m->m_pkthdr.len, f->frame_control, f->duration_id,
7713 	    f->da, ":", f->sa, ":", f->bssid, ":", f->seq_ctrl,
7714 	    (uintmax_t)le64_to_cpu(f->u.beacon.timestamp),
7715 	    le16_to_cpu(f->u.beacon.beacon_int),
7716 	    le16_to_cpu(f->u.beacon.capab_info), ssid);
7717 }
7718 #endif
7719 
7720 /* For %list see comment towards the end of the function. */
7721 void
7722 linuxkpi_ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
7723     struct ieee80211_sta *sta, struct napi_struct *napi __unused,
7724     struct list_head *list __unused)
7725 {
7726 	struct lkpi_hw *lhw;
7727 	struct ieee80211com *ic;
7728 	struct mbuf *m;
7729 	struct skb_shared_info *shinfo;
7730 	struct ieee80211_rx_status *rx_status;
7731 	struct ieee80211_rx_stats rx_stats;
7732 	struct ieee80211_node *ni;
7733 	struct ieee80211vap *vap;
7734 	struct ieee80211_hdr *hdr;
7735 	struct lkpi_sta *lsta;
7736 	int i, offset, ok, error;
7737 	uint8_t rssi;
7738 	bool is_beacon;
7739 
7740 	lhw = HW_TO_LHW(hw);
7741 	ic = lhw->ic;
7742 
7743 	if (skb->len < 2) {
7744 		/* Need 80211 stats here. */
7745 		counter_u64_add(ic->ic_ierrors, 1);
7746 		IMPROVE();
7747 		goto err;
7748 	}
7749 
7750 	/*
7751 	 * For now do the data copy; we can later improve things. Might even
7752 	 * have an mbuf backing the skb data then?
7753 	 */
7754 	m = m_get3(skb->len, M_NOWAIT, MT_DATA, M_PKTHDR);
7755 	if (m == NULL) {
7756 		counter_u64_add(ic->ic_ierrors, 1);
7757 		goto err;
7758 	}
7759 	m_copyback(m, 0, skb->tail - skb->data, skb->data);
7760 
7761 	shinfo = skb_shinfo(skb);
7762 	offset = m->m_len;
7763 	for (i = 0; i < shinfo->nr_frags; i++) {
7764 		m_copyback(m, offset, shinfo->frags[i].size,
7765 		    (uint8_t *)linux_page_address(shinfo->frags[i].page) +
7766 		    shinfo->frags[i].offset);
7767 		offset += shinfo->frags[i].size;
7768 	}
7769 
7770 	rx_status = IEEE80211_SKB_RXCB(skb);
7771 
7772 	hdr = (void *)skb->data;
7773 	is_beacon = ieee80211_is_beacon(hdr->frame_control);
7774 
7775 #ifdef LINUXKPI_DEBUG_80211
7776 	/*
7777 	 * We use the mbuf here as otherwise the variable part might
7778 	 * be in skb frags.
7779 	 */
7780 	if (is_beacon && ((linuxkpi_debug_80211 & D80211_SCAN_BEACON) != 0))
7781 		lkpi_rx_log_beacon(m, lhw, rx_status);
7782 
7783 	if (is_beacon && (linuxkpi_debug_80211 & D80211_TRACE_RX_BEACONS) == 0 &&
7784 	   (linuxkpi_debug_80211 & D80211_SCAN_BEACON) == 0)
7785 		goto no_trace_beacons;
7786 
7787 	if (linuxkpi_debug_80211 & D80211_TRACE_RX)
7788 		printf("TRACE-RX: %s: skb %p l/d/t-len (%u/%u/%u) "
7789 		    "h %p d %p t %p e %p sh %p (%u) m %p plen %u len %u%s\n",
7790 		    __func__, skb, skb->len, skb->data_len,
7791 		    skb->truesize, skb->head, skb->data, skb->tail, skb->end,
7792 		    shinfo, shinfo->nr_frags,
7793 		    m, m->m_pkthdr.len, m->m_len, is_beacon ? " beacon" : "");
7794 
7795 	if (linuxkpi_debug_80211 & D80211_TRACE_RX_DUMP)
7796 		hexdump(mtod(m, const void *), m->m_len, "RX (raw) ", 0);
7797 
7798 	/* Implement a dump_rxcb() !!! */
7799 	if ((linuxkpi_debug_80211 & D80211_TRACE_RX) != 0 ||
7800 	    (linuxkpi_debug_80211 & D80211_SCAN_BEACON) != 0)
7801 		printf("TRACE-RX: %s: RXCB: %ju %ju %u, %b, %u, %#0x, %#0x, "
7802 		    "%u band %u, %u { %d %d %d %d }, %d, %#x %#x %#x %#x %u %u %u\n",
7803 			__func__,
7804 			(uintmax_t)rx_status->boottime_ns,
7805 			(uintmax_t)rx_status->mactime,
7806 			rx_status->device_timestamp,
7807 			rx_status->flag, IEEE80211_RX_STATUS_FLAGS_BITS,
7808 			rx_status->freq,
7809 			rx_status->bw,
7810 			rx_status->encoding,
7811 			rx_status->ampdu_reference,
7812 			rx_status->band,
7813 			rx_status->chains,
7814 			rx_status->chain_signal[0],
7815 			rx_status->chain_signal[1],
7816 			rx_status->chain_signal[2],
7817 			rx_status->chain_signal[3],
7818 			rx_status->signal,
7819 			rx_status->enc_flags,
7820 			rx_status->he_dcm,
7821 			rx_status->he_gi,
7822 			rx_status->he_ru,
7823 			rx_status->zero_length_psdu_type,
7824 			rx_status->nss,
7825 			rx_status->rate_idx);
7826 no_trace_beacons:
7827 #endif
7828 
7829 	lsta = NULL;
7830 	if (sta != NULL) {
7831 		lsta = STA_TO_LSTA(sta);
7832 		ni = ieee80211_ref_node(lsta->ni);
7833 	} else {
7834 		struct ieee80211_frame_min *wh;
7835 
7836 		wh = mtod(m, struct ieee80211_frame_min *);
7837 		ni = ieee80211_find_rxnode(ic, wh);
7838 		if (ni != NULL)
7839 			lsta = ni->ni_drv_data;
7840 	}
7841 
7842 	rssi = 0;
7843 	lkpi_convert_rx_status(hw, lsta, rx_status, &rx_stats, &rssi);
7844 
7845 	ok = ieee80211_add_rx_params(m, &rx_stats);
7846 	if (ok == 0) {
7847 		m_freem(m);
7848 		counter_u64_add(ic->ic_ierrors, 1);
7849 		goto err;
7850 	}
7851 
7852 	if (ni != NULL)
7853 		vap = ni->ni_vap;
7854 	else
7855 		/*
7856 		 * XXX-BZ can we improve this by looking at the frame hdr
7857 		 * or other meta-data passed up?
7858 		 */
7859 		vap = TAILQ_FIRST(&ic->ic_vaps);
7860 
7861 #ifdef LINUXKPI_DEBUG_80211
7862 	if (linuxkpi_debug_80211 & D80211_TRACE_RX)
7863 		printf("TRACE-RX: %s: sta %p lsta %p state %d ni %p vap %p%s\n",
7864 		    __func__, sta, lsta, (lsta != NULL) ? lsta->state : -1,
7865 		    ni, vap, is_beacon ? " beacon" : "");
7866 #endif
7867 
7868 	if (ni != NULL && vap != NULL && is_beacon &&
7869 	    rx_status->device_timestamp > 0 &&
7870 	    m->m_pkthdr.len >= sizeof(struct ieee80211_frame)) {
7871 		struct lkpi_vif *lvif;
7872 		struct ieee80211_vif *vif;
7873 		struct ieee80211_frame *wh;
7874 
7875 		wh = mtod(m, struct ieee80211_frame *);
7876 		if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_bssid))
7877 			goto skip_device_ts;
7878 
7879 		lvif = VAP_TO_LVIF(vap);
7880 		vif = LVIF_TO_VIF(lvif);
7881 
7882 		IMPROVE("TIMING_BEACON_ONLY?");
7883 		/* mac80211 specific (not net80211) so keep it here. */
7884 		vif->bss_conf.sync_device_ts = rx_status->device_timestamp;
7885 		/*
7886 		 * net80211 should take care of the other information (sync_tsf,
7887 		 * sync_dtim_count) as otherwise we need to parse the beacon.
7888 		 */
7889 skip_device_ts:
7890 		;
7891 	}
7892 
7893 	if (vap != NULL && vap->iv_state > IEEE80211_S_INIT &&
7894 	    ieee80211_radiotap_active_vap(vap)) {
7895 		struct lkpi_radiotap_rx_hdr *rtap;
7896 
7897 		rtap = &lhw->rtap_rx;
7898 		rtap->wr_tsft = rx_status->device_timestamp;
7899 		rtap->wr_flags = 0;
7900 		if (rx_status->enc_flags & RX_ENC_FLAG_SHORTPRE)
7901 			rtap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
7902 		if (rx_status->enc_flags & RX_ENC_FLAG_SHORT_GI)
7903 			rtap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTGI;
7904 #if 0	/* .. or it does not given we strip it below. */
7905 		if (ieee80211_hw_check(hw, RX_INCLUDES_FCS))
7906 			rtap->wr_flags |= IEEE80211_RADIOTAP_F_FCS;
7907 #endif
7908 		if (rx_status->flag & RX_FLAG_FAILED_FCS_CRC)
7909 			rtap->wr_flags |= IEEE80211_RADIOTAP_F_BADFCS;
7910 		rtap->wr_rate = 0;
7911 		IMPROVE();
7912 		/* XXX TODO status->encoding / rate_index / bw */
7913 		rtap->wr_chan_freq = htole16(rx_stats.c_freq);
7914 		if (ic->ic_curchan->ic_ieee == rx_stats.c_ieee)
7915 			rtap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
7916 		rtap->wr_dbm_antsignal = rssi;
7917 		rtap->wr_dbm_antnoise = rx_stats.c_nf;
7918 	}
7919 
7920 	if (ieee80211_hw_check(hw, RX_INCLUDES_FCS))
7921 		m_adj(m, -IEEE80211_CRC_LEN);
7922 
7923 #if 0
7924 	if (list != NULL) {
7925 		/*
7926 		* Normally this would be queued up and delivered by
7927 		* netif_receive_skb_list(), napi_gro_receive(), or the like.
7928 		* See mt76::mac80211.c as only current possible consumer.
7929 		*/
7930 		IMPROVE("we simply pass the packet to net80211 to deal with.");
7931 	}
7932 #endif
7933 
7934 	/* Attach meta-information to the mbuf for the deferred RX path. */
7935 	if (ni != NULL) {
7936 #ifdef LKPI_80211_USE_MTAG
7937 		struct m_tag *mtag;
7938 		struct lkpi_80211_tag_rxni *rxni;
7939 
7940 		mtag = m_tag_alloc(MTAG_ABI_LKPI80211, LKPI80211_TAG_RXNI,
7941 		    sizeof(*rxni), IEEE80211_M_NOWAIT);
7942 		if (mtag == NULL) {
7943 			m_freem(m);
7944 			counter_u64_add(ic->ic_ierrors, 1);
7945 			goto err;
7946 		}
7947 		rxni = (struct lkpi_80211_tag_rxni *)(mtag + 1);
7948 		rxni->ni = ni;		/* We hold a reference. */
7949 		m_tag_prepend(m, mtag);
7950 #else
7951 		m->m_pkthdr.PH_loc.ptr = ni;	/* We hold a reference. */
7952 #endif
7953 	}
7954 
7955 	LKPI_80211_LHW_RXQ_LOCK(lhw);
7956 	if (lhw->rxq_stopped) {
7957 		LKPI_80211_LHW_RXQ_UNLOCK(lhw);
7958 		m_freem(m);
7959 		counter_u64_add(ic->ic_ierrors, 1);
7960 		goto err;
7961 	}
7962 
7963 	error = mbufq_enqueue(&lhw->rxq, m);
7964 	if (error != 0) {
7965 		LKPI_80211_LHW_RXQ_UNLOCK(lhw);
7966 		m_freem(m);
7967 		counter_u64_add(ic->ic_ierrors, 1);
7968 #ifdef LINUXKPI_DEBUG_80211
7969 		if (linuxkpi_debug_80211 & D80211_TRACE_RX)
7970 			ic_printf(ni->ni_ic, "%s: mbufq_enqueue failed: %d\n",
7971 			    __func__, error);
7972 #endif
7973 		goto err;
7974 	}
7975 	taskqueue_enqueue(taskqueue_thread, &lhw->rxq_task);
7976 	LKPI_80211_LHW_RXQ_UNLOCK(lhw);
7977 
7978 	IMPROVE();
7979 
7980 err:
7981 	/* The skb is ours so we can free it :-) */
7982 	kfree_skb(skb);
7983 }
7984 
7985 uint8_t
7986 linuxkpi_ieee80211_get_tid(struct ieee80211_hdr *hdr, bool nonqos_ok)
7987 {
7988 	const struct ieee80211_frame *wh;
7989 	uint8_t tid;
7990 
7991 	/* Linux seems to assume this is a QOS-Data-Frame */
7992 	KASSERT(nonqos_ok || ieee80211_is_data_qos(hdr->frame_control),
7993 	   ("%s: hdr %p fc %#06x not qos_data\n", __func__, hdr,
7994 	   hdr->frame_control));
7995 
7996 	wh = (const struct ieee80211_frame *)hdr;
7997 	tid = ieee80211_gettid(wh);
7998 	KASSERT(nonqos_ok || tid == (tid & IEEE80211_QOS_TID), ("%s: tid %u "
7999 	   "not expected (%u?)\n", __func__, tid, IEEE80211_NONQOS_TID));
8000 
8001 	return (tid);
8002 }
8003 
8004 /* -------------------------------------------------------------------------- */
8005 
8006 static void
8007 lkpi_wiphy_work(struct work_struct *work)
8008 {
8009 	struct lkpi_wiphy *lwiphy;
8010 	struct wiphy *wiphy;
8011 	struct wiphy_work *wk;
8012 
8013 	lwiphy = container_of(work, struct lkpi_wiphy, wwk);
8014 	wiphy = LWIPHY_TO_WIPHY(lwiphy);
8015 
8016 	wiphy_lock(wiphy);
8017 
8018 	LKPI_80211_LWIPHY_WORK_LOCK(lwiphy);
8019 	wk = list_first_entry_or_null(&lwiphy->wwk_list, struct wiphy_work, entry);
8020 	/* If there is nothing we do nothing. */
8021 	if (wk == NULL) {
8022 		LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8023 		wiphy_unlock(wiphy);
8024 		return;
8025 	}
8026 	list_del_init(&wk->entry);
8027 
8028 	/* More work to do? */
8029 	if (!list_empty(&lwiphy->wwk_list))
8030 		schedule_work(work);
8031 	LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8032 
8033 	/* Finally call the (*wiphy_work_fn)() function. */
8034 	wk->fn(wiphy, wk);
8035 
8036 	wiphy_unlock(wiphy);
8037 }
8038 
8039 void
8040 linuxkpi_wiphy_work_queue(struct wiphy *wiphy, struct wiphy_work *wwk)
8041 {
8042 	struct lkpi_wiphy *lwiphy;
8043 
8044 	lwiphy = WIPHY_TO_LWIPHY(wiphy);
8045 
8046 	LKPI_80211_LWIPHY_WORK_LOCK(lwiphy);
8047 	/* Do not double-queue. */
8048 	if (list_empty(&wwk->entry))
8049 		list_add_tail(&wwk->entry, &lwiphy->wwk_list);
8050 	LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8051 
8052 	/*
8053 	 * See how ieee80211_queue_work() work continues in Linux or if things
8054 	 * migrate here over time?
8055 	 * Use a system queue from linux/workqueue.h for now.
8056 	 */
8057 	queue_work(system_wq, &lwiphy->wwk);
8058 }
8059 
8060 void
8061 linuxkpi_wiphy_work_cancel(struct wiphy *wiphy, struct wiphy_work *wwk)
8062 {
8063 	struct lkpi_wiphy *lwiphy;
8064 
8065 	lwiphy = WIPHY_TO_LWIPHY(wiphy);
8066 
8067 	LKPI_80211_LWIPHY_WORK_LOCK(lwiphy);
8068 	/* Only cancel if queued. */
8069 	if (!list_empty(&wwk->entry))
8070 		list_del_init(&wwk->entry);
8071 	LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8072 }
8073 
8074 void
8075 linuxkpi_wiphy_work_flush(struct wiphy *wiphy, struct wiphy_work *wwk)
8076 {
8077 	struct lkpi_wiphy *lwiphy;
8078 	struct wiphy_work *wk;
8079 
8080 	lwiphy = WIPHY_TO_LWIPHY(wiphy);
8081 	LKPI_80211_LWIPHY_WORK_LOCK(lwiphy);
8082 	/* If wwk is unset, flush everything; called when wiphy is shut down. */
8083 	if (wwk != NULL && list_empty(&wwk->entry)) {
8084 		LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8085 		return;
8086 	}
8087 
8088 	while (!list_empty(&lwiphy->wwk_list)) {
8089 
8090 		wk = list_first_entry(&lwiphy->wwk_list, struct wiphy_work,
8091 		    entry);
8092 		list_del_init(&wk->entry);
8093 		LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8094 		wk->fn(wiphy, wk);
8095 		LKPI_80211_LWIPHY_WORK_LOCK(lwiphy);
8096 		if (wk == wwk)
8097 			break;
8098 	}
8099 	LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8100 }
8101 
8102 void
8103 lkpi_wiphy_delayed_work_timer(struct timer_list *tl)
8104 {
8105 	struct wiphy_delayed_work *wdwk;
8106 
8107 	wdwk = timer_container_of(wdwk, tl, timer);
8108 	wiphy_work_queue(wdwk->wiphy, &wdwk->work);
8109 }
8110 
8111 void
8112 linuxkpi_wiphy_delayed_work_queue(struct wiphy *wiphy,
8113     struct wiphy_delayed_work *wdwk, unsigned long delay)
8114 {
8115 	if (delay == 0) {
8116 		/* Run right away. */
8117 		del_timer(&wdwk->timer);
8118 		wiphy_work_queue(wiphy, &wdwk->work);
8119 	} else {
8120 		wdwk->wiphy = wiphy;
8121 		mod_timer(&wdwk->timer, jiffies + delay);
8122 	}
8123 }
8124 
8125 void
8126 linuxkpi_wiphy_delayed_work_cancel(struct wiphy *wiphy,
8127     struct wiphy_delayed_work *wdwk)
8128 {
8129 	del_timer_sync(&wdwk->timer);
8130 	wiphy_work_cancel(wiphy, &wdwk->work);
8131 }
8132 
8133 void
8134 linuxkpi_wiphy_delayed_work_flush(struct wiphy *wiphy,
8135     struct wiphy_delayed_work *wdwk)
8136 {
8137 	lockdep_assert_held(&wiphy->mtx);
8138 
8139 	del_timer_sync(&wdwk->timer);
8140 	wiphy_work_flush(wiphy, &wdwk->work);
8141 }
8142 
8143 /* -------------------------------------------------------------------------- */
8144 
8145 struct wiphy *
8146 linuxkpi_wiphy_new(const struct cfg80211_ops *ops, size_t priv_len)
8147 {
8148 	struct lkpi_wiphy *lwiphy;
8149 	struct wiphy *wiphy;
8150 
8151 	lwiphy = kzalloc(sizeof(*lwiphy) + priv_len, GFP_KERNEL);
8152 	if (lwiphy == NULL)
8153 		return (NULL);
8154 	lwiphy->ops = ops;
8155 
8156 	LKPI_80211_LWIPHY_WORK_LOCK_INIT(lwiphy);
8157 	INIT_LIST_HEAD(&lwiphy->wwk_list);
8158 	INIT_WORK(&lwiphy->wwk, lkpi_wiphy_work);
8159 
8160 	wiphy = LWIPHY_TO_WIPHY(lwiphy);
8161 
8162 	mutex_init(&wiphy->mtx);
8163 	TODO();
8164 
8165 	return (wiphy);
8166 }
8167 
8168 void
8169 linuxkpi_wiphy_free(struct wiphy *wiphy)
8170 {
8171 	struct lkpi_wiphy *lwiphy;
8172 
8173 	if (wiphy == NULL)
8174 		return;
8175 
8176 	linuxkpi_wiphy_work_flush(wiphy, NULL);
8177 	mutex_destroy(&wiphy->mtx);
8178 
8179 	lwiphy = WIPHY_TO_LWIPHY(wiphy);
8180 	LKPI_80211_LWIPHY_WORK_LOCK_DESTROY(lwiphy);
8181 
8182 	kfree(lwiphy);
8183 }
8184 
8185 static void
8186 lkpi_wiphy_band_annotate(struct wiphy *wiphy)
8187 {
8188 	int band;
8189 
8190 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
8191 		struct ieee80211_supported_band *supband;
8192 		int i;
8193 
8194 		supband = wiphy->bands[band];
8195 		if (supband == NULL)
8196 			continue;
8197 
8198 		switch (band) {
8199 		case NL80211_BAND_2GHZ:
8200 		case NL80211_BAND_5GHZ:
8201 			break;
8202 		default:
8203 #ifdef LINUXKPI_DEBUG_80211
8204 			IMPROVE("band %d(%s) not yet supported",
8205 			    band, lkpi_nl80211_band_name(band));
8206 			/* For bands added here, also check lkpi_lsta_alloc(). */
8207 #endif
8208 			continue;
8209 		}
8210 
8211 		for (i = 0; i < supband->n_bitrates; i++) {
8212 			switch (band) {
8213 			case NL80211_BAND_2GHZ:
8214 				switch (supband->bitrates[i].bitrate) {
8215 				case 110:
8216 				case 55:
8217 				case 20:
8218 				case 10:
8219 					supband->bitrates[i].flags |=
8220 					    IEEE80211_RATE_MANDATORY_B;
8221 					/* FALLTHROUGH */
8222 				/* 11g only */
8223 				case 240:
8224 				case 120:
8225 				case 60:
8226 					supband->bitrates[i].flags |=
8227 					    IEEE80211_RATE_MANDATORY_G;
8228 					break;
8229 				}
8230 				break;
8231 			case NL80211_BAND_5GHZ:
8232 				switch (supband->bitrates[i].bitrate) {
8233 				case 240:
8234 				case 120:
8235 				case 60:
8236 					supband->bitrates[i].flags |=
8237 					    IEEE80211_RATE_MANDATORY_A;
8238 					break;
8239 				}
8240 				break;
8241 			}
8242 		}
8243 	}
8244 }
8245 
8246 int
8247 linuxkpi_80211_wiphy_register(struct wiphy *wiphy)
8248 {
8249 	TODO("Lots of checks and initialization");
8250 
8251 	lkpi_wiphy_band_annotate(wiphy);
8252 
8253 	return (0);
8254 }
8255 
8256 static uint32_t
8257 lkpi_cfg80211_calculate_bitrate_ht(struct rate_info *rate)
8258 {
8259 	TODO("cfg80211_calculate_bitrate_ht");
8260 	return (rate->legacy);
8261 }
8262 
8263 static uint32_t
8264 lkpi_cfg80211_calculate_bitrate_vht(struct rate_info *rate)
8265 {
8266 	TODO("cfg80211_calculate_bitrate_vht");
8267 	return (rate->legacy);
8268 }
8269 
8270 uint32_t
8271 linuxkpi_cfg80211_calculate_bitrate(struct rate_info *rate)
8272 {
8273 
8274 	/* Beware: order! */
8275 	if (rate->flags & RATE_INFO_FLAGS_MCS)
8276 		return (lkpi_cfg80211_calculate_bitrate_ht(rate));
8277 
8278 	if (rate->flags & RATE_INFO_FLAGS_VHT_MCS)
8279 		return (lkpi_cfg80211_calculate_bitrate_vht(rate));
8280 
8281 	IMPROVE("HE/EHT/...");
8282 
8283 	return (rate->legacy);
8284 }
8285 
8286 uint32_t
8287 linuxkpi_ieee80211_channel_to_frequency(uint32_t channel,
8288     enum nl80211_band band)
8289 {
8290 
8291 	switch (band) {
8292 	case NL80211_BAND_2GHZ:
8293 		return (ieee80211_ieee2mhz(channel, IEEE80211_CHAN_2GHZ));
8294 		break;
8295 	case NL80211_BAND_5GHZ:
8296 		return (ieee80211_ieee2mhz(channel, IEEE80211_CHAN_5GHZ));
8297 		break;
8298 	default:
8299 		/* XXX abort, retry, error, panic? */
8300 		break;
8301 	}
8302 
8303 	return (0);
8304 }
8305 
8306 uint32_t
8307 linuxkpi_ieee80211_frequency_to_channel(uint32_t freq, uint32_t flags __unused)
8308 {
8309 
8310 	return (ieee80211_mhz2ieee(freq, 0));
8311 }
8312 
8313 #if 0
8314 static struct lkpi_sta *
8315 lkpi_find_lsta_by_ni(struct lkpi_vif *lvif, struct ieee80211_node *ni)
8316 {
8317 	struct lkpi_sta *lsta, *temp;
8318 
8319 	rcu_read_lock();
8320 	list_for_each_entry_rcu(lsta, &lvif->lsta_list, lsta_list) {
8321 		if (lsta->ni == ni) {
8322 			rcu_read_unlock();
8323 			return (lsta);
8324 		}
8325 	}
8326 	rcu_read_unlock();
8327 
8328 	return (NULL);
8329 }
8330 #endif
8331 
8332 struct ieee80211_sta *
8333 linuxkpi_ieee80211_find_sta(struct ieee80211_vif *vif, const u8 *peer)
8334 {
8335 	struct lkpi_vif *lvif;
8336 	struct lkpi_sta *lsta;
8337 	struct ieee80211_sta *sta;
8338 
8339 	lvif = VIF_TO_LVIF(vif);
8340 
8341 	rcu_read_lock();
8342 	list_for_each_entry_rcu(lsta, &lvif->lsta_list, lsta_list) {
8343 		sta = LSTA_TO_STA(lsta);
8344 		if (IEEE80211_ADDR_EQ(sta->addr, peer)) {
8345 			rcu_read_unlock();
8346 			return (sta);
8347 		}
8348 	}
8349 	rcu_read_unlock();
8350 	return (NULL);
8351 }
8352 
8353 struct ieee80211_sta *
8354 linuxkpi_ieee80211_find_sta_by_ifaddr(struct ieee80211_hw *hw,
8355     const uint8_t *addr, const uint8_t *ourvifaddr)
8356 {
8357 	struct lkpi_hw *lhw;
8358 	struct lkpi_vif *lvif;
8359 	struct lkpi_sta *lsta;
8360 	struct ieee80211_vif *vif;
8361 	struct ieee80211_sta *sta;
8362 
8363 	lhw = wiphy_priv(hw->wiphy);
8364 	sta = NULL;
8365 
8366 	LKPI_80211_LHW_LVIF_LOCK(lhw);
8367 	TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
8368 
8369 		/* XXX-BZ check our address from the vif. */
8370 
8371 		vif = LVIF_TO_VIF(lvif);
8372 		if (ourvifaddr != NULL &&
8373 		    !IEEE80211_ADDR_EQ(vif->addr, ourvifaddr))
8374 			continue;
8375 		sta = linuxkpi_ieee80211_find_sta(vif, addr);
8376 		if (sta != NULL)
8377 			break;
8378 	}
8379 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
8380 
8381 	if (sta != NULL) {
8382 		lsta = STA_TO_LSTA(sta);
8383 		if (!lsta->added_to_drv)
8384 			return (NULL);
8385 	}
8386 
8387 	return (sta);
8388 }
8389 
8390 struct sk_buff *
8391 linuxkpi_ieee80211_tx_dequeue(struct ieee80211_hw *hw,
8392     struct ieee80211_txq *txq)
8393 {
8394 	struct lkpi_txq *ltxq;
8395 	struct lkpi_vif *lvif;
8396 	struct sk_buff *skb;
8397 
8398 	IMPROVE("wiphy_lock? or assert?");
8399 	skb = NULL;
8400 	ltxq = TXQ_TO_LTXQ(txq);
8401 	ltxq->seen_dequeue = true;
8402 
8403 	if (ltxq->stopped)
8404 		goto stopped;
8405 
8406 	lvif = VIF_TO_LVIF(ltxq->txq.vif);
8407 	if (lvif->hw_queue_stopped[ltxq->txq.ac]) {
8408 		ltxq->stopped = true;
8409 		goto stopped;
8410 	}
8411 
8412 	IMPROVE("hw(TX_FRAG_LIST)");
8413 
8414 	LKPI_80211_LTXQ_LOCK(ltxq);
8415 	skb = skb_dequeue(&ltxq->skbq);
8416 	if (skb != NULL)
8417 		ltxq->frms_dequeued++;
8418 	LKPI_80211_LTXQ_UNLOCK(ltxq);
8419 
8420 stopped:
8421 	return (skb);
8422 }
8423 
8424 void
8425 linuxkpi_ieee80211_txq_get_depth(struct ieee80211_txq *txq,
8426     unsigned long *frame_cnt, unsigned long *byte_cnt)
8427 {
8428 	struct lkpi_txq *ltxq;
8429 	struct sk_buff *skb;
8430 	unsigned long fc, bc;
8431 
8432 	ltxq = TXQ_TO_LTXQ(txq);
8433 
8434 	fc = bc = 0;
8435 	LKPI_80211_LTXQ_LOCK(ltxq);
8436 	skb_queue_walk(&ltxq->skbq, skb) {
8437 		fc++;
8438 		bc += skb->len;
8439 	}
8440 	LKPI_80211_LTXQ_UNLOCK(ltxq);
8441 	if (frame_cnt)
8442 		*frame_cnt = fc;
8443 	if (byte_cnt)
8444 		*byte_cnt = bc;
8445 
8446 	/* Validate that this is doing the correct thing. */
8447 	/* Should we keep track on en/dequeue? */
8448 	IMPROVE();
8449 }
8450 
8451 /*
8452  * We are called from ieee80211_free_txskb() or ieee80211_tx_status().
8453  * The latter tries to derive the success status from the info flags
8454  * passed back from the driver.  rawx_mit() saves the ni on the m and the
8455  * m on the skb for us to be able to give feedback to net80211.
8456  */
8457 static void
8458 _lkpi_ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb,
8459     int status)
8460 {
8461 	struct ieee80211_node *ni;
8462 	struct mbuf *m;
8463 
8464 	if (skb == NULL)
8465 		return;
8466 
8467 	m = skb->m;
8468 	skb->m = NULL;
8469 
8470 	if (m != NULL) {
8471 		ni = m->m_pkthdr.PH_loc.ptr;
8472 		/* Status: 0 is ok, != 0 is error. */
8473 		ieee80211_tx_complete(ni, m, status);
8474 		/* ni & mbuf were consumed. */
8475 	}
8476 }
8477 
8478 void
8479 linuxkpi_ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb,
8480     int status)
8481 {
8482 
8483 	_lkpi_ieee80211_free_txskb(hw, skb, status);
8484 	kfree_skb(skb);
8485 }
8486 
8487 void
8488 linuxkpi_ieee80211_tx_status_ext(struct ieee80211_hw *hw,
8489     struct ieee80211_tx_status *txstat)
8490 {
8491 	struct sk_buff *skb;
8492 	struct ieee80211_tx_info *info, _info = { };
8493 	struct ieee80211_ratectl_tx_status txs;
8494 	struct ieee80211_node *ni;
8495 	int status;
8496 
8497 	skb = txstat->skb;
8498 	if (skb != NULL && skb->m != NULL) {
8499 		struct mbuf *m;
8500 
8501 		m = skb->m;
8502 		ni = m->m_pkthdr.PH_loc.ptr;
8503 		memset(&txs, 0, sizeof(txs));
8504 	} else {
8505 		ni = NULL;
8506 	}
8507 
8508 	/*
8509 	 * If we have no info information on tx, set info to an all-zero struct
8510 	 * to make the code (and debug output) simpler.
8511 	 */
8512 	info = txstat->info;
8513 	if (info == NULL)
8514 		info = &_info;
8515 	if (info->flags & IEEE80211_TX_STAT_ACK) {
8516 		status = 0;	/* No error. */
8517 		txs.status = IEEE80211_RATECTL_TX_SUCCESS;
8518 	} else {
8519 		status = 1;
8520 		txs.status = IEEE80211_RATECTL_TX_FAIL_UNSPECIFIED;
8521 	}
8522 
8523 	if (ni != NULL) {
8524 		txs.pktlen = skb->len;
8525 		txs.flags |= IEEE80211_RATECTL_STATUS_PKTLEN;
8526 		if (info->status.rates[0].count > 1) {
8527 			txs.long_retries = info->status.rates[0].count - 1;	/* 1 + retries in drivers. */
8528 			txs.flags |= IEEE80211_RATECTL_STATUS_LONG_RETRY;
8529 		}
8530 #if 0		/* Unused in net80211 currently. */
8531 		/* XXX-BZ convert check .flags for MCS/VHT/.. */
8532 		txs.final_rate = info->status.rates[0].idx;
8533 		txs.flags |= IEEE80211_RATECTL_STATUS_FINAL_RATE;
8534 #endif
8535 		if (info->status.flags & IEEE80211_TX_STATUS_ACK_SIGNAL_VALID) {
8536 			txs.rssi = info->status.ack_signal;		/* XXX-BZ CONVERT? */
8537 			txs.flags |= IEEE80211_RATECTL_STATUS_RSSI;
8538 		}
8539 
8540 		IMPROVE("only update rate if needed but that requires us to get a proper rate from mo_sta_statistics");
8541 		ieee80211_ratectl_tx_complete(ni, &txs);
8542 		ieee80211_ratectl_rate(ni->ni_vap->iv_bss, NULL, 0);
8543 
8544 #ifdef LINUXKPI_DEBUG_80211
8545 		if (linuxkpi_debug_80211 & D80211_TRACE_TX) {
8546 			printf("TX-RATE: %s: long_retries %d\n", __func__,
8547 			    txs.long_retries);
8548 		}
8549 #endif
8550 	}
8551 
8552 #ifdef LINUXKPI_DEBUG_80211
8553 	if (linuxkpi_debug_80211 & D80211_TRACE_TX)
8554 		printf("TX-STATUS: %s: hw %p skb %p status %d : flags %#x "
8555 		    "band %u hw_queue %u tx_time_est %d : "
8556 		    "rates [ %u %u %#x, %u %u %#x, %u %u %#x, %u %u %#x ] "
8557 		    "ack_signal %u ampdu_ack_len %u ampdu_len %u antenna %u "
8558 		    "tx_time %u flags %#x "
8559 		    "status_driver_data [ %p %p ]\n",
8560 		    __func__, hw, skb, status, info->flags,
8561 		    info->band, info->hw_queue, info->tx_time_est,
8562 		    info->status.rates[0].idx, info->status.rates[0].count,
8563 		    info->status.rates[0].flags,
8564 		    info->status.rates[1].idx, info->status.rates[1].count,
8565 		    info->status.rates[1].flags,
8566 		    info->status.rates[2].idx, info->status.rates[2].count,
8567 		    info->status.rates[2].flags,
8568 		    info->status.rates[3].idx, info->status.rates[3].count,
8569 		    info->status.rates[3].flags,
8570 		    info->status.ack_signal, info->status.ampdu_ack_len,
8571 		    info->status.ampdu_len, info->status.antenna,
8572 		    info->status.tx_time, info->status.flags,
8573 		    info->status.status_driver_data[0],
8574 		    info->status.status_driver_data[1]);
8575 #endif
8576 
8577 	if (txstat->free_list) {
8578 		_lkpi_ieee80211_free_txskb(hw, skb, status);
8579 		if (skb != NULL)
8580 			list_add_tail(&skb->list, txstat->free_list);
8581 	} else {
8582 		linuxkpi_ieee80211_free_txskb(hw, skb, status);
8583 	}
8584 }
8585 
8586 void
8587 linuxkpi_ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
8588 {
8589 	struct ieee80211_tx_status status;
8590 
8591 	memset(&status, 0, sizeof(status));
8592 	status.info = IEEE80211_SKB_CB(skb);
8593 	status.skb = skb;
8594 	/* sta, n_rates, rates, free_list? */
8595 
8596 	ieee80211_tx_status_ext(hw, &status);
8597 }
8598 
8599 /*
8600  * This is an internal bandaid for the moment for the way we glue
8601  * skbs and mbufs together for TX.  Once we have skbs backed by
8602  * mbufs this should go away.
8603  * This is a public function but kept on the private KPI (lkpi_)
8604  * and is not exposed by a header file.
8605  */
8606 static void
8607 lkpi_ieee80211_free_skb_mbuf(void *p)
8608 {
8609 	struct ieee80211_node *ni;
8610 	struct mbuf *m;
8611 
8612 	if (p == NULL)
8613 		return;
8614 
8615 	m = (struct mbuf *)p;
8616 	M_ASSERTPKTHDR(m);
8617 
8618 	ni = m->m_pkthdr.PH_loc.ptr;
8619 	m->m_pkthdr.PH_loc.ptr = NULL;
8620 	if (ni != NULL)
8621 		ieee80211_free_node(ni);
8622 	m_freem(m);
8623 }
8624 
8625 void
8626 linuxkpi_ieee80211_queue_delayed_work(struct ieee80211_hw *hw,
8627     struct delayed_work *w, int delay)
8628 {
8629 	struct lkpi_hw *lhw;
8630 
8631 	/* Need to make sure hw is in a stable (non-suspended) state. */
8632 	IMPROVE();
8633 
8634 	lhw = HW_TO_LHW(hw);
8635 	queue_delayed_work(lhw->workq, w, delay);
8636 }
8637 
8638 void
8639 linuxkpi_ieee80211_queue_work(struct ieee80211_hw *hw,
8640     struct work_struct *w)
8641 {
8642 	struct lkpi_hw *lhw;
8643 
8644 	/* Need to make sure hw is in a stable (non-suspended) state. */
8645 	IMPROVE();
8646 
8647 	lhw = HW_TO_LHW(hw);
8648 	queue_work(lhw->workq, w);
8649 }
8650 
8651 struct sk_buff *
8652 linuxkpi_ieee80211_probereq_get(struct ieee80211_hw *hw, const uint8_t *addr,
8653     const uint8_t *ssid, size_t ssid_len, size_t tailroom)
8654 {
8655 	struct sk_buff *skb;
8656 	struct ieee80211_frame *wh;
8657 	uint8_t *p;
8658 	size_t len;
8659 
8660 	len = sizeof(*wh);
8661 	len += 2 + ssid_len;
8662 
8663 	skb = dev_alloc_skb(hw->extra_tx_headroom + len + tailroom);
8664 	if (skb == NULL)
8665 		return (NULL);
8666 
8667 	skb_reserve(skb, hw->extra_tx_headroom);
8668 
8669 	wh = skb_put_zero(skb, sizeof(*wh));
8670 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0;
8671 	wh->i_fc[0] |= IEEE80211_FC0_SUBTYPE_PROBE_REQ | IEEE80211_FC0_TYPE_MGT;
8672 	IEEE80211_ADDR_COPY(wh->i_addr1, ieee80211broadcastaddr);
8673 	IEEE80211_ADDR_COPY(wh->i_addr2, addr);
8674 	IEEE80211_ADDR_COPY(wh->i_addr3, ieee80211broadcastaddr);
8675 
8676 	p = skb_put(skb, 2 + ssid_len);
8677 	*p++ = IEEE80211_ELEMID_SSID;
8678 	*p++ = ssid_len;
8679 	if (ssid_len > 0)
8680 		memcpy(p, ssid, ssid_len);
8681 
8682 	return (skb);
8683 }
8684 
8685 struct sk_buff *
8686 linuxkpi_ieee80211_pspoll_get(struct ieee80211_hw *hw,
8687     struct ieee80211_vif *vif)
8688 {
8689 	struct lkpi_vif *lvif;
8690 	struct ieee80211vap *vap;
8691 	struct sk_buff *skb;
8692 	struct ieee80211_frame_pspoll *psp;
8693 	uint16_t v;
8694 
8695 	skb = dev_alloc_skb(hw->extra_tx_headroom + sizeof(*psp));
8696 	if (skb == NULL)
8697 		return (NULL);
8698 
8699 	skb_reserve(skb, hw->extra_tx_headroom);
8700 
8701 	lvif = VIF_TO_LVIF(vif);
8702 	vap = LVIF_TO_VAP(lvif);
8703 
8704 	psp = skb_put_zero(skb, sizeof(*psp));
8705 	psp->i_fc[0] = IEEE80211_FC0_VERSION_0;
8706 	psp->i_fc[0] |= IEEE80211_FC0_SUBTYPE_PS_POLL | IEEE80211_FC0_TYPE_CTL;
8707 	v = htole16(vif->cfg.aid | 1<<15 | 1<<16);
8708 	memcpy(&psp->i_aid, &v, sizeof(v));
8709 	IEEE80211_ADDR_COPY(psp->i_bssid, vap->iv_bss->ni_macaddr);
8710 	IEEE80211_ADDR_COPY(psp->i_ta, vif->addr);
8711 
8712 	return (skb);
8713 }
8714 
8715 struct sk_buff *
8716 linuxkpi_ieee80211_nullfunc_get(struct ieee80211_hw *hw,
8717     struct ieee80211_vif *vif, int linkid, bool qos)
8718 {
8719 	struct lkpi_vif *lvif;
8720 	struct ieee80211vap *vap;
8721 	struct sk_buff *skb;
8722 	struct ieee80211_frame *nullf;
8723 
8724 	IMPROVE("linkid");
8725 
8726 	skb = dev_alloc_skb(hw->extra_tx_headroom + sizeof(*nullf));
8727 	if (skb == NULL)
8728 		return (NULL);
8729 
8730 	skb_reserve(skb, hw->extra_tx_headroom);
8731 
8732 	lvif = VIF_TO_LVIF(vif);
8733 	vap = LVIF_TO_VAP(lvif);
8734 
8735 	nullf = skb_put_zero(skb, sizeof(*nullf));
8736 	nullf->i_fc[0] = IEEE80211_FC0_VERSION_0;
8737 	nullf->i_fc[0] |= IEEE80211_FC0_SUBTYPE_NODATA | IEEE80211_FC0_TYPE_DATA;
8738 	nullf->i_fc[1] = IEEE80211_FC1_DIR_TODS;
8739 
8740 	IEEE80211_ADDR_COPY(nullf->i_addr1, vap->iv_bss->ni_bssid);
8741 	IEEE80211_ADDR_COPY(nullf->i_addr2, vif->addr);
8742 	IEEE80211_ADDR_COPY(nullf->i_addr3, vap->iv_bss->ni_macaddr);
8743 
8744 	return (skb);
8745 }
8746 
8747 struct wireless_dev *
8748 linuxkpi_ieee80211_vif_to_wdev(struct ieee80211_vif *vif)
8749 {
8750 	struct lkpi_vif *lvif;
8751 
8752 	lvif = VIF_TO_LVIF(vif);
8753 	return (&lvif->wdev);
8754 }
8755 
8756 void
8757 linuxkpi_ieee80211_connection_loss(struct ieee80211_vif *vif)
8758 {
8759 	struct lkpi_vif *lvif;
8760 	struct ieee80211vap *vap;
8761 	enum ieee80211_state nstate;
8762 	int arg;
8763 
8764 	lvif = VIF_TO_LVIF(vif);
8765 	vap = LVIF_TO_VAP(lvif);
8766 
8767 	/*
8768 	 * Go to init; otherwise we need to elaborately check state and
8769 	 * handle accordingly, e.g., if in RUN we could call iv_bmiss.
8770 	 * Let the statemachine handle all neccessary changes.
8771 	 */
8772 	nstate = IEEE80211_S_INIT;
8773 	arg = 0;	/* Not a valid reason. */
8774 
8775 	ic_printf(vap->iv_ic, "%s: vif %p vap %p state %s (synched %d, assoc %d "
8776 	    "beacons %d dtim_period %d)\n", __func__, vif, vap,
8777 	    ieee80211_state_name[vap->iv_state],
8778 	    lvif->lvif_bss_synched, vif->cfg.assoc, lvif->beacons,
8779 	    vif->bss_conf.dtim_period);
8780 	ieee80211_new_state(vap, nstate, arg);
8781 }
8782 
8783 void
8784 linuxkpi_ieee80211_beacon_loss(struct ieee80211_vif *vif)
8785 {
8786 	struct lkpi_vif *lvif;
8787 	struct ieee80211vap *vap;
8788 
8789 	lvif = VIF_TO_LVIF(vif);
8790 	vap = LVIF_TO_VAP(lvif);
8791 
8792 	ic_printf(vap->iv_ic, "%s: vif %p vap %p state %s (synched %d, assoc %d "
8793 	    "beacons %d dtim_period %d)\n", __func__, vif, vap,
8794 	    ieee80211_state_name[vap->iv_state],
8795 	    lvif->lvif_bss_synched, vif->cfg.assoc, lvif->beacons,
8796 	    vif->bss_conf.dtim_period);
8797 	ieee80211_beacon_miss(vap->iv_ic);
8798 }
8799 
8800 /* -------------------------------------------------------------------------- */
8801 
8802 void
8803 linuxkpi_ieee80211_stop_queue(struct ieee80211_hw *hw, int qnum)
8804 {
8805 	struct lkpi_hw *lhw;
8806 	struct lkpi_vif *lvif;
8807 	struct ieee80211_vif *vif;
8808 	int ac_count, ac;
8809 
8810 	KASSERT(qnum < hw->queues, ("%s: qnum %d >= hw->queues %d, hw %p\n",
8811 	    __func__, qnum, hw->queues, hw));
8812 
8813 	lhw = wiphy_priv(hw->wiphy);
8814 
8815 	/* See lkpi_ic_vap_create(). */
8816 	if (hw->queues >= IEEE80211_NUM_ACS)
8817 		ac_count = IEEE80211_NUM_ACS;
8818 	else
8819 		ac_count = 1;
8820 
8821 	LKPI_80211_LHW_LVIF_LOCK(lhw);
8822 	TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
8823 
8824 		vif = LVIF_TO_VIF(lvif);
8825 		for (ac = 0; ac < ac_count; ac++) {
8826 			IMPROVE_TXQ("LOCKING");
8827 			if (qnum == vif->hw_queue[ac]) {
8828 #ifdef LINUXKPI_DEBUG_80211
8829 				/*
8830 				 * For now log this to better understand
8831 				 * how this is supposed to work.
8832 				 */
8833 				if (lvif->hw_queue_stopped[ac] &&
8834 				    (linuxkpi_debug_80211 & D80211_IMPROVE_TXQ) != 0)
8835 					ic_printf(lhw->ic, "%s:%d: lhw %p hw %p "
8836 					    "lvif %p vif %p ac %d qnum %d already "
8837 					    "stopped\n", __func__, __LINE__,
8838 					    lhw, hw, lvif, vif, ac, qnum);
8839 #endif
8840 				lvif->hw_queue_stopped[ac] = true;
8841 			}
8842 		}
8843 	}
8844 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
8845 }
8846 
8847 void
8848 linuxkpi_ieee80211_stop_queues(struct ieee80211_hw *hw)
8849 {
8850 	int i;
8851 
8852 	IMPROVE_TXQ("Locking; do we need further info?");
8853 	for (i = 0; i < hw->queues; i++)
8854 		linuxkpi_ieee80211_stop_queue(hw, i);
8855 }
8856 
8857 
8858 static void
8859 lkpi_ieee80211_wake_queues(struct ieee80211_hw *hw, int hwq)
8860 {
8861 	struct lkpi_hw *lhw;
8862 	struct lkpi_vif *lvif;
8863 	struct lkpi_sta *lsta;
8864 	int ac_count, ac, tid;
8865 
8866 	/* See lkpi_ic_vap_create(). */
8867 	if (hw->queues >= IEEE80211_NUM_ACS)
8868 		ac_count = IEEE80211_NUM_ACS;
8869 	else
8870 		ac_count = 1;
8871 
8872 	lhw = wiphy_priv(hw->wiphy);
8873 
8874 	IMPROVE_TXQ("Locking");
8875 	LKPI_80211_LHW_LVIF_LOCK(lhw);
8876 	TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
8877 		struct ieee80211_vif *vif;
8878 
8879 		vif = LVIF_TO_VIF(lvif);
8880 		for (ac = 0; ac < ac_count; ac++) {
8881 
8882 			if (hwq == vif->hw_queue[ac]) {
8883 
8884 				/* XXX-BZ what about software scan? */
8885 
8886 #ifdef LINUXKPI_DEBUG_80211
8887 				/*
8888 				 * For now log this to better understand
8889 				 * how this is supposed to work.
8890 				 */
8891 				if (!lvif->hw_queue_stopped[ac] &&
8892 				    (linuxkpi_debug_80211 & D80211_IMPROVE_TXQ) != 0)
8893 					ic_printf(lhw->ic, "%s:%d: lhw %p hw %p "
8894 					    "lvif %p vif %p ac %d hw_q not stopped\n",
8895 					    __func__, __LINE__,
8896 					    lhw, hw, lvif, vif, ac);
8897 #endif
8898 				lvif->hw_queue_stopped[ac] = false;
8899 
8900 				rcu_read_lock();
8901 				list_for_each_entry_rcu(lsta, &lvif->lsta_list, lsta_list) {
8902 					struct ieee80211_sta *sta;
8903 
8904 					sta = LSTA_TO_STA(lsta);
8905 					for (tid = 0; tid < nitems(sta->txq); tid++) {
8906 						struct lkpi_txq *ltxq;
8907 
8908 						if (sta->txq[tid] == NULL)
8909 							continue;
8910 
8911 						if (sta->txq[tid]->ac != ac)
8912 							continue;
8913 
8914 						ltxq = TXQ_TO_LTXQ(sta->txq[tid]);
8915 						if (!ltxq->stopped)
8916 							continue;
8917 
8918 						ltxq->stopped = false;
8919 
8920 						if (!skb_queue_empty(&ltxq->skbq))
8921 							lkpi_80211_mo_wake_tx_queue(hw, sta->txq[tid], false);
8922 					}
8923 				}
8924 				rcu_read_unlock();
8925 			}
8926 		}
8927 	}
8928 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
8929 }
8930 
8931 static void
8932 lkpi_ieee80211_wake_queues_locked(struct ieee80211_hw *hw)
8933 {
8934 	int i;
8935 
8936 	IMPROVE_TXQ("Is this all/enough here?");
8937 	for (i = 0; i < hw->queues; i++)
8938 		lkpi_ieee80211_wake_queues(hw, i);
8939 }
8940 
8941 void
8942 linuxkpi_ieee80211_wake_queues(struct ieee80211_hw *hw)
8943 {
8944 	struct lkpi_hw *lhw;
8945 	unsigned long flags;
8946 
8947 	lhw = HW_TO_LHW(hw);
8948 
8949 	spin_lock_irqsave(&lhw->txq_lock, flags);
8950 	lkpi_ieee80211_wake_queues_locked(hw);
8951 	spin_unlock_irqrestore(&lhw->txq_lock, flags);
8952 }
8953 
8954 void
8955 linuxkpi_ieee80211_wake_queue(struct ieee80211_hw *hw, int qnum)
8956 {
8957 	struct lkpi_hw *lhw;
8958 	unsigned long flags;
8959 
8960 	KASSERT(qnum < hw->queues, ("%s: qnum %d >= hw->queues %d, hw %p\n",
8961 	    __func__, qnum, hw->queues, hw));
8962 
8963 	lhw = HW_TO_LHW(hw);
8964 
8965 	spin_lock_irqsave(&lhw->txq_lock, flags);
8966 	lkpi_ieee80211_wake_queues(hw, qnum);
8967 	spin_unlock_irqrestore(&lhw->txq_lock, flags);
8968 }
8969 
8970 void
8971 linuxkpi_ieee80211_handle_wake_tx_queue(struct ieee80211_hw *hw,
8972     struct ieee80211_txq *txq)
8973 {
8974 	struct lkpi_hw *lhw;
8975 
8976 	lhw = HW_TO_LHW(hw);
8977 
8978 	LKPI_80211_LHW_TXQ_LOCK(lhw);
8979 	ieee80211_txq_schedule_start(hw, txq->ac);
8980 	do {
8981 		struct lkpi_txq *ltxq;
8982 		struct ieee80211_txq *ntxq;
8983 		struct ieee80211_tx_control control;
8984 		struct sk_buff *skb;
8985 
8986 		ntxq = ieee80211_next_txq(hw, txq->ac);
8987 		if (ntxq == NULL)
8988 			break;
8989 		ltxq = TXQ_TO_LTXQ(ntxq);
8990 
8991 		memset(&control, 0, sizeof(control));
8992 		control.sta = ntxq->sta;
8993 		do {
8994 			skb = linuxkpi_ieee80211_tx_dequeue(hw, ntxq);
8995 			if (skb == NULL)
8996 				break;
8997 			ltxq->frms_tx++;
8998 			lkpi_80211_mo_tx(hw, &control, skb);
8999 		} while(1);
9000 
9001 		ieee80211_return_txq(hw, ntxq, false);
9002 	} while (1);
9003 	ieee80211_txq_schedule_end(hw, txq->ac);
9004 	LKPI_80211_LHW_TXQ_UNLOCK(lhw);
9005 }
9006 
9007 /* -------------------------------------------------------------------------- */
9008 
9009 /* This is just hardware queues. */
9010 /*
9011  * Being called from the driver thus use _bh() locking.
9012  */
9013 void
9014 linuxkpi_ieee80211_txq_schedule_start(struct ieee80211_hw *hw, uint8_t ac)
9015 {
9016 	struct lkpi_hw *lhw;
9017 
9018 	lhw = HW_TO_LHW(hw);
9019 
9020 	if (ac >= IEEE80211_NUM_ACS) {
9021 		ic_printf(lhw->ic, "%s: ac %u out of bounds.\n", __func__, ac);
9022 		return;
9023 	}
9024 
9025 	spin_lock_bh(&lhw->txq_scheduled_lock[ac]);
9026 	IMPROVE("check AIRTIME_FAIRNESS");
9027 	if (++lhw->txq_generation[ac] == 0)
9028 		lhw->txq_generation[ac]++;
9029 	spin_unlock_bh(&lhw->txq_scheduled_lock[ac]);
9030 }
9031 
9032 struct ieee80211_txq *
9033 linuxkpi_ieee80211_next_txq(struct ieee80211_hw *hw, uint8_t ac)
9034 {
9035 	struct lkpi_hw *lhw;
9036 	struct ieee80211_txq *txq;
9037 	struct lkpi_txq *ltxq;
9038 
9039 	lhw = HW_TO_LHW(hw);
9040 	txq = NULL;
9041 
9042 	if (ac >= IEEE80211_NUM_ACS) {
9043 		ic_printf(lhw->ic, "%s: ac %u out of bounds.\n", __func__, ac);
9044 		return (NULL);
9045 	}
9046 
9047 	spin_lock_bh(&lhw->txq_scheduled_lock[ac]);
9048 
9049 	/* Check that we are scheduled. */
9050 	if (lhw->txq_generation[ac] == 0)
9051 		goto out;
9052 
9053 	ltxq = TAILQ_FIRST(&lhw->txq_scheduled[ac]);
9054 	if (ltxq == NULL)
9055 		goto out;
9056 	if (ltxq->txq_generation == lhw->txq_generation[ac])
9057 		goto out;
9058 
9059 	IMPROVE("check AIRTIME_FAIRNESS");
9060 
9061 	TAILQ_REMOVE(&lhw->txq_scheduled[ac], ltxq, txq_entry);
9062 	ltxq->txq_generation = lhw->txq_generation[ac];
9063 	txq = &ltxq->txq;
9064 	TAILQ_ELEM_INIT(ltxq, txq_entry);
9065 
9066 out:
9067 	spin_unlock_bh(&lhw->txq_scheduled_lock[ac]);
9068 
9069 	return (txq);
9070 }
9071 
9072 void linuxkpi_ieee80211_schedule_txq(struct ieee80211_hw *hw,
9073     struct ieee80211_txq *txq, bool withoutpkts)
9074 {
9075 	struct lkpi_hw *lhw;
9076 	struct lkpi_txq *ltxq;
9077 	bool ltxq_empty;
9078 
9079 	ltxq = TXQ_TO_LTXQ(txq);
9080 
9081 	/* Only schedule if work to do or asked to anyway. */
9082 	LKPI_80211_LTXQ_LOCK(ltxq);
9083 	ltxq_empty = skb_queue_empty(&ltxq->skbq);
9084 	LKPI_80211_LTXQ_UNLOCK(ltxq);
9085 	if (!withoutpkts && ltxq_empty)
9086 		goto out;
9087 
9088 	lhw = HW_TO_LHW(hw);
9089 	spin_lock_bh(&lhw->txq_scheduled_lock[txq->ac]);
9090 	/*
9091 	 * Make sure we do not double-schedule. We do this by checking tqe_prev,
9092 	 * the previous entry in our tailq. tqe_prev is always valid if this entry
9093 	 * is queued, tqe_next may be NULL if this is the only element in the list.
9094 	 */
9095 	if (ltxq->txq_entry.tqe_prev != NULL)
9096 		goto unlock;
9097 
9098 	TAILQ_INSERT_TAIL(&lhw->txq_scheduled[txq->ac], ltxq, txq_entry);
9099 unlock:
9100 	spin_unlock_bh(&lhw->txq_scheduled_lock[txq->ac]);
9101 
9102 out:
9103 	return;
9104 }
9105 
9106 /* -------------------------------------------------------------------------- */
9107 
9108 struct lkpi_cfg80211_bss {
9109 	u_int refcnt;
9110 	struct cfg80211_bss bss;
9111 };
9112 
9113 struct lkpi_cfg80211_get_bss_iter_lookup {
9114 	struct wiphy *wiphy;
9115 	struct linuxkpi_ieee80211_channel *chan;
9116 	const uint8_t *bssid;
9117 	const uint8_t *ssid;
9118 	size_t ssid_len;
9119 	enum ieee80211_bss_type bss_type;
9120 	enum ieee80211_privacy privacy;
9121 
9122 	/*
9123 	 * Something to store a copy of the result as the net80211 scan cache
9124 	 * is not refoucnted so a scan entry might go away any time.
9125 	 */
9126 	bool match;
9127 	struct cfg80211_bss *bss;
9128 };
9129 
9130 static void
9131 lkpi_cfg80211_get_bss_iterf(void *arg, const struct ieee80211_scan_entry *se)
9132 {
9133 	struct lkpi_cfg80211_get_bss_iter_lookup *lookup;
9134 	size_t ielen;
9135 
9136 	lookup = arg;
9137 
9138 	/* Do not try to find another match. */
9139 	if (lookup->match)
9140 		return;
9141 
9142 	/* Nothing to store result. */
9143 	if (lookup->bss == NULL)
9144 		return;
9145 
9146 	if (lookup->privacy != IEEE80211_PRIVACY_ANY) {
9147 		/* if (se->se_capinfo & IEEE80211_CAPINFO_PRIVACY) */
9148 		/* We have no idea what to compare to as the drivers only request ANY */
9149 		return;
9150 	}
9151 
9152 	if (lookup->bss_type != IEEE80211_BSS_TYPE_ANY) {
9153 		/* if (se->se_capinfo & (IEEE80211_CAPINFO_IBSS|IEEE80211_CAPINFO_ESS)) */
9154 		/* We have no idea what to compare to as the drivers only request ANY */
9155 		return;
9156 	}
9157 
9158 	if (lookup->chan != NULL) {
9159 		struct linuxkpi_ieee80211_channel *chan;
9160 
9161 		chan = linuxkpi_ieee80211_get_channel(lookup->wiphy,
9162 		    se->se_chan->ic_freq);
9163 		if (chan == NULL || chan != lookup->chan)
9164 			return;
9165 	}
9166 
9167 	if (lookup->bssid && !IEEE80211_ADDR_EQ(lookup->bssid, se->se_bssid))
9168 		return;
9169 
9170 	if (lookup->ssid) {
9171 		if (lookup->ssid_len != se->se_ssid[1] ||
9172 		    se->se_ssid[1] == 0)
9173 			return;
9174 		if (memcmp(lookup->ssid, se->se_ssid+2, lookup->ssid_len) != 0)
9175 			return;
9176 	}
9177 
9178 	ielen = se->se_ies.len;
9179 
9180 	lookup->bss->ies = malloc(sizeof(*lookup->bss->ies) + ielen,
9181 	    M_LKPI80211, M_NOWAIT | M_ZERO);
9182 	if (lookup->bss->ies == NULL)
9183 		return;
9184 
9185 	lookup->bss->ies->data = (uint8_t *)lookup->bss->ies + sizeof(*lookup->bss->ies);
9186 	lookup->bss->ies->len = ielen;
9187 	if (ielen)
9188 		memcpy(lookup->bss->ies->data, se->se_ies.data, ielen);
9189 
9190 	lookup->match = true;
9191 }
9192 
9193 struct cfg80211_bss *
9194 linuxkpi_cfg80211_get_bss(struct wiphy *wiphy, struct linuxkpi_ieee80211_channel *chan,
9195     const uint8_t *bssid, const uint8_t *ssid, size_t ssid_len,
9196     enum ieee80211_bss_type bss_type, enum ieee80211_privacy privacy)
9197 {
9198 	struct lkpi_cfg80211_bss *lbss;
9199 	struct lkpi_cfg80211_get_bss_iter_lookup lookup;
9200 	struct lkpi_hw *lhw;
9201 	struct ieee80211vap *vap;
9202 
9203 	lhw = wiphy_priv(wiphy);
9204 
9205 	/* Let's hope we can alloc. */
9206 	lbss = malloc(sizeof(*lbss), M_LKPI80211, M_NOWAIT | M_ZERO);
9207 	if (lbss == NULL) {
9208 		ic_printf(lhw->ic, "%s: alloc failed.\n", __func__);
9209 		return (NULL);
9210 	}
9211 
9212 	lookup.wiphy = wiphy;
9213 	lookup.chan = chan;
9214 	lookup.bssid = bssid;
9215 	lookup.ssid = ssid;
9216 	lookup.ssid_len = ssid_len;
9217 	lookup.bss_type = bss_type;
9218 	lookup.privacy = privacy;
9219 	lookup.match = false;
9220 	lookup.bss = &lbss->bss;
9221 
9222 	IMPROVE("Iterate over all VAPs comparing perm_addr and addresses?");
9223 	vap = TAILQ_FIRST(&lhw->ic->ic_vaps);
9224 	ieee80211_scan_iterate(vap, lkpi_cfg80211_get_bss_iterf, &lookup);
9225 	if (!lookup.match) {
9226 		free(lbss, M_LKPI80211);
9227 		return (NULL);
9228 	}
9229 
9230 	refcount_init(&lbss->refcnt, 1);
9231 	return (&lbss->bss);
9232 }
9233 
9234 void
9235 linuxkpi_cfg80211_put_bss(struct wiphy *wiphy, struct cfg80211_bss *bss)
9236 {
9237 	struct lkpi_cfg80211_bss *lbss;
9238 
9239 	lbss = container_of(bss, struct lkpi_cfg80211_bss, bss);
9240 
9241 	/* Free everything again on refcount ... */
9242 	if (refcount_release(&lbss->refcnt)) {
9243 		free(lbss->bss.ies, M_LKPI80211);
9244 		free(lbss, M_LKPI80211);
9245 	}
9246 }
9247 
9248 void
9249 linuxkpi_cfg80211_bss_flush(struct wiphy *wiphy)
9250 {
9251 	struct lkpi_hw *lhw;
9252 	struct ieee80211com *ic;
9253 	struct ieee80211vap *vap;
9254 
9255 	lhw = wiphy_priv(wiphy);
9256 	ic = lhw->ic;
9257 
9258 	/*
9259 	 * If we haven't called ieee80211_ifattach() yet
9260 	 * or there is no VAP, there are no scans to flush.
9261 	 */
9262 	if (ic == NULL ||
9263 	    (lhw->sc_flags & LKPI_MAC80211_DRV_STARTED) == 0)
9264 		return;
9265 
9266 	/* Should only happen on the current one? Not seen it late enough. */
9267 	IEEE80211_LOCK(ic);
9268 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
9269 		ieee80211_scan_flush(vap);
9270 	IEEE80211_UNLOCK(ic);
9271 }
9272 
9273 /* -------------------------------------------------------------------------- */
9274 
9275 static bool
9276 cfg80211_chan_def_are_same(struct cfg80211_chan_def *cd1,
9277     struct cfg80211_chan_def *cd2)
9278 {
9279 
9280 	if (cd1 == cd2)
9281 		return (true);
9282 
9283 	if (cd1 == NULL || cd2 == NULL)
9284 		return (false);
9285 
9286 	if (cd1->chan != cd2->chan)
9287 		return (false);
9288 
9289 	if (cd1->width != cd2->width)
9290 		return (false);
9291 
9292 	if (cd1->center_freq1 != cd2->center_freq1)
9293 		return (false);
9294 
9295 	if (cd1->center_freq2 != cd2->center_freq2)
9296 		return (false);
9297 
9298 	if (cd1->punctured != cd2->punctured)
9299 		return (false);
9300 
9301 	return (true);
9302 }
9303 
9304 /*
9305  * hw->conf get initialized/set in various places for us:
9306  * - linuxkpi_ieee80211_alloc_hw(): flags
9307  * - linuxkpi_ieee80211_ifattach(): chandef
9308  * - lkpi_ic_vap_create(): listen_interval
9309  * - lkpi_ic_set_channel(): chandef, flags
9310  */
9311 
9312 static int
9313 lkpi_80211_update_chandef(struct ieee80211_hw *hw,
9314     struct ieee80211_chanctx_conf *new)
9315 {
9316 	struct lkpi_hw *lhw;
9317 	struct cfg80211_chan_def *cd;
9318 	uint32_t changed;
9319 	int error;
9320 	bool same;
9321 
9322 	lockdep_assert_wiphy(hw->wiphy);
9323 
9324 	lhw = HW_TO_LHW(hw);
9325 	if (!lhw->emulate_chanctx)
9326 		return (0);
9327 
9328 	if (new == NULL || new->def.chan == NULL) {
9329 		/*
9330 		 * In case of remove "new" is NULL, we need to get us to some
9331 		 * basic channel width but we'd also need to set the channel
9332 		 * accordingly somewhere.
9333 		 * The same is true if we are scanning in which case the
9334 		 * scan_chandef should have a channel set.
9335 		 */
9336 		if (lhw->scan_chandef.chan != NULL) {
9337 			cd = &lhw->scan_chandef;
9338 		} else {
9339 			cd = &lhw->dflt_chandef;
9340 		}
9341 	} else {
9342 		cd = &new->def;
9343 	}
9344 
9345 	changed = 0;
9346 	same = cfg80211_chan_def_are_same(cd, &hw->conf.chandef);
9347 	if (!same) {
9348 		/* Copy; the chan pointer is fine and will stay valid. */
9349 		hw->conf.chandef = *cd;
9350 		changed |= IEEE80211_CONF_CHANGE_CHANNEL;
9351 	}
9352 	IMPROVE("IEEE80211_CONF_CHANGE_PS, IEEE80211_CONF_CHANGE_POWER");
9353 
9354 	if (changed == 0)
9355 		return (0);
9356 
9357 	error = lkpi_80211_mo_config(hw, changed);
9358 	return (error);
9359 }
9360 
9361 int
9362 ieee80211_emulate_add_chanctx(struct ieee80211_hw *hw,
9363     struct ieee80211_chanctx_conf *chanctx_conf)
9364 {
9365 	int error;
9366 
9367 	lockdep_assert_wiphy(hw->wiphy);
9368 
9369 #ifdef LINUXKPI_DEBUG_80211
9370 	if ((linuxkpi_debug_80211 & D80211_TRACE) != 0) {
9371 		struct lkpi_hw *lhw;
9372 
9373 		lhw = HW_TO_LHW(hw);
9374 		ic_printf(lhw->ic, "%s:%d: chanctx_conf %p\n",
9375 		    __func__, __LINE__, chanctx_conf);
9376 	}
9377 #endif
9378 
9379 	hw->conf.radar_enabled = chanctx_conf->radar_enabled;
9380 	error = lkpi_80211_update_chandef(hw, chanctx_conf);
9381 	return (error);
9382 }
9383 
9384 void
9385 ieee80211_emulate_remove_chanctx(struct ieee80211_hw *hw,
9386     struct ieee80211_chanctx_conf *chanctx_conf __unused)
9387 {
9388 
9389 	lockdep_assert_wiphy(hw->wiphy);
9390 
9391 #ifdef LINUXKPI_DEBUG_80211
9392 	if ((linuxkpi_debug_80211 & D80211_TRACE) != 0) {
9393 		struct lkpi_hw *lhw;
9394 
9395 		lhw = HW_TO_LHW(hw);
9396 		ic_printf(lhw->ic, "%s:%d: chanctx_conf %p\n",
9397 		    __func__, __LINE__, chanctx_conf);
9398 	}
9399 #endif
9400 
9401 	hw->conf.radar_enabled = false;
9402 	lkpi_80211_update_chandef(hw, NULL);
9403 }
9404 
9405 void
9406 ieee80211_emulate_change_chanctx(struct ieee80211_hw *hw,
9407     struct ieee80211_chanctx_conf *chanctx_conf, uint32_t changed __unused)
9408 {
9409 
9410 	lockdep_assert_wiphy(hw->wiphy);
9411 
9412 #ifdef LINUXKPI_DEBUG_80211
9413 	if ((linuxkpi_debug_80211 & D80211_TRACE) != 0) {
9414 		struct lkpi_hw *lhw;
9415 
9416 		lhw = HW_TO_LHW(hw);
9417 		ic_printf(lhw->ic, "%s:%d: chanctx_conf %p\n",
9418 		    __func__, __LINE__, chanctx_conf);
9419 	}
9420 #endif
9421 
9422 	hw->conf.radar_enabled = chanctx_conf->radar_enabled;
9423 	lkpi_80211_update_chandef(hw, chanctx_conf);
9424 }
9425 
9426 int
9427 ieee80211_emulate_switch_vif_chanctx(struct ieee80211_hw *hw,
9428     struct ieee80211_vif_chanctx_switch *vifs, int n_vifs,
9429     enum ieee80211_chanctx_switch_mode mode __unused)
9430 {
9431 	struct ieee80211_chanctx_conf *chanctx_conf;
9432 	int error;
9433 
9434 	lockdep_assert_wiphy(hw->wiphy);
9435 
9436 	/* Sanity check. */
9437 	if (n_vifs <= 0)
9438 		return (-EINVAL);
9439 	if (vifs == NULL || vifs[0].new_ctx == NULL)
9440 		return (-EINVAL);
9441 
9442 	/*
9443 	 * What to do if n_vifs > 1?
9444 	 * Does that make sense for drivers not supporting chanctx?
9445 	 */
9446 	hw->conf.radar_enabled = vifs[0].new_ctx->radar_enabled;
9447 	chanctx_conf = vifs[0].new_ctx;
9448 	error = lkpi_80211_update_chandef(hw, chanctx_conf);
9449 	return (error);
9450 }
9451 
9452 /* -------------------------------------------------------------------------- */
9453 
9454 MODULE_VERSION(linuxkpi_wlan, 1);
9455 MODULE_DEPEND(linuxkpi_wlan, linuxkpi, 1, 1, 1);
9456 MODULE_DEPEND(linuxkpi_wlan, wlan, 1, 1, 1);
9457