xref: /freebsd/sys/compat/linuxkpi/common/src/linux_80211.c (revision 3f88f6b89942a7f3aa6bb682b02b7307d060b52f)
1 /*-
2  * Copyright (c) 2020-2026 The FreeBSD Foundation
3  * Copyright (c) 2020-2025 Bjoern A. Zeeb
4  *
5  * This software was developed by Björn Zeeb under sponsorship from
6  * the FreeBSD Foundation.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  */
29 
30 /*
31  * Public functions are called linuxkpi_*().
32  * Internal (static) functions are called lkpi_*().
33  *
34  * The internal structures holding metadata over public structures are also
35  * called lkpi_xxx (usually with a member at the end called xxx).
36  * Note: we do not replicate the structure names but the general variable names
37  * for these (e.g., struct hw -> struct lkpi_hw, struct sta -> struct lkpi_sta).
38  * There are macros to access one from the other.
39  * We call the internal versions lxxx (e.g., hw -> lhw, sta -> lsta).
40  */
41 
42 /*
43  * TODO:
44  * - lots :)
45  * - HW_CRYPTO: we need a "keystore" and an ordered list for suspend/resume.
46  */
47 
48 #include <sys/param.h>
49 #include <sys/types.h>
50 #include <sys/kernel.h>
51 #include <sys/errno.h>
52 #include <sys/malloc.h>
53 #include <sys/module.h>
54 #include <sys/mutex.h>
55 #include <sys/sbuf.h>
56 #include <sys/socket.h>
57 #include <sys/sysctl.h>
58 #include <sys/queue.h>
59 #include <sys/taskqueue.h>
60 #include <sys/libkern.h>
61 
62 #include <net/if.h>
63 #include <net/if_var.h>
64 #include <net/if_media.h>
65 #include <net/ethernet.h>
66 
67 #include <net80211/ieee80211_var.h>
68 #include <net80211/ieee80211_proto.h>
69 #include <net80211/ieee80211_ratectl.h>
70 #include <net80211/ieee80211_radiotap.h>
71 #include <net80211/ieee80211_vht.h>
72 
73 #define	LINUXKPI_NET80211
74 #include <net/mac80211.h>
75 
76 #include <linux/workqueue.h>
77 #include <linux/rculist.h>
78 #include "linux_80211.h"
79 
80 /* #define	LKPI_80211_USE_SCANLIST */
81 /* #define	LKPI_80211_BGSCAN */
82 #define	LKPI_80211_WME
83 #define	LKPI_80211_HW_CRYPTO
84 #define	LKPI_80211_HT
85 #define	LKPI_80211_VHT
86 
87 #if defined(LKPI_80211_VHT) && !defined(LKPI_80211_HT)
88 #define	LKPI_80211_HT
89 #endif
90 #if defined(LKPI_80211_HT) && !defined(LKPI_80211_HW_CRYPTO)
91 #define	LKPI_80211_HW_CRYPTO
92 #endif
93 
94 static MALLOC_DEFINE(M_LKPI80211, "lkpi80211", "LinuxKPI 80211 compat");
95 
96 /* XXX-BZ really want this and others in queue.h */
97 #define	TAILQ_ELEM_INIT(elm, field) do {				\
98 	(elm)->field.tqe_next = NULL;					\
99 	(elm)->field.tqe_prev = NULL;					\
100 } while (0)
101 
102 /* -------------------------------------------------------------------------- */
103 
104 SYSCTL_DECL(_compat_linuxkpi);
105 SYSCTL_NODE(_compat_linuxkpi, OID_AUTO, 80211, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
106     "LinuxKPI 802.11 compatibility layer");
107 
108 static int lkpi_suspend_type = 1;
109 SYSCTL_INT(_compat_linuxkpi_80211, OID_AUTO, suspend_type, CTLFLAG_RW,
110     &lkpi_suspend_type, 0,
111     "LinuxKPI 802.11 suspend type bitmask (0=off, 1=net80211, 2=wowlan");
112 
113 static bool lkpi_order_scanlist = false;
114 SYSCTL_BOOL(_compat_linuxkpi_80211, OID_AUTO, order_scanlist, CTLFLAG_RW,
115     &lkpi_order_scanlist, 0, "Enable LinuxKPI 802.11 scan list shuffeling");
116 
117 #if defined(LKPI_80211_HW_CRYPTO)
118 static bool lkpi_hwcrypto = false;
119 SYSCTL_BOOL(_compat_linuxkpi_80211, OID_AUTO, hw_crypto, CTLFLAG_RDTUN,
120     &lkpi_hwcrypto, 0, "Enable LinuxKPI 802.11 hardware crypto offload");
121 
122 static bool lkpi_hwcrypto_tkip = false;
123 SYSCTL_BOOL(_compat_linuxkpi_80211, OID_AUTO, tkip, CTLFLAG_RDTUN,
124     &lkpi_hwcrypto_tkip, 0, "Enable LinuxKPI 802.11 TKIP crypto offload");
125 #endif
126 
127 /* Keep public for as long as header files are using it too. */
128 int linuxkpi_debug_80211;
129 
130 #ifdef LINUXKPI_DEBUG_80211
131 SYSCTL_INT(_compat_linuxkpi_80211, OID_AUTO, debug, CTLFLAG_RWTUN,
132     &linuxkpi_debug_80211, 0, "LinuxKPI 802.11 debug level");
133 
134 #define	UNIMPLEMENTED		if (linuxkpi_debug_80211 & D80211_TODO)		\
135     printf("XXX-TODO %s:%d: UNIMPLEMENTED\n", __func__, __LINE__)
136 #define	TRACEOK(_fmt, ...)	if (linuxkpi_debug_80211 & D80211_TRACEOK)	\
137     printf("%s:%d: TRACEPOINT " _fmt "\n", __func__, __LINE__, ##__VA_ARGS__)
138 #else
139 #define	UNIMPLEMENTED		do { } while (0)
140 #define	TRACEOK(...)		do { } while (0)
141 #endif
142 
143 /* #define	PREP_TX_INFO_DURATION	(IEEE80211_TRANS_WAIT * 1000) */
144 #ifndef PREP_TX_INFO_DURATION
145 #define	PREP_TX_INFO_DURATION	0 /* Let the driver do its thing. */
146 #endif
147 
148 /* This is DSAP | SSAP | CTRL | ProtoID/OrgCode{3}. */
149 const uint8_t rfc1042_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
150 
151 /* IEEE 802.11-05/0257r1 */
152 const uint8_t bridge_tunnel_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
153 
154 /* IEEE 802.11e Table 20i-UP-to-AC mappings. */
155 static const uint8_t ieee80211e_up_to_ac[] = {
156 	IEEE80211_AC_BE,
157 	IEEE80211_AC_BK,
158 	IEEE80211_AC_BK,
159 	IEEE80211_AC_BE,
160 	IEEE80211_AC_VI,
161 	IEEE80211_AC_VI,
162 	IEEE80211_AC_VO,
163 	IEEE80211_AC_VO,
164 #if 0
165 	IEEE80211_AC_VO, /* We treat MGMT as TID 8, which is set as AC_VO */
166 #endif
167 };
168 
169 const struct cfg80211_ops linuxkpi_mac80211cfgops = {
170 	/*
171 	 * XXX TODO need a "glue layer" to link cfg80211 ops to
172 	 * mac80211 and to the driver or net80211.
173 	 * Can we pass some on 1:1? Need to compare the (*f)().
174 	 */
175 };
176 
177 #if 0
178 static struct lkpi_sta *lkpi_find_lsta_by_ni(struct lkpi_vif *,
179     struct ieee80211_node *);
180 #endif
181 static void lkpi_sw_scan_task(void *, int);
182 static void lkpi_80211_txq_tx_one(struct lkpi_sta *, struct mbuf *);
183 static void lkpi_80211_txq_task(void *, int);
184 static void lkpi_80211_lhw_rxq_task(void *, int);
185 static void lkpi_ieee80211_free_skb_mbuf(void *);
186 #ifdef LKPI_80211_WME
187 static int lkpi_wme_update(struct lkpi_hw *, struct ieee80211vap *, bool);
188 #endif
189 static int lkpi_80211_update_chandef(struct ieee80211_hw *,
190     struct ieee80211_chanctx_conf *);
191 static void lkpi_ieee80211_wake_queues_locked(struct ieee80211_hw *);
192 
193 static const char *
194 lkpi_rate_info_bw_to_str(enum rate_info_bw bw)
195 {
196 
197 	switch (bw) {
198 
199         case RATE_INFO_BW_20:
200 		return ("20");
201 		break;
202         case RATE_INFO_BW_5:
203 		return ("5");
204 		break;
205         case RATE_INFO_BW_10:
206 		return ("10");
207 		break;
208         case RATE_INFO_BW_40:
209 		return ("40");
210 		break;
211         case RATE_INFO_BW_80:
212 		return ("80");
213 		break;
214         case RATE_INFO_BW_160:
215 		return ("160");
216 		break;
217         case RATE_INFO_BW_HE_RU:
218 		IMPROVE("nl80211_he_ru_alloc");
219 		return ("HE_RU");
220 		break;
221         case RATE_INFO_BW_320:
222 		return ("320");
223 		break;
224         case RATE_INFO_BW_EHT_RU:
225 		IMPROVE("nl80211_eht_ru_alloc");
226 		return ("EHT_RU");
227 		break;
228 	default:
229 		return ("?");
230 		break;
231 	}
232 }
233 
234 static void
235 lkpi_nl80211_sta_info_to_str(struct sbuf *s, const char *prefix,
236     const uint64_t flags)
237 {
238 	int bit, i;
239 
240 	sbuf_printf(s, "%s %#010jx", prefix, flags);
241 
242 	i = 0;
243 	for (bit = 0; bit < BITS_PER_TYPE(flags); bit++) {
244 
245 		if ((flags & BIT_ULL(bit)) == 0)
246 			continue;
247 
248 #define	EXPAND_CASE(_flag)						\
249 	case NL80211_STA_INFO_ ## _flag:				\
250 		sbuf_printf(s, "%c%s", (i == 0) ? '<' : ',', #_flag);	\
251 		i++;							\
252 		break;
253 
254 		switch (bit) {
255 		EXPAND_CASE(BEACON_RX)
256 		EXPAND_CASE(BEACON_SIGNAL_AVG)
257 		EXPAND_CASE(BSS_PARAM)
258 		EXPAND_CASE(CHAIN_SIGNAL)
259 		EXPAND_CASE(CHAIN_SIGNAL_AVG)
260 		EXPAND_CASE(CONNECTED_TIME)
261 		EXPAND_CASE(INACTIVE_TIME)
262 		EXPAND_CASE(SIGNAL)
263 		EXPAND_CASE(SIGNAL_AVG)
264 		EXPAND_CASE(STA_FLAGS)
265 		EXPAND_CASE(RX_BITRATE)
266 		EXPAND_CASE(RX_PACKETS)
267 		EXPAND_CASE(RX_BYTES)
268 		EXPAND_CASE(RX_DROP_MISC)
269 		EXPAND_CASE(TX_BITRATE)
270 		EXPAND_CASE(TX_PACKETS)
271 		EXPAND_CASE(TX_BYTES)
272 		EXPAND_CASE(TX_BYTES64)
273 		EXPAND_CASE(RX_BYTES64)
274 		EXPAND_CASE(TX_FAILED)
275 		EXPAND_CASE(TX_RETRIES)
276 		EXPAND_CASE(RX_DURATION)
277 		EXPAND_CASE(TX_DURATION)
278 		EXPAND_CASE(ACK_SIGNAL)
279 		EXPAND_CASE(ACK_SIGNAL_AVG)
280 		default:
281 			sbuf_printf(s, "%c?%d", (i == 0) ? '<' : ',', bit);
282 			break;
283 		}
284 	}
285 #undef	EXPAND_CASE
286 	if (i > 0)
287 		sbuf_printf(s, ">");
288 	sbuf_printf(s, "\n");
289 }
290 
291 static void
292 lkpi_80211_dump_lvif_stas(struct lkpi_vif *lvif, struct sbuf *s, bool dump_queues)
293 {
294 	struct lkpi_hw *lhw;
295 	struct ieee80211_hw *hw;
296 	struct ieee80211vap *vap;
297 	struct ieee80211_vif *vif;
298 	struct lkpi_sta *lsta;
299 	struct ieee80211_sta *sta;
300 	struct station_info sinfo;
301 	int error;
302 	uint8_t tid;
303 
304 	vif = LVIF_TO_VIF(lvif);
305 	vap = LVIF_TO_VAP(lvif);
306 	lhw = vap->iv_ic->ic_softc;
307 	hw = LHW_TO_HW(lhw);
308 
309 	wiphy_lock(hw->wiphy);
310 	list_for_each_entry(lsta, &lvif->lsta_list, lsta_list) {
311 		sta = LSTA_TO_STA(lsta);
312 
313 		sbuf_putc(s, '\n');
314 		sbuf_printf(s, "lsta %p sta %p added_to_drv %d\n", lsta, sta, lsta->added_to_drv);
315 
316 		memset(&sinfo, 0, sizeof(sinfo));
317 		error = lkpi_80211_mo_sta_statistics(hw, vif, sta, &sinfo);
318 		if (error == EEXIST)	/* Not added to driver. */
319 			continue;
320 		if (error == ENOTSUPP) {
321 			sbuf_printf(s, " sta_statistics not supported\n");
322 			continue;
323 		}
324 		if (error != 0) {
325 			sbuf_printf(s, " sta_statistics failed: %d\n", error);
326 			continue;
327 		}
328 
329 		/* If no RX_BITRATE is reported, try to fill it in from the lsta sinfo. */
330 		if ((sinfo.filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) == 0 &&
331 		    (lsta->sinfo.filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) != 0) {
332 			memcpy(&sinfo.rxrate, &lsta->sinfo.rxrate, sizeof(sinfo.rxrate));
333 			sinfo.filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
334 		}
335 		/* If no CHAIN_SIGNAL is reported,  try to fill it in from the lsta sinfo. */
336 		if ((sinfo.filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) == 0 &&
337 		    (lsta->sinfo.filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) != 0) {
338 			sinfo.chains = lsta->sinfo.chains;
339 			memcpy(sinfo.chain_signal, lsta->sinfo.chain_signal,
340 			    sizeof(sinfo.chain_signal));
341 			sinfo.filled |= BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL);
342 		}
343 
344 		lkpi_nl80211_sta_info_to_str(s, " nl80211_sta_info (valid fields)", sinfo.filled);
345 		sbuf_printf(s, " connected_time %u inactive_time %u\n",
346 		    sinfo.connected_time, sinfo.inactive_time);
347 		sbuf_printf(s, " rx_bytes %ju rx_packets %u rx_dropped_misc %u\n",
348 		    (uintmax_t)sinfo.rx_bytes, sinfo.rx_packets, sinfo.rx_dropped_misc);
349 		sbuf_printf(s, " rx_duration %ju rx_beacon %u rx_beacon_signal_avg %d\n",
350 		    (uintmax_t)sinfo.rx_duration, sinfo.rx_beacon, (int8_t)sinfo.rx_beacon_signal_avg);
351 
352 		sbuf_printf(s, " tx_bytes %ju tx_packets %u tx_failed %u\n",
353 		    (uintmax_t)sinfo.tx_bytes, sinfo.tx_packets, sinfo.tx_failed);
354 		sbuf_printf(s, " tx_duration %ju tx_retries %u\n",
355 		    (uintmax_t)sinfo.tx_duration, sinfo.tx_retries);
356 
357 		sbuf_printf(s, " signal %d signal_avg %d ack_signal %d avg_ack_signal %d\n",
358 		    sinfo.signal, sinfo.signal_avg, sinfo.ack_signal, sinfo.avg_ack_signal);
359 		sbuf_printf(s, " generation %d assoc_req_ies_len %zu chains %#04x\n",
360 		    sinfo.generation, sinfo.assoc_req_ies_len, sinfo.chains);
361 
362 		for (int i = 0; i < nitems(sinfo.chain_signal) && i < IEEE80211_MAX_CHAINS; i++) {
363 			if (!(sinfo.chains & BIT(i)))
364 				continue;
365 			sbuf_printf(s, "  chain[%d] signal %d signal_avg %d\n",
366 			    i, (int8_t)sinfo.chain_signal[i], (int8_t)sinfo.chain_signal_avg[i]);
367 		}
368 
369 		/* assoc_req_ies, bss_param, sta_flags */
370 
371 		sbuf_printf(s, " rxrate: flags %b bw %u(%s) legacy %u kbit/s mcs %u nss %u\n",
372 		    sinfo.rxrate.flags, CFG80211_RATE_INFO_FLAGS_BITS,
373 		    sinfo.rxrate.bw, lkpi_rate_info_bw_to_str(sinfo.rxrate.bw),
374 		    sinfo.rxrate.legacy * 100,
375 		    sinfo.rxrate.mcs, sinfo.rxrate.nss);
376 		sbuf_printf(s, "         he_dcm %u he_gi %u he_ru_alloc %u eht_gi %u\n",
377 		    sinfo.rxrate.he_dcm, sinfo.rxrate.he_gi, sinfo.rxrate.he_ru_alloc,
378 		    sinfo.rxrate.eht_gi);
379 		sbuf_printf(s, " txrate: flags %b bw %u(%s) legacy %u kbit/s mcs %u nss %u\n",
380 		    sinfo.txrate.flags, CFG80211_RATE_INFO_FLAGS_BITS,
381 		    sinfo.txrate.bw, lkpi_rate_info_bw_to_str(sinfo.txrate.bw),
382 		    sinfo.txrate.legacy * 100,
383 		    sinfo.txrate.mcs, sinfo.txrate.nss);
384 		sbuf_printf(s, "         he_dcm %u he_gi %u he_ru_alloc %u eht_gi %u\n",
385 		    sinfo.txrate.he_dcm, sinfo.txrate.he_gi, sinfo.txrate.he_ru_alloc,
386 		    sinfo.txrate.eht_gi);
387 
388 		if (!dump_queues)
389 			continue;
390 
391 		/* Dump queue information. */
392 		sbuf_printf(s, " Queue information:\n");
393 		sbuf_printf(s, "  frms direct tx %ju\n", lsta->frms_tx);
394 		for (tid = 0; tid <= IEEE80211_NUM_TIDS; tid++) {
395 			struct lkpi_txq *ltxq;
396 
397 			if (sta->txq[tid] == NULL) {
398 				sbuf_printf(s, "  tid %-2u NOQ\n", tid);
399 				continue;
400 			}
401 
402 			ltxq = TXQ_TO_LTXQ(sta->txq[tid]);
403 #ifdef __notyet__
404 			sbuf_printf(s, "  tid %-2u flags: %b "
405 			    "txq_generation %u skbq len %d\n",
406 			    tid, ltxq->flags, LKPI_TXQ_FLAGS_BITS,
407 			    ltxq->txq_generation,
408 			    skb_queue_len_lockless(&ltxq->skbq));
409 #else
410 			sbuf_printf(s, "  tid %-2u "
411 			    "txq_generation %u skbq len %d\n",
412 			    tid,
413 			    ltxq->txq_generation,
414 			    skb_queue_len_lockless(&ltxq->skbq));
415 #endif
416 			sbuf_printf(s, "         frms_enqueued %ju frms_dequeued %ju "
417 			    "frms_tx %ju\n",
418 			    ltxq->frms_enqueued, ltxq->frms_dequeued, ltxq->frms_tx);
419 		}
420 	}
421 	wiphy_unlock(hw->wiphy);
422 }
423 
424 static int
425 lkpi_80211_dump_stas(SYSCTL_HANDLER_ARGS)
426 {
427 	struct lkpi_vif *lvif;
428 	struct sbuf s;
429 
430 	if (req->newptr)
431 		return (EPERM);
432 
433 	lvif = (struct lkpi_vif *)arg1;
434 
435 	sbuf_new_for_sysctl(&s, NULL, 1024, req);
436 
437 	lkpi_80211_dump_lvif_stas(lvif, &s, false);
438 
439 	sbuf_finish(&s);
440 	sbuf_delete(&s);
441 
442 	return (0);
443 }
444 
445 static int
446 lkpi_80211_dump_sta_queues(SYSCTL_HANDLER_ARGS)
447 {
448 	struct lkpi_vif *lvif;
449 	struct sbuf s;
450 
451 	if (req->newptr)
452 		return (EPERM);
453 
454 	lvif = (struct lkpi_vif *)arg1;
455 
456 	sbuf_new_for_sysctl(&s, NULL, 1024, req);
457 
458 	lkpi_80211_dump_lvif_stas(lvif, &s, true);
459 
460 	sbuf_finish(&s);
461 	sbuf_delete(&s);
462 
463 	return (0);
464 }
465 
466 static enum ieee80211_sta_rx_bandwidth
467 lkpi_cw_to_rx_bw(enum nl80211_chan_width cw)
468 {
469 	switch (cw) {
470 	case NL80211_CHAN_WIDTH_320:
471 		return (IEEE80211_STA_RX_BW_320);
472 	case NL80211_CHAN_WIDTH_160:
473 	case NL80211_CHAN_WIDTH_80P80:
474 		return (IEEE80211_STA_RX_BW_160);
475 	case NL80211_CHAN_WIDTH_80:
476 		return (IEEE80211_STA_RX_BW_80);
477 	case NL80211_CHAN_WIDTH_40:
478 		return (IEEE80211_STA_RX_BW_40);
479 	case NL80211_CHAN_WIDTH_20:
480 	case NL80211_CHAN_WIDTH_20_NOHT:
481 		return (IEEE80211_STA_RX_BW_20);
482 	case NL80211_CHAN_WIDTH_5:
483 	case NL80211_CHAN_WIDTH_10:
484 		/* Unsupported input. */
485 		return (IEEE80211_STA_RX_BW_20);
486 	}
487 }
488 
489 static enum nl80211_chan_width
490 lkpi_rx_bw_to_cw(enum ieee80211_sta_rx_bandwidth rx_bw)
491 {
492 	switch (rx_bw) {
493 	case IEEE80211_STA_RX_BW_20:
494 		return (NL80211_CHAN_WIDTH_20);	/* _NOHT */
495 	case IEEE80211_STA_RX_BW_40:
496 		return (NL80211_CHAN_WIDTH_40);
497 	case IEEE80211_STA_RX_BW_80:
498 		return (NL80211_CHAN_WIDTH_80);
499 	case IEEE80211_STA_RX_BW_160:
500 		return (NL80211_CHAN_WIDTH_160); /* 80P80 */
501 	case IEEE80211_STA_RX_BW_320:
502 		return (NL80211_CHAN_WIDTH_320);
503 	}
504 }
505 
506 static enum ieee80211_bss_changed
507 lkpi_sta_supp_rates(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
508     struct ieee80211_node *ni,
509     enum ieee80211_rate_control_changed_flags *rc_changed)
510 {
511 	struct lkpi_vif *lvif;
512 	struct lkpi_sta *lsta;
513 	struct ieee80211_sta *sta;
514 	enum ieee80211_bss_changed bss_changed;
515 	struct ieee80211_supported_band *supband;
516 	uint32_t supp_rates, basic_rates;
517 	int band, i, n;
518 
519 	bss_changed = 0;
520 
521 	band = vif->bss_conf.chanreq.oper.chan->band;
522 	supband = hw->wiphy->bands[band];
523 	if (supband == NULL)
524 		return (bss_changed);
525 
526 	lvif = VIF_TO_LVIF(vif);
527 	lsta = ni->ni_drv_data;
528 	sta = LSTA_TO_STA(lsta);
529 
530 	supp_rates = 0;
531 	basic_rates = 0;
532 
533 	for (n = 0; n < ni->ni_rates.rs_nrates; n++) {
534 		uint8_t supp_rate;
535 		uint16_t bitr;
536 		bool basic;
537 
538 		/* Note: net80211 rates are in 0.5Mbit/s, e.g., 108 is 54Mbit/s. */
539 		supp_rate = ni->ni_rates.rs_rates[n] & (~IEEE80211_RATE_BASIC);
540 		basic = (ni->ni_rates.rs_rates[n] & IEEE80211_RATE_BASIC) != 0;
541 
542 		for (i = 0; i < supband->n_bitrates; i++) {
543 			/* Band bitrates are * 10 so, e.g., 55 is 5.5Mbit/s. */
544 			/* To match net80211 rates we need to do a DIV5. */
545 			bitr = howmany(supband->bitrates[i].bitrate, 5);
546 			if (supp_rate == bitr) {
547 				supp_rates |= BIT(i);
548 				if (basic)
549 					basic_rates |= BIT(i);
550 			}
551 			/*
552 			 * We are not checking if we are doing 11b or 11g and
553 			 * if the rate is fine for each.
554 			 */
555 		}
556 		TRACE_RATES("supp_rate %u basic %d supp_rates %#010x basic_rates %#010x",
557 		    supp_rate, basic, supp_rates, basic_rates);
558 	}
559 	if (basic_rates != 0 &&
560 	    vif->bss_conf.basic_rates != basic_rates) {
561 		TRACE_RATES("vif bss_conf basic_rates %#010x update to %#010x",
562 		    vif->bss_conf.basic_rates, basic_rates);
563 		vif->bss_conf.basic_rates = basic_rates;
564 		bss_changed |= BSS_CHANGED_BASIC_RATES;
565 	}
566 	/* Guard against net80211 not having any rates set when we get here. */
567 	if (supp_rates == 0)
568 		supp_rates = vif->bss_conf.basic_rates;
569 	if (sta->deflink.supp_rates[band] != supp_rates) {
570 		TRACE_RATES("band %d supp_rates %#010x update to %#010x",
571 		    band, sta->deflink.supp_rates[band], supp_rates);
572 		sta->deflink.supp_rates[band] = supp_rates;
573 		if (rc_changed != NULL)
574 			*rc_changed |= IEEE80211_RC_SUPP_RATES_CHANGED;
575 	}
576 
577 	/*
578 	 * br_mask got initialized in lkpi_ic_vap_create().
579 	 * Do a basic rates check against it for the current band if we are
580 	 * in a state to have all the above information.
581 	 */
582 	TRACE_RATES("band %d br_mask legacy %#010x & basic_rates %#010x != 0?",
583 	    band, lvif->br_mask.control[band].legacy, vif->bss_conf.basic_rates);
584 	if (band == vif->bss_conf.chanreq.oper.chan->band &&
585 	    (lvif->br_mask.control[band].legacy & vif->bss_conf.basic_rates) == 0) {
586 		/* In our setup this should never happen. */
587 		printf("%s: WARNING: no acceptable basic rate %#010x & %#010x\n",
588 		     __func__, lvif->br_mask.control[band].legacy, vif->bss_conf.basic_rates);
589 	}
590 
591 	/*
592 	 * XXX-BZ we should track changes here as well and call or let the
593 	 * caller call lkpi_80211_mo_set_bitrate_mask() if needed.
594 	 * Note: the call in lkpi_sta_scan_to_auth() still have to
595 	 * happen unconditionally for the initial setting.
596 	 */
597 #if defined(LKPI_80211_HT)
598 	if (supband->ht_cap.ht_supported) {
599 		memcpy(lvif->br_mask.control[band].ht_mcs,
600 		    supband->ht_cap.mcs.rx_mask,
601 		    sizeof(lvif->br_mask.control[band].ht_mcs));
602 #if defined(LINUXKPI_DEBUG_80211)
603 		for (int i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
604 			TRACE_RATES("band %d ht_mcs[%d] %#010x",
605 			    band, i, lvif->br_mask.control[band].ht_mcs[i]);
606 		}
607 #endif
608 	}
609 #endif /* LKPI_80211_HT */
610 #if defined(LKPI_80211_VHT)
611 	if (supband->vht_cap.vht_supported) {
612 		uint16_t mcs_map, val;
613 		uint8_t nss;
614 
615 		mcs_map = supband->vht_cap.vht_mcs.tx_mcs_map;
616 		for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
617 			TRACE_RATES("band %d nss %d vht_mcs.tx_mcs_map %#06x mcs_map %#06x & 0x3 = %#06x",
618 			    band, nss, supband->vht_cap.vht_mcs.tx_mcs_map, mcs_map, mcs_map & 0x3);
619 			switch (mcs_map & 0x3) {
620 			case IEEE80211_VHT_MCS_SUPPORT_0_7:
621 				val = 0x00ff;
622 				break;
623 			case IEEE80211_VHT_MCS_SUPPORT_0_8:
624 				val = 0x01ff;
625 				break;
626 			case IEEE80211_VHT_MCS_SUPPORT_0_9:
627 				val = 0x03ff;
628 				break;
629 			case IEEE80211_VHT_MCS_NOT_SUPPORTED:
630 				val = 0;
631 				break;
632 			}
633 			lvif->br_mask.control[band].vht_mcs[nss] = val;
634 			TRACE_RATES("band %d nss %d vht_mcs %#06x",
635 			    band, nss, lvif->br_mask.control[band].vht_mcs[nss]);
636 			mcs_map >>= 2;
637 		}
638 	}
639 #endif /* LKPI_80211_VHT */
640 
641 	return (bss_changed);
642 }
643 
644 static void
645 lkpi_sync_chanctx_cw_from_rx_bw(struct ieee80211_hw *hw,
646     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
647 {
648 	struct lkpi_hw *lhw;
649 	struct ieee80211_chanctx_conf *chanctx_conf;
650 	enum ieee80211_sta_rx_bandwidth old_bw;
651 	uint32_t changed;
652 
653 	lockdep_assert_wiphy(hw->wiphy);
654 
655 	chanctx_conf = rcu_dereference_protected(vif->bss_conf.chanctx_conf,
656 	    lockdep_is_held(&hw->wiphy->mtx));
657 	if (chanctx_conf == NULL)
658 		return;
659 
660 	old_bw = lkpi_cw_to_rx_bw(chanctx_conf->def.width);
661 	TRACE_RATES("old_bw %d sta->deflink.bandwidth %d hw->conf.chandef.width %d",
662 	    old_bw, sta->deflink.bandwidth, lkpi_cw_to_rx_bw(hw->conf.chandef.width));
663 
664 	lhw = HW_TO_LHW(hw);
665 	if (old_bw == sta->deflink.bandwidth &&
666 	    (!lhw->emulate_chanctx || old_bw == lkpi_cw_to_rx_bw(hw->conf.chandef.width)))
667 		return;
668 
669 	chanctx_conf->def.width = lkpi_rx_bw_to_cw(sta->deflink.bandwidth);
670 	if (chanctx_conf->def.width == NL80211_CHAN_WIDTH_20 &&
671 	    !sta->deflink.ht_cap.ht_supported)
672 		chanctx_conf->def.width = NL80211_CHAN_WIDTH_20_NOHT;
673 
674 	chanctx_conf->min_def = chanctx_conf->def;
675 
676 	vif->bss_conf.chanreq.oper.width = chanctx_conf->def.width;
677 
678 	TRACE_RATES("chanctx_conf %p def.width %d sta->deflink.bandwidth %d "
679 	    "ht_supported %d vht_supported %d",
680 	    chanctx_conf, chanctx_conf->def.width, sta->deflink.bandwidth,
681 	    sta->deflink.ht_cap.ht_supported, sta->deflink.vht_cap.vht_supported);
682 
683 	changed = IEEE80211_CHANCTX_CHANGE_MIN_WIDTH;
684 	changed |= IEEE80211_CHANCTX_CHANGE_WIDTH;
685 	lkpi_80211_mo_change_chanctx(hw, chanctx_conf, changed);
686 }
687 
688 #if defined(LKPI_80211_HT)
689 static void
690 lkpi_sta_sync_ht_from_ni(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
691     struct ieee80211_sta *sta, struct ieee80211_node *ni)
692 {
693 	struct ieee80211vap *vap;
694 	uint8_t *ie;
695 	struct ieee80211_ht_cap *htcap;
696 	struct ieee80211_sta_ht_cap *ht_cap, *sta_ht_cap;
697 	enum nl80211_band band;
698 	int i, rx_nss;
699 
700 	if ((ni->ni_flags & IEEE80211_NODE_HT) == 0) {
701 		sta->deflink.ht_cap.ht_supported = false;
702 		TRACE_RATES("HT ht_supported %d", sta->deflink.ht_cap.ht_supported);
703 		return;
704 	}
705 
706 	sta->deflink.ht_cap.ht_supported = true;
707 
708 	/* htcap->ampdu_params_info */
709 	vap = ni->ni_vap;
710 	sta->deflink.ht_cap.ampdu_density = _IEEE80211_MASKSHIFT(ni->ni_htparam, IEEE80211_HTCAP_MPDUDENSITY);
711 	if (sta->deflink.ht_cap.ampdu_density > vap->iv_ampdu_density)
712 		sta->deflink.ht_cap.ampdu_density = vap->iv_ampdu_density;
713 	sta->deflink.ht_cap.ampdu_factor = _IEEE80211_MASKSHIFT(ni->ni_htparam, IEEE80211_HTCAP_MAXRXAMPDU);
714 	if (sta->deflink.ht_cap.ampdu_factor > vap->iv_ampdu_rxmax)
715 		sta->deflink.ht_cap.ampdu_factor = vap->iv_ampdu_rxmax;
716 
717 	ie = ni->ni_ies.htcap_ie;
718 	KASSERT(ie != NULL, ("%s: HT but no htcap_ie on ni %p\n", __func__, ni));
719 	if (ie[0] == IEEE80211_ELEMID_VENDOR)
720 		ie += 4;
721 	ie += 2;
722 	htcap = (struct ieee80211_ht_cap *)ie;
723 	sta->deflink.ht_cap.cap = htcap->cap_info;
724 	sta->deflink.ht_cap.mcs = htcap->mcs;
725 
726 	/*
727 	 * 802.11n-2009 20.6 Parameters for HT MCSs gives the mandatory/
728 	 * optional MCS for Nss=1..4.  We need to check the first four
729 	 * MCS sets from the Rx MCS Bitmask; then there is MCS 32 and
730 	 * MCS33.. is UEQM.
731 	 */
732 	band = vif->bss_conf.chanctx_conf->def.chan->band;
733 	ht_cap = &hw->wiphy->bands[band]->ht_cap;
734 	sta_ht_cap = &sta->deflink.ht_cap;
735 	rx_nss = 0;
736 	for (i = 0; i < 4; i++) {
737 		TRACE_RATES("HT rx_mask[%d] sta %#04x & hw %#04x", i,
738 		    sta_ht_cap->mcs.rx_mask[i], ht_cap->mcs.rx_mask[i]);
739 		sta_ht_cap->mcs.rx_mask[i] =
740 			sta_ht_cap->mcs.rx_mask[i] & ht_cap->mcs.rx_mask[i];
741 		/* XXX-BZ masking unequal modulation? */
742 
743 		if (sta_ht_cap->mcs.rx_mask[i] != 0)
744 			rx_nss++;
745 	}
746 	if (rx_nss > 0) {
747 		TRACE_RATES("HT rx_nss = max(%d, %d)", rx_nss, sta->deflink.rx_nss);
748 		sta->deflink.rx_nss = MAX(rx_nss, sta->deflink.rx_nss);
749 	} else {
750 		sta->deflink.ht_cap.ht_supported = false;
751 		TRACE_RATES("HT ht_supported %d", sta->deflink.ht_cap.ht_supported);
752 		return;
753 	}
754 
755 	if ((sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) != 0 &&
756 	    IEEE80211_IS_CHAN_HT40(ni->ni_chan))
757 		sta->deflink.bandwidth = IEEE80211_STA_RX_BW_40;
758 	else
759 		sta->deflink.bandwidth = IEEE80211_STA_RX_BW_20;
760 
761 	IMPROVE("sta->wme");
762 
763 	if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_MAX_AMSDU)
764 		sta->deflink.agg.max_amsdu_len = IEEE80211_MAX_MPDU_LEN_HT_7935;
765 	else
766 		sta->deflink.agg.max_amsdu_len = IEEE80211_MAX_MPDU_LEN_HT_3839;
767 	sta->deflink.agg.max_rc_amsdu_len = IEEE80211_MAX_MPDU_LEN_HT_BA;
768 #ifdef __handled_by_driver__	/* iwlwifi only? actually unused? */
769 	for (i = 0; i < nitems(sta.deflink.agg.max_tid_amsdu_len); i++) {
770 		sta->deflink.agg.max_tid_amsdu_len[j] = ;
771 	}
772 #endif
773 	TRACE_RATES("HT ht_supported %d", sta->deflink.ht_cap.ht_supported);
774 }
775 #endif
776 
777 #if defined(LKPI_80211_VHT)
778 static void
779 lkpi_sta_sync_vht_from_ni(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
780     struct ieee80211_sta *sta, struct ieee80211_node *ni)
781 {
782 	struct ieee80211_sta_vht_cap *vht_cap, *sta_vht_cap;;
783 	enum ieee80211_sta_rx_bandwidth bw;
784 	enum nl80211_band band;
785 	uint32_t width;
786 	int rx_nss;
787 	uint16_t rx_map, tx_map;
788 
789 	if ((ni->ni_flags & IEEE80211_NODE_VHT) == 0 ||
790 	    !IEEE80211_IS_CHAN_VHT_5GHZ(ni->ni_chan)) {
791 		sta->deflink.vht_cap.vht_supported = false;
792 		TRACE_RATES("VHT vht_supported %d", sta->deflink.vht_cap.vht_supported);
793 		return;
794 	}
795 
796 	sta->deflink.vht_cap.vht_supported = true;
797 
798 	sta->deflink.vht_cap.cap = ni->ni_vhtcap;
799 	sta->deflink.vht_cap.vht_mcs = ni->ni_vht_mcsinfo;
800 
801 	/*
802 	 * If VHT20/40 are selected do not update the bandwidth
803 	 * from HT but stya on VHT.
804 	 */
805 	if (ni->ni_vht_chanwidth == IEEE80211_VHT_CHANWIDTH_USE_HT)
806 		goto skip_bw;
807 
808 	bw = sta->deflink.bandwidth;
809 	width = (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK);
810 	switch (width) {
811 	/* Deprecated. */
812 	case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ:
813 	case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ:
814 		bw = IEEE80211_STA_RX_BW_160;
815 		break;
816 	default:
817 		/* Check if we do support 160Mhz somehow after all. */
818 		if ((sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_EXT_NSS_BW_MASK) != 0)
819 			bw = IEEE80211_STA_RX_BW_160;
820 		else
821 			bw = IEEE80211_STA_RX_BW_80;
822 	}
823 	/*
824 	 * While we can set what is possibly supported we also need to be
825 	 * on a channel which supports that bandwidth; e.g., we can support
826 	 * VHT160 but the AP only does VHT80.
827 	 * Further ni_chan will also have filtered out what we disabled
828 	 * by configuration.
829 	 * Once net80211 channel selection is fixed for 802.11-2020 and
830 	 * VHT160 we can possibly spare ourselves the above.
831 	 */
832 	if (bw == IEEE80211_STA_RX_BW_160 &&
833 	    !IEEE80211_IS_CHAN_VHT160(ni->ni_chan) &&
834 	    !IEEE80211_IS_CHAN_VHT80P80(ni->ni_chan))
835 		bw = IEEE80211_STA_RX_BW_80;
836 	if (bw == IEEE80211_STA_RX_BW_80 &&
837 	    !IEEE80211_IS_CHAN_VHT80(ni->ni_chan))
838 		bw = sta->deflink.bandwidth;
839 	sta->deflink.bandwidth = bw;
840 skip_bw:
841 
842 	band = vif->bss_conf.chanctx_conf->def.chan->band;
843 	vht_cap = &hw->wiphy->bands[band]->vht_cap;
844 	sta_vht_cap = &sta->deflink.vht_cap;
845 
846 	rx_nss = 0;
847 	rx_map = tx_map = 0;
848 	for (int i = 7; i >= 0; i--) {
849 		uint8_t card, sta;
850 
851 		card = (vht_cap->vht_mcs.rx_mcs_map >> (2 * i)) & 0x3;
852 		sta  = (sta_vht_cap->vht_mcs.rx_mcs_map >> (2 * i)) & 0x3;
853 		if (sta != IEEE80211_VHT_MCS_NOT_SUPPORTED) {
854 			if (card == IEEE80211_VHT_MCS_NOT_SUPPORTED)
855 				sta = IEEE80211_VHT_MCS_NOT_SUPPORTED;
856 			else {
857 				sta = MIN(sta, card);
858 				if (rx_nss == 0)
859 					rx_nss = i + 1;
860 			}
861 		}
862 		rx_map |= (sta << (2 * i));
863 
864 		card = (vht_cap->vht_mcs.tx_mcs_map >> (2 * i)) & 0x3;
865 		sta  = (sta_vht_cap->vht_mcs.tx_mcs_map >> (2 * i)) & 0x3;
866 		if (sta != IEEE80211_VHT_MCS_NOT_SUPPORTED) {
867 			if (card == IEEE80211_VHT_MCS_NOT_SUPPORTED)
868 				sta = IEEE80211_VHT_MCS_NOT_SUPPORTED;
869 			else
870 				sta = MIN(sta, card);
871 		}
872 		tx_map |= (sta << (2 * i));
873 	}
874 	TRACE_RATES("VHT rx_mcs_map %#010x->%#010x, tx_mcs_map %#010x->%#010x, rx_nss = %d",
875 	    sta_vht_cap->vht_mcs.rx_mcs_map, rx_map,
876 	    sta_vht_cap->vht_mcs.tx_mcs_map, tx_map, rx_nss);
877 	sta_vht_cap->vht_mcs.rx_mcs_map = rx_map;
878 	sta_vht_cap->vht_mcs.tx_mcs_map = tx_map;
879 	if (rx_nss > 0) {
880 		TRACE_RATES("VHT rx_nss = max(%d, %d)", rx_nss, sta->deflink.rx_nss);
881 		sta->deflink.rx_nss = MAX(rx_nss, sta->deflink.rx_nss);
882 	} else {
883 		sta->deflink.vht_cap.vht_supported = false;
884 		TRACE_RATES("VHT vht_supported %d", sta->deflink.vht_cap.vht_supported);
885 		return;
886 	}
887 
888 	switch (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MAX_MPDU_MASK) {
889 	case IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454:
890 		sta->deflink.agg.max_amsdu_len = IEEE80211_MAX_MPDU_LEN_VHT_11454;
891 		break;
892 	case IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991:
893 		sta->deflink.agg.max_amsdu_len = IEEE80211_MAX_MPDU_LEN_VHT_7991;
894 		break;
895 	case IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895:
896 	default:
897 		sta->deflink.agg.max_amsdu_len = IEEE80211_MAX_MPDU_LEN_VHT_3895;
898 		break;
899 	}
900 
901 	TRACE_RATES("VHT vht_supported %d", sta->deflink.vht_cap.vht_supported);
902 }
903 #endif
904 
905 static enum ieee80211_bss_changed
906 lkpi_sta_sync_from_ni(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
907     struct ieee80211_sta *sta, struct ieee80211_node *ni, bool updchnctx)
908 {
909 	enum ieee80211_bss_changed bss_changed;
910 	enum ieee80211_rate_control_changed_flags rc_changed;
911 	enum ieee80211_sta_rx_bandwidth bandwidth;
912 	uint8_t rx_nss;
913 
914 	if (updchnctx)
915 		lockdep_assert_wiphy(hw->wiphy);
916 
917 	bss_changed = 0;
918 	rc_changed = 0;
919 
920 	bandwidth = sta->deflink.bandwidth;
921 	rx_nss = sta->deflink.rx_nss;
922 
923 	TRACE_RATES("updchnctx %d bandwidth %d rx_nss %u",
924 	    updchnctx, bandwidth, rx_nss);
925 
926 	/*
927 	 * Ensure rx_nss is at least 1 as otherwise drivers run into
928 	 * unexpected problems.
929 	 */
930 	sta->deflink.rx_nss = 1;
931 
932 #if defined(LKPI_80211_HT)
933 	lkpi_sta_sync_ht_from_ni(hw, vif, sta, ni);
934 #endif
935 #if defined(LKPI_80211_VHT)
936 	lkpi_sta_sync_vht_from_ni(hw, vif, sta, ni);
937 #endif
938 
939 	/*
940 	 * We are also called from node allocation which net80211
941 	 * can do even on `ifconfig down`; in that case the chanctx
942 	 * may still be valid and we get a discrepancy between
943 	 * sta and chanctx.  Thus do not try to update the chanctx
944 	 * when called from lkpi_lsta_alloc().
945 	 */
946 	if (updchnctx)
947 		lkpi_sync_chanctx_cw_from_rx_bw(hw, vif, sta);
948 
949 	bss_changed |= lkpi_sta_supp_rates(hw, vif, ni, &rc_changed);
950 
951 	if (sta->deflink.bandwidth != bandwidth)
952 		rc_changed |= IEEE80211_RC_BW_CHANGED;
953 	if (sta->deflink.rx_nss != rx_nss)
954 		rc_changed |= IEEE80211_RC_NSS_CHANGED;
955 
956 	TRACE_RATES("updchnctx %d rc_change %#010x bss_changed %#010jx "
957 	    "bandwidth %d rx_nss %u",
958 	    updchnctx, rc_changed, (uintmax_t)bss_changed,
959 	    sta->deflink.bandwidth, sta->deflink.rx_nss);
960 
961 	if (rc_changed != 0)
962 		lkpi_80211_mo_link_sta_rc_update(hw, vif, &sta->deflink, rc_changed);
963 
964 	return (bss_changed);
965 }
966 
967 #if 0
968 static uint8_t
969 lkpi_get_max_rx_chains(struct ieee80211_node *ni)
970 {
971 	uint8_t chains;
972 #if defined(LKPI_80211_HT) || defined(LKPI_80211_VHT)
973 	struct lkpi_sta *lsta;
974 	struct ieee80211_sta *sta;
975 
976 	lsta = ni->ni_drv_data;
977 	sta = LSTA_TO_STA(lsta);
978 #endif
979 
980 	chains = 1;
981 #if defined(LKPI_80211_HT)
982 	IMPROVE("We should factor counting MCS/NSS out for sync and here");
983 	if (sta->deflink.ht_cap.ht_supported)
984 		chains = MAX(chains, sta->deflink.rx_nss);
985 #endif
986 
987 #if defined(LKPI_80211_VHT)
988 	if (sta->deflink.vht_cap.vht_supported)
989 		chains = MAX(chains, sta->deflink.rx_nss);
990 #endif
991 
992 	return (chains);
993 }
994 #endif
995 
996 static void
997 lkpi_lsta_dump(struct lkpi_sta *lsta, struct ieee80211_node *ni,
998     const char *_f, int _l)
999 {
1000 
1001 #ifdef LINUXKPI_DEBUG_80211
1002 	if ((linuxkpi_debug_80211 & D80211_TRACE_STA) == 0)
1003 		return;
1004 	if (lsta == NULL)
1005 		return;
1006 
1007 	printf("%s:%d lsta %p ni %p sta %p\n",
1008 	    _f, _l, lsta, ni, &lsta->sta);
1009 	if (ni != NULL)
1010 		ieee80211_dump_node(NULL, ni);
1011 	printf("\ttxq_task txq len %d mtx\n", mbufq_len(&lsta->txq));
1012 	printf("\tkc %p state %d added_to_drv %d in_mgd %d\n",
1013 		&lsta->kc[0], lsta->state, lsta->added_to_drv, lsta->in_mgd);
1014 #endif
1015 }
1016 
1017 static void
1018 lkpi_lsta_remove(struct lkpi_sta *lsta, struct lkpi_vif *lvif)
1019 {
1020 
1021 	lockdep_assert_wiphy(lsta->hw->wiphy);
1022 
1023 	KASSERT(!list_empty(&lsta->lsta_list),
1024 	    ("%s: lsta %p ni %p\n", __func__, lsta, lsta->ni));
1025 	list_del_init(&lsta->lsta_list);
1026 }
1027 
1028 static struct lkpi_sta *
1029 lkpi_lsta_alloc(struct ieee80211vap *vap, const uint8_t mac[IEEE80211_ADDR_LEN],
1030     struct ieee80211_hw *hw, struct ieee80211_node *ni)
1031 {
1032 	struct lkpi_sta *lsta;
1033 	struct lkpi_vif *lvif;
1034 	struct ieee80211_vif *vif;
1035 	struct ieee80211_sta *sta;
1036 	int band, i, tid;
1037 
1038 	lsta = malloc(sizeof(*lsta) + hw->sta_data_size, M_LKPI80211,
1039 	    M_NOWAIT | M_ZERO);
1040 	if (lsta == NULL)
1041 		return (NULL);
1042 
1043 	lsta->hw = hw;
1044 	lsta->added_to_drv = false;
1045 	lsta->state = IEEE80211_STA_NOTEXIST;
1046 	/*
1047 	 * Link the ni to the lsta here without taking a reference.
1048 	 * For one we would have to take the reference in node_init()
1049 	 * as ieee80211_alloc_node() will initialise the refcount after us.
1050 	 * For the other a ni and an lsta are 1:1 mapped and always together
1051 	 * from [ic_]node_alloc() to [ic_]node_free() so we are essentally
1052 	 * using the ni references for the lsta as well despite it being
1053 	 * two separate allocations.
1054 	 */
1055 	lsta->ni = ni;
1056 	/* The back-pointer "drv_data" to net80211_node let's us get lsta. */
1057 	ni->ni_drv_data = lsta;
1058 
1059 	lvif = VAP_TO_LVIF(vap);
1060 	vif = LVIF_TO_VIF(lvif);
1061 	sta = LSTA_TO_STA(lsta);
1062 
1063 	IEEE80211_ADDR_COPY(sta->addr, mac);
1064 
1065 	/* TXQ */
1066 	for (tid = 0; tid < nitems(sta->txq); tid++) {
1067 		struct lkpi_txq *ltxq;
1068 
1069 		/* We are not limiting ourselves to hw.queues here. */
1070 		ltxq = malloc(sizeof(*ltxq) + hw->txq_data_size,
1071 		    M_LKPI80211, M_NOWAIT | M_ZERO);
1072 		if (ltxq == NULL)
1073 			goto cleanup;
1074 		/* iwlwifi//mvm/sta.c::tid_to_mac80211_ac[] */
1075 		if (tid == IEEE80211_NUM_TIDS) {
1076 			if (!ieee80211_hw_check(hw, STA_MMPDU_TXQ)) {
1077 				free(ltxq, M_LKPI80211);
1078 				continue;
1079 			}
1080 			IMPROVE("AP/if we support non-STA here too");
1081 			ltxq->txq.ac = IEEE80211_AC_VO;
1082 		} else {
1083 			ltxq->txq.ac = ieee80211e_up_to_ac[tid & 7];
1084 		}
1085 		ltxq->flags = 0;
1086 		ltxq->txq.vif = vif;
1087 		ltxq->txq.tid = tid;
1088 		ltxq->txq.sta = sta;
1089 		TAILQ_ELEM_INIT(ltxq, txq_entry);
1090 		skb_queue_head_init(&ltxq->skbq);
1091 		LKPI_80211_LTXQ_LOCK_INIT(ltxq);
1092 		sta->txq[tid] = &ltxq->txq;
1093 	}
1094 
1095 	/* Deflink information. */
1096 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
1097 		struct ieee80211_supported_band *supband;
1098 		uint32_t rate_mandatory;;
1099 
1100 		supband = hw->wiphy->bands[band];
1101 		if (supband == NULL)
1102 			continue;
1103 
1104 		switch (band) {
1105 		case NL80211_BAND_2GHZ:
1106 			/* We have to assume 11g support here. */
1107 			rate_mandatory = IEEE80211_RATE_MANDATORY_G |
1108 			    IEEE80211_RATE_MANDATORY_B;
1109 			break;
1110 		case NL80211_BAND_5GHZ:
1111 			rate_mandatory = IEEE80211_RATE_MANDATORY_A;
1112 			break;
1113 		default:
1114 			continue;
1115 		}
1116 
1117 		for (i = 0; i < supband->n_bitrates; i++) {
1118 			if ((supband->bitrates[i].flags & rate_mandatory) != 0)
1119 				sta->deflink.supp_rates[band] |= BIT(i);
1120 		}
1121 	}
1122 
1123 	sta->deflink.smps_mode = IEEE80211_SMPS_OFF;
1124 	sta->deflink.bandwidth = IEEE80211_STA_RX_BW_20;
1125 	sta->deflink.agg.max_rc_amsdu_len = IEEE80211_MAX_MPDU_LEN_HT_BA;
1126 	sta->deflink.rx_nss = 1;
1127 	sta->deflink.sta = sta;
1128 
1129 	(void)lkpi_sta_sync_from_ni(hw, vif, sta, ni, false);
1130 
1131 	IMPROVE("he, eht, bw_320, ... smps_mode, ..");
1132 
1133 	/* Link configuration. */
1134 	IEEE80211_ADDR_COPY(sta->deflink.addr, sta->addr);
1135 	sta->link[0] = &sta->deflink;
1136 	for (i = 1; i < nitems(sta->link); i++) {
1137 		IMPROVE("more links; only link[0] = deflink currently.");
1138 	}
1139 	IMPROVE("11be");
1140 	sta->mlo = false;
1141 
1142 	/* Deferred TX path. */
1143 	LKPI_80211_LSTA_TXQ_LOCK_INIT(lsta);
1144 	TASK_INIT(&lsta->txq_task, 0, lkpi_80211_txq_task, lsta);
1145 	mbufq_init(&lsta->txq, 32 * NAPI_POLL_WEIGHT);
1146 	lsta->txq_ready = true;
1147 
1148 	return (lsta);
1149 
1150 cleanup:
1151 	for (; tid >= 0; tid--) {
1152 		struct lkpi_txq *ltxq;
1153 
1154 		ltxq = TXQ_TO_LTXQ(sta->txq[tid]);
1155 		LKPI_80211_LTXQ_LOCK_DESTROY(ltxq);
1156 		free(sta->txq[tid], M_LKPI80211);
1157 	}
1158 	free(lsta, M_LKPI80211);
1159 	return (NULL);
1160 }
1161 
1162 static void
1163 lkpi_lsta_free(struct lkpi_sta *lsta, struct ieee80211_node *ni)
1164 {
1165 	struct mbuf *m;
1166 
1167 	if (lsta->added_to_drv)
1168 		panic("%s: Trying to free an lsta still known to firmware: "
1169 		    "lsta %p ni %p added_to_drv %d\n",
1170 		    __func__, lsta, ni, lsta->added_to_drv);
1171 
1172 	/* XXX-BZ free resources, ... */
1173 	IMPROVE();
1174 
1175 	/* Drain sta->txq[] */
1176 
1177 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
1178 	lsta->txq_ready = false;
1179 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
1180 
1181 	/* Drain taskq, won't be restarted until added_to_drv is set again. */
1182 	while (taskqueue_cancel(taskqueue_thread, &lsta->txq_task, NULL) != 0)
1183 		taskqueue_drain(taskqueue_thread, &lsta->txq_task);
1184 
1185 	/* Flush mbufq (make sure to release ni refs!). */
1186 	m = mbufq_dequeue(&lsta->txq);
1187 	while (m != NULL) {
1188 		struct ieee80211_node *nim;
1189 
1190 		nim = (struct ieee80211_node *)m->m_pkthdr.rcvif;
1191 		if (nim != NULL)
1192 			ieee80211_free_node(nim);
1193 		m_freem(m);
1194 		m = mbufq_dequeue(&lsta->txq);
1195 	}
1196 	KASSERT(mbufq_empty(&lsta->txq), ("%s: lsta %p has txq len %d != 0\n",
1197 	    __func__, lsta, mbufq_len(&lsta->txq)));
1198 	LKPI_80211_LSTA_TXQ_LOCK_DESTROY(lsta);
1199 
1200 	/* Remove lsta from vif; that is done by the state machine.  Should assert it? */
1201 
1202 	IMPROVE("Make sure everything is cleaned up.");
1203 
1204 	/* Free lsta. */
1205 	lsta->ni = NULL;
1206 	ni->ni_drv_data = NULL;
1207 	free(lsta, M_LKPI80211);
1208 }
1209 
1210 
1211 static enum nl80211_band
1212 lkpi_net80211_chan_to_nl80211_band(struct ieee80211_channel *c)
1213 {
1214 
1215 	if (IEEE80211_IS_CHAN_2GHZ(c))
1216 		return (NL80211_BAND_2GHZ);
1217 	else if (IEEE80211_IS_CHAN_5GHZ(c))
1218 		return (NL80211_BAND_5GHZ);
1219 #ifdef __notyet__
1220 	else if ()
1221 		return (NL80211_BAND_6GHZ);
1222 	else if ()
1223 		return (NL80211_BAND_60GHZ);
1224 	else if (IEEE80211_IS_CHAN_GSM(c))
1225 		return (NL80211_BAND_XXX);
1226 #endif
1227 	else
1228 		panic("%s: unsupported band. c %p flags %#x\n",
1229 		    __func__, c, c->ic_flags);
1230 }
1231 
1232 static uint32_t
1233 lkpi_nl80211_band_to_net80211_band(enum nl80211_band band)
1234 {
1235 
1236 	/* XXX-BZ this is just silly; net80211 is too convoluted. */
1237 	/* IEEE80211_CHAN_A / _G / .. doesn't really work either. */
1238 	switch (band) {
1239 	case NL80211_BAND_2GHZ:
1240 		return (IEEE80211_CHAN_2GHZ);
1241 		break;
1242 	case NL80211_BAND_5GHZ:
1243 		return (IEEE80211_CHAN_5GHZ);
1244 		break;
1245 	case NL80211_BAND_60GHZ:
1246 		break;
1247 	case NL80211_BAND_6GHZ:
1248 		break;
1249 	default:
1250 		panic("%s: unsupported band %u\n", __func__, band);
1251 		break;
1252 	}
1253 
1254 	IMPROVE();
1255 	return (0x00);
1256 }
1257 
1258 #ifdef LINUXKPI_DEBUG_80211
1259 static const char *
1260 lkpi_nl80211_band_name(enum nl80211_band band)
1261 {
1262 	switch (band) {
1263 	case NL80211_BAND_2GHZ:
1264 		return "2Ghz";
1265 		break;
1266 	case NL80211_BAND_5GHZ:
1267 		return "5Ghz";
1268 		break;
1269 	case NL80211_BAND_60GHZ:
1270 		return "60Ghz";
1271 		break;
1272 	case NL80211_BAND_6GHZ:
1273 		return "6Ghz";
1274 		break;
1275 	default:
1276 		panic("%s: unsupported band %u\n", __func__, band);
1277 		break;
1278 	}
1279 }
1280 #endif
1281 
1282 #if 0
1283 static enum ieee80211_ac_numbers
1284 lkpi_ac_net_to_l80211(int ac)
1285 {
1286 
1287 	switch (ac) {
1288 	case WME_AC_VO:
1289 		return (IEEE80211_AC_VO);
1290 	case WME_AC_VI:
1291 		return (IEEE80211_AC_VI);
1292 	case WME_AC_BE:
1293 		return (IEEE80211_AC_BE);
1294 	case WME_AC_BK:
1295 		return (IEEE80211_AC_BK);
1296 	default:
1297 		printf("%s: invalid WME_AC_* input: ac = %d\n", __func__, ac);
1298 		return (IEEE80211_AC_BE);
1299 	}
1300 }
1301 #endif
1302 
1303 static enum nl80211_iftype
1304 lkpi_opmode_to_vif_type(enum ieee80211_opmode opmode)
1305 {
1306 
1307 	switch (opmode) {
1308 	case IEEE80211_M_IBSS:
1309 		return (NL80211_IFTYPE_ADHOC);
1310 		break;
1311 	case IEEE80211_M_STA:
1312 		return (NL80211_IFTYPE_STATION);
1313 		break;
1314 	case IEEE80211_M_WDS:
1315 		return (NL80211_IFTYPE_WDS);
1316 		break;
1317 	case IEEE80211_M_HOSTAP:
1318 		return (NL80211_IFTYPE_AP);
1319 		break;
1320 	case IEEE80211_M_MONITOR:
1321 		return (NL80211_IFTYPE_MONITOR);
1322 		break;
1323 	case IEEE80211_M_MBSS:
1324 		return (NL80211_IFTYPE_MESH_POINT);
1325 		break;
1326 	case IEEE80211_M_AHDEMO:
1327 		/* FALLTHROUGH */
1328 	default:
1329 		printf("ERROR: %s: unsupported opmode %d\n", __func__, opmode);
1330 		/* FALLTHROUGH */
1331 	}
1332 	return (NL80211_IFTYPE_UNSPECIFIED);
1333 }
1334 
1335 #ifdef LKPI_80211_HW_CRYPTO
1336 static const char *
1337 lkpi_cipher_suite_to_name(uint32_t wlan_cipher_suite)
1338 {
1339 	switch (wlan_cipher_suite) {
1340 	case WLAN_CIPHER_SUITE_WEP40:
1341 		return ("WEP40");
1342 	case WLAN_CIPHER_SUITE_WEP104:
1343 		return ("WEP104");
1344 	case WLAN_CIPHER_SUITE_TKIP:
1345 		return ("TKIP");
1346 	case WLAN_CIPHER_SUITE_CCMP:
1347 		return ("CCMP");
1348 	case WLAN_CIPHER_SUITE_CCMP_256:
1349 		return ("CCMP_256");
1350 	case WLAN_CIPHER_SUITE_GCMP:
1351 		return ("GCMP");
1352 	case WLAN_CIPHER_SUITE_GCMP_256:
1353 		return ("GCMP_256");
1354 	case WLAN_CIPHER_SUITE_AES_CMAC:
1355 		return ("AES_CMAC");
1356 	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
1357 		return ("BIP_CMAC_256");
1358 	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
1359 		return ("BIP_GMAC_128");
1360 	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
1361 		return ("BIP_GMAC_256");
1362 	default:
1363 		return ("??");
1364 	}
1365 }
1366 
1367 static uint32_t
1368 lkpi_l80211_to_net80211_cyphers(struct ieee80211com *ic,
1369     uint32_t wlan_cipher_suite)
1370 {
1371 	switch (wlan_cipher_suite) {
1372 	case WLAN_CIPHER_SUITE_WEP40:
1373 		return (IEEE80211_CRYPTO_WEP);
1374 	case WLAN_CIPHER_SUITE_WEP104:
1375 		return (IEEE80211_CRYPTO_WEP);
1376 	case WLAN_CIPHER_SUITE_TKIP:
1377 		return (IEEE80211_CRYPTO_TKIP);
1378 	case WLAN_CIPHER_SUITE_CCMP:
1379 		return (IEEE80211_CRYPTO_AES_CCM);
1380 	case WLAN_CIPHER_SUITE_CCMP_256:
1381 		return (IEEE80211_CRYPTO_AES_CCM_256);
1382 	case WLAN_CIPHER_SUITE_GCMP:
1383 		return (IEEE80211_CRYPTO_AES_GCM_128);
1384 	case WLAN_CIPHER_SUITE_GCMP_256:
1385 		return (IEEE80211_CRYPTO_AES_GCM_256);
1386 	case WLAN_CIPHER_SUITE_AES_CMAC:
1387 		return (IEEE80211_CRYPTO_BIP_CMAC_128);
1388 	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
1389 		return (IEEE80211_CRYPTO_BIP_CMAC_256);
1390 	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
1391 		return (IEEE80211_CRYPTO_BIP_GMAC_128);
1392 	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
1393 		return (IEEE80211_CRYPTO_BIP_GMAC_256);
1394 	default:
1395 		ic_printf(ic, "%s: unknown WLAN Cipher Suite %#08x | %u (%s)\n",
1396 		    __func__,
1397 		    wlan_cipher_suite >> 8, wlan_cipher_suite & 0xff,
1398 		    lkpi_cipher_suite_to_name(wlan_cipher_suite));
1399 		return (0);
1400 	}
1401 }
1402 
1403 static uint32_t
1404 lkpi_net80211_to_l80211_cipher_suite(uint32_t cipher, uint8_t keylen)
1405 {
1406 
1407 	switch (cipher) {
1408 	case IEEE80211_CIPHER_WEP:
1409 		if (keylen == (40/NBBY))
1410 			return (WLAN_CIPHER_SUITE_WEP40);
1411 		else if (keylen == (104/NBBY))
1412 			return (WLAN_CIPHER_SUITE_WEP104);
1413 		else {
1414 			printf("%s: WEP with unsupported keylen %d\n",
1415 			    __func__, keylen * NBBY);
1416 			return (0);
1417 		}
1418 		break;
1419 	case IEEE80211_CIPHER_TKIP:
1420 		return (WLAN_CIPHER_SUITE_TKIP);
1421 	case IEEE80211_CIPHER_AES_CCM:
1422 		return (WLAN_CIPHER_SUITE_CCMP);
1423 	case IEEE80211_CIPHER_AES_CCM_256:
1424 		return (WLAN_CIPHER_SUITE_CCMP_256);
1425 	case IEEE80211_CIPHER_AES_GCM_128:
1426 		return (WLAN_CIPHER_SUITE_GCMP);
1427 	case IEEE80211_CIPHER_AES_GCM_256:
1428 		return (WLAN_CIPHER_SUITE_GCMP_256);
1429 	case IEEE80211_CIPHER_BIP_CMAC_128:
1430 		return (WLAN_CIPHER_SUITE_AES_CMAC);
1431 	case IEEE80211_CIPHER_BIP_CMAC_256:
1432 		return (WLAN_CIPHER_SUITE_BIP_CMAC_256);
1433 	case IEEE80211_CIPHER_BIP_GMAC_128:
1434 		return (WLAN_CIPHER_SUITE_BIP_GMAC_128);
1435 	case IEEE80211_CIPHER_BIP_GMAC_256:
1436 		return (WLAN_CIPHER_SUITE_BIP_GMAC_256);
1437 
1438 	case IEEE80211_CIPHER_AES_OCB:
1439 	case IEEE80211_CIPHER_TKIPMIC:
1440 		/*
1441 		 * TKIP w/ hw MIC support
1442 		 * (gone wrong; should really be a crypto flag in net80211).
1443 		 */
1444 	case IEEE80211_CIPHER_CKIP:
1445 	case IEEE80211_CIPHER_NONE:
1446 		printf("%s: unsupported cipher %#010x\n", __func__, cipher);
1447 		break;
1448 	default:
1449 		printf("%s: unknown cipher %#010x\n", __func__, cipher);
1450 	};
1451 	return (0);
1452 }
1453 #endif
1454 
1455 #ifdef __notyet__
1456 static enum ieee80211_sta_state
1457 lkpi_net80211_state_to_sta_state(enum ieee80211_state state)
1458 {
1459 
1460 	/*
1461 	 * XXX-BZ The net80211 states are "try to ..", the lkpi8011 states are
1462 	 * "done".  Also ASSOC/AUTHORIZED are both "RUN" then?
1463 	 */
1464 	switch (state) {
1465 	case IEEE80211_S_INIT:
1466 		return (IEEE80211_STA_NOTEXIST);
1467 	case IEEE80211_S_SCAN:
1468 		return (IEEE80211_STA_NONE);
1469 	case IEEE80211_S_AUTH:
1470 		return (IEEE80211_STA_AUTH);
1471 	case IEEE80211_S_ASSOC:
1472 		return (IEEE80211_STA_ASSOC);
1473 	case IEEE80211_S_RUN:
1474 		return (IEEE80211_STA_AUTHORIZED);
1475 	case IEEE80211_S_CAC:
1476 	case IEEE80211_S_CSA:
1477 	case IEEE80211_S_SLEEP:
1478 	default:
1479 		UNIMPLEMENTED;
1480 	};
1481 
1482 	return (IEEE80211_STA_NOTEXIST);
1483 }
1484 #endif
1485 
1486 static struct linuxkpi_ieee80211_channel *
1487 lkpi_find_lkpi80211_chan(struct lkpi_hw *lhw,
1488     struct ieee80211_channel *c)
1489 {
1490 	struct ieee80211_hw *hw;
1491 	struct linuxkpi_ieee80211_channel *channels;
1492 	enum nl80211_band band;
1493 	int i, nchans;
1494 
1495 	hw = LHW_TO_HW(lhw);
1496 	band = lkpi_net80211_chan_to_nl80211_band(c);
1497 	if (hw->wiphy->bands[band] == NULL)
1498 		return (NULL);
1499 
1500 	nchans = hw->wiphy->bands[band]->n_channels;
1501 	if (nchans <= 0)
1502 		return (NULL);
1503 
1504 	channels = hw->wiphy->bands[band]->channels;
1505 	for (i = 0; i < nchans; i++) {
1506 		if (channels[i].center_freq == c->ic_freq)
1507 			return (&channels[i]);
1508 	}
1509 
1510 	return (NULL);
1511 }
1512 
1513 #if 0
1514 static struct linuxkpi_ieee80211_channel *
1515 lkpi_get_lkpi80211_chan(struct ieee80211com *ic, struct ieee80211_node *ni)
1516 {
1517 	struct linuxkpi_ieee80211_channel *chan;
1518 	struct ieee80211_channel *c;
1519 	struct lkpi_hw *lhw;
1520 
1521 	chan = NULL;
1522 	if (ni != NULL && ni->ni_chan != IEEE80211_CHAN_ANYC)
1523 		c = ni->ni_chan;
1524 	else if (ic->ic_bsschan != IEEE80211_CHAN_ANYC)
1525 		c = ic->ic_bsschan;
1526 	else if (ic->ic_curchan != IEEE80211_CHAN_ANYC)
1527 		c = ic->ic_curchan;
1528 	else
1529 		c = NULL;
1530 
1531 	if (c != NULL && c != IEEE80211_CHAN_ANYC) {
1532 		lhw = ic->ic_softc;
1533 		chan = lkpi_find_lkpi80211_chan(lhw, c);
1534 	}
1535 
1536 	return (chan);
1537 }
1538 #endif
1539 
1540 struct linuxkpi_ieee80211_channel *
1541 linuxkpi_ieee80211_get_channel(struct wiphy *wiphy, uint32_t freq)
1542 {
1543 	enum nl80211_band band;
1544 
1545 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
1546 		struct ieee80211_supported_band *supband;
1547 		struct linuxkpi_ieee80211_channel *channels;
1548 		int i;
1549 
1550 		supband = wiphy->bands[band];
1551 		if (supband == NULL || supband->n_channels == 0)
1552 			continue;
1553 
1554 		channels = supband->channels;
1555 		for (i = 0; i < supband->n_channels; i++) {
1556 			if (channels[i].center_freq == freq)
1557 				return (&channels[i]);
1558 		}
1559 	}
1560 
1561 	return (NULL);
1562 }
1563 
1564 #ifdef LKPI_80211_HW_CRYPTO
1565 static int
1566 lkpi_sta_del_keys(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
1567     struct lkpi_sta *lsta)
1568 {
1569 	int error;
1570 
1571 	if (!lkpi_hwcrypto)
1572 		return (0);
1573 
1574 	lockdep_assert_wiphy(hw->wiphy);
1575 
1576 	if (vif->cfg.assoc && lsta->state == IEEE80211_STA_AUTHORIZED) {
1577 		if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1578 			ic_printf(lsta->ni->ni_ic,
1579 			    "%d %lu %s: vif still assoc; not deleting keys\n",
1580 			    curthread->td_tid, jiffies, __func__);
1581 		return (0);
1582 	}
1583 
1584 	ieee80211_ref_node(lsta->ni);
1585 
1586 	error = 0;
1587 	for (ieee80211_keyix keyix = 0; keyix < nitems(lsta->kc); keyix++) {
1588 		struct ieee80211_key_conf *kc;
1589 		int err;
1590 
1591 		if (lsta->kc[keyix] == NULL)
1592 			continue;
1593 		kc = lsta->kc[keyix];
1594 
1595 #ifdef LINUXKPI_DEBUG_80211
1596 		if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1597 			ic_printf(lsta->ni->ni_ic, "%d %lu %s: running set_key cmd %d(%s) for "
1598 			    "sta %6D: keyidx %u hw_key_idx %u flags %b\n",
1599 			    curthread->td_tid, jiffies, __func__,
1600 			    DISABLE_KEY, "DISABLE", lsta->sta.addr, ":",
1601 			    kc->keyidx, kc->hw_key_idx, kc->flags, IEEE80211_KEY_FLAG_BITS);
1602 #endif
1603 
1604 		err = lkpi_80211_mo_set_key(hw, DISABLE_KEY, vif,
1605 		    LSTA_TO_STA(lsta), kc);
1606 		if (err != 0) {
1607 			ic_printf(lsta->ni->ni_ic, "%d %lu %s: set_key cmd %d(%s) for "
1608 			    "sta %6D failed: %d\n", curthread->td_tid, jiffies, __func__,
1609 			    DISABLE_KEY, "DISABLE", lsta->sta.addr, ":", err);
1610 			error++;
1611 
1612 			/*
1613 			 * If we free the key here we will never be able to get it
1614 			 * removed from the driver/fw which will likely make us
1615 			 * crash (firmware).
1616 			 */
1617 			continue;
1618 		}
1619 #ifdef LINUXKPI_DEBUG_80211
1620 		if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1621 			ic_printf(lsta->ni->ni_ic, "%d %lu %s: set_key cmd %d(%s) for "
1622 			    "sta %6D succeeded: keyidx %u hw_key_idx %u flags %b\n",
1623 			    curthread->td_tid, jiffies, __func__,
1624 			    DISABLE_KEY, "DISABLE", lsta->sta.addr, ":",
1625 			    kc->keyidx, kc->hw_key_idx, kc->flags, IEEE80211_KEY_FLAG_BITS);
1626 #endif
1627 
1628 		lsta->kc[keyix] = NULL;
1629 		free(kc, M_LKPI80211);
1630 	}
1631 	ieee80211_free_node(lsta->ni);
1632 	return (error);
1633 }
1634 
1635 /* XXX-BZ one day we should replace this iterating over VIFs, or node list? */
1636 /* See also lkpi_sta_del_keys() these days. */
1637 static int
1638 lkpi_iv_key_delete(struct ieee80211vap *vap, const struct ieee80211_key *k)
1639 {
1640 	struct ieee80211com *ic;
1641 	struct lkpi_hw *lhw;
1642 	struct ieee80211_hw *hw;
1643 	struct lkpi_vif *lvif;
1644 	struct lkpi_sta *lsta;
1645 	struct ieee80211_vif *vif;
1646 	struct ieee80211_sta *sta;
1647 	struct ieee80211_node *ni;
1648 	struct ieee80211_key_conf *kc;
1649 	int error;
1650 
1651 	ic = vap->iv_ic;
1652 	lhw = ic->ic_softc;
1653 	hw = LHW_TO_HW(lhw);
1654 	lvif = VAP_TO_LVIF(vap);
1655 	vif = LVIF_TO_VIF(lvif);
1656 
1657 	/*
1658 	 * Make sure we do not make it here without going through
1659 	 * lkpi_iv_key_update_begin() first.
1660 	 */
1661 	lockdep_assert_wiphy(hw->wiphy);
1662 
1663 	ni = ieee80211_ref_node(vap->iv_bss);
1664 	lsta = ni->ni_drv_data;
1665 	if (lsta == NULL) {
1666 		ic_printf(ic, "%s: ni %p (%6D) with lsta NULL\n",
1667 		    __func__, ni, ni->ni_bssid, ":");
1668 		ieee80211_free_node(ni);
1669 		return (0);
1670 	}
1671 
1672 	/*
1673 	 * While we are assoc we may still send packets.  We cannot delete the
1674 	 * keys as otherwise packets could go out unencrypted.  Some firmware
1675 	 * does not like this and will fire an assert.
1676 	 * net80211 needs to drive this better but given we want the disassoc
1677 	 * frame out and have to unlock we are open to a race currently.
1678 	 * This check should prevent problems.
1679 	 * How to test: run 800Mbit/s UDP traffic and during that restart your
1680 	 * supplicant.  You want to survive that.
1681 	 */
1682 	if (vif->cfg.assoc && lsta->state == IEEE80211_STA_AUTHORIZED) {
1683 		if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1684 			ic_printf(ic, "%d %lu %s: vif still assoc; not deleting keys\n",
1685 			    curthread->td_tid, jiffies, __func__);
1686 		ieee80211_free_node(ni);
1687 		return (0);
1688 	}
1689 
1690 	if (IEEE80211_KEY_UNDEFINED(k)) {
1691 		ic_printf(ic, "%s: vap %p key %p is undefined: %p %u\n",
1692 		    __func__, vap, k, k->wk_cipher, k->wk_keyix);
1693 		ieee80211_free_node(ni);
1694 		return (0);
1695 	}
1696 
1697 	if (vap->iv_bss == NULL) {
1698 		ic_printf(ic, "%s: iv_bss %p for vap %p is NULL\n",
1699 		    __func__, vap->iv_bss, vap);
1700 		ieee80211_free_node(ni);
1701 		return (0);
1702 	}
1703 	sta = LSTA_TO_STA(lsta);
1704 
1705 	if (lsta->kc[k->wk_keyix] == NULL) {
1706 #ifdef LINUXKPI_DEBUG_80211
1707 		if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1708 			ic_printf(ic, "%d %lu %s: sta %6D and no key information, "
1709 			    "keyidx %u wk_macaddr %6D; returning success\n",
1710 			    curthread->td_tid, jiffies, __func__, sta->addr, ":",
1711 			    k->wk_keyix, k->wk_macaddr, ":");
1712 #endif
1713 		ieee80211_free_node(ni);
1714 		return (1);
1715 	}
1716 	kc = lsta->kc[k->wk_keyix];
1717 
1718 #ifdef LINUXKPI_DEBUG_80211
1719 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1720 		ic_printf(ic, "%d %lu %s: running set_key cmd %d(%s) for sta %6D: "
1721 		    "keyidx %u hw_key_idx %u flags %b\n",
1722 		    curthread->td_tid, jiffies, __func__,
1723 		    DISABLE_KEY, "DISABLE", sta->addr, ":",
1724 		    kc->keyidx, kc->hw_key_idx, kc->flags, IEEE80211_KEY_FLAG_BITS);
1725 #endif
1726 
1727 	error = lkpi_80211_mo_set_key(hw, DISABLE_KEY, vif, sta, kc);
1728 	if (error != 0) {
1729 		ic_printf(ic, "%d %lu %s: set_key cmd %d(%s) for sta %6D failed: %d\n",
1730 		    curthread->td_tid, jiffies, __func__,
1731 		    DISABLE_KEY, "DISABLE", sta->addr, ":", error);
1732 		error = 0;
1733 		goto out;
1734 	}
1735 
1736 #ifdef LINUXKPI_DEBUG_80211
1737 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1738 		ic_printf(ic, "%d %lu %s: set_key cmd %d(%s) for sta %6D succeeded: "
1739 		    "keyidx %u hw_key_idx %u flags %b\n",
1740 		    curthread->td_tid, jiffies, __func__,
1741 		    DISABLE_KEY, "DISABLE", sta->addr, ":",
1742 		    kc->keyidx, kc->hw_key_idx, kc->flags, IEEE80211_KEY_FLAG_BITS);
1743 #endif
1744 	lsta->kc[k->wk_keyix] = NULL;
1745 	free(kc, M_LKPI80211);
1746 	error = 1;
1747 out:
1748 	ieee80211_free_node(ni);
1749 	return (error);
1750 }
1751 
1752 static int
1753 lkpi_iv_key_set(struct ieee80211vap *vap, const struct ieee80211_key *k)
1754 {
1755 	struct ieee80211com *ic;
1756 	struct lkpi_hw *lhw;
1757 	struct ieee80211_hw *hw;
1758 	struct lkpi_vif *lvif;
1759 	struct lkpi_sta *lsta;
1760 	struct ieee80211_vif *vif;
1761 	struct ieee80211_sta *sta;
1762 	struct ieee80211_node *ni;
1763 	struct ieee80211_key_conf *kc;
1764 	struct ieee80211_key *wk;
1765 	uint32_t lcipher;
1766 	uint16_t exp_flags;
1767 	uint8_t keylen;
1768 	int error;
1769 
1770 	ic = vap->iv_ic;
1771 	lhw = ic->ic_softc;
1772 	hw = LHW_TO_HW(lhw);
1773 
1774 	/*
1775 	 * Make sure we do not make it here without going through
1776 	 * lkpi_iv_key_update_begin() first.
1777 	 */
1778 	lockdep_assert_wiphy(hw->wiphy);
1779 
1780 	if (IEEE80211_KEY_UNDEFINED(k)) {
1781 		ic_printf(ic, "%s: vap %p key %p is undefined: %p %u\n",
1782 		    __func__, vap, k, k->wk_cipher, k->wk_keyix);
1783 		return (0);
1784 	}
1785 
1786 	if (vap->iv_bss == NULL) {
1787 		ic_printf(ic, "%s: iv_bss %p for vap %p is NULL\n",
1788 		    __func__, vap->iv_bss, vap);
1789 		return (0);
1790 	}
1791 	ni = ieee80211_ref_node(vap->iv_bss);
1792 	lsta = ni->ni_drv_data;
1793 	if (lsta == NULL) {
1794 		ic_printf(ic, "%s: ni %p (%6D) with lsta NULL\n",
1795 		    __func__, ni, ni->ni_bssid, ":");
1796 		ieee80211_free_node(ni);
1797 		return (0);
1798 	}
1799 	sta = LSTA_TO_STA(lsta);
1800 
1801 	keylen = ieee80211_crypto_get_key_len(k);
1802 	lcipher = lkpi_net80211_to_l80211_cipher_suite(
1803 	    k->wk_cipher->ic_cipher, ieee80211_crypto_get_key_len(k));
1804 	switch (lcipher) {
1805 	case WLAN_CIPHER_SUITE_TKIP:
1806 		keylen += ieee80211_crypto_get_key_txmic_len(k);
1807 		keylen += ieee80211_crypto_get_key_rxmic_len(k);
1808 		break;
1809 	case WLAN_CIPHER_SUITE_CCMP:
1810 	case WLAN_CIPHER_SUITE_GCMP:
1811 		break;
1812 	default:
1813 		ic_printf(ic, "%s: CIPHER SUITE %#x (%s) not supported\n",
1814 		    __func__, lcipher, lkpi_cipher_suite_to_name(lcipher));
1815 		IMPROVE();
1816 		ieee80211_free_node(ni);
1817 		return (0);
1818 	}
1819 
1820 	if (lsta->kc[k->wk_keyix] != NULL) {
1821 		IMPROVE("Still in firmware? Del first. Can we assert this cannot happen?");
1822 		ic_printf(ic, "%s: sta %6D found with key information\n",
1823 		    __func__, sta->addr, ":");
1824 		kc = lsta->kc[k->wk_keyix];
1825 		lsta->kc[k->wk_keyix] = NULL;
1826 		free(kc, M_LKPI80211);
1827 		kc = NULL;	/* safeguard */
1828 	}
1829 
1830 	kc = malloc(sizeof(*kc) + keylen, M_LKPI80211, M_WAITOK | M_ZERO);
1831 	kc->_k = k;		/* Save the pointer to net80211. */
1832 	kc->cipher = lcipher;
1833 	kc->keyidx = k->wk_keyix;
1834 #if 0
1835 	kc->hw_key_idx = /* set by hw and needs to be passed for TX */;
1836 #endif
1837 	atomic64_set(&kc->tx_pn, k->wk_keytsc);
1838 	kc->keylen = ieee80211_crypto_get_key_len(k);
1839 	memcpy(kc->key, ieee80211_crypto_get_key_data(k),
1840 	    ieee80211_crypto_get_key_len(k));
1841 
1842 	if (k->wk_flags & (IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV))
1843 		kc->flags |= IEEE80211_KEY_FLAG_PAIRWISE;
1844 	if (k->wk_flags & IEEE80211_KEY_GROUP)
1845 		kc->flags &= ~IEEE80211_KEY_FLAG_PAIRWISE;
1846 
1847 	kc->iv_len = k->wk_cipher->ic_header;
1848 	kc->icv_len = k->wk_cipher->ic_trailer;
1849 
1850 	switch (kc->cipher) {
1851 	case WLAN_CIPHER_SUITE_TKIP:
1852 		memcpy(kc->key + NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY,
1853 		    ieee80211_crypto_get_key_txmic_data(k),
1854 		    ieee80211_crypto_get_key_txmic_len(k));
1855 		memcpy(kc->key + NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY,
1856 		    ieee80211_crypto_get_key_rxmic_data(k),
1857 		    ieee80211_crypto_get_key_rxmic_len(k));
1858 		break;
1859 	case WLAN_CIPHER_SUITE_CCMP:
1860 	case WLAN_CIPHER_SUITE_GCMP:
1861 		break;
1862 	default:
1863 		/* currently UNREACH */
1864 		IMPROVE();
1865 		break;
1866 	};
1867 	lsta->kc[k->wk_keyix] = kc;
1868 
1869 #ifdef LINUXKPI_DEBUG_80211
1870 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1871 		ic_printf(ic, "%d %lu %s: running set_key cmd %d(%s) for sta %6D: "
1872 		    "kc %p keyidx %u hw_key_idx %u keylen %u flags %b\n",
1873 		    curthread->td_tid, jiffies, __func__,
1874 		    SET_KEY, "SET", sta->addr, ":", kc, kc->keyidx, kc->hw_key_idx,
1875 		    kc->keylen, kc->flags, IEEE80211_KEY_FLAG_BITS);
1876 #endif
1877 
1878 	lvif = VAP_TO_LVIF(vap);
1879 	vif = LVIF_TO_VIF(lvif);
1880 	error = lkpi_80211_mo_set_key(hw, SET_KEY, vif, sta, kc);
1881 	if (error != 0) {
1882 		ic_printf(ic, "%d %lu %s: set_key cmd %d(%s) for sta %6D failed: %d\n",
1883 		    curthread->td_tid, jiffies, __func__,
1884 		    SET_KEY, "SET", sta->addr, ":", error);
1885 		lsta->kc[k->wk_keyix] = NULL;
1886 		free(kc, M_LKPI80211);
1887 		ieee80211_free_node(ni);
1888 		return (0);
1889 	}
1890 
1891 #ifdef LINUXKPI_DEBUG_80211
1892 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1893 		ic_printf(ic, "%d %lu %s: set_key cmd %d(%s) for sta %6D succeeded: "
1894 		    "kc %p keyidx %u hw_key_idx %u flags %b\n",
1895 		    curthread->td_tid, jiffies, __func__,
1896 		    SET_KEY, "SET", sta->addr, ":",
1897 		    kc, kc->keyidx, kc->hw_key_idx, kc->flags, IEEE80211_KEY_FLAG_BITS);
1898 #endif
1899 
1900 	/*
1901 	 * Getting here means we support HW crypto offload.
1902 	 * Some drivers do not set the wiphy [n_]cipher_suites and thus we
1903 	 * never populate ic_cryptocaps. which means SWCRYPT will be set and we
1904 	 * should disable this now (before possibly setting other SW flags
1905 	 * again for when we need partial SW support).
1906 	 */
1907 	wk = __DECONST(struct ieee80211_key *, k);
1908 	wk->wk_flags &= ~IEEE80211_KEY_SWCRYPT;
1909 
1910 	exp_flags = 0;
1911 	switch (kc->cipher) {
1912 	case WLAN_CIPHER_SUITE_TKIP:
1913 		exp_flags = (IEEE80211_KEY_FLAG_PAIRWISE |
1914 			IEEE80211_KEY_FLAG_PUT_IV_SPACE |
1915 			IEEE80211_KEY_FLAG_GENERATE_MMIC |
1916 			IEEE80211_KEY_FLAG_PUT_MIC_SPACE);
1917 #define	TKIP_INVAL_COMBINATION						\
1918      (IEEE80211_KEY_FLAG_PUT_MIC_SPACE|IEEE80211_KEY_FLAG_GENERATE_MMIC)
1919 		if ((kc->flags & TKIP_INVAL_COMBINATION) == TKIP_INVAL_COMBINATION) {
1920 			ic_printf(ic, "%s: SET_KEY for %s returned invalid "
1921 			    "combination %b\n", __func__,
1922 			    lkpi_cipher_suite_to_name(kc->cipher),
1923 			    kc->flags, IEEE80211_KEY_FLAG_BITS);
1924 		}
1925 #undef	TKIP_INVAL_COMBINATION
1926 #ifdef __notyet__
1927 		/* Do flags surgery; special see linuxkpi_ieee80211_ifattach(). */
1928 		if ((kc->flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) != 0) {
1929 			wk->wk_flags &= ~(IEEE80211_KEY_NOMICMGT|IEEE80211_KEY_NOMIC);
1930 			wk->wk_flags |= IEEE80211_KEY_SWMIC;
1931 			ic->ic_cryptocaps &= ~IEEE80211_CRYPTO_TKIPMIC
1932 		}
1933 #endif
1934 		break;
1935 	case WLAN_CIPHER_SUITE_CCMP:
1936 	case WLAN_CIPHER_SUITE_GCMP:
1937 		exp_flags = (IEEE80211_KEY_FLAG_PAIRWISE |
1938 		    IEEE80211_KEY_FLAG_PUT_IV_SPACE |
1939 		    IEEE80211_KEY_FLAG_GENERATE_IV |
1940 		    IEEE80211_KEY_FLAG_GENERATE_IV_MGMT |	/* Only needs IV geeration for MGMT frames. */
1941 		    IEEE80211_KEY_FLAG_SW_MGMT_TX);		/* MFP in software */
1942 		break;
1943 	}
1944 	if ((kc->flags & ~exp_flags) != 0)
1945 		ic_printf(ic, "%s: SET_KEY for %s returned unexpected key flags: "
1946 		    " %#06x & ~%#06x = %b\n", __func__,
1947 		    lkpi_cipher_suite_to_name(kc->cipher), kc->flags, exp_flags,
1948 		    (kc->flags & ~exp_flags), IEEE80211_KEY_FLAG_BITS);
1949 
1950 #ifdef __notyet__
1951 	/* Do flags surgery. */
1952 	if ((kc->flags & IEEE80211_KEY_FLAG_GENERATE_IV_MGMT) == 0)
1953 		wk->wk_flags |= IEEE80211_KEY_NOIVMGT;
1954 	if ((kc->flags & IEEE80211_KEY_FLAG_GENERATE_IV) == 0)
1955 		wk->wk_flags |= IEEE80211_KEY_NOIV;
1956 #endif
1957 
1958 	ieee80211_free_node(ni);
1959 	return (1);
1960 }
1961 
1962 static void
1963 lkpi_iv_key_update_begin(struct ieee80211vap *vap)
1964 {
1965 	struct ieee80211_node_table *nt;
1966 	struct ieee80211com *ic;
1967 	struct lkpi_hw *lhw;
1968 	struct ieee80211_hw *hw;
1969 	struct lkpi_vif *lvif;
1970 	struct ieee80211_node *ni;
1971 	bool icislocked, ntislocked;
1972 
1973 	ic = vap->iv_ic;
1974 	lhw = ic->ic_softc;
1975 	hw = LHW_TO_HW(lhw);
1976 	lvif = VAP_TO_LVIF(vap);
1977 	nt = &ic->ic_sta;
1978 
1979 	icislocked = IEEE80211_IS_LOCKED(ic);
1980 	ntislocked = IEEE80211_NODE_IS_LOCKED(nt);
1981 
1982 #ifdef LINUXKPI_DEBUG_80211
1983 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1984 		ic_printf(ic, "%d %lu %s: vap %p ic %p %slocked nt %p %slocked "
1985 		    "lvif ic_unlocked %d nt_unlocked %d\n",
1986 		    curthread->td_tid, jiffies, __func__, vap,
1987 		    ic, icislocked ? "" : "un", nt, ntislocked ? "" : "un",
1988 		    lvif->ic_unlocked, lvif->nt_unlocked);
1989 #endif
1990 
1991 	/*
1992 	 * This is inconsistent net80211 locking to be fixed one day.
1993 	 */
1994 	/* Try to make sure the node does not go away while possibly unlocked. */
1995 	ni = NULL;
1996 	if (icislocked || ntislocked) {
1997 		if (vap->iv_bss != NULL)
1998 			ni = ieee80211_ref_node(vap->iv_bss);
1999 	}
2000 
2001 	if (icislocked)
2002 		IEEE80211_UNLOCK(ic);
2003 	if (ntislocked)
2004 		IEEE80211_NODE_UNLOCK(nt);
2005 
2006 	wiphy_lock(hw->wiphy);
2007 
2008 	KASSERT(lvif->key_update_iv_bss == NULL, ("%s: key_update_iv_bss not NULL %p",
2009 	    __func__, lvif->key_update_iv_bss));
2010 	lvif->key_update_iv_bss = ni;
2011 
2012 	/*
2013 	 * ic/nt_unlocked could be a bool given we are under the lock and there
2014 	 * must only be a single thread.
2015 	 * In case anything in the future disturbs the order the refcnt will
2016 	 * help us catching problems a lot easier.
2017 	 */
2018 	if (icislocked)
2019 		refcount_acquire(&lvif->ic_unlocked);
2020 	if (ntislocked)
2021 		refcount_acquire(&lvif->nt_unlocked);
2022 
2023 	/*
2024 	 * Stop the queues while doing key updates.
2025 	 */
2026 	ieee80211_stop_queues(hw);
2027 }
2028 
2029 static void
2030 lkpi_iv_key_update_end(struct ieee80211vap *vap)
2031 {
2032 	struct ieee80211_node_table *nt;
2033 	struct ieee80211com *ic;
2034 	struct lkpi_hw *lhw;
2035 	struct ieee80211_hw *hw;
2036 	struct lkpi_vif *lvif;
2037 	bool icislocked, ntislocked;
2038 
2039 	ic = vap->iv_ic;
2040 	lhw = ic->ic_softc;
2041 	hw = LHW_TO_HW(lhw);
2042 	lvif = VAP_TO_LVIF(vap);
2043 	nt = &ic->ic_sta;
2044 
2045 	/*
2046 	 * Re-enabled the queues after the key update.
2047 	 */
2048 	lkpi_ieee80211_wake_queues_locked(hw);
2049 
2050 	icislocked = IEEE80211_IS_LOCKED(ic);
2051 	MPASS(!icislocked);
2052 	ntislocked = IEEE80211_NODE_IS_LOCKED(nt);
2053 	MPASS(!ntislocked);
2054 
2055 #ifdef LINUXKPI_DEBUG_80211
2056 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
2057 		ic_printf(ic, "%d %lu %s: vap %p ic %p %slocked nt %p %slocked "
2058 		    "lvif ic_unlocked %d nt_unlocked %d\n",
2059 		    curthread->td_tid, jiffies, __func__, vap,
2060 		    ic, icislocked ? "" : "un", nt, ntislocked ? "" : "un",
2061 		    lvif->ic_unlocked, lvif->nt_unlocked);
2062 #endif
2063 
2064 	/*
2065 	 * Check under lock; see comment in lkpi_iv_key_update_begin().
2066 	 * In case the refcnt gets out of sync locking in net80211 will
2067 	 * quickly barf as well (trying to unlock a lock not held).
2068 	 */
2069 	icislocked = refcount_release_if_last(&lvif->ic_unlocked);
2070 	ntislocked = refcount_release_if_last(&lvif->nt_unlocked);
2071 
2072 	if (lvif->key_update_iv_bss != NULL) {
2073 		ieee80211_free_node(lvif->key_update_iv_bss);
2074 		lvif->key_update_iv_bss = NULL;
2075 	}
2076 
2077 	wiphy_unlock(hw->wiphy);
2078 
2079 	/*
2080 	 * This is inconsistent net80211 locking to be fixed one day.
2081 	 * ic before nt to avoid a LOR.
2082 	 */
2083 	if (icislocked)
2084 		IEEE80211_LOCK(ic);
2085 	if (ntislocked)
2086 		IEEE80211_NODE_LOCK(nt);
2087 }
2088 #endif
2089 
2090 static void
2091 lkpi_cleanup_mcast_list_locked(struct lkpi_hw *lhw)
2092 {
2093 	struct list_head *le, *next;
2094 	struct netdev_hw_addr *addr;
2095 
2096 	if (lhw->mc_list.count != 0) {
2097 		list_for_each_safe(le, next, &lhw->mc_list.addr_list) {
2098 			addr = list_entry(le, struct netdev_hw_addr, addr_list);
2099 			list_del(le);
2100 			lhw->mc_list.count--;
2101 			free(addr, M_LKPI80211);
2102 		}
2103 	}
2104 	KASSERT(lhw->mc_list.count == 0, ("%s: mc_list %p count %d != 0\n",
2105 	    __func__, &lhw->mc_list, lhw->mc_list.count));
2106 }
2107 
2108 static u_int
2109 lkpi_ic_update_mcast_copy(void *arg, struct sockaddr_dl *sdl, u_int cnt)
2110 {
2111 	struct netdev_hw_addr_list *mc_list;
2112 	struct netdev_hw_addr *addr;
2113 
2114 	KASSERT(arg != NULL && sdl != NULL, ("%s: arg %p sdl %p cnt %u\n",
2115 	    __func__, arg, sdl, cnt));
2116 
2117 	mc_list = arg;
2118 	/* If it is on the list already skip it. */
2119 	netdev_hw_addr_list_for_each(addr, mc_list) {
2120 		if (!memcmp(addr->addr, LLADDR(sdl), sdl->sdl_alen))
2121 			return (0);
2122 	}
2123 
2124 	addr = malloc(sizeof(*addr), M_LKPI80211, M_NOWAIT | M_ZERO);
2125 	if (addr == NULL)
2126 		return (0);
2127 
2128 	INIT_LIST_HEAD(&addr->addr_list);
2129 	memcpy(addr->addr, LLADDR(sdl), sdl->sdl_alen);
2130 	/* XXX this should be a netdev function? */
2131 	list_add(&addr->addr_list, &mc_list->addr_list);
2132 	mc_list->count++;
2133 
2134 #ifdef LINUXKPI_DEBUG_80211
2135 	if (linuxkpi_debug_80211 & D80211_TRACE)
2136 		printf("%s:%d: mc_list count %d: added %6D\n",
2137 		    __func__, __LINE__, mc_list->count, addr->addr, ":");
2138 #endif
2139 
2140 	return (1);
2141 }
2142 
2143 static void
2144 lkpi_update_mcast_filter_locked(struct ieee80211com *ic)
2145 {
2146 	struct lkpi_hw *lhw;
2147 	struct ieee80211_hw *hw;
2148 	u64 mc;
2149 	unsigned int changed_flags, flags;
2150 	bool scanning;
2151 
2152 	lhw = ic->ic_softc;
2153 	hw = LHW_TO_HW(lhw);
2154 
2155 	lockdep_assert_wiphy(hw->wiphy);
2156 
2157 	LKPI_80211_LHW_SCAN_LOCK(lhw);
2158 	scanning = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
2159 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
2160 
2161 	LKPI_80211_LHW_MC_LOCK(lhw);
2162 
2163 	flags = 0;
2164 	if (scanning)
2165 		flags |= FIF_BCN_PRBRESP_PROMISC;
2166 	/* The latter condition may not be as expected but seems wise. */
2167 	if (lhw->mc_all_multi || lhw->ops->prepare_multicast == NULL)
2168 		flags |= FIF_ALLMULTI;
2169 
2170 	mc = lkpi_80211_mo_prepare_multicast(hw, &lhw->mc_list);
2171 
2172 	changed_flags = (lhw->mc_flags ^ flags) & FIF_FLAGS_MASK;
2173 	lkpi_80211_mo_configure_filter(hw, changed_flags, &flags, mc);
2174 	lhw->mc_flags = flags;
2175 
2176 #ifdef LINUXKPI_DEBUG_80211
2177 	if (linuxkpi_debug_80211 & D80211_TRACE)
2178 		printf("%s: changed_flags %#06x count %d mc_flags %#010x\n",
2179 		    __func__, changed_flags, lhw->mc_list.count, lhw->mc_flags);
2180 #endif
2181 
2182 	LKPI_80211_LHW_MC_UNLOCK(lhw);
2183 }
2184 
2185 static void
2186 lkpi_update_mcast_filter(struct ieee80211com *ic)
2187 {
2188 	struct lkpi_hw *lhw;
2189 	struct ieee80211_hw *hw;
2190 
2191 	lhw = ic->ic_softc;
2192 	hw = LHW_TO_HW(lhw);
2193 
2194 	wiphy_lock(hw->wiphy);
2195 	lkpi_update_mcast_filter_locked(ic);
2196 	wiphy_unlock(hw->wiphy);
2197 }
2198 
2199 static enum ieee80211_bss_changed
2200 lkpi_update_dtim_tsf(struct ieee80211_vif *vif, struct ieee80211_node *ni,
2201     struct ieee80211vap *vap, const char *_f, int _l)
2202 {
2203 	enum ieee80211_bss_changed bss_changed;
2204 
2205 	bss_changed = 0;
2206 
2207 #ifdef LINUXKPI_DEBUG_80211
2208 	if (linuxkpi_debug_80211 & D80211_TRACE)
2209 		printf("%s:%d [%s:%d] assoc %d aid %d beacon_int %u "
2210 		    "dtim_period %u sync_dtim_count %u sync_tsf %ju "
2211 		    "sync_device_ts %u bss_changed %#010jx\n",
2212 			__func__, __LINE__, _f, _l,
2213 			vif->cfg.assoc, vif->cfg.aid,
2214 			vif->bss_conf.beacon_int, vif->bss_conf.dtim_period,
2215 			vif->bss_conf.sync_dtim_count,
2216 			(uintmax_t)vif->bss_conf.sync_tsf,
2217 			vif->bss_conf.sync_device_ts,
2218 			(uintmax_t)bss_changed);
2219 #endif
2220 
2221 	if (vif->bss_conf.beacon_int != ni->ni_intval) {
2222 		vif->bss_conf.beacon_int = ni->ni_intval;
2223 		/* iwlwifi FW bug workaround; iwl_mvm_mac_sta_state. */
2224 		if (vif->bss_conf.beacon_int < 16)
2225 			vif->bss_conf.beacon_int = 16;
2226 		bss_changed |= BSS_CHANGED_BEACON_INT;
2227 	}
2228 
2229 	/*
2230 	 * lkpi_iv_sta_recv_mgmt() will directly call into this function.
2231 	 * iwlwifi(4) in iwl_mvm_bss_info_changed_station_common() will
2232 	 * stop seesion protection the moment it sees
2233 	 * BSS_CHANGED_BEACON_INFO (with the expectations that it was
2234 	 * "a beacon from the associated AP"). It will also update
2235 	 * the beacon filter in that case.  This is the only place
2236 	 * we set the BSS_CHANGED_BEACON_INFO on the non-teardown
2237 	 * path so make sure we only do run this check once we are
2238 	 * assoc. (*iv_recv_mgmt)() will be called before we enter
2239 	 * here so the ni will be updated with information from the
2240 	 * beacon via net80211::sta_recv_mgmt().  We also need to
2241 	 * make sure we do not do it on every beacon we still may
2242 	 * get so only do if something changed.  vif->bss_conf.dtim_period
2243 	 * should be 0 as we start up (we also reset it on teardown).
2244 	 *
2245 	 * If we are assoc we need to make sure dtim_period is non-0.
2246 	 * 0 is a reserved value and drivers assume they can DIV by it.
2247 	 * In theory this means we need to wait for the first beacon
2248 	 * before we finalize the vif being assoc.  In practise that
2249 	 * is harder until net80211 learns how to.  Work around like
2250 	 * this for the moment.
2251 	 */
2252 	if (vif->cfg.assoc) {
2253 		if (vif->bss_conf.dtim_period != ni->ni_dtim_period &&
2254 	            ni->ni_dtim_period > 0) {
2255 			vif->bss_conf.dtim_period = ni->ni_dtim_period;
2256 			bss_changed |= BSS_CHANGED_BEACON_INFO;
2257 		} else if (vif->bss_conf.dtim_period == 0) {
2258 			vif->bss_conf.dtim_period = 1;
2259 			bss_changed |= BSS_CHANGED_BEACON_INFO;
2260 		}
2261 	}
2262 
2263 	vif->bss_conf.sync_dtim_count = ni->ni_dtim_count;
2264 	vif->bss_conf.sync_tsf = le64toh(ni->ni_tstamp.tsf);
2265 	/* vif->bss_conf.sync_device_ts = set in linuxkpi_ieee80211_rx. */
2266 
2267 #ifdef LINUXKPI_DEBUG_80211
2268 	if (linuxkpi_debug_80211 & D80211_TRACE)
2269 		printf("%s:%d [%s:%d] assoc %d aid %d beacon_int %u "
2270 		    "dtim_period %u sync_dtim_count %u sync_tsf %ju "
2271 		    "sync_device_ts %u bss_changed %#010jx\n",
2272 			__func__, __LINE__, _f, _l,
2273 			vif->cfg.assoc, vif->cfg.aid,
2274 			vif->bss_conf.beacon_int, vif->bss_conf.dtim_period,
2275 			vif->bss_conf.sync_dtim_count,
2276 			(uintmax_t)vif->bss_conf.sync_tsf,
2277 			vif->bss_conf.sync_device_ts,
2278 			(uintmax_t)bss_changed);
2279 #endif
2280 
2281 	return (bss_changed);
2282 }
2283 
2284 static void
2285 lkpi_stop_hw_scan(struct lkpi_hw *lhw, struct ieee80211_vif *vif)
2286 {
2287 	struct ieee80211_hw *hw;
2288 	int error;
2289 	bool cancel;
2290 
2291 	TRACE_SCAN(lhw->ic, "scan_flags %b", lhw->scan_flags, LKPI_LHW_SCAN_BITS);
2292 
2293 	LKPI_80211_LHW_SCAN_LOCK(lhw);
2294 	cancel = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
2295 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
2296 	if (!cancel)
2297 		return;
2298 
2299 	hw = LHW_TO_HW(lhw);
2300 
2301 	IEEE80211_UNLOCK(lhw->ic);
2302 	wiphy_lock(hw->wiphy);
2303 	/* Need to cancel the scan. */
2304 	lkpi_80211_mo_cancel_hw_scan(hw, vif);
2305 	wiphy_unlock(hw->wiphy);
2306 
2307 	/* Need to make sure we see ieee80211_scan_completed. */
2308 	LKPI_80211_LHW_SCAN_LOCK(lhw);
2309 	if ((lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0)
2310 		error = msleep(lhw, &lhw->scan_mtx, 0, "lhwscanstop", hz/2);
2311 	cancel = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
2312 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
2313 
2314 	IEEE80211_LOCK(lhw->ic);
2315 
2316 	if (cancel)
2317 		ic_printf(lhw->ic, "%s: failed to cancel scan: %d (%p, %p)\n",
2318 		    __func__, error, lhw, vif);
2319 }
2320 
2321 static void
2322 lkpi_hw_conf_idle(struct ieee80211_hw *hw, bool new)
2323 {
2324 	struct lkpi_hw *lhw;
2325 	int error;
2326 	bool old;
2327 
2328 	lockdep_assert_wiphy(hw->wiphy);
2329 
2330 	old = hw->conf.flags & IEEE80211_CONF_IDLE;
2331 	if (old == new)
2332 		return;
2333 
2334 	hw->conf.flags ^= IEEE80211_CONF_IDLE;
2335 	error = lkpi_80211_mo_config(hw, IEEE80211_CONF_CHANGE_IDLE);
2336 	if (error != 0 && error != EOPNOTSUPP) {
2337 		lhw = HW_TO_LHW(hw);
2338 		ic_printf(lhw->ic, "ERROR: %s: config %#0x returned %d\n",
2339 		    __func__, IEEE80211_CONF_CHANGE_IDLE, error);
2340 	}
2341 }
2342 
2343 static enum ieee80211_bss_changed
2344 lkpi_disassoc(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
2345     struct lkpi_hw *lhw)
2346 {
2347 	struct ieee80211_hw *hw;
2348 	struct lkpi_vif *lvif;
2349 	enum ieee80211_bss_changed changed;
2350 
2351 	hw = LHW_TO_HW(lhw);
2352 	lockdep_assert_wiphy(hw->wiphy);
2353 
2354 	changed = 0;
2355 	sta->aid = 0;
2356 	if (vif->cfg.assoc) {
2357 
2358 		vif->cfg.assoc = false;
2359 		vif->cfg.aid = 0;
2360 		changed |= BSS_CHANGED_ASSOC;
2361 		IMPROVE();
2362 
2363 		lkpi_update_mcast_filter_locked(lhw->ic);
2364 
2365 		/*
2366 		 * Executing the bss_info_changed(BSS_CHANGED_ASSOC) with
2367 		 * assoc = false right away here will remove the sta from
2368 		 * firmware for iwlwifi.
2369 		 * We no longer do this but only return the BSS_CHNAGED value.
2370 		 * The caller is responsible for removing the sta gong to
2371 		 * IEEE80211_STA_NOTEXIST and then executing the
2372 		 * bss_info_changed() update.
2373 		 * See DOWN4 for more detailed comment.
2374 		 */
2375 
2376 		lvif = VIF_TO_LVIF(vif);
2377 		lvif->beacons = 0;
2378 	}
2379 
2380 	return (changed);
2381 }
2382 
2383 static void
2384 lkpi_wake_tx_queues(struct ieee80211_hw *hw, struct ieee80211_sta *sta,
2385     bool dequeue_seen, bool no_emptyq)
2386 {
2387 	struct lkpi_txq *ltxq;
2388 	int tid;
2389 	bool ltxq_empty;
2390 
2391 	/* Wake up all queues to know they are allocated in the driver. */
2392 	for (tid = 0; tid < nitems(sta->txq); tid++) {
2393 
2394 		if (tid == IEEE80211_NUM_TIDS) {
2395 			IMPROVE("station specific?");
2396 			if (!ieee80211_hw_check(hw, STA_MMPDU_TXQ))
2397 				continue;
2398 		} else if (tid >= hw->queues)
2399 			continue;
2400 
2401 		if (sta->txq[tid] == NULL)
2402 			continue;
2403 
2404 		ltxq = TXQ_TO_LTXQ(sta->txq[tid]);
2405 		if (dequeue_seen && (ltxq->flags & LKPI_TXQ_SEEN_DEQUEUE) == 0)
2406 			continue;
2407 
2408 		LKPI_80211_LTXQ_LOCK(ltxq);
2409 		ltxq_empty = skb_queue_empty(&ltxq->skbq);
2410 		LKPI_80211_LTXQ_UNLOCK(ltxq);
2411 		if (no_emptyq && ltxq_empty)
2412 			continue;
2413 
2414 		lkpi_80211_mo_wake_tx_queue(hw, sta->txq[tid], false);
2415 	}
2416 }
2417 
2418 /*
2419  * On the way down from RUN -> ASSOC -> AUTH we may send a DISASSOC or DEAUTH
2420  * packet.  The problem is that the state machine functions tend to hold the
2421  * LHW lock which will prevent lkpi_80211_txq_tx_one() from sending the packet.
2422  * We call this after dropping the ic lock and before acquiring the LHW lock.
2423  * we make sure no further packets are queued and if they are queued the task
2424  * will finish or be cancelled.  At the end if a packet is left we manually
2425  * send it.  scan_to_auth() would re-enable sending if the lsta would be
2426  * re-used.
2427  */
2428 static void
2429 lkpi_80211_flush_tx(struct lkpi_hw *lhw, struct lkpi_sta *lsta)
2430 {
2431 	struct ieee80211_hw *hw;
2432 	struct mbufq mq;
2433 	struct mbuf *m;
2434 	int len;
2435 
2436 	/* There is no lockdep_assert_not_held_wiphy(). */
2437 	hw = LHW_TO_HW(lhw);
2438 	lockdep_assert_not_held(&hw->wiphy->mtx);
2439 
2440 	/* Do not accept any new packets until scan_to_auth or lsta_free(). */
2441 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
2442 	lsta->txq_ready = false;
2443 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
2444 
2445 	while (taskqueue_cancel(taskqueue_thread, &lsta->txq_task, NULL) != 0)
2446 		taskqueue_drain(taskqueue_thread, &lsta->txq_task);
2447 
2448 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
2449 	len = mbufq_len(&lsta->txq);
2450 	if (len <= 0) {
2451 		LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
2452 		return;
2453 	}
2454 
2455 	mbufq_init(&mq, IFQ_MAXLEN);
2456 	mbufq_concat(&mq, &lsta->txq);
2457 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
2458 
2459 	m = mbufq_dequeue(&mq);
2460 	while (m != NULL) {
2461 		lkpi_80211_txq_tx_one(lsta, m);
2462 		m = mbufq_dequeue(&mq);
2463 	}
2464 }
2465 
2466 static void
2467 lkpi_init_chandef(struct ieee80211com *ic __unused,
2468     struct cfg80211_chan_def *chandef,
2469     struct linuxkpi_ieee80211_channel *chan, struct ieee80211_channel *c,
2470     bool can_ht)
2471 {
2472 
2473 	cfg80211_chandef_create(chandef, chan,
2474 	    (can_ht) ? NL80211_CHAN_HT20 : NL80211_CHAN_NO_HT);
2475 	chandef->center_freq1 = ieee80211_get_channel_center_freq1(c);
2476 	chandef->center_freq2 = ieee80211_get_channel_center_freq2(c);
2477 
2478 	IMPROVE("Check ht/vht_cap from band not just chan? See lkpi_sta_sync_from_ni...");
2479 #ifdef LKPI_80211_HT
2480 	if (IEEE80211_IS_CHAN_HT(c)) {
2481 		if (IEEE80211_IS_CHAN_HT40(c))
2482 			chandef->width = NL80211_CHAN_WIDTH_40;
2483 		else
2484 			chandef->width = NL80211_CHAN_WIDTH_20;
2485 	}
2486 #endif
2487 #ifdef LKPI_80211_VHT
2488 	if (IEEE80211_IS_CHAN_VHT_5GHZ(c)) {
2489 		if (IEEE80211_IS_CHAN_VHT80P80(c))
2490 			chandef->width = NL80211_CHAN_WIDTH_80P80;
2491 		else if (IEEE80211_IS_CHAN_VHT160(c))
2492 			chandef->width = NL80211_CHAN_WIDTH_160;
2493 		else if (IEEE80211_IS_CHAN_VHT80(c))
2494 			chandef->width = NL80211_CHAN_WIDTH_80;
2495 	}
2496 #endif
2497 
2498 #ifdef LINUXKPI_DEBUG_80211
2499 	if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
2500 		ic_printf(ic, "%s:%d: chandef %p { chan %p { %u }, "
2501 		    "width %d cfreq1 %u cfreq2 %u punctured %u }\n",
2502 		    __func__, __LINE__, chandef,
2503 		    chandef->chan, chandef->chan->center_freq,
2504 		    chandef->width,
2505 		    chandef->center_freq1, chandef->center_freq2,
2506 		    chandef->punctured);
2507 #endif
2508 }
2509 
2510 static uint32_t
2511 lkpi_init_chanctx_conf(struct ieee80211_hw *hw,
2512     struct cfg80211_chan_def *chandef,
2513     struct ieee80211_chanctx_conf *chanctx_conf)
2514 {
2515 	uint32_t changed;
2516 
2517 	lockdep_assert_wiphy(hw->wiphy);
2518 
2519 	changed = 0;
2520 
2521 	chanctx_conf->rx_chains_static = 1;
2522 	chanctx_conf->rx_chains_dynamic = 1;
2523 	changed |= IEEE80211_CHANCTX_CHANGE_RX_CHAINS;
2524 
2525 	if (chanctx_conf->radar_enabled != hw->conf.radar_enabled) {
2526 		chanctx_conf->radar_enabled = hw->conf.radar_enabled;
2527 		changed |= IEEE80211_CHANCTX_CHANGE_RADAR;
2528 	}
2529 
2530 	chanctx_conf->def = *chandef;
2531 	changed |= IEEE80211_CHANCTX_CHANGE_WIDTH;
2532 
2533 	/* One day we should figure this out; is for iwlwifi-only. */
2534 	chanctx_conf->min_def = chanctx_conf->def;
2535 	changed |= IEEE80211_CHANCTX_CHANGE_MIN_WIDTH;
2536 
2537 	/* chanctx_conf->ap = */
2538 
2539 	return (changed);
2540 }
2541 
2542 static struct lkpi_chanctx *
2543 lkpi_alloc_lchanctx(struct ieee80211_hw *hw, struct lkpi_vif *lvif)
2544 {
2545 	struct lkpi_chanctx *lchanctx;
2546 
2547 	lchanctx = malloc(sizeof(*lchanctx) + hw->chanctx_data_size,
2548 	    M_LKPI80211, M_WAITOK | M_ZERO);
2549 	lchanctx->lvif = lvif;
2550 
2551 	return (lchanctx);
2552 }
2553 
2554 static struct lkpi_chanctx *
2555 lkpi_find_lchanctx_reserved(struct ieee80211_hw *hw, struct lkpi_vif *lvif)
2556 {
2557 	struct lkpi_hw *lhw;
2558 	struct lkpi_chanctx *lchanctx;
2559 	bool found;
2560 
2561 	lhw = HW_TO_LHW(hw);
2562 
2563 	found = false;
2564 	rcu_read_lock();
2565 	list_for_each_entry_rcu(lchanctx, &lhw->lchanctx_list_reserved, entry) {
2566 		if (lchanctx->lvif == lvif) {
2567 			found = true;
2568 			break;
2569 		}
2570 	}
2571 	rcu_read_unlock();
2572 
2573 	if (!found) {
2574 		lchanctx = lkpi_alloc_lchanctx(hw, lvif);
2575 		list_add_rcu(&lchanctx->entry, &lhw->lchanctx_list_reserved);
2576 	}
2577 
2578 	return (lchanctx);
2579 }
2580 
2581 static struct ieee80211_chanctx_conf *
2582 lkpi_get_chanctx_conf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
2583 {
2584 	struct ieee80211_chanctx_conf *chanctx_conf;
2585 
2586 	chanctx_conf = rcu_dereference_protected(vif->bss_conf.chanctx_conf,
2587 	    lockdep_is_held(&hw->wiphy->mtx));
2588 	if (chanctx_conf == NULL) {
2589 		struct lkpi_chanctx *lchanctx;
2590 		struct lkpi_vif *lvif;
2591 
2592 		lvif = VIF_TO_LVIF(vif);
2593 		lchanctx = lkpi_find_lchanctx_reserved(hw, lvif);
2594 		KASSERT(lchanctx != NULL, ("%s: hw %p, vif %p no lchanctx\n",
2595 		    __func__, hw, vif));
2596 		list_del(&lchanctx->entry);
2597 		chanctx_conf = &lchanctx->chanctx_conf;
2598 	}
2599 	/* else { IMPROVE("diff changes for changed, working on live copy, rcu"); } */
2600 
2601 	return (chanctx_conf);
2602 }
2603 
2604 static int
2605 lkpi_set_chanctx_conf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
2606     struct ieee80211_chanctx_conf *chanctx_conf,
2607     uint32_t changed, bool changed_set)
2608 {
2609 	struct lkpi_hw *lhw;
2610 	struct lkpi_chanctx *lchanctx;
2611 	int error;
2612 
2613 	lockdep_assert_wiphy(hw->wiphy);
2614 
2615 	if (vif->bss_conf.chanctx_conf == chanctx_conf) {
2616 		if (!changed_set) {
2617 			IMPROVE("OBSOLETE?");
2618 			changed = IEEE80211_CHANCTX_CHANGE_MIN_WIDTH;
2619 			changed |= IEEE80211_CHANCTX_CHANGE_RADAR;
2620 			changed |= IEEE80211_CHANCTX_CHANGE_RX_CHAINS;
2621 			changed |= IEEE80211_CHANCTX_CHANGE_WIDTH;
2622 		}
2623 		lkpi_80211_mo_change_chanctx(hw, chanctx_conf, changed);
2624 
2625 		return (0);
2626 	}
2627 
2628 	lhw = HW_TO_LHW(hw);
2629 
2630 	/* The device is no longer idle. */
2631 	IMPROVE("Once we do multi-vif, only do for 1st chanctx");
2632 	lkpi_hw_conf_idle(hw, false);
2633 
2634 	error = lkpi_80211_mo_add_chanctx(hw, chanctx_conf);
2635 	if (error != 0 && error != EOPNOTSUPP) {
2636 		ic_printf(lhw->ic, "%s:%d: mo_add_chanctx "
2637 		    "failed: %d\n", __func__, __LINE__, error);
2638 		return (error);
2639 	}
2640 
2641 	vif->bss_conf.chanreq.oper.chan = chanctx_conf->def.chan;
2642 	vif->bss_conf.chanreq.oper.width = chanctx_conf->def.width;
2643 	vif->bss_conf.chanreq.oper.center_freq1 =
2644 	    chanctx_conf->def.center_freq1;
2645 	vif->bss_conf.chanreq.oper.center_freq2 =
2646 	    chanctx_conf->def.center_freq2;
2647 
2648 	lchanctx = CHANCTX_CONF_TO_LCHANCTX(chanctx_conf);
2649 	list_add_rcu(&lchanctx->entry, &lhw->lchanctx_list);
2650 	rcu_assign_pointer(vif->bss_conf.chanctx_conf, chanctx_conf);
2651 
2652 	/* Assign vif chanctx. */
2653 	if (error == 0)
2654 		error = lkpi_80211_mo_assign_vif_chanctx(hw, vif,
2655 		    &vif->bss_conf, chanctx_conf);
2656 	if (error == EOPNOTSUPP)
2657 		error = 0;
2658 	if (error != 0) {
2659 		ic_printf(lhw->ic, "%s:%d: mo_assign_vif_chanctx "
2660 		    "failed: %d\n", __func__, __LINE__, error);
2661 		lkpi_80211_mo_remove_chanctx(hw, chanctx_conf);
2662 		rcu_assign_pointer(vif->bss_conf.chanctx_conf, NULL);
2663 		lchanctx = CHANCTX_CONF_TO_LCHANCTX(chanctx_conf);
2664 		list_del(&lchanctx->entry);
2665 		memset(lchanctx, 0, sizeof(*lchanctx));
2666 		lchanctx->lvif = VIF_TO_LVIF(vif);
2667 		list_add_rcu(&lchanctx->entry, &lhw->lchanctx_list_reserved);
2668 	}
2669 
2670 	return (error);
2671 }
2672 
2673 static void
2674 lkpi_remove_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
2675 {
2676 	struct lkpi_hw *lhw;
2677 	struct ieee80211_chanctx_conf *chanctx_conf;
2678 	struct lkpi_chanctx *lchanctx;
2679 
2680 	lockdep_assert_wiphy(hw->wiphy);
2681 
2682 	chanctx_conf = rcu_dereference_protected(vif->bss_conf.chanctx_conf,
2683 	    lockdep_is_held(&hw->wiphy->mtx));
2684 
2685 	if (chanctx_conf == NULL)
2686 		return;
2687 
2688 	/* Remove vif context. */
2689 	lkpi_80211_mo_unassign_vif_chanctx(hw, vif, &vif->bss_conf, chanctx_conf);
2690 
2691 	lkpi_hw_conf_idle(hw, true);
2692 
2693 	/* Remove chan ctx. */
2694 	lkpi_80211_mo_remove_chanctx(hw, chanctx_conf);
2695 
2696 	/* Cleanup. */
2697 	rcu_assign_pointer(vif->bss_conf.chanctx_conf, NULL);
2698 	lchanctx = CHANCTX_CONF_TO_LCHANCTX(chanctx_conf);
2699 	list_del(&lchanctx->entry);
2700 	lhw = HW_TO_LHW(hw);
2701 	memset(lchanctx, 0, sizeof(*lchanctx));
2702 	lchanctx->lvif = VIF_TO_LVIF(vif);
2703 	list_add_rcu(&lchanctx->entry, &lhw->lchanctx_list_reserved);
2704 }
2705 
2706 /* -------------------------------------------------------------------------- */
2707 
2708 /* Any other options belong here? Check more drivers. */
2709 #define	BSS_CHANGED_VIF_CFG_BITS					\
2710     (BSS_CHANGED_SSID | BSS_CHANGED_IDLE | BSS_CHANGED_PS | BSS_CHANGED_ASSOC | \
2711     BSS_CHANGED_ARP_FILTER | BSS_CHANGED_MLD_VALID_LINKS | BSS_CHANGED_MLD_TTLM)
2712 
2713 static void
2714 lkpi_bss_info_change(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
2715     enum ieee80211_bss_changed bss_changed)
2716 {
2717 	struct lkpi_vif *lvif;
2718 	enum ieee80211_bss_changed vif_cfg_bits, link_info_bits;
2719 
2720 	if (ieee80211_vif_is_mld(vif)) {
2721 		TODO("This likely needs a subset only; split up into 3 parts.");
2722 	}
2723 
2724 	/* Nothing to do? */
2725 	if (bss_changed == 0)
2726 		return;
2727 
2728 	/*
2729 	 * If the vif is not known to the driver there is nothing to notifiy for.
2730 	 * We MUST NOT check for !lvif_bss_synched here (the reasonable it seems)
2731 	 * as we need to execute the update(s) or we will have follow-up issues.
2732 	 */
2733 	lvif = VIF_TO_LVIF(vif);
2734 	if (!lvif->added_to_drv)
2735 		return;
2736 
2737 	/*
2738 	 * With the advent of MLO bss_conf got split up into vif and link
2739 	 * change notfications, while historically it was one.
2740 	 * We now need to support all possible models.
2741 	 */
2742 	vif_cfg_bits = bss_changed & BSS_CHANGED_VIF_CFG_BITS;
2743 	if (vif_cfg_bits != 0)
2744 		lkpi_80211_mo_vif_cfg_changed(hw, vif, vif_cfg_bits, false);
2745 
2746 	link_info_bits = bss_changed & ~(BSS_CHANGED_VIF_CFG_BITS);
2747 	if (link_info_bits != 0)
2748 		lkpi_80211_mo_link_info_changed(hw, vif, &vif->bss_conf,
2749 		    link_info_bits, 0, false);
2750 
2751 	lkpi_80211_mo_bss_info_changed(hw, vif, &vif->bss_conf, bss_changed);
2752 }
2753 
2754 /* -------------------------------------------------------------------------- */
2755 
2756 static int
2757 lkpi_sta_state_do_nada(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2758 {
2759 	return (0);
2760 }
2761 
2762 /* UP1 */
2763 static int
2764 lkpi_sta_init_to_scan(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2765 {
2766 	return (lkpi_sta_state_do_nada(vap, nstate, arg));
2767 }
2768 
2769 /* UP2 */
2770 static int
2771 lkpi_sta_scan_to_auth(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2772 {
2773 	struct linuxkpi_ieee80211_channel *chan;
2774 	struct cfg80211_chan_def chandef;
2775 	struct ieee80211_chanctx_conf *chanctx_conf;
2776 	struct lkpi_hw *lhw;
2777 	struct ieee80211_hw *hw;
2778 	struct lkpi_vif *lvif;
2779 	struct ieee80211_vif *vif;
2780 	struct ieee80211_node *ni;
2781 	struct lkpi_sta *lsta;
2782 	enum ieee80211_bss_changed bss_changed;
2783 	struct ieee80211_prep_tx_info prep_tx_info;
2784 	uint32_t changed;
2785 	int error;
2786 	bool synched, can_ht;
2787 
2788 	/*
2789 	 * In here we use vap->iv_bss until lvif->lvif_bss is set.
2790 	 * For all later (STATE >= AUTH) functions we need to use the lvif
2791 	 * cache which will be tracked even through (*iv_update_bss)().
2792 	 */
2793 
2794 	if (vap->iv_bss == NULL) {
2795 		ic_printf(vap->iv_ic, "%s: no iv_bss for vap %p\n", __func__, vap);
2796 		return (EINVAL);
2797 	}
2798 	/*
2799 	 * Keep the ni alive locally.  In theory (and practice) iv_bss can change
2800 	 * once we unlock here.  This is due to net80211 allowing state changes
2801 	 * and new join1() despite having an active node as well as due to
2802 	 * the fact that the iv_bss can be swapped under the hood in (*iv_update_bss).
2803 	 */
2804 	ni = ieee80211_ref_node(vap->iv_bss);
2805 	if (ni->ni_chan == NULL || ni->ni_chan == IEEE80211_CHAN_ANYC) {
2806 		ic_printf(vap->iv_ic, "%s: no channel set for iv_bss ni %p "
2807 		    "on vap %p\n", __func__, ni, vap);
2808 		ieee80211_free_node(ni);	/* Error handling for the local ni. */
2809 		return (EINVAL);
2810 	}
2811 
2812 	lhw = vap->iv_ic->ic_softc;
2813 	chan = lkpi_find_lkpi80211_chan(lhw, ni->ni_chan);
2814 	if (chan == NULL) {
2815 		ic_printf(vap->iv_ic, "%s: failed to get LKPI channel from "
2816 		    "iv_bss ni %p on vap %p\n", __func__, ni, vap);
2817 		ieee80211_free_node(ni);	/* Error handling for the local ni. */
2818 		return (ESRCH);
2819 	}
2820 
2821 	hw = LHW_TO_HW(lhw);
2822 	lvif = VAP_TO_LVIF(vap);
2823 	vif = LVIF_TO_VIF(lvif);
2824 
2825 	LKPI_80211_LVIF_LOCK(lvif);
2826 	/* XXX-BZ KASSERT later? */
2827 	if (lvif->lvif_bss_synched || lvif->lvif_bss != NULL) {
2828 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
2829 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
2830 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
2831 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
2832 		    lvif->lvif_bss_synched);
2833 		LKPI_80211_LVIF_UNLOCK(lvif);
2834 		ieee80211_free_node(ni);	/* Error handling for the local ni. */
2835 		return (EBUSY);
2836 	}
2837 	LKPI_80211_LVIF_UNLOCK(lvif);
2838 
2839 	IEEE80211_UNLOCK(vap->iv_ic);
2840 	wiphy_lock(hw->wiphy);
2841 
2842 	/* Add chanctx (or if exists, change it). */
2843 	chanctx_conf = lkpi_get_chanctx_conf(hw, vif);
2844 
2845 	KASSERT(ni->ni_chan != NULL && ni->ni_chan != IEEE80211_CHAN_ANYC,
2846 	   ("%s:%d: ni %p ni_chan %p\n", __func__, __LINE__, ni, ni->ni_chan));
2847 
2848 #ifdef LKPI_80211_HT
2849 	can_ht = (vap->iv_ic->ic_flags_ht & IEEE80211_FHT_HT) != 0;
2850 #else
2851 	can_ht = false;
2852 #endif
2853 	lkpi_init_chandef(vap->iv_ic, &chandef, chan, ni->ni_chan, can_ht);
2854 	hw->conf.radar_enabled =
2855 	    ((chan->flags & IEEE80211_CHAN_RADAR) != 0) ? true : false;
2856 	hw->conf.chandef = chandef;
2857 	vif->bss_conf.chanreq.oper = hw->conf.chandef;
2858 #ifdef LINUXKPI_DEBUG_80211
2859 	if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
2860 		ic_printf(vap->iv_ic, "%s:%d: hw->conf.chandef %p = chandef %p = "
2861 		    "vif->bss_conf.chanreq.oper %p\n", __func__, __LINE__,
2862 		    &hw->conf.chandef, &chandef, &vif->bss_conf.chanreq.oper);
2863 #endif
2864 
2865 	changed = lkpi_init_chanctx_conf(hw, &chandef, chanctx_conf);
2866 
2867 	/* Responder ... */
2868 
2869 	/* Set bss info (bss_info_changed). */
2870 	bss_changed = 0;
2871 	IEEE80211_ADDR_COPY(vif->cfg.ap_addr, ni->ni_bssid);
2872 	vif->bss_conf.bssid = ni->ni_bssid;
2873 	bss_changed |= BSS_CHANGED_BSSID;
2874 	vif->bss_conf.txpower = ni->ni_txpower;
2875 	bss_changed |= BSS_CHANGED_TXPOWER;
2876 	vif->cfg.idle = false;
2877 	bss_changed |= BSS_CHANGED_IDLE;
2878 
2879 	lvif->beacons = 0;
2880 	/* Should almost assert it is this. */
2881 	vif->cfg.assoc = false;
2882 	vif->cfg.aid = 0;
2883 
2884 	bss_changed |= lkpi_update_dtim_tsf(vif, ni, vap, __func__, __LINE__);
2885 
2886 	error = lkpi_set_chanctx_conf(hw, vif, chanctx_conf, changed, true);
2887 	if (error != 0)
2888 		goto out;
2889 
2890 	IMPROVE("update radiotap chan fields too");
2891 
2892 	/* RATES */
2893 	IMPROVE("bss info: not all needs to come now and rates are missing");
2894 	bss_changed |= lkpi_sta_supp_rates(hw, vif, ni, NULL);
2895 	if (ieee80211_hw_check(hw, HAS_RATE_CONTROL))
2896 		lkpi_80211_mo_set_bitrate_mask(hw, vif, &lvif->br_mask);
2897 	TODO("cfg80211_tid_config WHERE?");
2898 
2899 	lkpi_bss_info_change(hw, vif, bss_changed);
2900 
2901 	/*
2902 	 * Given ni and lsta are 1:1 from alloc to free we can assert that
2903 	 * ni always has lsta data attach despite net80211 node swapping
2904 	 * under the hoods.
2905 	 */
2906 	KASSERT(ni->ni_drv_data != NULL, ("%s: ni %p ni_drv_data %p\n",
2907 	    __func__, ni, ni->ni_drv_data));
2908 	lsta = ni->ni_drv_data;
2909 
2910 	/* Insert the [l]sta into the list of known stations. */
2911 	list_add_tail(&lsta->lsta_list, &lvif->lsta_list);
2912 
2913 	/* Add (or adjust) sta and change state (from NOTEXIST) to NONE. */
2914 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
2915 	KASSERT(lsta->state == IEEE80211_STA_NOTEXIST, ("%s: lsta %p state not "
2916 	    "NOTEXIST: %#x\n", __func__, lsta, lsta->state));
2917 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_NONE);
2918 	if (error != 0) {
2919 		IMPROVE("do we need to undo the chan ctx?");
2920 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(NONE) "
2921 		    "failed: %d\n", __func__, __LINE__, error);
2922 		goto out;
2923 	}
2924 #if 0
2925 	lsta->added_to_drv = true;	/* mo manages. */
2926 #endif
2927 
2928 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
2929 
2930 #if 0
2931 	/*
2932 	 * Wakeup all queues now that sta is there so we have as much time to
2933 	 * possibly prepare the queue in the driver to be ready for the 1st
2934 	 * packet;  lkpi_80211_txq_tx_one() still has a workaround as there
2935 	 * is no guarantee or way to check.
2936 	 * XXX-BZ and by now we know that this does not work on all drivers
2937 	 * for all queues.
2938 	 */
2939 	lkpi_wake_tx_queues(hw, LSTA_TO_STA(lsta), false, false);
2940 #endif
2941 
2942 	/* Start mgd_prepare_tx. */
2943 	memset(&prep_tx_info, 0, sizeof(prep_tx_info));
2944 	prep_tx_info.duration = PREP_TX_INFO_DURATION;		/* SAE */
2945 	prep_tx_info.subtype = IEEE80211_STYPE_AUTH;
2946 	prep_tx_info.link_id = 0;
2947 	lkpi_80211_mo_mgd_prepare_tx(hw, vif, &prep_tx_info);
2948 	lsta->in_mgd = true;
2949 
2950 	/*
2951 	 * What is going to happen next:
2952 	 * - <twiddle> .. we should end up in "auth_to_assoc"
2953 	 * - event_callback
2954 	 * - update sta_state (NONE to AUTH)
2955 	 * - mgd_complete_tx
2956 	 * (ideally we'd do that on a callback for something else ...)
2957 	 */
2958 
2959 	wiphy_unlock(hw->wiphy);
2960 	IEEE80211_LOCK(vap->iv_ic);
2961 
2962 	LKPI_80211_LVIF_LOCK(lvif);
2963 	/* Re-check given (*iv_update_bss) could have happened while we were unlocked. */
2964 	if (lvif->lvif_bss_synched || lvif->lvif_bss != NULL ||
2965 	    lsta->ni != vap->iv_bss)
2966 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
2967 		    "lvif_bss->ni %p synched %d, ni %p lsta %p\n", __func__, __LINE__,
2968 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
2969 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
2970 		    lvif->lvif_bss_synched, ni, lsta);
2971 
2972 	/*
2973 	 * Reference the "ni" for caching the lsta/ni in lvif->lvif_bss.
2974 	 * Given we cache lsta we use lsta->ni instead of ni here (even though
2975 	 * lsta->ni == ni) to be distinct from the rest of the code where we do
2976 	 * assume that ni == vap->iv_bss which it may or may not be.
2977 	 * So do NOT use iv_bss here anymore as that may have diverged from our
2978 	 * function local ni already while ic was unlocked and would lead to
2979 	 * inconsistencies.  Go and see if we lost a race and do not update
2980 	 * lvif_bss_synched in that case.
2981 	 */
2982 	ieee80211_ref_node(lsta->ni);
2983 	lvif->lvif_bss = lsta;
2984 	if (lsta->ni == vap->iv_bss) {
2985 		lvif->lvif_bss_synched = synched = true;
2986 	} else {
2987 		/* Set to un-synched no matter what. */
2988 		lvif->lvif_bss_synched = synched = false;
2989 		/*
2990 		 * We do not error as someone has to take us down.
2991 		 * If we are followed by a 2nd, new net80211::join1() going to
2992 		 * AUTH lkpi_sta_a_to_a() will error, lkpi_sta_auth_to_{scan,init}()
2993 		 * will take the lvif->lvif_bss node down eventually.
2994 		 * What happens with the vap->iv_bss node will entirely be up
2995 		 * to net80211 as we never used the node beyond alloc()/free()
2996 		 * and we do not hold an extra reference for that anymore given
2997 		 * ni : lsta == 1:1.
2998 		 * Problem is if we do not error a MGMT/AUTH frame will be
2999 		 * sent from net80211::sta_newstate(); disable lsta queue below.
3000 		 */
3001 	}
3002 	LKPI_80211_LVIF_UNLOCK(lvif);
3003 	/*
3004 	 * Make sure in case the sta did not change and we re-added it,
3005 	 * that we can tx again but only if the vif/iv_bss are in sync.
3006 	 * Otherwise this should prevent the MGMT/AUTH frame from being
3007 	 * sent triggering a warning in iwlwifi.
3008 	 */
3009 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
3010 	lsta->txq_ready = synched;
3011 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
3012 	goto out_relocked;
3013 
3014 out:
3015 	wiphy_unlock(hw->wiphy);
3016 	IEEE80211_LOCK(vap->iv_ic);
3017 out_relocked:
3018 	/*
3019 	 * Release the reference that kept the ni stable locally
3020 	 * during the work of this function.
3021 	 */
3022 	if (ni != NULL)
3023 		ieee80211_free_node(ni);
3024 	return (error);
3025 }
3026 
3027 /* UP3.1 */
3028 static int
3029 lkpi_sta_auth_to_assoc(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3030 {
3031 	struct lkpi_hw *lhw;
3032 	struct ieee80211_hw *hw;
3033 	struct lkpi_vif *lvif;
3034 	struct ieee80211_vif *vif;
3035 	struct lkpi_sta *lsta;
3036 	struct ieee80211_prep_tx_info prep_tx_info;
3037 	int error;
3038 
3039 	lhw = vap->iv_ic->ic_softc;
3040 	hw = LHW_TO_HW(lhw);
3041 	lvif = VAP_TO_LVIF(vap);
3042 	vif = LVIF_TO_VIF(lvif);
3043 
3044 	IEEE80211_UNLOCK(vap->iv_ic);
3045 	wiphy_lock(hw->wiphy);
3046 
3047 	LKPI_80211_LVIF_LOCK(lvif);
3048 	/* XXX-BZ KASSERT later? */
3049 	if (!lvif->lvif_bss_synched || lvif->lvif_bss == NULL) {
3050 #ifdef LINUXKPI_DEBUG_80211
3051 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
3052 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
3053 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
3054 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
3055 		    lvif->lvif_bss_synched);
3056 #endif
3057 		error = ENOTRECOVERABLE;
3058 		LKPI_80211_LVIF_UNLOCK(lvif);
3059 		goto out;
3060 	}
3061 	lsta = lvif->lvif_bss;
3062 	LKPI_80211_LVIF_UNLOCK(lvif);
3063 
3064 	KASSERT(lsta != NULL, ("%s: lsta %p\n", __func__, lsta));
3065 
3066 	/* Finish auth. */
3067 	IMPROVE("event callback");
3068 
3069 	/* Update sta_state (NONE to AUTH). */
3070 	KASSERT(lsta->state == IEEE80211_STA_NONE, ("%s: lsta %p state not "
3071 	    "NONE: %#x\n", __func__, lsta, lsta->state));
3072 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_AUTH);
3073 	if (error != 0) {
3074 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(AUTH) "
3075 		    "failed: %d\n", __func__, __LINE__, error);
3076 		goto out;
3077 	}
3078 
3079 	/* End mgd_complete_tx. */
3080 	if (lsta->in_mgd) {
3081 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3082 		prep_tx_info.subtype = IEEE80211_STYPE_AUTH;
3083 		prep_tx_info.success = true;
3084 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
3085 		lsta->in_mgd = false;
3086 	}
3087 
3088 	/* Now start assoc. unless nstate=RUN (auth_to_run). */
3089 
3090 	/* Start mgd_prepare_tx. */
3091 	if (nstate == IEEE80211_S_ASSOC && !lsta->in_mgd) {
3092 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3093 		prep_tx_info.subtype = IEEE80211_STYPE_ASSOC_REQ;
3094 		prep_tx_info.link_id = 0;
3095 		lkpi_80211_mo_mgd_prepare_tx(hw, vif, &prep_tx_info);
3096 		lsta->in_mgd = true;
3097 	}
3098 
3099 #if 0
3100 	/* We do not yet have a packet to go out. */
3101 	/* Wake tx queue to get packet out. */
3102 	lkpi_wake_tx_queues(hw, LSTA_TO_STA(lsta), false, true);
3103 #endif
3104 
3105 	/*
3106 	 * <twiddle> .. we end up in "assoc_to_run"
3107 	 * - update sta_state (AUTH to ASSOC)
3108 	 * - conf_tx [all]
3109 	 * - bss_info_changed (assoc, aid, ssid, ..)
3110 	 * - change_chanctx (if needed)
3111 	 * - event_callback
3112 	 * - mgd_complete_tx
3113 	 */
3114 
3115 out:
3116 	wiphy_unlock(hw->wiphy);
3117 	IEEE80211_LOCK(vap->iv_ic);
3118 	return (error);
3119 }
3120 
3121 static int lkpi_sta_assoc_to_run(struct ieee80211vap *, enum ieee80211_state, int);
3122 
3123 /* UP3.2 */
3124 static int
3125 lkpi_sta_auth_to_run(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3126 {
3127 	int error;
3128 
3129 	error = lkpi_sta_auth_to_assoc(vap, nstate, arg);
3130 	if (error == 0)
3131 		error = lkpi_sta_assoc_to_run(vap, nstate, arg);
3132 	return (error);
3133 }
3134 
3135 /* UP4 */
3136 static int
3137 lkpi_sta_assoc_to_run(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3138 {
3139 	struct lkpi_hw *lhw;
3140 	struct ieee80211_hw *hw;
3141 	struct lkpi_vif *lvif;
3142 	struct ieee80211_vif *vif;
3143 	struct ieee80211_node *ni;
3144 	struct lkpi_sta *lsta;
3145 	struct ieee80211_sta *sta;
3146 	struct ieee80211_prep_tx_info prep_tx_info;
3147 	enum ieee80211_bss_changed bss_changed;
3148 	int error;
3149 
3150 	lhw = vap->iv_ic->ic_softc;
3151 	hw = LHW_TO_HW(lhw);
3152 	lvif = VAP_TO_LVIF(vap);
3153 	vif = LVIF_TO_VIF(lvif);
3154 
3155 	IEEE80211_UNLOCK(vap->iv_ic);
3156 	wiphy_lock(hw->wiphy);
3157 
3158 	LKPI_80211_LVIF_LOCK(lvif);
3159 	/* XXX-BZ KASSERT later? */
3160 	if (!lvif->lvif_bss_synched || lvif->lvif_bss == NULL) {
3161 #ifdef LINUXKPI_DEBUG_80211
3162 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
3163 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
3164 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
3165 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
3166 		    lvif->lvif_bss_synched);
3167 #endif
3168 		LKPI_80211_LVIF_UNLOCK(lvif);
3169 		error = ENOTRECOVERABLE;
3170 		goto out;
3171 	}
3172 	lsta = lvif->lvif_bss;
3173 	LKPI_80211_LVIF_UNLOCK(lvif);
3174 	KASSERT(lsta != NULL && lsta->ni != NULL, ("%s: lsta %p ni %p "
3175 	    "lvif %p vap %p\n", __func__,
3176 	    lsta, (lsta != NULL) ? lsta->ni : NULL, lvif, vap));
3177 
3178 	ni = lsta->ni;		/* Reference held for lvif_bss. */
3179 
3180 	IMPROVE("ponder some of this moved to ic_newassoc, scan_assoc_success, "
3181 	    "and to lesser extend ieee80211_notify_node_join");
3182 
3183 	/* Finish assoc. */
3184 	/* Update sta_state (AUTH to ASSOC) and set aid. */
3185 	KASSERT(lsta->state == IEEE80211_STA_AUTH, ("%s: lsta %p state not "
3186 	    "AUTH: %#x\n", __func__, lsta, lsta->state));
3187 	sta = LSTA_TO_STA(lsta);
3188 	sta->aid = IEEE80211_NODE_AID(ni);
3189 #ifdef LKPI_80211_WME
3190 	if (vap->iv_flags & IEEE80211_F_WME)
3191 		sta->wme = true;
3192 #endif
3193 	bss_changed = 0;
3194 	/*
3195 	 * This sync needs to happen before the sta_state change to ASSOC.
3196 	 * At least mt7921 (likely all drivers) rely on, e.g., ht_cap, vht_cap,
3197 	 * .. to be set at the point we go to assoc.
3198 	 */
3199 	bss_changed |= lkpi_sta_sync_from_ni(hw, vif, sta, ni, true);
3200 	if (ieee80211_hw_check(hw, HAS_RATE_CONTROL))
3201 		lkpi_80211_mo_set_bitrate_mask(hw, vif, &lvif->br_mask);
3202 
3203 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_ASSOC);
3204 	if (error != 0) {
3205 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(ASSOC) "
3206 		    "failed: %d\n", __func__, __LINE__, error);
3207 		goto out;
3208 	}
3209 
3210 	IMPROVE("wme / conf_tx [all]");
3211 
3212 	/* Update bss info (bss_info_changed) (assoc, aid, ..). */
3213 #ifdef LKPI_80211_WME
3214 	bss_changed |= lkpi_wme_update(lhw, vap, true);
3215 #endif
3216 	if (!vif->cfg.assoc || vif->cfg.aid != IEEE80211_NODE_AID(ni)) {
3217 		lvif->beacons = 0;
3218 		vif->cfg.assoc = true;
3219 		vif->cfg.aid = IEEE80211_NODE_AID(ni);
3220 		bss_changed |= BSS_CHANGED_ASSOC;
3221 	}
3222 	/* We set SSID but this is not BSSID! */
3223 	vif->cfg.ssid_len = ni->ni_esslen;
3224 	memcpy(vif->cfg.ssid, ni->ni_essid, ni->ni_esslen);
3225 	if ((vap->iv_flags & IEEE80211_F_SHPREAMBLE) !=
3226 	    vif->bss_conf.use_short_preamble) {
3227 		vif->bss_conf.use_short_preamble ^= 1;
3228 		/* bss_changed |= BSS_CHANGED_??? */
3229 	}
3230 	if ((vap->iv_flags & IEEE80211_F_SHSLOT) !=
3231 	    vif->bss_conf.use_short_slot) {
3232 		vif->bss_conf.use_short_slot ^= 1;
3233 		/* bss_changed |= BSS_CHANGED_??? */
3234 	}
3235 	if ((ni->ni_flags & IEEE80211_NODE_QOS) !=
3236 	    vif->bss_conf.qos) {
3237 		vif->bss_conf.qos ^= 1;
3238 		bss_changed |= BSS_CHANGED_QOS;
3239 	}
3240 
3241 	bss_changed |= lkpi_update_dtim_tsf(vif, ni, vap, __func__, __LINE__);
3242 	lkpi_bss_info_change(hw, vif, bss_changed);
3243 
3244 	/* - change_chanctx (if needed)
3245 	 * - event_callback
3246 	 */
3247 
3248 	/* End mgd_complete_tx. (we do not have to check ostate == IEEE80211_S_ASSOC). */
3249 	if (lsta->in_mgd) {
3250 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3251 		prep_tx_info.subtype = IEEE80211_STYPE_ASSOC_REQ;
3252 		prep_tx_info.success = true;	/* Needs vif->cfg.assoc set! */
3253 		prep_tx_info.link_id = 0;
3254 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
3255 		lsta->in_mgd = false;
3256 	}
3257 
3258 	/*
3259 	 * And then:
3260 	 * - (more packets)?
3261 	 * - set_key
3262 	 * - set_default_unicast_key
3263 	 * - set_key (?)
3264 	 * - ipv6_addr_change (?)
3265 	 */
3266 
3267 	if (!ieee80211_node_is_authorized(ni)) {
3268 		IMPROVE("net80211 does not consider node authorized");
3269 	}
3270 
3271 	bss_changed = 0;
3272 	IMPROVE("Is this the right spot, has net80211 done all updates already?");
3273 
3274 	/* Update thresholds. */
3275 	hw->wiphy->frag_threshold = vap->iv_fragthreshold;
3276 	lkpi_80211_mo_set_frag_threshold(hw, vap->iv_fragthreshold);
3277 	hw->wiphy->rts_threshold = vap->iv_rtsthreshold;
3278 	lkpi_80211_mo_set_rts_threshold(hw, vap->iv_rtsthreshold);
3279 
3280 	/* Update sta_state (ASSOC to AUTHORIZED). */
3281 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
3282 	KASSERT(lsta->state == IEEE80211_STA_ASSOC, ("%s: lsta %p state not "
3283 	    "ASSOC: %#x\n", __func__, lsta, lsta->state));
3284 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_AUTHORIZED);
3285 	if (error != 0) {
3286 		IMPROVE("undo some changes?");
3287 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(AUTHORIZED) "
3288 		    "failed: %d\n", __func__, __LINE__, error);
3289 		goto out;
3290 	}
3291 
3292 	/* - drv_config (?)
3293 	 * - bss_info_changed
3294 	 * - set_rekey_data (?)
3295 	 *
3296 	 * And now we should be passing packets.
3297 	 */
3298 	IMPROVE("Need that bssid setting, and the keys");
3299 
3300 	bss_changed |= lkpi_update_dtim_tsf(vif, ni, vap, __func__, __LINE__);
3301 	lkpi_bss_info_change(hw, vif, bss_changed);
3302 
3303 	/* Prepare_multicast && configure_filter. */
3304 	lkpi_update_mcast_filter_locked(vap->iv_ic);
3305 
3306 out:
3307 	wiphy_unlock(hw->wiphy);
3308 	IEEE80211_LOCK(vap->iv_ic);
3309 	return (error);
3310 }
3311 
3312 /*
3313  * DOWN1
3314  * "to assoc" means we are going back to State 2 from State 4[/3].
3315  * This means ni still is authenticated, so we keep sta, chanctx, ..
3316  * We will send a (Re)Assoc Request in case net80211 handles roadming.
3317  * Note: this can be called as part of a DEAUTH going to State 1 as well,
3318  * so for RoC prep_tx_info we need to check nstate (see run_to_{auth,scan,init}).
3319  */
3320 static int
3321 lkpi_sta_run_to_assoc(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3322 {
3323 	struct lkpi_hw *lhw;
3324 	struct ieee80211_hw *hw;
3325 	struct lkpi_vif *lvif;
3326 	struct ieee80211_vif *vif;
3327 	struct ieee80211_node *ni;
3328 	struct lkpi_sta *lsta;
3329 	struct ieee80211_sta *sta;
3330 	struct ieee80211_prep_tx_info prep_tx_info;
3331 #if 0
3332 	enum ieee80211_bss_changed bss_changed;
3333 #endif
3334 	struct ieee80211_rx_ampdu *rap;
3335 	int error;
3336 
3337 	lhw = vap->iv_ic->ic_softc;
3338 	hw = LHW_TO_HW(lhw);
3339 	lvif = VAP_TO_LVIF(vap);
3340 	vif = LVIF_TO_VIF(lvif);
3341 
3342 	IEEE80211_UNLOCK(vap->iv_ic);
3343 	wiphy_lock(hw->wiphy);
3344 
3345 	LKPI_80211_LVIF_LOCK(lvif);
3346 #ifdef LINUXKPI_DEBUG_80211
3347 	/* XXX-BZ KASSERT later; state going down so no action. */
3348 	if (lvif->lvif_bss == NULL)
3349 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
3350 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
3351 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
3352 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
3353 		    lvif->lvif_bss_synched);
3354 #endif
3355 	lsta = lvif->lvif_bss;
3356 	LKPI_80211_LVIF_UNLOCK(lvif);
3357 	KASSERT(lsta != NULL && lsta->ni != NULL, ("%s: lsta %p ni %p "
3358 	    "lvif %p vap %p\n", __func__,
3359 	    lsta, (lsta != NULL) ? lsta->ni : NULL, lvif, vap));
3360 
3361 	ni = lsta->ni;		/* Reference held for lvif_bss. */
3362 	sta = LSTA_TO_STA(lsta);
3363 
3364 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3365 
3366 	/* flush, drop. */
3367 	lkpi_80211_mo_flush(hw, vif,  nitems(sta->txq), true);
3368 
3369 	/* We should make this a KASSERT. */
3370 	if (lsta->in_mgd) {
3371 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p lsta %p in_mgd\n",
3372 		    __func__, __LINE__, lvif, vap, lsta);
3373 	}
3374 	/*
3375 	 * Problem is that we should hook into the tx/rx flow and not
3376 	 * try to re-model the state machine parts.  We may miss a SME
3377 	 * triggered frame this way.
3378 	 */
3379 	memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3380 	if (nstate == IEEE80211_S_ASSOC) {
3381 		if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
3382 			if (arg)
3383 				prep_tx_info.subtype = IEEE80211_STYPE_REASSOC_REQ;
3384 			else
3385 				prep_tx_info.subtype = IEEE80211_STYPE_ASSOC_REQ;
3386 		} else {
3387 			/* wpa_supplicant upon RTM_IEEE80211_LEAVE. */
3388 			prep_tx_info.subtype = IEEE80211_STYPE_DISASSOC;
3389 		}
3390 	} else
3391 		prep_tx_info.subtype = IEEE80211_STYPE_DEAUTH;
3392 	prep_tx_info.was_assoc = true;
3393 	prep_tx_info.link_id = 0;
3394 	lkpi_80211_mo_mgd_prepare_tx(hw, vif, &prep_tx_info);
3395 	lsta->in_mgd = true;
3396 
3397 	wiphy_unlock(hw->wiphy);
3398 	IEEE80211_LOCK(vap->iv_ic);
3399 
3400 	/* Call iv_newstate first so we get potential (RE-)ASSOC/DEAUTH? packet out. */
3401 	error = lvif->iv_newstate(vap, nstate, arg);
3402 	if (error != 0) {
3403 		ic_printf(vap->iv_ic, "%s:%d: iv_newstate(%p, %d, %d) "
3404 		    "failed: %d\n", __func__, __LINE__, vap, nstate, arg, error);
3405 		goto outni;
3406 	}
3407 
3408 	/* Stop any BA sessions if still active. */
3409 	for (int rapn = 0; rapn < WME_NUM_TID; rapn++) {
3410 		rap = &ni->ni_rx_ampdu[rapn];
3411 
3412 		if ((rap->rxa_flags & IEEE80211_AGGR_RUNNING) == 0)
3413 			continue;
3414 
3415 		vap->iv_ic->ic_ampdu_rx_stop(ni, rap);
3416 	}
3417 
3418 	IEEE80211_UNLOCK(vap->iv_ic);
3419 
3420 	/* Ensure the packets get out. */
3421 	lkpi_80211_flush_tx(lhw, lsta);
3422 
3423 	wiphy_lock(hw->wiphy);
3424 
3425 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3426 
3427 	/* Wake tx queues to get packet(s) out. */
3428 	lkpi_wake_tx_queues(hw, sta, false, true);
3429 
3430 	/* flush, no drop */
3431 	lkpi_80211_mo_flush(hw, vif,  nitems(sta->txq), false);
3432 
3433 	/* End mgd_complete_tx. */
3434 	/* We should make this a KASSERT. */
3435 	if (!lsta->in_mgd) {
3436 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p lsta %p !in_mgd\n",
3437 		    __func__, __LINE__, lvif, vap, lsta);
3438 	}
3439 	lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
3440 	lsta->in_mgd = false;
3441 
3442 #if 0
3443 	/* sync_rx_queues */
3444 	lkpi_80211_mo_sync_rx_queues(hw);
3445 
3446 	/* sta_pre_rcu_remove */
3447 	lkpi_80211_mo_sta_pre_rcu_remove(hw, vif, sta);
3448 #endif
3449 
3450 	/* Take the station down. */
3451 
3452 	/* Adjust sta and change state (from AUTHORIZED) to ASSOC. */
3453 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
3454 	KASSERT(lsta->state == IEEE80211_STA_AUTHORIZED, ("%s: lsta %p state not "
3455 	    "AUTHORIZED: %#x\n", __func__, lsta, lsta->state));
3456 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_ASSOC);
3457 	if (error != 0) {
3458 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(ASSOC) "
3459 		    "failed: %d\n", __func__, __LINE__, error);
3460 		goto out;
3461 	}
3462 
3463 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3464 
3465 #ifdef LKPI_80211_HW_CRYPTO
3466 	if (lkpi_hwcrypto) {
3467 		error = lkpi_sta_del_keys(hw, vif, lsta);
3468 		if (error != 0) {
3469 			ic_printf(vap->iv_ic, "%s:%d: lkpi_sta_del_keys "
3470 			    "failed: %d\n", __func__, __LINE__, error);
3471 			/*
3472 			 * Either drv/fw will crash or cleanup itself,
3473 			 * otherwise net80211 will delete the keys (at a
3474 			 * less appropriate time).
3475 			 */
3476 			/* goto out; */
3477 		}
3478 	}
3479 #endif
3480 
3481 	/* Update sta_state (ASSOC to AUTH). */
3482 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
3483 	KASSERT(lsta->state == IEEE80211_STA_ASSOC, ("%s: lsta %p state not "
3484 	    "ASSOC: %#x\n", __func__, lsta, lsta->state));
3485 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_AUTH);
3486 	if (error != 0) {
3487 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(AUTH) "
3488 		    "failed: %d\n", __func__, __LINE__, error);
3489 		goto out;
3490 	}
3491 
3492 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3493 
3494 #if 0
3495 	/* Update bss info (bss_info_changed) (assoc, aid, ..). */
3496 	/* See comment in DOWN4. */
3497 	lkpi_disassoc(sta, vif, lhw);
3498 #endif
3499 
3500 	error = EALREADY;
3501 out:
3502 	wiphy_unlock(hw->wiphy);
3503 	IEEE80211_LOCK(vap->iv_ic);
3504 outni:
3505 	return (error);
3506 }
3507 
3508 /*
3509  * DOWN2
3510  * We are in state 2 and go back to state 1 and will try to auth again
3511  * (to IEEE80211_S_AUTH in FreeBSD means "try to auth").  This should be
3512  * like scan_to_auth but that we keep the "ni" and with that chanctx/bssid,
3513  * which essentially makes this "a_to_a" in LinuxKPI.
3514  */
3515 static int
3516 lkpi_sta_assoc_to_auth(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3517 {
3518 	struct lkpi_hw *lhw;
3519 	struct ieee80211_hw *hw;
3520 	struct lkpi_vif *lvif;
3521 	struct ieee80211_vif *vif;
3522 	struct ieee80211_node *ni;
3523 	struct lkpi_sta *lsta;
3524 	struct ieee80211_prep_tx_info prep_tx_info;
3525 	int error;
3526 
3527 	lhw = vap->iv_ic->ic_softc;
3528 	hw = LHW_TO_HW(lhw);
3529 	lvif = VAP_TO_LVIF(vap);
3530 	vif = LVIF_TO_VIF(lvif);
3531 
3532 	IEEE80211_UNLOCK(vap->iv_ic);
3533 	wiphy_lock(hw->wiphy);
3534 
3535 	LKPI_80211_LVIF_LOCK(lvif);
3536 #ifdef LINUXKPI_DEBUG_80211
3537 	/* XXX-BZ KASSERT later; state going down so no action. */
3538 	if (lvif->lvif_bss == NULL)
3539 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
3540 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
3541 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
3542 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
3543 		    lvif->lvif_bss_synched);
3544 #endif
3545 	lsta = lvif->lvif_bss;
3546 	LKPI_80211_LVIF_UNLOCK(lvif);
3547 	KASSERT(lsta != NULL && lsta->ni != NULL, ("%s: lsta %p ni %p "
3548 	    "lvif %p vap %p\n", __func__,
3549 	    lsta, (lsta != NULL) ? lsta->ni : NULL, lvif, vap));
3550 
3551 	ni = lsta->ni;		/* Reference held for lvif_bss. */
3552 
3553 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3554 
3555 	/* End mgd_complete_tx. */
3556 	if (lsta->in_mgd && vap->iv_state == IEEE80211_S_ASSOC) {
3557 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3558 		prep_tx_info.subtype = IEEE80211_STYPE_ASSOC_REQ;
3559 		prep_tx_info.link_id = 0;
3560 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
3561 		lsta->in_mgd = false;
3562 	} else if (lsta->in_mgd) {
3563 		ic_printf(vap->iv_ic, "%s:%d: in_mgd %d (%s) -> %d (%s) %d\n",
3564 		    __func__, __LINE__,
3565 		    vap->iv_state, ieee80211_state_name[vap->iv_state],
3566 		    nstate, ieee80211_state_name[nstate], arg);
3567 	}
3568 
3569 	/* Take the station down. */
3570 	/* Update sta_state (AUTH to NONE). */
3571 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
3572 	KASSERT(lsta->state == IEEE80211_STA_AUTH, ("%s: lsta %p state not "
3573 	    "AUTH: %#x\n", __func__, lsta, lsta->state));
3574 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_NONE);
3575 	if (error != 0) {
3576 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(NONE) "
3577 		    "failed: %d\n", __func__, __LINE__, error);
3578 		goto out;
3579 	}
3580 
3581 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3582 
3583 out:
3584 	wiphy_unlock(hw->wiphy);
3585 	IEEE80211_LOCK(vap->iv_ic);
3586 	return (error);
3587 }
3588 
3589 /*
3590  * DOWN3
3591  * We are in state 1.  Either auth timed out (arg != 0) or we have an internal
3592  * state change forcing us to give up trying to authenticate.
3593  * Cleanup and remove chanctx, sta, ...
3594  */
3595 static int
3596 lkpi_sta_auth_to_scan(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3597 {
3598 	struct lkpi_hw *lhw;
3599 	struct ieee80211_hw *hw;
3600 	struct lkpi_vif *lvif;
3601 	struct ieee80211_vif *vif;
3602 	struct ieee80211_node *ni;
3603 	struct lkpi_sta *lsta;
3604 	struct ieee80211_sta *sta;
3605 	struct ieee80211_prep_tx_info prep_tx_info;
3606 	enum ieee80211_bss_changed bss_changed;
3607 	int error;
3608 
3609 	lhw = vap->iv_ic->ic_softc;
3610 	hw = LHW_TO_HW(lhw);
3611 	lvif = VAP_TO_LVIF(vap);
3612 	vif = LVIF_TO_VIF(lvif);
3613 
3614 	IEEE80211_UNLOCK(vap->iv_ic);
3615 	wiphy_lock(hw->wiphy);
3616 
3617 	LKPI_80211_LVIF_LOCK(lvif);
3618 	/*
3619 	 * XXX-BZ KASSERT later; state going down so no action in theory
3620 	 * but try to avoid a NULL-pointer derref for now and gracefully
3621 	 * fail for non-debug kernels.
3622 	 */
3623 	if (lvif->lvif_bss == NULL) {
3624 		ic_printf(vap->iv_ic, "%s:%d: ERROR: lvif %p vap %p iv_bss %p "
3625 		    "lvif_bss %p lvif_bss->ni %p synched %d; "
3626 		    "expect follow-up problems\n", __func__, __LINE__,
3627 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
3628 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
3629 		    lvif->lvif_bss_synched);
3630 		LKPI_80211_LVIF_UNLOCK(lvif);
3631 		/*
3632 		 * This will likely lead to a firmware crash (if there
3633 		 * was not one before already) and need a
3634 		 * ieee80211_restart_hw() but still better than a panic
3635 		 * for users as they can at least recover.
3636 		 */
3637 		error = ENOTRECOVERABLE;
3638 		goto out;
3639 	}
3640 	lsta = lvif->lvif_bss;
3641 	LKPI_80211_LVIF_UNLOCK(lvif);
3642 	KASSERT(lsta != NULL && lsta->ni != NULL, ("%s: lsta %p ni %p "
3643 	    "lvif %p vap %p\n", __func__,
3644 	    lsta, (lsta != NULL) ? lsta->ni : NULL, lvif, vap));
3645 	ni = lsta->ni;			/* Reference held for lvif_bss. */
3646 	sta = LSTA_TO_STA(lsta);
3647 
3648 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3649 
3650 	/* flush, drop. */
3651 	lkpi_80211_mo_flush(hw, vif,  nitems(sta->txq), true);
3652 
3653 	/* Wake tx queues to get packet(s) out. */
3654 	lkpi_wake_tx_queues(hw, sta, false, true);
3655 
3656 	/* flush, no drop */
3657 	lkpi_80211_mo_flush(hw, vif,  nitems(sta->txq), false);
3658 
3659 	/* End mgd_complete_tx. */
3660 	if (lsta->in_mgd) {
3661 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3662 		prep_tx_info.subtype = IEEE80211_STYPE_AUTH;
3663 		prep_tx_info.link_id = 0;
3664 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
3665 		lsta->in_mgd = false;
3666 	}
3667 
3668 	/* sync_rx_queues */
3669 	lkpi_80211_mo_sync_rx_queues(hw);
3670 
3671 #ifdef LKPI_80211_HW_CRYPTO
3672 	if (lkpi_hwcrypto) {
3673 		error = lkpi_sta_del_keys(hw, vif, lsta);
3674 		if (error != 0) {
3675 			ic_printf(vap->iv_ic, "%s:%d: lkpi_sta_del_keys "
3676 			    "failed: %d\n", __func__, __LINE__, error);
3677 			/*
3678 			 * Either drv/fw will crash or cleanup itself,
3679 			 * otherwise net80211 will delete the keys (at a
3680 			 * less appropriate time).
3681 			 */
3682 			/* goto out; */
3683 		}
3684 	}
3685 #endif
3686 
3687 	/* sta_pre_rcu_remove */
3688         lkpi_80211_mo_sta_pre_rcu_remove(hw, vif, sta);
3689 
3690 	synchronize_net();
3691 
3692 	/* Take the station down. */
3693 
3694 	bss_changed = 0;
3695 	/*
3696 	 * Start updating bss info (*bss_info_changed) (assoc, aid, ..).
3697 	 *
3698 	 * One would expect this to happen when going off AUTHORIZED but
3699 	 * not so.
3700 	 *
3701 	 * Immediately issuing the (*bss_info_changed) used to also remove the
3702 	 * sta from firmware for iwlwifi; or we have problems with the sta
3703 	 * silently not being removed and then crash upon the next sta add.
3704 	 * Neither seems to be the case or a problem still.
3705 	 *
3706 	 * Contrary for BE200 (iwlwifi/mld) if we do not issue the
3707 	 * (*vif_cfg_change) to tell FW that we are no longer assoc
3708 	 * it will crash now upon sta rm.  So the order now is as we once
3709 	 * expected it:
3710 	 *
3711 	 * 1) lkpi_disassoc(): set vif->cfg.assoc = false and .aid=0
3712 	 * 2) add the remaining BSS_CHANGED changes and call (*bss_info_changed)
3713 	 *    (which may be split up into (*vif_cfg_change) and
3714 	 *    (*link_info_changed) for more modern drivers).
3715 	 * 3) call the last sta_state update -> IEEE80211_STA_NOTEXIST
3716 	 *    (removes the sta given assoc is false) and tidy up our lists.
3717 	 * 4) call unassign_vif_chanctx
3718 	 * 5) call lkpi_hw_conf_idle
3719 	 * 6) call remove_chanctx
3720 	 *
3721 	 * Note: vif->driver_flags & IEEE80211_VIF_REMOVE_AP_AFTER_DISASSOC
3722 	 * might change this.
3723 	 */
3724 	bss_changed |= lkpi_disassoc(sta, vif, lhw);
3725 
3726 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3727 
3728 	IMPROVE("Any bss_info changes to announce?");
3729 	vif->bss_conf.qos = false;
3730 	bss_changed |= BSS_CHANGED_QOS;
3731 	vif->cfg.ssid_len = 0;
3732 	memset(vif->cfg.ssid, '\0', sizeof(vif->cfg.ssid));
3733 	IEEE80211_ADDR_COPY(vif->cfg.ap_addr, ieee80211broadcastaddr);
3734 	bss_changed |= BSS_CHANGED_BSSID;
3735 	vif->bss_conf.use_short_preamble = false;
3736 	/* XXX BSS_CHANGED_???? */
3737 	vif->bss_conf.dtim_period = 0; /* go back to 0. */
3738 	bss_changed |= BSS_CHANGED_BEACON_INFO;
3739 	lkpi_bss_info_change(hw, vif, bss_changed);
3740 
3741 	/* Adjust sta and change state (from NONE) to NOTEXIST. */
3742 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
3743 	KASSERT(lsta->state == IEEE80211_STA_NONE, ("%s: lsta %p state not "
3744 	    "NONE: %#x, nstate %d arg %d\n", __func__, lsta, lsta->state, nstate, arg));
3745 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_NOTEXIST);
3746 	if (error != 0) {
3747 		IMPROVE("do we need to undo the chan ctx?");
3748 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(NOTEXIST) "
3749 		    "failed: %d\n", __func__, __LINE__, error);
3750 		goto out;
3751 	}
3752 
3753 	lkpi_lsta_remove(lsta, lvif);
3754 
3755 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3756 
3757 	LKPI_80211_LVIF_LOCK(lvif);
3758 	/* Remove ni reference for this cache of lsta. */
3759 	lvif->lvif_bss = NULL;
3760 	lvif->lvif_bss_synched = false;
3761 	LKPI_80211_LVIF_UNLOCK(lvif);
3762 
3763 	/* conf_tx */
3764 
3765 	lkpi_remove_chanctx(hw, vif);
3766 
3767 out:
3768 	wiphy_unlock(hw->wiphy);
3769 	IEEE80211_LOCK(vap->iv_ic);
3770 	if (error == 0) {
3771 		/*
3772 		 * We do this outside the wiphy lock as net80211::node_free() may call
3773 		 * into crypto code to delete keys and we have a recursed on
3774 		 * non-recursive sx panic.  Also only do this if we get here w/o error.
3775 		 *
3776 		 * The very last release the reference on the ni for the ni/lsta on
3777 		 * lvif->lvif_bss.  Upon return from this both ni and lsta are invalid
3778 		 * and potentially freed.
3779 		 */
3780 		ieee80211_free_node(ni);
3781 	}
3782 	return (error);
3783 }
3784 
3785 /* DOWN4 */
3786 static int
3787 lkpi_sta_scan_to_init(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3788 {
3789 	/* lkpi_iv_newstate() handles the stop scan case in common code. */
3790 	return (lkpi_sta_state_do_nada(vap, nstate, arg));
3791 }
3792 
3793 /* ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ */
3794 
3795 static int
3796 lkpi_sta_auth_to_init(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3797 {
3798 	int error;
3799 
3800 	error = lkpi_sta_auth_to_scan(vap, nstate, arg);
3801 	if (error == 0)
3802 		error = lkpi_sta_scan_to_init(vap, nstate, arg);
3803 	return (error);
3804 }
3805 
3806 /* auth_to_auth, assoc_to_assoc. */
3807 static int
3808 lkpi_sta_a_to_a(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3809 {
3810 	struct lkpi_hw *lhw;
3811 	struct ieee80211_hw *hw;
3812 	struct lkpi_vif *lvif;
3813 	struct ieee80211_vif *vif;
3814 	struct lkpi_sta *lsta;
3815 	struct ieee80211_prep_tx_info prep_tx_info;
3816 	int error;
3817 
3818 	lhw = vap->iv_ic->ic_softc;
3819 	hw = LHW_TO_HW(lhw);
3820 	lvif = VAP_TO_LVIF(vap);
3821 	vif = LVIF_TO_VIF(lvif);
3822 
3823 	IEEE80211_UNLOCK(vap->iv_ic);
3824 	wiphy_lock(hw->wiphy);
3825 
3826 	LKPI_80211_LVIF_LOCK(lvif);
3827 	/* XXX-BZ KASSERT later? */
3828 	if (!lvif->lvif_bss_synched || lvif->lvif_bss == NULL) {
3829 #ifdef LINUXKPI_DEBUG_80211
3830 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
3831 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
3832 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
3833 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
3834 		    lvif->lvif_bss_synched);
3835 #endif
3836 		LKPI_80211_LVIF_UNLOCK(lvif);
3837 		error = ENOTRECOVERABLE;
3838 		goto out;
3839 	}
3840 	lsta = lvif->lvif_bss;
3841 	LKPI_80211_LVIF_UNLOCK(lvif);
3842 
3843 	KASSERT(lsta != NULL, ("%s: lsta %p! lvif %p vap %p\n", __func__,
3844 	    lsta, lvif, vap));
3845 
3846 	IMPROVE("event callback?");
3847 
3848 	/* End mgd_complete_tx. */
3849 	if (lsta->in_mgd) {
3850 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3851 		if (vap->iv_state == IEEE80211_S_AUTH)
3852 			prep_tx_info.subtype = IEEE80211_STYPE_AUTH;
3853 		else
3854 			prep_tx_info.subtype = IEEE80211_STYPE_ASSOC_REQ;
3855 		prep_tx_info.link_id = 0;
3856 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
3857 		lsta->in_mgd = false;
3858 	}
3859 
3860 	/* Now start auth/assoc. */
3861 
3862 	/* Start mgd_prepare_tx. */
3863 	if (!lsta->in_mgd) {
3864 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3865 		if (nstate == IEEE80211_S_AUTH)
3866 			prep_tx_info.subtype = IEEE80211_STYPE_AUTH;
3867 		else
3868 			prep_tx_info.subtype = IEEE80211_STYPE_ASSOC_REQ;
3869 		prep_tx_info.link_id = 0;
3870 		lkpi_80211_mo_mgd_prepare_tx(hw, vif, &prep_tx_info);
3871 		lsta->in_mgd = true;
3872 	}
3873 
3874 	error = 0;
3875 out:
3876 	wiphy_unlock(hw->wiphy);
3877 	IEEE80211_LOCK(vap->iv_ic);
3878 
3879 	return (error);
3880 }
3881 
3882 static int
3883 lkpi_sta_assoc_to_scan(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3884 {
3885 	int error;
3886 
3887 	error = lkpi_sta_assoc_to_auth(vap, nstate, arg);
3888 	if (error != 0 && error != EALREADY)
3889 		return (error);
3890 
3891 	error = lkpi_sta_auth_to_scan(vap, nstate, arg);
3892 	return (error);
3893 }
3894 
3895 static int
3896 lkpi_sta_assoc_to_init(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3897 {
3898 	int error;
3899 
3900 	error = lkpi_sta_assoc_to_scan(vap, nstate, arg);
3901 	if (error != 0 && error != EALREADY)
3902 		return (error);
3903 
3904 	error = lkpi_sta_scan_to_init(vap, nstate, arg);	/* do_nada */
3905 	return (error);
3906 }
3907 
3908 static int
3909 lkpi_sta_run_to_init(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3910 {
3911 	int error;
3912 
3913 	error = lkpi_sta_run_to_assoc(vap, nstate, arg);
3914 	if (error != 0 && error != EALREADY)
3915 		return (error);
3916 
3917 	error = lkpi_sta_assoc_to_init(vap, nstate, arg);
3918 	return (error);
3919 }
3920 
3921 static int
3922 lkpi_sta_run_to_scan(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3923 {
3924 	int error;
3925 
3926 	error = lkpi_sta_run_to_assoc(vap, nstate, arg);
3927 	if (error != 0 && error != EALREADY)
3928 		return (error);
3929 
3930 	error = lkpi_sta_assoc_to_scan(vap, nstate, arg);
3931 	return (error);
3932 }
3933 
3934 static int
3935 lkpi_sta_run_to_auth(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3936 {
3937 	int error;
3938 
3939 	error = lkpi_sta_run_to_assoc(vap, nstate, arg);
3940 	if (error != 0 && error != EALREADY)
3941 		return (error);
3942 
3943 	error = lkpi_sta_assoc_to_auth(vap, nstate, arg);
3944 	return (error);
3945 }
3946 
3947 /* -------------------------------------------------------------------------- */
3948 
3949 /*
3950  * The matches the documented state changes in net80211::sta_newstate().
3951  * XXX (1) without CSA and SLEEP yet, * XXX (2) not all unhandled cases
3952  * there are "invalid" (so there is a room for failure here).
3953  */
3954 struct fsm_state {
3955 	/* INIT, SCAN, AUTH, ASSOC, CAC, RUN, CSA, SLEEP */
3956 	enum ieee80211_state ostate;
3957 	enum ieee80211_state nstate;
3958 	int (*handler)(struct ieee80211vap *, enum ieee80211_state, int);
3959 } sta_state_fsm[] = {
3960 	{ IEEE80211_S_INIT,	IEEE80211_S_INIT, lkpi_sta_state_do_nada },
3961 	{ IEEE80211_S_SCAN,	IEEE80211_S_INIT, lkpi_sta_state_do_nada },	/* DOWN4 scan_to_init */
3962 	{ IEEE80211_S_AUTH,	IEEE80211_S_INIT, lkpi_sta_auth_to_init },	/* not explicitly in sta_newstate() */
3963 	{ IEEE80211_S_ASSOC,	IEEE80211_S_INIT, lkpi_sta_assoc_to_init },	/* Send DEAUTH. */
3964 	{ IEEE80211_S_RUN,	IEEE80211_S_INIT, lkpi_sta_run_to_init },	/* Send DISASSOC. */
3965 
3966 	{ IEEE80211_S_INIT,	IEEE80211_S_SCAN, lkpi_sta_init_to_scan },	/* UP1 */
3967 	{ IEEE80211_S_SCAN,	IEEE80211_S_SCAN, lkpi_sta_state_do_nada },
3968 	{ IEEE80211_S_AUTH,	IEEE80211_S_SCAN, lkpi_sta_auth_to_scan },	/* DOWN3 */
3969 	{ IEEE80211_S_ASSOC,	IEEE80211_S_SCAN, lkpi_sta_assoc_to_scan },
3970 	{ IEEE80211_S_RUN,	IEEE80211_S_SCAN, lkpi_sta_run_to_scan },	/* Beacon miss. */
3971 
3972 	{ IEEE80211_S_INIT,	IEEE80211_S_AUTH, lkpi_sta_scan_to_auth },	/* Send AUTH. */
3973 	{ IEEE80211_S_SCAN,	IEEE80211_S_AUTH, lkpi_sta_scan_to_auth },	/* UP2 Send AUTH. */
3974 	{ IEEE80211_S_AUTH,	IEEE80211_S_AUTH, lkpi_sta_a_to_a },		/* Send ?AUTH. */
3975 	{ IEEE80211_S_ASSOC,	IEEE80211_S_AUTH, lkpi_sta_assoc_to_auth },	/* DOWN2 Send ?AUTH. */
3976 	{ IEEE80211_S_RUN,	IEEE80211_S_AUTH, lkpi_sta_run_to_auth },	/* Send ?AUTH. */
3977 
3978 	{ IEEE80211_S_AUTH,	IEEE80211_S_ASSOC, lkpi_sta_auth_to_assoc },	/* UP3.1 Send ASSOCREQ. */
3979 	{ IEEE80211_S_ASSOC,	IEEE80211_S_ASSOC, lkpi_sta_a_to_a },		/* Send ASSOCREQ. */
3980 	{ IEEE80211_S_RUN,	IEEE80211_S_ASSOC, lkpi_sta_run_to_assoc },	/* DOWN1 Send ASSOCREQ/REASSOCREQ. */
3981 
3982 	{ IEEE80211_S_AUTH,	IEEE80211_S_RUN, lkpi_sta_auth_to_run },	/* UP3.2 */
3983 	{ IEEE80211_S_ASSOC,	IEEE80211_S_RUN, lkpi_sta_assoc_to_run },	/* UP4 */
3984 	{ IEEE80211_S_RUN,	IEEE80211_S_RUN, lkpi_sta_state_do_nada },
3985 
3986 	/* Dummy at the end without handler. */
3987 	{ IEEE80211_S_INIT,	IEEE80211_S_INIT, NULL },
3988 };
3989 
3990 static int
3991 lkpi_iv_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3992 {
3993 	struct ieee80211com *ic;
3994 	struct lkpi_hw *lhw;
3995 	struct lkpi_vif *lvif;
3996 	struct ieee80211_vif *vif;
3997 	struct fsm_state *s;
3998 	enum ieee80211_state ostate;
3999 	int error;
4000 
4001 	ic = vap->iv_ic;
4002 	IEEE80211_LOCK_ASSERT(ic);
4003 	ostate = vap->iv_state;
4004 
4005 #ifdef LINUXKPI_DEBUG_80211
4006 	if (linuxkpi_debug_80211 & D80211_TRACE)
4007 		ic_printf(vap->iv_ic, "%s:%d: vap %p nstate %#x arg %#x\n",
4008 		    __func__, __LINE__, vap, nstate, arg);
4009 #endif
4010 
4011 	if (vap->iv_opmode == IEEE80211_M_STA) {
4012 
4013 		lhw = ic->ic_softc;
4014 		lvif = VAP_TO_LVIF(vap);
4015 		vif = LVIF_TO_VIF(lvif);
4016 
4017 		/* No need to replicate this in most state handlers. */
4018 		if (nstate > IEEE80211_S_SCAN)
4019 			lkpi_stop_hw_scan(lhw, vif);
4020 
4021 		s = sta_state_fsm;
4022 
4023 	} else {
4024 		ic_printf(vap->iv_ic, "%s: only station mode currently supported: "
4025 		    "vap %p iv_opmode %d\n", __func__, vap, vap->iv_opmode);
4026 		return (ENOSYS);
4027 	}
4028 
4029 	error = 0;
4030 	for (; s->handler != NULL; s++) {
4031 		if (ostate == s->ostate && nstate == s->nstate) {
4032 #ifdef LINUXKPI_DEBUG_80211
4033 			if (linuxkpi_debug_80211 & D80211_TRACE)
4034 				ic_printf(vap->iv_ic, "%s: new state %d (%s) ->"
4035 				    " %d (%s): arg %d.\n", __func__,
4036 				    ostate, ieee80211_state_name[ostate],
4037 				    nstate, ieee80211_state_name[nstate], arg);
4038 #endif
4039 			error = s->handler(vap, nstate, arg);
4040 			break;
4041 		}
4042 	}
4043 	IEEE80211_LOCK_ASSERT(vap->iv_ic);
4044 
4045 	if (s->handler == NULL) {
4046 		IMPROVE("turn this into a KASSERT\n");
4047 		ic_printf(vap->iv_ic, "%s: unsupported state transition "
4048 		    "%d (%s) -> %d (%s)\n", __func__,
4049 		    ostate, ieee80211_state_name[ostate],
4050 		    nstate, ieee80211_state_name[nstate]);
4051 		return (ENOSYS);
4052 	}
4053 
4054 	if (error == EALREADY) {
4055 #ifdef LINUXKPI_DEBUG_80211
4056 		if (linuxkpi_debug_80211 & D80211_TRACE)
4057 			ic_printf(vap->iv_ic, "%s: state transition %d (%s) -> "
4058 			    "%d (%s): iv_newstate already handled: %d.\n",
4059 			    __func__, ostate, ieee80211_state_name[ostate],
4060 			    nstate, ieee80211_state_name[nstate], error);
4061 #endif
4062 		return (0);
4063 	}
4064 
4065 	if (error != 0) {
4066 		ic_printf(vap->iv_ic, "%s: error %d during state transition "
4067 		    "%d (%s) -> %d (%s)\n", __func__, error,
4068 		    ostate, ieee80211_state_name[ostate],
4069 		    nstate, ieee80211_state_name[nstate]);
4070 		return (error);
4071 	}
4072 
4073 #ifdef LINUXKPI_DEBUG_80211
4074 	if (linuxkpi_debug_80211 & D80211_TRACE)
4075 		ic_printf(vap->iv_ic, "%s:%d: vap %p nstate %#x arg %#x "
4076 		    "calling net80211 parent\n",
4077 		    __func__, __LINE__, vap, nstate, arg);
4078 #endif
4079 
4080 	return (lvif->iv_newstate(vap, nstate, arg));
4081 }
4082 
4083 /* -------------------------------------------------------------------------- */
4084 
4085 /*
4086  * We overload (*iv_update_bss) as otherwise we have cases in, e.g.,
4087  * net80211::ieee80211_sta_join1() where vap->iv_bss gets replaced by a
4088  * new node without us knowing and thus our ni/lsta are out of sync.
4089  */
4090 static struct ieee80211_node *
4091 lkpi_iv_update_bss(struct ieee80211vap *vap, struct ieee80211_node *ni)
4092 {
4093 	struct lkpi_vif *lvif;
4094 	struct ieee80211_node *rni;
4095 
4096 	IEEE80211_LOCK_ASSERT(vap->iv_ic);
4097 
4098 	lvif = VAP_TO_LVIF(vap);
4099 
4100 	LKPI_80211_LVIF_LOCK(lvif);
4101 	lvif->lvif_bss_synched = false;
4102 	LKPI_80211_LVIF_UNLOCK(lvif);
4103 
4104 	rni = lvif->iv_update_bss(vap, ni);
4105 	return (rni);
4106 }
4107 
4108 #ifdef LKPI_80211_WME
4109 static int
4110 lkpi_wme_update(struct lkpi_hw *lhw, struct ieee80211vap *vap, bool planned)
4111 {
4112 	struct ieee80211com *ic;
4113 	struct ieee80211_hw *hw;
4114 	struct lkpi_vif *lvif;
4115 	struct ieee80211_vif *vif;
4116 	struct chanAccParams chp;
4117 	struct wmeParams wmeparr[WME_NUM_AC];
4118 	struct ieee80211_tx_queue_params txqp;
4119 	enum ieee80211_bss_changed bss_changed;
4120 	int error;
4121 	uint16_t ac;
4122 
4123 	hw = LHW_TO_HW(lhw);
4124 	lockdep_assert_wiphy(hw->wiphy);
4125 
4126 	IMPROVE();
4127 	KASSERT(WME_NUM_AC == IEEE80211_NUM_ACS, ("%s: WME_NUM_AC %d != "
4128 	    "IEEE80211_NUM_ACS %d\n", __func__, WME_NUM_AC, IEEE80211_NUM_ACS));
4129 
4130 	if (vap == NULL)
4131 		return (0);
4132 
4133 	if ((vap->iv_flags & IEEE80211_F_WME) == 0)
4134 		return (0);
4135 
4136 	if (lhw->ops->conf_tx == NULL)
4137 		return (0);
4138 
4139 	if (!planned && (vap->iv_state != IEEE80211_S_RUN)) {
4140 		lhw->update_wme = true;
4141 		return (0);
4142 	}
4143 	lhw->update_wme = false;
4144 
4145 	ic = lhw->ic;
4146 	ieee80211_wme_ic_getparams(ic, &chp);
4147 	IEEE80211_LOCK(ic);
4148 	for (ac = 0; ac < WME_NUM_AC; ac++)
4149 		wmeparr[ac] = chp.cap_wmeParams[ac];
4150 	IEEE80211_UNLOCK(ic);
4151 
4152 	lvif = VAP_TO_LVIF(vap);
4153 	vif = LVIF_TO_VIF(lvif);
4154 
4155 	/* Configure tx queues (conf_tx) & send BSS_CHANGED_QOS. */
4156 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
4157 		struct wmeParams *wmep;
4158 
4159 		wmep = &wmeparr[ac];
4160 		bzero(&txqp, sizeof(txqp));
4161 		txqp.cw_min = wmep->wmep_logcwmin;
4162 		txqp.cw_max = wmep->wmep_logcwmax;
4163 		txqp.txop = wmep->wmep_txopLimit;
4164 		txqp.aifs = wmep->wmep_aifsn;
4165 		error = lkpi_80211_mo_conf_tx(hw, vif, /* link_id */0, ac, &txqp);
4166 		if (error != 0)
4167 			ic_printf(ic, "%s: conf_tx ac %u failed %d\n",
4168 			    __func__, ac, error);
4169 	}
4170 	bss_changed = BSS_CHANGED_QOS;
4171 	if (!planned)
4172 		lkpi_bss_info_change(hw, vif, bss_changed);
4173 
4174 	return (bss_changed);
4175 }
4176 #endif
4177 
4178 static int
4179 lkpi_ic_wme_update(struct ieee80211com *ic)
4180 {
4181 #ifdef LKPI_80211_WME
4182 	struct ieee80211vap *vap;
4183 	struct lkpi_hw *lhw;
4184 	struct ieee80211_hw *hw;
4185 
4186 	IMPROVE("Use the per-VAP callback in net80211.");
4187 	vap = TAILQ_FIRST(&ic->ic_vaps);
4188 	if (vap == NULL)
4189 		return (0);
4190 
4191 	lhw = ic->ic_softc;
4192 	hw = LHW_TO_HW(lhw);
4193 
4194 	wiphy_lock(hw->wiphy);
4195 	lkpi_wme_update(lhw, vap, false);
4196 	wiphy_unlock(hw->wiphy);
4197 #endif
4198 	return (0);	/* unused */
4199 }
4200 
4201 static void
4202 lkpi_iv_sta_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0,
4203     int subtype, const struct ieee80211_rx_stats *rxs, int rssi, int nf)
4204 {
4205 	struct lkpi_hw *lhw;
4206 	struct ieee80211_hw *hw;
4207 	struct lkpi_vif *lvif;
4208 	struct ieee80211_vif *vif;
4209 	enum ieee80211_bss_changed bss_changed;
4210 
4211 	lvif = VAP_TO_LVIF(ni->ni_vap);
4212 	vif = LVIF_TO_VIF(lvif);
4213 
4214 	lvif->iv_recv_mgmt(ni, m0, subtype, rxs, rssi, nf);
4215 
4216 	switch (subtype) {
4217 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
4218 		break;
4219 	case IEEE80211_FC0_SUBTYPE_BEACON:
4220 		/*
4221 		 * Only count beacons when assoc. SCAN has its own logging.
4222 		 * This is for connection/beacon loss/session protection almost
4223 		 * over debugging when trying to get into a stable RUN state.
4224 		 */
4225 		if (vif->cfg.assoc)
4226 			lvif->beacons++;
4227 		break;
4228 	default:
4229 		return;
4230 	}
4231 
4232 	lhw = ni->ni_ic->ic_softc;
4233 	hw = LHW_TO_HW(lhw);
4234 
4235 	/*
4236 	 * If this direct call to mo_bss_info_changed will not work due to
4237 	 * locking, see if queue_work() is fast enough.
4238 	 */
4239 	bss_changed = lkpi_update_dtim_tsf(vif, ni, ni->ni_vap, __func__, __LINE__);
4240 	lkpi_bss_info_change(hw, vif, bss_changed);
4241 }
4242 
4243 /*
4244  * Change link-layer address on the vif (if the vap is not started/"UP").
4245  * This can happen if a user changes 'ether' using ifconfig.
4246  * The code is based on net80211/ieee80211_freebsd.c::wlan_iflladdr() but
4247  * we do use a per-[l]vif event handler to be sure we exist as we
4248  * cannot assume that from every vap derives a vif and we have a hard
4249  * time checking based on net80211 information.
4250  * Should this ever become a real problem we could add a callback function
4251  * to wlan_iflladdr() to be set optionally but that would be for a
4252  * single-consumer (or needs a list) -- was just too complicated for an
4253  * otherwise perfect mechanism FreeBSD already provides.
4254  */
4255 static void
4256 lkpi_vif_iflladdr(void *arg, struct ifnet *ifp)
4257 {
4258 	struct epoch_tracker et;
4259 	struct ieee80211_vif *vif;
4260 
4261 	NET_EPOCH_ENTER(et);
4262 	/* NB: identify vap's by if_transmit; left as an extra check. */
4263 	if (if_gettransmitfn(ifp) != ieee80211_vap_transmit ||
4264 	    (if_getflags(ifp) & IFF_UP) != 0) {
4265 		NET_EPOCH_EXIT(et);
4266 		return;
4267 	}
4268 
4269 	vif = arg;
4270 	IEEE80211_ADDR_COPY(vif->bss_conf.addr, if_getlladdr(ifp));
4271 	NET_EPOCH_EXIT(et);
4272 }
4273 
4274 static struct ieee80211vap *
4275 lkpi_ic_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ],
4276     int unit, enum ieee80211_opmode opmode, int flags,
4277     const uint8_t bssid[IEEE80211_ADDR_LEN],
4278     const uint8_t mac[IEEE80211_ADDR_LEN])
4279 {
4280 	struct lkpi_hw *lhw;
4281 	struct ieee80211_hw *hw;
4282 	struct lkpi_vif *lvif;
4283 	struct ieee80211vap *vap;
4284 	struct ieee80211_vif *vif;
4285 	struct ieee80211_tx_queue_params txqp;
4286 	enum ieee80211_bss_changed bss_changed;
4287 	enum nl80211_band band;
4288 	struct sysctl_oid *node;
4289 	size_t len;
4290 	int error, i;
4291 	uint16_t ac;
4292 
4293 	if (!TAILQ_EMPTY(&ic->ic_vaps))	/* 1 so far. Add <n> once this works. */
4294 		return (NULL);
4295 
4296 	lhw = ic->ic_softc;
4297 	hw = LHW_TO_HW(lhw);
4298 
4299 	len = sizeof(*lvif);
4300 	len += hw->vif_data_size;	/* vif->drv_priv */
4301 
4302 	lvif = malloc(len, M_80211_VAP, M_WAITOK | M_ZERO);
4303 	mtx_init(&lvif->mtx, "lvif", NULL, MTX_DEF);
4304 	TASK_INIT(&lvif->sw_scan_task, 0, lkpi_sw_scan_task, lvif);
4305 	INIT_LIST_HEAD(&lvif->lsta_list);
4306 	lvif->lvif_bss = NULL;
4307 	refcount_init(&lvif->nt_unlocked, 0);
4308 	lvif->lvif_bss_synched = false;
4309 	vap = LVIF_TO_VAP(lvif);
4310 	vif = LVIF_TO_VIF(lvif);
4311 
4312 	/*
4313 	 * Setup legacy br_mask here.  We will call (*set_bitrate_mask)
4314 	 * elsewhere to announce it to the driver but it is a static
4315 	 * setup.
4316 	 * Also setup basic_rates with just the mandatory rates for the
4317 	 * current band (if avail).
4318 	 */
4319 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
4320 		struct ieee80211_supported_band *supband;
4321 		uint32_t rate_mandatory;;
4322 
4323 		supband = hw->wiphy->bands[band];
4324 		if (supband == NULL || supband->n_bitrates == 0)
4325 			continue;
4326 
4327 		/* Per-band legacy br_mask. */
4328 		lvif->br_mask.control[band].legacy = (1 << supband->n_bitrates) - 1;
4329 
4330 		/* basic_rates for the current band. */
4331 		if (hw->conf.chandef.chan == NULL ||
4332 		    hw->conf.chandef.chan->band != band)
4333 			continue;
4334 
4335 		switch (band) {
4336 		case NL80211_BAND_2GHZ:
4337 			/* We have to assume 11g support here. */
4338 			rate_mandatory = IEEE80211_RATE_MANDATORY_G |
4339 			    IEEE80211_RATE_MANDATORY_B;
4340 			break;
4341 		case NL80211_BAND_5GHZ:
4342 			rate_mandatory = IEEE80211_RATE_MANDATORY_A;
4343 			break;
4344 		default:
4345 			continue;
4346 		}
4347 
4348 		for (i = 0; i < supband->n_bitrates; i++) {
4349 			if ((supband->bitrates[i].flags & rate_mandatory) != 0)
4350 				vif->bss_conf.basic_rates |= BIT(i);
4351 		}
4352 	}
4353 
4354 	memcpy(vif->addr, mac, IEEE80211_ADDR_LEN);
4355 	vif->p2p = false;
4356 	vif->probe_req_reg = false;
4357 	vif->type = lkpi_opmode_to_vif_type(opmode);
4358 	lvif->wdev.iftype = vif->type;
4359 	/* Need to fill in other fields as well. */
4360 	IMPROVE();
4361 
4362 	/* Create a chanctx to be used later. */
4363 	IMPROVE("lkpi_alloc_lchanctx reserved as many as can be");
4364 	(void) lkpi_find_lchanctx_reserved(hw, lvif);
4365 
4366 	/* XXX-BZ hardcoded for now! */
4367 #if 1
4368 	RCU_INIT_POINTER(vif->bss_conf.chanctx_conf, NULL);
4369 	vif->bss_conf.vif = vif;
4370 	/* vap->iv_myaddr is not set until net80211::vap_setup or vap_attach. */
4371 	IEEE80211_ADDR_COPY(vif->bss_conf.addr, mac);
4372 	lvif->lvif_ifllevent = EVENTHANDLER_REGISTER(iflladdr_event,
4373 	    lkpi_vif_iflladdr, vif, EVENTHANDLER_PRI_ANY);
4374 	vif->bss_conf.link_id = 0;	/* Non-MLO operation. */
4375 	vif->bss_conf.chanreq.oper.chan = lhw->dflt_chandef.chan;
4376 	vif->bss_conf.chanreq.oper.width = NL80211_CHAN_WIDTH_20_NOHT;
4377 	vif->bss_conf.use_short_preamble = false;	/* vap->iv_flags IEEE80211_F_SHPREAMBLE */
4378 	vif->bss_conf.use_short_slot = false;		/* vap->iv_flags IEEE80211_F_SHSLOT */
4379 	vif->bss_conf.qos = false;
4380 	vif->bss_conf.use_cts_prot = false;		/* vap->iv_protmode */
4381 	vif->bss_conf.ht_operation_mode = IEEE80211_HT_OP_MODE_PROTECTION_NONE;
4382 	IEEE80211_ADDR_COPY(vif->cfg.ap_addr, ieee80211broadcastaddr);
4383 	vif->cfg.aid = 0;
4384 	vif->cfg.assoc = false;
4385 	vif->cfg.idle = true;
4386 	vif->cfg.ps = false;
4387 	IMPROVE("Check other fields and then figure out whats is left elsewhere of them");
4388 	/*
4389 	 * We need to initialize it to something as the bss_info_changed call
4390 	 * will try to copy from it in iwlwifi and NULL is a panic.
4391 	 * We will set the proper one in scan_to_auth() before being assoc.
4392 	 */
4393 	vif->bss_conf.bssid = ieee80211broadcastaddr;
4394 #endif
4395 #if 0
4396 	vif->bss_conf.dtim_period = 0; /* IEEE80211_DTIM_DEFAULT ; must stay 0. */
4397 	IEEE80211_ADDR_COPY(vif->bss_conf.bssid, bssid);
4398 	vif->bss_conf.beacon_int = ic->ic_bintval;
4399 	/* iwlwifi bug. */
4400 	if (vif->bss_conf.beacon_int < 16)
4401 		vif->bss_conf.beacon_int = 16;
4402 #endif
4403 
4404 	/* Link Config */
4405 	vif->link_conf[0] = &vif->bss_conf;
4406 	for (i = 0; i < nitems(vif->link_conf); i++) {
4407 		IMPROVE("more than 1 link one day");
4408 	}
4409 
4410 	/* Setup queue defaults; driver may override in (*add_interface). */
4411 	for (i = 0; i < IEEE80211_NUM_ACS; i++) {
4412 		if (ieee80211_hw_check(hw, QUEUE_CONTROL))
4413 			vif->hw_queue[i] = IEEE80211_INVAL_HW_QUEUE;
4414 		else if (hw->queues >= IEEE80211_NUM_ACS)
4415 			vif->hw_queue[i] = i;
4416 		else
4417 			vif->hw_queue[i] = 0;
4418 
4419 		/* Initialize the queue to running. Stopped? */
4420 		lvif->hw_queue_stopped[i] = false;
4421 	}
4422 	vif->cab_queue = IEEE80211_INVAL_HW_QUEUE;
4423 
4424 	IMPROVE();
4425 
4426 	wiphy_lock(hw->wiphy);
4427 	error = lkpi_80211_mo_start(hw);
4428 	if (error != 0) {
4429 		wiphy_unlock(hw->wiphy);
4430 		ic_printf(ic, "%s: failed to start hw: %d\n", __func__, error);
4431 		mtx_destroy(&lvif->mtx);
4432 		free(lvif, M_80211_VAP);
4433 		return (NULL);
4434 	}
4435 
4436 	error = lkpi_80211_mo_add_interface(hw, vif);
4437 	if (error != 0) {
4438 		IMPROVE();	/* XXX-BZ mo_stop()? */
4439 		wiphy_unlock(hw->wiphy);
4440 		ic_printf(ic, "%s: failed to add interface: %d\n", __func__, error);
4441 		mtx_destroy(&lvif->mtx);
4442 		free(lvif, M_80211_VAP);
4443 		return (NULL);
4444 	}
4445 	wiphy_unlock(hw->wiphy);
4446 
4447 	LKPI_80211_LHW_LVIF_LOCK(lhw);
4448 	TAILQ_INSERT_TAIL(&lhw->lvif_head, lvif, lvif_entry);
4449 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
4450 
4451 	/* Set bss_info. */
4452 	bss_changed = 0;
4453 	lkpi_bss_info_change(hw, vif, bss_changed);
4454 
4455 	/* Configure tx queues (conf_tx), default WME & send BSS_CHANGED_QOS. */
4456 	IMPROVE("Hardcoded values; to fix see 802.11-2016, 9.4.2.29 EDCA Parameter Set element");
4457 	wiphy_lock(hw->wiphy);
4458 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
4459 
4460 		bzero(&txqp, sizeof(txqp));
4461 		txqp.cw_min = 15;
4462 		txqp.cw_max = 1023;
4463 		txqp.txop = 0;
4464 		txqp.aifs = 2;
4465 		error = lkpi_80211_mo_conf_tx(hw, vif, /* link_id */0, ac, &txqp);
4466 		if (error != 0)
4467 			ic_printf(ic, "%s: conf_tx ac %u failed %d\n",
4468 			    __func__, ac, error);
4469 	}
4470 	bss_changed = BSS_CHANGED_QOS;
4471 	lkpi_bss_info_change(hw, vif, bss_changed);
4472 
4473 	/* Force MC init. */
4474 	lkpi_update_mcast_filter_locked(ic);
4475 
4476 	wiphy_unlock(hw->wiphy);
4477 
4478 	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
4479 
4480 	/* Now we have a valid vap->iv_ifp.  Any checksum offloading goes below. */
4481 
4482 	IMPROVE();
4483 
4484 	/* Override with LinuxKPI method so we can drive mac80211/cfg80211. */
4485 	lvif->iv_newstate = vap->iv_newstate;
4486 	vap->iv_newstate = lkpi_iv_newstate;
4487 	lvif->iv_update_bss = vap->iv_update_bss;
4488 	vap->iv_update_bss = lkpi_iv_update_bss;
4489 	lvif->iv_recv_mgmt = vap->iv_recv_mgmt;
4490 	vap->iv_recv_mgmt = lkpi_iv_sta_recv_mgmt;
4491 
4492 #ifdef LKPI_80211_HW_CRYPTO
4493 	/* Key management. */
4494 	if (lkpi_hwcrypto && lhw->ops->set_key != NULL) {
4495 		vap->iv_key_set = lkpi_iv_key_set;
4496 		vap->iv_key_delete = lkpi_iv_key_delete;
4497 		vap->iv_key_update_begin = lkpi_iv_key_update_begin;
4498 		vap->iv_key_update_end = lkpi_iv_key_update_end;
4499 	}
4500 #endif
4501 
4502 #ifdef LKPI_80211_HT
4503 	/* Stay with the iv_ampdu_rxmax,limit / iv_ampdu_density defaults until later. */
4504 #endif
4505 
4506 	ieee80211_ratectl_init(vap);
4507 
4508 	/* Complete setup. */
4509 	ieee80211_vap_attach(vap, ieee80211_media_change,
4510 	    ieee80211_media_status, mac);
4511 
4512 #ifdef LKPI_80211_HT
4513 	/*
4514 	 * Modern chipset/fw/drv will do A-MPDU in drv/fw and fail
4515 	 * to do so if they cannot do the crypto too.
4516 	 */
4517 	if (!lkpi_hwcrypto && IEEE80211_CONF_AMPDU_OFFLOAD(ic))
4518 		vap->iv_flags_ht &= ~IEEE80211_FHT_AMPDU_RX;
4519 #endif
4520 
4521 	if (hw->max_listen_interval == 0)
4522 		hw->max_listen_interval = 7 * (ic->ic_lintval / ic->ic_bintval);
4523 	hw->conf.listen_interval = hw->max_listen_interval;
4524 
4525 	/* XXX-BZ do we need to be able to update these? */
4526 	hw->wiphy->frag_threshold = vap->iv_fragthreshold;
4527 	lkpi_80211_mo_set_frag_threshold(hw, vap->iv_fragthreshold);
4528 	hw->wiphy->rts_threshold = vap->iv_rtsthreshold;
4529 	lkpi_80211_mo_set_rts_threshold(hw, vap->iv_rtsthreshold);
4530 	/* any others? */
4531 
4532 	/* Add per-VIF/VAP sysctls. */
4533 	sysctl_ctx_init(&lvif->sysctl_ctx);
4534 
4535 	node = SYSCTL_ADD_NODE(&lvif->sysctl_ctx,
4536 	    SYSCTL_CHILDREN(&sysctl___compat_linuxkpi_80211),
4537 	    OID_AUTO, if_name(vap->iv_ifp),
4538 	    CTLFLAG_RD | CTLFLAG_SKIP | CTLFLAG_MPSAFE, NULL, "VIF Information");
4539 
4540 	SYSCTL_ADD_PROC(&lvif->sysctl_ctx,
4541 	    SYSCTL_CHILDREN(node), OID_AUTO, "dump_stas",
4542 	    CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_MPSAFE, lvif, 0,
4543 	    lkpi_80211_dump_stas, "A", "Dump sta statistics of this vif");
4544 	SYSCTL_ADD_PROC(&lvif->sysctl_ctx,
4545 	    SYSCTL_CHILDREN(node), OID_AUTO, "dump_stas_queues",
4546 	    CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_MPSAFE | CTLFLAG_SKIP, lvif, 0,
4547 	    lkpi_80211_dump_sta_queues, "A",
4548 	    "Dump queue statistics for any sta of this vif");
4549 
4550 	IMPROVE();
4551 
4552 	return (vap);
4553 }
4554 
4555 void
4556 linuxkpi_ieee80211_unregister_hw(struct ieee80211_hw *hw)
4557 {
4558 
4559 	wiphy_unregister(hw->wiphy);
4560 	linuxkpi_ieee80211_ifdetach(hw);
4561 
4562 	IMPROVE();
4563 }
4564 
4565 void
4566 linuxkpi_ieee80211_restart_hw(struct ieee80211_hw *hw)
4567 {
4568 
4569 	TODO();
4570 }
4571 
4572 static void
4573 lkpi_ic_vap_delete(struct ieee80211vap *vap)
4574 {
4575 	struct ieee80211com *ic;
4576 	struct lkpi_hw *lhw;
4577 	struct ieee80211_hw *hw;
4578 	struct lkpi_vif *lvif;
4579 	struct ieee80211_vif *vif;
4580 
4581 	lvif = VAP_TO_LVIF(vap);
4582 	vif = LVIF_TO_VIF(lvif);
4583 	ic = vap->iv_ic;
4584 	lhw = ic->ic_softc;
4585 	hw = LHW_TO_HW(lhw);
4586 
4587 	EVENTHANDLER_DEREGISTER(iflladdr_event, lvif->lvif_ifllevent);
4588 
4589 	/* Clear up per-VIF/VAP sysctls. */
4590 	sysctl_ctx_free(&lvif->sysctl_ctx);
4591 
4592 	ieee80211_draintask(ic, &lvif->sw_scan_task);
4593 
4594 	LKPI_80211_LHW_LVIF_LOCK(lhw);
4595 	TAILQ_REMOVE(&lhw->lvif_head, lvif, lvif_entry);
4596 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
4597 
4598 	ieee80211_ratectl_deinit(vap);
4599 	ieee80211_vap_detach(vap);
4600 
4601 	IMPROVE("clear up other bits in this state");
4602 
4603 	lkpi_80211_mo_remove_interface(hw, vif);
4604 
4605 	/* Single VAP, so we can do this here. */
4606 	lkpi_80211_mo_stop(hw, false);			/* XXX SUSPEND */
4607 
4608 	mtx_destroy(&lvif->mtx);
4609 	free(lvif, M_80211_VAP);
4610 }
4611 
4612 static void
4613 lkpi_ic_update_mcast(struct ieee80211com *ic)
4614 {
4615 	struct ieee80211vap *vap;
4616 	struct lkpi_hw *lhw;
4617 
4618 	lhw = ic->ic_softc;
4619 
4620 	LKPI_80211_LHW_MC_LOCK(lhw);
4621 	/* Cleanup anything on the current list. */
4622 	lkpi_cleanup_mcast_list_locked(lhw);
4623 
4624 	/* Build up the new list (or allmulti). */
4625 	if (ic->ic_allmulti == 0) {
4626 		TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
4627 			if_foreach_llmaddr(vap->iv_ifp,
4628 			    lkpi_ic_update_mcast_copy, &lhw->mc_list);
4629 		lhw->mc_all_multi = false;
4630 	} else {
4631 		lhw->mc_all_multi = true;
4632 	}
4633 	LKPI_80211_LHW_MC_UNLOCK(lhw);
4634 
4635 	lkpi_update_mcast_filter(ic);
4636 	TRACEOK();
4637 }
4638 
4639 static void
4640 lkpi_ic_update_promisc(struct ieee80211com *ic)
4641 {
4642 
4643 	UNIMPLEMENTED;
4644 }
4645 
4646 static void
4647 lkpi_ic_update_chw(struct ieee80211com *ic)
4648 {
4649 
4650 	UNIMPLEMENTED;
4651 }
4652 
4653 /* Start / stop device. */
4654 static void
4655 lkpi_ic_parent(struct ieee80211com *ic)
4656 {
4657 	struct lkpi_hw *lhw;
4658 	struct ieee80211_hw *hw;
4659 #ifdef HW_START_STOP
4660 	int error;
4661 #endif
4662 	bool start_all;
4663 
4664 	IMPROVE();
4665 
4666 	lhw = ic->ic_softc;
4667 	hw = LHW_TO_HW(lhw);
4668 	start_all = false;
4669 
4670 	/* IEEE80211_UNLOCK(ic); */
4671 	wiphy_lock(hw->wiphy);
4672 	if (ic->ic_nrunning > 0) {
4673 #ifdef HW_START_STOP
4674 		error = lkpi_80211_mo_start(hw);
4675 		if (error == 0)
4676 #endif
4677 			start_all = true;
4678 	} else {
4679 #ifdef HW_START_STOP
4680 		lkpi_80211_mo_stop(hw, false);		/* XXX SUSPEND */
4681 #endif
4682 	}
4683 	wiphy_unlock(hw->wiphy);
4684 	/* IEEE80211_LOCK(ic); */
4685 
4686 	if (start_all)
4687 		ieee80211_start_all(ic);
4688 }
4689 
4690 bool
4691 linuxkpi_ieee80211_is_ie_id_in_ie_buf(const u8 ie, const u8 *ie_ids,
4692     size_t ie_ids_len)
4693 {
4694 	int i;
4695 
4696 	for (i = 0; i < ie_ids_len; i++) {
4697 		if (ie == *ie_ids)
4698 			return (true);
4699 	}
4700 
4701 	return (false);
4702 }
4703 
4704 /* Return true if skipped; false if error. */
4705 bool
4706 linuxkpi_ieee80211_ie_advance(size_t *xp, const u8 *ies, size_t ies_len)
4707 {
4708 	size_t x;
4709 	uint8_t l;
4710 
4711 	x = *xp;
4712 
4713 	KASSERT(x < ies_len, ("%s: x %zu ies_len %zu ies %p\n",
4714 	    __func__, x, ies_len, ies));
4715 	l = ies[x + 1];
4716 	x += 2 + l;
4717 
4718 	if (x > ies_len)
4719 		return (false);
4720 
4721 	*xp = x;
4722 	return (true);
4723 }
4724 
4725 static uint8_t *
4726 lkpi_scan_ies_add(uint8_t *p, struct ieee80211_scan_ies *scan_ies,
4727     uint32_t band_mask, struct ieee80211vap *vap, struct ieee80211_hw *hw)
4728 {
4729 	struct ieee80211_supported_band *supband;
4730 	struct linuxkpi_ieee80211_channel *channels;
4731 	struct ieee80211com *ic;
4732 	const struct ieee80211_channel *chan;
4733 	const struct ieee80211_rateset *rs;
4734 	uint8_t *pb;
4735 	int band, i;
4736 
4737 	ic = vap->iv_ic;
4738 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
4739 		if ((band_mask & (1 << band)) == 0)
4740 			continue;
4741 
4742 		supband = hw->wiphy->bands[band];
4743 		/*
4744 		 * This should not happen;
4745 		 * band_mask is a bitmask of valid bands to scan on.
4746 		 */
4747 		if (supband == NULL || supband->n_channels == 0)
4748 			continue;
4749 
4750 		/* Find a first channel to get the mode and rates from. */
4751 		channels = supband->channels;
4752 		chan = NULL;
4753 		for (i = 0; i < supband->n_channels; i++) {
4754 			uint32_t flags;
4755 
4756 			if (channels[i].flags & IEEE80211_CHAN_DISABLED)
4757 				continue;
4758 
4759 			flags = 0;
4760 			switch (band) {
4761 			case NL80211_BAND_2GHZ:
4762 				flags |= IEEE80211_CHAN_G;
4763 				break;
4764 			case NL80211_BAND_5GHZ:
4765 				flags |= IEEE80211_CHAN_A;
4766 				break;
4767 			default:
4768 				panic("%s:%d: unupported band %d\n",
4769 				    __func__, __LINE__, band);
4770 			}
4771 
4772 			chan = ieee80211_find_channel(ic,
4773 			    channels[i].center_freq, flags);
4774 			if (chan != NULL)
4775 				break;
4776 		}
4777 
4778 		/* This really should not happen. */
4779 		if (chan == NULL)
4780 			continue;
4781 
4782 		pb = p;
4783 		rs = ieee80211_get_suprates(ic, chan);	/* calls chan2mode */
4784 		p = ieee80211_add_rates(p, rs);
4785 		p = ieee80211_add_xrates(p, rs);
4786 
4787 #if defined(LKPI_80211_HT)
4788 		if ((vap->iv_flags_ht & IEEE80211_FHT_HT) != 0) {
4789 			struct ieee80211_channel *c;
4790 
4791 			c = ieee80211_ht_adjust_channel(ic, ic->ic_curchan,
4792 			    vap->iv_flags_ht);
4793 			p = ieee80211_add_htcap_ch(p, vap, c);
4794 		}
4795 #endif
4796 #if defined(LKPI_80211_VHT)
4797 		if (band == NL80211_BAND_5GHZ &&
4798 		    (vap->iv_vht_flags & IEEE80211_FVHT_VHT) != 0) {
4799 			struct ieee80211_channel *c;
4800 
4801 			c = ieee80211_ht_adjust_channel(ic, ic->ic_curchan,
4802 			    vap->iv_flags_ht);
4803 			c = ieee80211_vht_adjust_channel(ic, c,
4804 			    vap->iv_vht_flags);
4805 			p = ieee80211_add_vhtcap_ch(p, vap, c);
4806 		}
4807 #endif
4808 
4809 		scan_ies->ies[band] = pb;
4810 		scan_ies->len[band] = p - pb;
4811 	}
4812 
4813 	/* Add common_ies */
4814 	pb = p;
4815 	if ((vap->iv_flags & IEEE80211_F_WPA1) != 0 &&
4816 	    vap->iv_wpa_ie != NULL) {
4817 		memcpy(p, vap->iv_wpa_ie, 2 + vap->iv_wpa_ie[1]);
4818 		p += 2 + vap->iv_wpa_ie[1];
4819 	}
4820 	if (vap->iv_appie_probereq != NULL) {
4821 		memcpy(p, vap->iv_appie_probereq->ie_data,
4822 		    vap->iv_appie_probereq->ie_len);
4823 		p += vap->iv_appie_probereq->ie_len;
4824 	}
4825 	scan_ies->common_ies = pb;
4826 	scan_ies->common_ie_len = p - pb;
4827 
4828 	return (p);
4829 }
4830 
4831 static void
4832 lkpi_enable_hw_scan(struct lkpi_hw *lhw)
4833 {
4834 
4835 	if (lhw->ops->hw_scan) {
4836 		/*
4837 		 * Advertise full-offload scanning.
4838 		 *
4839 		 * Not limiting to SINGLE_SCAN_ON_ALL_BANDS here as otherwise
4840 		 * we essentially disable hw_scan for all drivers not setting
4841 		 * the flag.
4842 		 */
4843 		lhw->ic->ic_flags_ext |= IEEE80211_FEXT_SCAN_OFFLOAD;
4844 		lhw->scan_flags |= LKPI_LHW_SCAN_HW;
4845 	}
4846 }
4847 
4848 #ifndef LKPI_80211_USE_SCANLIST
4849 static const uint32_t chan_pri[] = {
4850 	5180, 5500, 5745,
4851 	5260, 5580, 5660, 5825,
4852 	5220, 5300, 5540, 5620, 5700, 5785, 5865,
4853 	2437, 2412, 2422, 2462, 2472, 2432, 2452
4854 };
4855 
4856 static int
4857 lkpi_scan_chan_list_idx(const struct linuxkpi_ieee80211_channel *lc)
4858 {
4859 	int i;
4860 
4861 	for (i = 0; i < nitems(chan_pri); i++) {
4862 		if (lc->center_freq == chan_pri[i])
4863 			return (i);
4864 	}
4865 
4866 	return (-1);
4867 }
4868 
4869 static int
4870 lkpi_scan_chan_list_comp(const  struct linuxkpi_ieee80211_channel *lc1,
4871     const  struct linuxkpi_ieee80211_channel *lc2)
4872 {
4873 	int idx1, idx2;
4874 
4875 	/* Find index in list. */
4876 	idx1 = lkpi_scan_chan_list_idx(lc1);
4877 	idx2 = lkpi_scan_chan_list_idx(lc2);
4878 
4879 	if (idx1 == -1 && idx2 != -1)
4880 		return (1);
4881 	if (idx1 != -1 && idx2 == -1)
4882 		return (-1);
4883 
4884 	/* Neither on the list, use center_freq. */
4885 	if (idx1 == -1 && idx2 == -1)
4886 		return (lc1->center_freq - lc2->center_freq);
4887 
4888 	/* Whichever is first in the list. */
4889 	return (idx1 - idx2);
4890 }
4891 
4892 static void
4893 lkpi_scan_chan_list_resort(struct linuxkpi_ieee80211_channel **cpp, size_t nchan)
4894 {
4895 	struct linuxkpi_ieee80211_channel *lc, *nc;
4896 	size_t i, j;
4897 	int rc;
4898 
4899 	for (i = (nchan - 1); i > 0; i--) {
4900 		for (j = i; j > 0 ; j--) {
4901 			lc = *(cpp + j);
4902 			nc = *(cpp + j - 1);
4903 			rc = lkpi_scan_chan_list_comp(lc, nc);
4904 			if (rc < 0) {
4905 				*(cpp + j) = nc;
4906 				*(cpp + j - 1) = lc;
4907 			}
4908 		}
4909 	}
4910 }
4911 
4912 static bool
4913 lkpi_scan_chan(struct linuxkpi_ieee80211_channel *c,
4914     struct ieee80211com *ic, bool log)
4915 {
4916 
4917 	if ((c->flags & IEEE80211_CHAN_DISABLED) != 0) {
4918 		if (log)
4919 			TRACE_SCAN(ic, "Skipping disabled chan "
4920 			    "on band %s [%#x/%u/%#x]",
4921 			    lkpi_nl80211_band_name(c->band), c->hw_value,
4922 			    c->center_freq, c->flags);
4923 		return (false);
4924 	}
4925 	if (isclr(ic->ic_chan_active, ieee80211_mhz2ieee(c->center_freq,
4926 	    lkpi_nl80211_band_to_net80211_band(c->band)))) {
4927 		if (log)
4928 			TRACE_SCAN(ic, "Skipping !active chan "
4929 			    "on band %s [%#x/%u/%#x]",
4930 			    lkpi_nl80211_band_name(c->band), c->hw_value,
4931 			    c->center_freq, c->flags);
4932 		return (false);
4933 	}
4934 	return (true);
4935 }
4936 #endif
4937 
4938 static void
4939 lkpi_ic_scan_start(struct ieee80211com *ic)
4940 {
4941 	struct lkpi_hw *lhw;
4942 	struct ieee80211_hw *hw;
4943 	struct lkpi_vif *lvif;
4944 	struct ieee80211_vif *vif;
4945 	struct ieee80211_scan_state *ss;
4946 	struct ieee80211vap *vap;
4947 	int error;
4948 	bool is_hw_scan;
4949 
4950 	lhw = ic->ic_softc;
4951 	ss = ic->ic_scan;
4952 	vap = ss->ss_vap;
4953 	TRACE_SCAN(ic, "scan_flags %b", lhw->scan_flags, LKPI_LHW_SCAN_BITS);
4954 
4955 	LKPI_80211_LHW_SCAN_LOCK(lhw);
4956 	if ((lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0) {
4957 		/* A scan is still running. */
4958 		LKPI_80211_LHW_SCAN_UNLOCK(lhw);
4959 		TRACE_SCAN(ic, "Trying to start new scan while still running; "
4960 		    "cancelling new net80211 scan; scan_flags %b",
4961 		    lhw->scan_flags, LKPI_LHW_SCAN_BITS);
4962 		ieee80211_cancel_scan(vap);
4963 		return;
4964 	}
4965 	is_hw_scan = (lhw->scan_flags & LKPI_LHW_SCAN_HW) != 0;
4966 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
4967 
4968 #if 0
4969 	if (vap->iv_state != IEEE80211_S_SCAN) {
4970 		TODO("We need to be able to scan if not in S_SCAN");
4971 		TRACE_SCAN(ic, "scan_flags %b iv_state %d",
4972 		    lhw->scan_flags, LKPI_LHW_SCAN_BITS, vap->iv_state);
4973 		ieee80211_cancel_scan(vap);
4974 		return;
4975 	}
4976 #endif
4977 
4978 	hw = LHW_TO_HW(lhw);
4979 	if (!is_hw_scan) {
4980 		/* If hw_scan is cleared clear FEXT_SCAN_OFFLOAD too. */
4981 		vap->iv_flags_ext &= ~IEEE80211_FEXT_SCAN_OFFLOAD;
4982 
4983 		lvif = VAP_TO_LVIF(vap);
4984 		vif = LVIF_TO_VIF(lvif);
4985 
4986 		if (vap->iv_state == IEEE80211_S_SCAN) {
4987 			wiphy_lock(hw->wiphy);
4988 			lkpi_hw_conf_idle(hw, false);
4989 			wiphy_unlock(hw->wiphy);
4990 		}
4991 
4992 		LKPI_80211_LHW_SCAN_LOCK(lhw);
4993 		lhw->scan_flags |= LKPI_LHW_SCAN_RUNNING;
4994 		LKPI_80211_LHW_SCAN_UNLOCK(lhw);
4995 
4996 		lkpi_update_mcast_filter(ic);
4997 
4998 		TRACE_SCAN(vap->iv_ic, "Starting SW_SCAN: scan_flags %b",
4999 		    lhw->scan_flags, LKPI_LHW_SCAN_BITS);
5000 		lkpi_80211_mo_sw_scan_start(hw, vif, vif->addr);
5001 		/* net80211::scan_start() handled PS for us. */
5002 		IMPROVE();
5003 		/* XXX Also means it is too late to flush queues?
5004 		 * need to check iv_sta_ps or overload? */
5005 		/* XXX want to adjust ss end time/ maxdwell? */
5006 
5007 	} else {
5008 		struct ieee80211_scan_request *hw_req;
5009 		struct linuxkpi_ieee80211_channel *lc, **cpp;
5010 		struct cfg80211_ssid *ssids;
5011 		struct cfg80211_scan_6ghz_params *s6gp;
5012 		size_t chan_len, nchan, ssids_len, s6ghzlen;
5013 		int band, i, ssid_count, common_ie_len;
5014 #ifndef LKPI_80211_USE_SCANLIST
5015 		int n;
5016 #endif
5017 		uint32_t band_mask;
5018 		uint8_t *ie, *ieend;
5019 		bool running;
5020 
5021 		ssid_count = min(ss->ss_nssid, hw->wiphy->max_scan_ssids);
5022 		ssids_len = ssid_count * sizeof(*ssids);
5023 		s6ghzlen = 0 * (sizeof(*s6gp));			/* XXX-BZ */
5024 
5025 		band_mask = 0;
5026 		nchan = 0;
5027 		if (ieee80211_hw_check(hw, SINGLE_SCAN_ON_ALL_BANDS)) {
5028 #ifdef LKPI_80211_USE_SCANLIST
5029 		/* Avoid net80211 scan lists until it has proper scan offload support. */
5030 			for (i = ss->ss_next; i < ss->ss_last; i++) {
5031 				nchan++;
5032 				band = lkpi_net80211_chan_to_nl80211_band(
5033 				    ss->ss_chans[ss->ss_next + i]);
5034 				band_mask |= (1 << band);
5035 			}
5036 #else
5037 			/* Instead we scan for all channels all the time. */
5038 			for (band = 0; band < NUM_NL80211_BANDS; band++) {
5039 				switch (band) {
5040 				case NL80211_BAND_2GHZ:
5041 				case NL80211_BAND_5GHZ:
5042 					break;
5043 				default:
5044 					continue;
5045 				}
5046 				if (hw->wiphy->bands[band] != NULL) {
5047 					struct linuxkpi_ieee80211_channel *channels;
5048 					int n;
5049 
5050 					band_mask |= (1 << band);
5051 
5052 					channels = hw->wiphy->bands[band]->channels;
5053 					n = hw->wiphy->bands[band]->n_channels;
5054 					for (i = 0; i < n; i++) {
5055 						if (lkpi_scan_chan(&channels[i], ic, true))
5056 							nchan++;
5057 					}
5058 				}
5059 			}
5060 #endif
5061 		} else {
5062 			IMPROVE("individual band scans not yet supported, only scanning first band");
5063 			/* In theory net80211 should drive this. */
5064 			/* Probably we need to add local logic for now;
5065 			 * need to deal with scan_complete
5066 			 * and cancel_scan and keep local state.
5067 			 * Also cut the nchan down above.
5068 			 */
5069 			/* XXX-BZ ath10k does not set this but still does it? &$%^ */
5070 		}
5071 
5072 		chan_len = nchan * (sizeof(lc) + sizeof(*lc));
5073 
5074 		common_ie_len = 0;
5075 		if ((vap->iv_flags & IEEE80211_F_WPA1) != 0 &&
5076 		    vap->iv_wpa_ie != NULL)
5077 			common_ie_len += vap->iv_wpa_ie[1];
5078 		if (vap->iv_appie_probereq != NULL)
5079 			common_ie_len += vap->iv_appie_probereq->ie_len;
5080 
5081 		/* We would love to check this at an earlier stage... */
5082 		if (common_ie_len >  hw->wiphy->max_scan_ie_len) {
5083 			ic_printf(ic, "WARNING: %s: common_ie_len %d > "
5084 			    "wiphy->max_scan_ie_len %d\n", __func__,
5085 			    common_ie_len, hw->wiphy->max_scan_ie_len);
5086 		}
5087 
5088 		hw_req = malloc(sizeof(*hw_req) + ssids_len +
5089 		    s6ghzlen + chan_len + lhw->supbands * lhw->scan_ie_len +
5090 		    common_ie_len, M_LKPI80211, M_WAITOK | M_ZERO);
5091 
5092 		hw_req->req.flags = 0;			/* XXX ??? */
5093 		/* hw_req->req.wdev */
5094 		hw_req->req.wiphy = hw->wiphy;
5095 		hw_req->req.no_cck = false;		/* XXX */
5096 
5097 		/*
5098 		 * In general setting duration[_mandatory] seems to pessimise
5099 		 * default scanning behaviour.  We only use it for BGSCANnig
5100 		 * to keep the dwell times small.
5101 		 * Setting duration_mandatory makes this the maximum dwell
5102 		 * time (otherwise may be shorter).  Duration is in TU.
5103 		 */
5104 		if ((ic->ic_flags_ext & IEEE80211_FEXT_BGSCAN) != 0) {
5105 			unsigned long dwell;
5106 
5107 			if ((ic->ic_caps & IEEE80211_C_BGSCAN) == 0 ||
5108 			    (vap->iv_flags & IEEE80211_F_BGSCAN) == 0)
5109 				ic_printf(ic, "BGSCAN despite off: %b, %b, %b\n",
5110 				    ic->ic_flags_ext, IEEE80211_FEXT_BITS,
5111 				    vap->iv_flags, IEEE80211_F_BITS,
5112 				    ic->ic_caps, IEEE80211_C_BITS);
5113 
5114 			dwell = ss->ss_mindwell;
5115 			if (dwell == 0)
5116 				dwell = msecs_to_ticks(20);
5117 
5118 			hw_req->req.duration_mandatory = true;
5119 			hw_req->req.duration = TICKS_2_USEC(dwell) / 1024;
5120 		}
5121 
5122 #ifdef __notyet__
5123 		hw_req->req.flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
5124 		memcpy(hw_req->req.mac_addr, xxx, IEEE80211_ADDR_LEN);
5125 		memset(hw_req->req.mac_addr_mask, 0xxx, IEEE80211_ADDR_LEN);
5126 #endif
5127 		eth_broadcast_addr(hw_req->req.bssid);
5128 
5129 		hw_req->req.n_channels = nchan;
5130 		cpp = (struct linuxkpi_ieee80211_channel **)(hw_req + 1);
5131 		lc = (struct linuxkpi_ieee80211_channel *)(cpp + nchan);
5132 #ifdef LKPI_80211_USE_SCANLIST
5133 		for (i = 0; i < nchan; i++) {
5134 			*(cpp + i) =
5135 			    (struct linuxkpi_ieee80211_channel *)(lc + i);
5136 		}
5137 		/* Avoid net80211 scan lists until it has proper scan offload support. */
5138 		for (i = 0; i < nchan; i++) {
5139 			struct ieee80211_channel *c;
5140 
5141 			c = ss->ss_chans[ss->ss_next + i];
5142 			lc->center_freq = c->ic_freq;	/* XXX */
5143 			/* lc->flags */
5144 			lc->band = lkpi_net80211_chan_to_nl80211_band(c);
5145 			lc->max_power = c->ic_maxpower;
5146 			/* lc-> ... */
5147 			lc++;
5148 		}
5149 #else
5150 		/* Add bands in reverse order for scanning. */
5151 		n = 0;
5152 		for (band = NUM_NL80211_BANDS - 1; band >= 0; band--) {
5153 			struct ieee80211_supported_band *supband;
5154 			struct linuxkpi_ieee80211_channel *channels;
5155 
5156 			/* Band disabled for scanning? */
5157 			if ((band_mask & (1 << band)) == 0)
5158 				continue;
5159 
5160 			/* Nothing to scan in band? */
5161 			supband = hw->wiphy->bands[band];
5162 			if (supband == NULL || supband->n_channels == 0)
5163 				continue;
5164 
5165 			channels = supband->channels;
5166 			for (i = 0; i < supband->n_channels; i++) {
5167 				if (lkpi_scan_chan(&channels[i], ic, false))
5168 					*(cpp + n++) = &channels[i];
5169 			}
5170 		}
5171 		if (lkpi_order_scanlist)
5172 			lkpi_scan_chan_list_resort(cpp, nchan);
5173 
5174 		if ((linuxkpi_debug_80211 & D80211_SCAN) != 0) {
5175 			printf("%s:%d: %s SCAN Channel List (nchan=%zu): ",
5176 			    __func__, __LINE__, ic->ic_name, nchan);
5177 			for (i = 0; i < nchan; i++) {
5178 				struct linuxkpi_ieee80211_channel *xc;
5179 
5180 				xc = *(cpp + i);
5181 				printf(" %d(%d)",
5182 				    ieee80211_mhz2ieee(xc->center_freq,
5183 				        lkpi_nl80211_band_to_net80211_band(
5184 					xc->band)),
5185 				    xc->center_freq);
5186 			}
5187 			printf("\n");
5188 		}
5189 #endif
5190 
5191 		hw_req->req.n_ssids = ssid_count;
5192 		if (hw_req->req.n_ssids > 0) {
5193 			ssids = (struct cfg80211_ssid *)lc;
5194 			hw_req->req.ssids = ssids;
5195 			for (i = 0; i < ssid_count; i++) {
5196 				ssids->ssid_len = ss->ss_ssid[i].len;
5197 				memcpy(ssids->ssid, ss->ss_ssid[i].ssid,
5198 				    ss->ss_ssid[i].len);
5199 				ssids++;
5200 			}
5201 			s6gp = (struct cfg80211_scan_6ghz_params *)ssids;
5202 		} else {
5203 			s6gp = (struct cfg80211_scan_6ghz_params *)lc;
5204 		}
5205 
5206 		/* 6GHz one day. */
5207 		hw_req->req.n_6ghz_params = 0;
5208 		hw_req->req.scan_6ghz_params = NULL;
5209 		hw_req->req.scan_6ghz = false;	/* Weird boolean; not what you think. */
5210 		/* s6gp->... */
5211 
5212 		ie = ieend = (uint8_t *)s6gp;
5213 		/* Copy per-band IEs, copy common IEs */
5214 		ieend = lkpi_scan_ies_add(ie, &hw_req->ies, band_mask, vap, hw);
5215 		hw_req->req.ie = ie;
5216 		hw_req->req.ie_len = ieend - ie;
5217 		hw_req->req.scan_start = jiffies;
5218 
5219 		lvif = VAP_TO_LVIF(vap);
5220 		vif = LVIF_TO_VIF(lvif);
5221 
5222 		LKPI_80211_LHW_SCAN_LOCK(lhw);
5223 		/* Re-check under lock. */
5224 		running = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
5225 		if (!running) {
5226 			KASSERT(lhw->hw_req == NULL, ("%s: ic %p lhw %p hw_req %p "
5227 			    "!= NULL\n", __func__, ic, lhw, lhw->hw_req));
5228 
5229 			lhw->scan_flags |= LKPI_LHW_SCAN_RUNNING;
5230 			lhw->hw_req = hw_req;
5231 		}
5232 		LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5233 		if (running) {
5234 			free(hw_req, M_LKPI80211);
5235 			TRACE_SCAN(ic, "Trying to start new scan while still "
5236 			    "running (2); cancelling new net80211 scan; "
5237 			    "scan_flags %b",
5238 			    lhw->scan_flags, LKPI_LHW_SCAN_BITS);
5239 			ieee80211_cancel_scan(vap);
5240 			return;
5241 		}
5242 
5243 		wiphy_lock(hw->wiphy);
5244 		lkpi_update_mcast_filter_locked(ic);
5245 		TRACE_SCAN(ic, "Starting HW_SCAN: scan_flags %b, "
5246 		    "ie_len %d, n_ssids %d, n_chan %d, common_ie_len %d [%d, %d]",
5247 		    lhw->scan_flags, LKPI_LHW_SCAN_BITS, hw_req->req.ie_len,
5248 		    hw_req->req.n_ssids, hw_req->req.n_channels,
5249 		    hw_req->ies.common_ie_len,
5250 		    hw_req->ies.len[NL80211_BAND_2GHZ],
5251 		    hw_req->ies.len[NL80211_BAND_5GHZ]);
5252 
5253 		error = lkpi_80211_mo_hw_scan(hw, vif, hw_req);
5254 		wiphy_unlock(hw->wiphy);
5255 		if (error != 0) {
5256 			bool scan_done;
5257 			int e;
5258 
5259 			TRACE_SCAN(ic, "hw_scan failed; scan_flags %b, error %d",
5260 			    lhw->scan_flags, LKPI_LHW_SCAN_BITS, error);
5261 			ieee80211_cancel_scan(vap);
5262 
5263 			/*
5264 			 * ieee80211_scan_completed must be called in either
5265 			 * case of error or none.  So let the free happen there
5266 			 * and only there.
5267 			 * That would be fine in theory but in practice drivers
5268 			 * behave differently:
5269 			 * ath10k does not return hw_scan until after scan_complete
5270 			 *        and can then still return an error.
5271 			 * rtw88 can return 1 or -EBUSY without scan_complete
5272 			 * iwlwifi can return various errors before scan starts
5273 			 * ...
5274 			 * So we cannot rely on that behaviour and have to check
5275 			 * and balance between both code paths.
5276 			 */
5277 			e = 0;
5278 			scan_done = true;
5279 			LKPI_80211_LHW_SCAN_LOCK(lhw);
5280 			if ((lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0) {
5281 
5282 				free(lhw->hw_req, M_LKPI80211);
5283 				lhw->hw_req = NULL;
5284 				/*
5285 				 * The ieee80211_cancel_scan() above runs in a
5286 				 * taskq and it may take ages for the previous
5287 				 * scan to clear;  starting a new one right away
5288 				 * we run into the problem that the old one is
5289 				 * still active.
5290 				 */
5291 				e = msleep(lhw, &lhw->scan_mtx, 0, "lhwscanstop", hz);
5292 				scan_done = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
5293 
5294 				/*
5295 				 * Now we can clear running if no one else did.
5296 				 */
5297 				lhw->scan_flags &= ~LKPI_LHW_SCAN_RUNNING;
5298 			}
5299 			LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5300 			lkpi_update_mcast_filter(ic);
5301 			if (!scan_done) {
5302 				ic_printf(ic, "ERROR: %s: timeout/error to wait "
5303 				    "for ieee80211_cancel_scan: %d\n", __func__, e);
5304 				return;
5305 			}
5306 
5307 			/*
5308 			 * XXX-SIGH magic number.
5309 			 * rtw88 has a magic "return 1" if offloading scan is
5310 			 * not possible.  Fall back to sw scan in that case.
5311 			 */
5312 			if (error == 1) {
5313 				/*
5314 				 * We need to put this into some defered context
5315 				 * the net80211 scan may not be done yet
5316 				 * (ic_flags & IEEE80211_F_SCAN) and we cannot
5317 				 * wait here; if we do scan_curchan_task always
5318 				 * runs after our timeout to finalize the scan.
5319 				 */
5320 				ieee80211_runtask(ic, &lvif->sw_scan_task);
5321 				return;
5322 			}
5323 
5324 			ic_printf(ic, "ERROR: %s: hw_scan returned %d\n",
5325 			    __func__, error);
5326 		}
5327 	}
5328 }
5329 
5330 static void
5331 lkpi_sw_scan_task(void *arg, int pending __unused)
5332 {
5333 	struct lkpi_hw *lhw;
5334 	struct lkpi_vif *lvif;
5335 	struct ieee80211vap *vap;
5336 	struct ieee80211_scan_state *ss;
5337 
5338 	lvif = arg;
5339 	vap = LVIF_TO_VAP(lvif);
5340 	lhw = vap->iv_ic->ic_softc;
5341 	ss = vap->iv_ic->ic_scan;
5342 
5343 	LKPI_80211_LHW_SCAN_LOCK(lhw);
5344 	/*
5345 	 * We will re-enable this at scan_end calling lkpi_enable_hw_scan().
5346 	 * IEEE80211_FEXT_SCAN_OFFLOAD will be cleared by lkpi_ic_scan_start.
5347 	 */
5348 	lhw->scan_flags &= ~LKPI_LHW_SCAN_HW;
5349 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5350 
5351 	TRACE_SCAN(vap->iv_ic, "Triggering SW_SCAN: pending %d, scan_flags %b",
5352 	    pending, lhw->scan_flags, LKPI_LHW_SCAN_BITS);
5353 
5354 	/*
5355 	 * This will call ic_scan_start() and we will get into the right path
5356 	 * unless other scans started in between.
5357 	 */
5358 	ieee80211_start_scan(vap,
5359 	    IEEE80211_SCAN_ONCE,
5360 	    msecs_to_ticks(10000), /* 10000 ms (=~ 50 chan * 200 ms) */
5361 	    ss->ss_mindwell ? ss->ss_mindwell : msecs_to_ticks(20),
5362 	    ss->ss_maxdwell ? ss->ss_maxdwell : msecs_to_ticks(200),
5363 	    vap->iv_des_nssid, vap->iv_des_ssid);
5364 }
5365 
5366 static void
5367 lkpi_ic_scan_end(struct ieee80211com *ic)
5368 {
5369 	struct lkpi_hw *lhw;
5370 	bool is_hw_scan;
5371 
5372 	lhw = ic->ic_softc;
5373 	TRACE_SCAN(ic, "scan_flags %b", lhw->scan_flags, LKPI_LHW_SCAN_BITS);
5374 
5375 	LKPI_80211_LHW_SCAN_LOCK(lhw);
5376 	if ((lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) == 0) {
5377 		LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5378 		return;
5379 	}
5380 	is_hw_scan = (lhw->scan_flags & LKPI_LHW_SCAN_HW) != 0;
5381 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5382 
5383 	if (!is_hw_scan) {
5384 		struct ieee80211_scan_state *ss;
5385 		struct ieee80211vap *vap;
5386 		struct ieee80211_hw *hw;
5387 		struct lkpi_vif *lvif;
5388 		struct ieee80211_vif *vif;
5389 
5390 		ss = ic->ic_scan;
5391 		vap = ss->ss_vap;
5392 		hw = LHW_TO_HW(lhw);
5393 		lvif = VAP_TO_LVIF(vap);
5394 		vif = LVIF_TO_VIF(lvif);
5395 
5396 		lkpi_80211_mo_sw_scan_complete(hw, vif);
5397 
5398 		/* Send PS to stop buffering if n80211 does not for us? */
5399 
5400 		if (vap->iv_state == IEEE80211_S_SCAN) {
5401 			wiphy_lock(hw->wiphy);
5402 			lkpi_hw_conf_idle(hw, true);
5403 			wiphy_unlock(hw->wiphy);
5404 		}
5405 	}
5406 
5407 	/*
5408 	 * In case we disabled the hw_scan in lkpi_ic_scan_start() and
5409 	 * switched to swscan, re-enable hw_scan if available.
5410 	 */
5411 	lkpi_enable_hw_scan(lhw);
5412 
5413 	/* Clear the scanning chandef. */
5414 	memset(&lhw->scan_chandef, 0, sizeof(lhw->scan_chandef));
5415 
5416 	LKPI_80211_LHW_SCAN_LOCK(lhw);
5417 	wakeup(lhw);
5418 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5419 }
5420 
5421 static void
5422 lkpi_ic_scan_curchan(struct ieee80211_scan_state *ss,
5423     unsigned long maxdwell)
5424 {
5425 	struct lkpi_hw *lhw;
5426 	bool is_hw_scan;
5427 
5428 	lhw = ss->ss_ic->ic_softc;
5429 	TRACE_SCAN(ss->ss_ic, "scan_flags %b chan %d maxdwell %lu",
5430 	    lhw->scan_flags, LKPI_LHW_SCAN_BITS,
5431 	    ss->ss_ic->ic_curchan->ic_ieee, maxdwell);
5432 
5433 	LKPI_80211_LHW_SCAN_LOCK(lhw);
5434 	is_hw_scan = (lhw->scan_flags & LKPI_LHW_SCAN_HW) != 0;
5435 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5436 	if (!is_hw_scan)
5437 		lhw->ic_scan_curchan(ss, maxdwell);
5438 }
5439 
5440 static void
5441 lkpi_ic_scan_mindwell(struct ieee80211_scan_state *ss)
5442 {
5443 	struct lkpi_hw *lhw;
5444 	bool is_hw_scan;
5445 
5446 	lhw = ss->ss_ic->ic_softc;
5447 	TRACE_SCAN(ss->ss_ic, "scan_flags %b chan %d mindwell %lu",
5448 	    lhw->scan_flags, LKPI_LHW_SCAN_BITS,
5449 	    ss->ss_ic->ic_curchan->ic_ieee, ss->ss_mindwell);
5450 
5451 	LKPI_80211_LHW_SCAN_LOCK(lhw);
5452 	is_hw_scan = (lhw->scan_flags & LKPI_LHW_SCAN_HW) != 0;
5453 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5454 	if (!is_hw_scan)
5455 		lhw->ic_scan_mindwell(ss);
5456 }
5457 
5458 struct lkpi_ic_set_channel_iter_arg {
5459 	struct linuxkpi_ieee80211_channel *chan;
5460 	struct ieee80211_chanctx_conf *chanctx_conf;
5461 };
5462 
5463 static void
5464 lkpi_ic_set_channel_chanctx_iterf(struct ieee80211_hw *hw,
5465     struct ieee80211_chanctx_conf *chanctx_conf, void *arg)
5466 {
5467 	struct lkpi_ic_set_channel_iter_arg *chanctx_iter_arg;
5468 
5469 	chanctx_iter_arg = arg;
5470 	if (chanctx_iter_arg->chanctx_conf != NULL)
5471 		return;
5472 
5473 	if (chanctx_iter_arg->chan == chanctx_conf->def.chan)
5474 		chanctx_iter_arg->chanctx_conf = chanctx_conf;
5475 }
5476 
5477 static void
5478 lkpi_ic_set_channel(struct ieee80211com *ic)
5479 {
5480 	struct lkpi_hw *lhw;
5481 	struct ieee80211_hw *hw;
5482 	struct ieee80211_channel *c;
5483 	struct linuxkpi_ieee80211_channel *chan;
5484 	struct ieee80211_chanctx_conf *chanctx_conf;
5485 	uint32_t changed;
5486 	int error;
5487 	bool hw_scan, scan_running;
5488 
5489 	IEEE80211_UNLOCK_ASSERT(ic);
5490 
5491 	lhw = ic->ic_softc;
5492 
5493 	c = ic->ic_curchan;
5494 	if (c == NULL || c == IEEE80211_CHAN_ANYC) {
5495 		ic_printf(ic, "%s: Unset channel: c %p, ignoring update\n",
5496 		    __func__, c);
5497 		return;
5498 	}
5499 
5500 	chan = lkpi_find_lkpi80211_chan(lhw, c);
5501 	if (chan == NULL) {
5502 		ic_printf(ic, "%s: No channel found for c %p(%d) chan %p\n",
5503 		    __func__, c, c->ic_ieee, chan);
5504 		return;
5505 	}
5506 
5507 	/*
5508 	 * All net80211 callers call ieee80211_radiotap_chan_change().
5509 	 * That means we have nothing to do ourselves.
5510 	 */
5511 
5512 	/* If we have a hw_scan running do not switch channels. */
5513 	LKPI_80211_LHW_SCAN_LOCK(lhw);
5514 	scan_running = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
5515 	hw_scan = (lhw->scan_flags & LKPI_LHW_SCAN_HW) != 0;
5516 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5517 	if (scan_running && hw_scan) {
5518 		TRACE_SCAN(ic, "scan_flags %b chan %d nothing to do.",
5519 		    lhw->scan_flags, LKPI_LHW_SCAN_BITS,
5520 		    c->ic_ieee);
5521 		/* Let us hope we set tx power levels elsewhere. */
5522 		return;
5523 	}
5524 
5525 	hw = LHW_TO_HW(lhw);
5526 	wiphy_lock(hw->wiphy);
5527 	if (scan_running) {
5528 		struct ieee80211vap *vap;
5529 		struct lkpi_vif *lvif;
5530 		struct ieee80211_vif *vif;
5531 
5532 		/*
5533 		 * For now and for scanning just pick the first VIF.
5534 		 * net80211 will need to grow DBDC/link_id support
5535 		 * for us to find the vif/chanctx otherwise.
5536 		 */
5537 		vap = TAILQ_FIRST(&ic->ic_vaps);
5538 		lvif = VAP_TO_LVIF(vap);
5539 		vif = LVIF_TO_VIF(lvif);
5540 
5541 		/* We always set the chandef to no-HT for scanning. */
5542 		cfg80211_chandef_create(&lhw->scan_chandef, chan,
5543 		    NL80211_CHAN_NO_HT);
5544 #ifdef LINUXKPI_DEBUG_80211
5545 		if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
5546 			ic_printf(ic, "%s:%d: initialized lhw->scan_chandef\n",
5547 			    __func__, __LINE__);
5548 #endif
5549 
5550 		/*
5551 		 * This works for as long as we do not do BGSCANs; otherwise
5552 		 * it'll have to be offchan work.
5553 		 */
5554 		chanctx_conf = lkpi_get_chanctx_conf(hw, vif);
5555 		changed = lkpi_init_chanctx_conf(hw, &lhw->scan_chandef, chanctx_conf);
5556 		error = lkpi_set_chanctx_conf(hw, vif, chanctx_conf, changed, true);
5557 
5558 		TRACE_SCAN(ic, "scan_flags %b chan %d ???, error %d",
5559 		    lhw->scan_flags, LKPI_LHW_SCAN_BITS,
5560 		    c->ic_ieee, error);
5561 
5562 		IMPROVE("max power for scanning; TODO in lkpi_80211_update_chandef");
5563 
5564 	} else if (lhw->emulate_chanctx) {
5565 		/*
5566 		 * We do not set the channel here for normal chanctx operation.
5567 		 * That's just a setup to fail. scan_to_auth will setup all the
5568 		 * other neccessary options for this to work.
5569 		 */
5570 		struct lkpi_ic_set_channel_iter_arg chanctx_iter_arg = {
5571 			.chan		= chan,
5572 			.chanctx_conf	= NULL,
5573 		};
5574 		struct cfg80211_chan_def chandef;
5575 
5576 		lkpi_init_chandef(ic, &chandef, chan, c, false);
5577 
5578 		ieee80211_iter_chan_contexts_mtx(hw,
5579 		    lkpi_ic_set_channel_chanctx_iterf, &chanctx_iter_arg);
5580 
5581 		if (chanctx_iter_arg.chanctx_conf == NULL) {
5582 			/* No chanctx found for this channel. */
5583 			struct ieee80211vap *vap;
5584 			struct lkpi_vif *lvif;
5585 			struct ieee80211_vif *vif;
5586 
5587 			/*
5588 			 * For now just pick the first VIF.
5589 			 * net80211 will need to grow DBDC/link_id support
5590 			 * for us to find the vif/chanctx otherwise.
5591 			 */
5592 			vap = TAILQ_FIRST(&ic->ic_vaps);
5593 			lvif = VAP_TO_LVIF(vap);
5594 			vif = LVIF_TO_VIF(lvif);
5595 
5596 #ifdef LINUXKPI_DEBUG_80211
5597 			if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
5598 				ic_printf(ic, "%s:%d: using on stack chandef\n",
5599 				    __func__, __LINE__);
5600 #endif
5601 			chanctx_conf = lkpi_get_chanctx_conf(hw, vif);
5602 			changed = lkpi_init_chanctx_conf(hw, &chandef, chanctx_conf);
5603 			IMPROVE("update HT, VHT, bw, ...");
5604 			error = lkpi_set_chanctx_conf(hw, vif, chanctx_conf, changed, true);
5605 
5606 		} else {
5607 			/*
5608 			 * We know we are on the same channel.
5609 			 * Do we really have to reset everything?
5610 			 */
5611 			IMPROVE("update HT, VHT, bw, ...");
5612 
5613 #ifdef LINUXKPI_DEBUG_80211
5614 			if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
5615 				ic_printf(ic, "%s:%d: using on stack chandef\n",
5616 				    __func__, __LINE__);
5617 #endif
5618 
5619 			chanctx_conf = chanctx_iter_arg.chanctx_conf;
5620 			changed = lkpi_init_chanctx_conf(hw, &chandef, chanctx_conf);
5621 			lkpi_80211_mo_change_chanctx(hw, chanctx_conf, changed);
5622 		}
5623 	}
5624 
5625 	/* Currently PS is hard coded off! Not sure it belongs here. */
5626 	IMPROVE("PS");
5627 	if (ieee80211_hw_check(hw, SUPPORTS_PS) &&
5628 	    (hw->conf.flags & IEEE80211_CONF_PS) != 0) {
5629 		hw->conf.flags &= ~IEEE80211_CONF_PS;
5630 		error = lkpi_80211_mo_config(hw, IEEE80211_CONF_CHANGE_PS);
5631 		if (error != 0 && error != EOPNOTSUPP)
5632 			ic_printf(ic, "ERROR: %s: config %#0x returned "
5633 			    "%d\n", __func__, IEEE80211_CONF_CHANGE_PS,
5634 			    error);
5635 	}
5636 
5637 	wiphy_unlock(hw->wiphy);
5638 }
5639 
5640 static struct ieee80211_node *
5641 lkpi_ic_node_alloc(struct ieee80211vap *vap,
5642     const uint8_t mac[IEEE80211_ADDR_LEN])
5643 {
5644 	struct ieee80211com *ic;
5645 	struct lkpi_hw *lhw;
5646 	struct ieee80211_node *ni;
5647 	struct ieee80211_hw *hw;
5648 	struct lkpi_sta *lsta;
5649 
5650 	ic = vap->iv_ic;
5651 	lhw = ic->ic_softc;
5652 
5653 	/* We keep allocations de-coupled so we can deal with the two worlds. */
5654 	if (lhw->ic_node_alloc == NULL)
5655 		return (NULL);
5656 
5657 	ni = lhw->ic_node_alloc(vap, mac);
5658 	if (ni == NULL)
5659 		return (NULL);
5660 
5661 	hw = LHW_TO_HW(lhw);
5662 	lsta = lkpi_lsta_alloc(vap, mac, hw, ni);
5663 	if (lsta == NULL) {
5664 		if (lhw->ic_node_free != NULL)
5665 			lhw->ic_node_free(ni);
5666 		return (NULL);
5667 	}
5668 
5669 	return (ni);
5670 }
5671 
5672 static int
5673 lkpi_ic_node_init(struct ieee80211_node *ni)
5674 {
5675 	struct ieee80211com *ic;
5676 	struct lkpi_hw *lhw;
5677 	int error;
5678 
5679 	ic = ni->ni_ic;
5680 	lhw = ic->ic_softc;
5681 
5682 	if (lhw->ic_node_init != NULL) {
5683 		error = lhw->ic_node_init(ni);
5684 		if (error != 0)
5685 			return (error);
5686 	}
5687 
5688 	/* XXX-BZ Sync other state over. */
5689 	IMPROVE();
5690 
5691 	return (0);
5692 }
5693 
5694 static void
5695 lkpi_ic_node_cleanup(struct ieee80211_node *ni)
5696 {
5697 	struct ieee80211com *ic;
5698 	struct lkpi_hw *lhw;
5699 
5700 	ic = ni->ni_ic;
5701 	lhw = ic->ic_softc;
5702 
5703 	/* XXX-BZ remove from driver, ... */
5704 	IMPROVE();
5705 
5706 	if (lhw->ic_node_cleanup != NULL)
5707 		lhw->ic_node_cleanup(ni);
5708 }
5709 
5710 static void
5711 lkpi_ic_node_free(struct ieee80211_node *ni)
5712 {
5713 	struct ieee80211com *ic;
5714 	struct lkpi_hw *lhw;
5715 	struct lkpi_sta *lsta;
5716 
5717 	ic = ni->ni_ic;
5718 	lhw = ic->ic_softc;
5719 	lsta = ni->ni_drv_data;
5720 
5721 	/* KASSERT lsta is not NULL here. Print ni/ni__refcnt. */
5722 
5723 	/*
5724 	 * Pass in the original ni just in case of error we could check that
5725 	 * it is the same as lsta->ni.
5726 	 */
5727 	lkpi_lsta_free(lsta, ni);
5728 
5729 	if (lhw->ic_node_free != NULL)
5730 		lhw->ic_node_free(ni);
5731 }
5732 
5733 /*
5734  * lkpi_xmit() called from both the (*ic_raw_xmit) as well as the (*ic_transmit)
5735  * call path.
5736  * Unfortunately they have slightly different invariants.  See
5737  * ieee80211_raw_output() and ieee80211_parent_xmitpkt().
5738  * Both take care of the ni reference in case of error, and otherwise during
5739  * the callback after transmit.
5740  * The difference is that in case of error (*ic_raw_xmit) needs us to release
5741  * the mbuf, while (*ic_transmit) will free the mbuf itself.
5742  */
5743 static int
5744 lkpi_xmit(struct ieee80211_node *ni, struct mbuf *m,
5745     const struct ieee80211_bpf_params *params __unused,
5746     bool freem)
5747 {
5748 	struct lkpi_sta *lsta;
5749 	int error;
5750 
5751 	lsta = ni->ni_drv_data;
5752 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
5753 #if 0
5754 	if (!lsta->added_to_drv || !lsta->txq_ready) {
5755 #else
5756 	/*
5757 	 * Backout this part of 886653492945f which breaks rtw88 or
5758 	 * in general drivers without (*sta_state)() but only the
5759 	 * legacy fallback to (*sta_add)().
5760 	 */
5761 	if (!lsta->txq_ready) {
5762 #endif
5763 		LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
5764 		if (freem)
5765 			m_freem(m);
5766 		return (ENETDOWN);
5767 	}
5768 
5769 	/* Queue the packet and enqueue the task to handle it. */
5770 	error = mbufq_enqueue(&lsta->txq, m);
5771 	if (error != 0) {
5772 		LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
5773 		if (freem)
5774 			m_freem(m);
5775 #ifdef LINUXKPI_DEBUG_80211
5776 		if (linuxkpi_debug_80211 & D80211_TRACE_TX)
5777 			ic_printf(ni->ni_ic, "%s: mbufq_enqueue failed: %d\n",
5778 			    __func__, error);
5779 #endif
5780 		return (ENETDOWN);
5781 	}
5782 	taskqueue_enqueue(taskqueue_thread, &lsta->txq_task);
5783 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
5784 
5785 #ifdef LINUXKPI_DEBUG_80211
5786 	if (linuxkpi_debug_80211 & D80211_TRACE_TX)
5787 		printf("%s:%d lsta %p ni %p %6D mbuf_qlen %d\n",
5788 		    __func__, __LINE__, lsta, ni, ni->ni_macaddr, ":",
5789 		    mbufq_len(&lsta->txq));
5790 #endif
5791 
5792 	return (0);
5793 }
5794 
5795 static int
5796 lkpi_ic_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
5797         const struct ieee80211_bpf_params *params __unused)
5798 {
5799 	return (lkpi_xmit(ni, m, NULL, true));
5800 }
5801 
5802 #ifdef LKPI_80211_HW_CRYPTO
5803 /*
5804  * This is a bit of a hack given we know we are operating on a
5805  * single frame and we know that hardware will deal with it.
5806  * But otherwise the enmic bit and the encrypt bit need to be
5807  * decoupled.
5808  */
5809 static int
5810 lkpi_hw_crypto_prepare_tkip(struct ieee80211_key *k,
5811     struct ieee80211_key_conf *kc, struct sk_buff *skb)
5812 {
5813 	struct ieee80211_hdr *hdr;
5814 	uint32_t hlen, hdrlen;
5815 	uint8_t *p;
5816 
5817 	/*
5818 	 * TKIP only happens on data.
5819 	 */
5820 	hdr = (void *)skb->data;
5821 	if (!ieee80211_is_data_present(hdr->frame_control))
5822 		return (0);
5823 
5824 	/*
5825 	 * "enmic" (though we do not do that).
5826 	 */
5827 	/* any conditions to not apply this? */
5828 	if (skb_tailroom(skb) < ieee80211_crypto_get_key_txmic_len(k))
5829 		return (ENOBUFS);
5830 
5831 	p = skb_put(skb, ieee80211_crypto_get_key_txmic_len(k));
5832 	if ((kc->flags & IEEE80211_KEY_FLAG_PUT_MIC_SPACE) != 0)
5833 		goto encrypt;
5834 
5835 	/*
5836 	 * (*enmic) which we hopefully do not have to do with hw accel.
5837 	 * That means if we make it here we have a problem.
5838 	 */
5839 	TODO("(*enmic)");
5840 	return (ENXIO);
5841 
5842 encrypt:
5843 	/*
5844 	 * "encrypt" (though we do not do that).
5845 	 */
5846 	/*
5847 	 * Check if we have anything to do as requested by driver
5848 	 * or if we are done?
5849 	 */
5850 	if ((kc->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) == 0 &&
5851 	    (kc->flags & IEEE80211_KEY_FLAG_GENERATE_IV) == 0)
5852 			return (0);
5853 
5854 	hlen = k->wk_cipher->ic_header;
5855 	if (skb_headroom(skb) < hlen)
5856 		return (ENOBUFS);
5857 
5858 	hdr = (void *)skb->data;
5859 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
5860 	p = skb_push(skb, hlen);
5861 	memmove(p, p + hlen, hdrlen);
5862 
5863 	/* If driver request space only we are done. */
5864 	if ((kc->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) != 0)
5865 		return (0);
5866 
5867 	p += hdrlen;
5868 	k->wk_cipher->ic_setiv(k, p);
5869 
5870 	/* If we make it hear we do sw encryption. */
5871 	TODO("sw encrypt");
5872 	return (ENXIO);
5873 }
5874 
5875 static int
5876 lkpi_hw_crypto_prepare_ccmp(struct ieee80211_key *k,
5877     struct ieee80211_key_conf *kc, struct sk_buff *skb)
5878 {
5879 	struct ieee80211_hdr *hdr;
5880 	uint32_t hlen, hdrlen;
5881 	uint8_t *p;
5882 
5883 	hdr = (void *)skb->data;
5884 
5885 	/*
5886 	 * Check if we have anythig to do as requested by driver
5887 	 * or if we are done?
5888 	 */
5889 	if ((kc->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) == 0 &&
5890 	    (kc->flags & IEEE80211_KEY_FLAG_GENERATE_IV) == 0 &&
5891 	    /* MFP */
5892 	    !((kc->flags & IEEE80211_KEY_FLAG_GENERATE_IV_MGMT) != 0 &&
5893 		ieee80211_is_mgmt(hdr->frame_control)))
5894 			return (0);
5895 
5896 	hlen = k->wk_cipher->ic_header;
5897 	if (skb_headroom(skb) < hlen)
5898 		return (ENOBUFS);
5899 
5900 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
5901 	p = skb_push(skb, hlen);
5902 	memmove(p, p + hlen, hdrlen);
5903 
5904 	/* If driver request space only we are done. */
5905 	if ((kc->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) != 0)
5906 		return (0);
5907 
5908 	p += hdrlen;
5909 	k->wk_cipher->ic_setiv(k, p);
5910 
5911 	return (0);
5912 }
5913 
5914 static int
5915 lkpi_hw_crypto_prepare(struct lkpi_sta *lsta, struct ieee80211_key *k,
5916     struct sk_buff *skb)
5917 {
5918 	struct ieee80211_tx_info *info;
5919 	struct ieee80211_key_conf *kc;
5920 
5921 	KASSERT(lsta != NULL, ("%s: lsta is NULL", __func__));
5922 	KASSERT(k != NULL, ("%s: key is NULL", __func__));
5923 	KASSERT(skb != NULL, ("%s: skb is NULL", __func__));
5924 
5925 	kc = lsta->kc[k->wk_keyix];
5926 
5927 	info = IEEE80211_SKB_CB(skb);
5928 	info->control.hw_key = kc;
5929 
5930 	/* MUST NOT happen. KASSERT? */
5931 	if (kc == NULL) {
5932 		ic_printf(lsta->ni->ni_ic, "%s: lsta %p k %p skb %p, "
5933 		    "kc is NULL on hw crypto offload\n", __func__, lsta, k, skb);
5934 		return (ENXIO);
5935 	}
5936 
5937 	switch (kc->cipher) {
5938 	case WLAN_CIPHER_SUITE_TKIP:
5939 		return (lkpi_hw_crypto_prepare_tkip(k, kc, skb));
5940 	case WLAN_CIPHER_SUITE_CCMP:
5941 		return (lkpi_hw_crypto_prepare_ccmp(k, kc, skb));
5942 	case WLAN_CIPHER_SUITE_GCMP:
5943 		return (lkpi_hw_crypto_prepare_ccmp(k, kc, skb));
5944 	case WLAN_CIPHER_SUITE_WEP40:
5945 	case WLAN_CIPHER_SUITE_WEP104:
5946 	case WLAN_CIPHER_SUITE_CCMP_256:
5947 	case WLAN_CIPHER_SUITE_GCMP_256:
5948 	case WLAN_CIPHER_SUITE_AES_CMAC:
5949 	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
5950 	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
5951 	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
5952 	default:
5953 		ic_printf(lsta->ni->ni_ic, "%s: lsta %p k %p kc %p skb %p, "
5954 		    "unsupported cipher suite %u (%s)\n", __func__, lsta, k, kc,
5955 		    skb, kc->cipher, lkpi_cipher_suite_to_name(kc->cipher));
5956 		return (EOPNOTSUPP);
5957 	}
5958 }
5959 
5960 static uint8_t
5961 lkpi_hw_crypto_tailroom(struct lkpi_sta *lsta, struct ieee80211_key *k)
5962 {
5963 	struct ieee80211_key_conf *kc;
5964 
5965 	kc = lsta->kc[k->wk_keyix];
5966 	if (kc == NULL)
5967 		return (0);
5968 
5969 	IMPROVE("which other flags need tailroom?");
5970 	if (kc->flags & (IEEE80211_KEY_FLAG_PUT_MIC_SPACE))
5971 		return (32);	/* Large enough to hold everything and pow2. */
5972 
5973 	return (0);
5974 }
5975 #endif
5976 
5977 static void
5978 lkpi_80211_txq_tx_one(struct lkpi_sta *lsta, struct mbuf *m)
5979 {
5980 	struct ieee80211_node *ni;
5981 	struct ieee80211_frame *wh;
5982 	struct ieee80211_key *k;
5983 	struct sk_buff *skb;
5984 	struct ieee80211com *ic;
5985 	struct lkpi_hw *lhw;
5986 	struct ieee80211_hw *hw;
5987 	struct lkpi_vif *lvif;
5988 	struct ieee80211_vif *vif;
5989 	struct ieee80211_channel *c;
5990 	struct ieee80211_tx_control control;
5991 	struct ieee80211_tx_info *info;
5992 	struct ieee80211_sta *sta;
5993 	struct ieee80211_hdr *hdr;
5994 	struct lkpi_txq *ltxq;
5995 	void *buf;
5996 	ieee80211_keyix keyix;
5997 	uint8_t ac, tid, tailroom;
5998 
5999 	M_ASSERTPKTHDR(m);
6000 #ifdef LINUXKPI_DEBUG_80211
6001 	if (linuxkpi_debug_80211 & D80211_TRACE_TX_DUMP)
6002 		hexdump(mtod(m, const void *), m->m_len, "RAW TX (plain) ", 0);
6003 #endif
6004 
6005 	ni = lsta->ni;
6006 	ieee80211_output_seqno_assign(ni, -1, m);
6007 
6008 	k = NULL;
6009 	keyix = IEEE80211_KEYIX_NONE;
6010 	wh = mtod(m, struct ieee80211_frame *);
6011 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
6012 
6013 #ifdef LKPI_80211_HW_CRYPTO
6014 		if (lkpi_hwcrypto) {
6015 			k = ieee80211_crypto_get_txkey(ni, m);
6016 			if (k != NULL && lsta->kc[k->wk_keyix] != NULL)
6017 				keyix = k->wk_keyix;
6018 		}
6019 #endif
6020 
6021 		/* Encrypt the frame if need be. */
6022 		if (keyix == IEEE80211_KEYIX_NONE) {
6023 			/* Retrieve key for TX && do software encryption. */
6024 			k = ieee80211_crypto_encap(ni, m);
6025 			if (k == NULL) {
6026 				ieee80211_free_node(ni);
6027 				m_freem(m);
6028 				return;
6029 			}
6030 		}
6031 	}
6032 
6033 	ic = ni->ni_ic;
6034 	lhw = ic->ic_softc;
6035 	hw = LHW_TO_HW(lhw);
6036 	c = ni->ni_chan;
6037 
6038 	if (ieee80211_radiotap_active_vap(ni->ni_vap)) {
6039 		struct lkpi_radiotap_tx_hdr *rtap;
6040 
6041 		rtap = &lhw->rtap_tx;
6042 		rtap->wt_flags = 0;
6043 		if (k != NULL)
6044 			rtap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
6045 		if (m->m_flags & M_FRAG)
6046 			rtap->wt_flags |= IEEE80211_RADIOTAP_F_FRAG;
6047 		IMPROVE();
6048 		rtap->wt_rate = 0;
6049 		if (c != NULL && c != IEEE80211_CHAN_ANYC) {
6050 			rtap->wt_chan_freq = htole16(c->ic_freq);
6051 			rtap->wt_chan_flags = htole16(c->ic_flags);
6052 		}
6053 
6054 		ieee80211_radiotap_tx(ni->ni_vap, m);
6055 	}
6056 
6057 #ifdef LKPI_80211_HW_CRYPTO
6058 	if (lkpi_hwcrypto && keyix != IEEE80211_KEYIX_NONE)
6059 		tailroom = lkpi_hw_crypto_tailroom(lsta, k);
6060 	else
6061 #endif
6062 		tailroom = 0;
6063 
6064 	/*
6065 	 * net80211 should handle hw->extra_tx_headroom.
6066 	 * Though for as long as we are copying we don't mind.
6067 	 * XXX-BZ rtw88 asks for too much headroom for ipv6+tcp:
6068 	 * https://lists.freebsd.org/archives/freebsd-transport/2022-February/000012.html
6069 	 */
6070 	skb = dev_alloc_skb(hw->extra_tx_headroom + tailroom + m->m_pkthdr.len);
6071 	if (skb == NULL) {
6072 		static uint8_t skb_alloc_failures = 0;
6073 
6074 		if (skb_alloc_failures++ == 0) {
6075 			int tid;
6076 
6077 			sta = LSTA_TO_STA(lsta);
6078 			ic_printf(ic, "ERROR %s: skb alloc failed %d + %d, lsta %p sta %p ni %p\n",
6079 			    __func__, hw->extra_tx_headroom, m->m_pkthdr.len, lsta, sta, ni);
6080 			for (tid = 0; tid < nitems(sta->txq); tid++) {
6081 				if (sta->txq[tid] == NULL)
6082 					continue;
6083 				ltxq = TXQ_TO_LTXQ(sta->txq[tid]);
6084 				ic_printf(ic, "  tid %d ltxq %p flags %b skb_queue_len %u\n",
6085 				    tid, ltxq, ltxq->flags, LKPI_TXQ_FLAGS_BITS, skb_queue_len(&ltxq->skbq));
6086 			}
6087 		}
6088 		ieee80211_free_node(ni);
6089 		m_freem(m);
6090 		return;
6091 	}
6092 	skb_reserve(skb, hw->extra_tx_headroom);
6093 
6094 	/* XXX-BZ we need a SKB version understanding mbuf. */
6095 	/* Save the mbuf for ieee80211_tx_complete(). */
6096 	skb->m_free_func = lkpi_ieee80211_free_skb_mbuf;
6097 	skb->m = m;
6098 #if 0
6099 	skb_put_data(skb, m->m_data, m->m_pkthdr.len);
6100 #else
6101 	buf = skb_put(skb, m->m_pkthdr.len);
6102 	m_copydata(m, 0, m->m_pkthdr.len, buf);
6103 #endif
6104 	/* Save the ni. */
6105 	m->m_pkthdr.PH_loc.ptr = ni;
6106 
6107 	lvif = VAP_TO_LVIF(ni->ni_vap);
6108 	vif = LVIF_TO_VIF(lvif);
6109 
6110 	hdr = (void *)skb->data;
6111 	tid = linuxkpi_ieee80211_get_tid(hdr, true);
6112 	if (tid == IEEE80211_NONQOS_TID) { /* == IEEE80211_NUM_TIDS */
6113 		if (!ieee80211_is_data(hdr->frame_control)) {
6114 			/* MGMT and CTRL frames go on TID 7/VO. */
6115 			skb->priority = 7;
6116 			ac = IEEE80211_AC_VO;
6117 		} else {
6118 			/* Other non-QOS traffic goes to BE. */
6119 			/* Contrary to net80211 we MUST NOT promote M_EAPOL. */
6120 			skb->priority = 0;
6121 			ac = IEEE80211_AC_BE;
6122 		}
6123 	} else {
6124 		skb->priority = tid & IEEE80211_QOS_CTL_TID_MASK;
6125 		ac = ieee80211e_up_to_ac[tid & 7];
6126 	}
6127 	skb_set_queue_mapping(skb, ac);
6128 
6129 	info = IEEE80211_SKB_CB(skb);
6130 	info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
6131 	/* Slight delay; probably only happens on scanning so fine? */
6132 	if (c == NULL || c == IEEE80211_CHAN_ANYC)
6133 		c = ic->ic_curchan;
6134 	info->band = lkpi_net80211_chan_to_nl80211_band(c);
6135 	info->hw_queue = vif->hw_queue[ac];
6136 	if ((m->m_flags & M_EAPOL) != 0) {
6137 		info->control.flags |= IEEE80211_TX_CTRL_PORT_CTRL_PROTO;
6138 		info->flags |= IEEE80211_TX_CTL_USE_MINRATE;	/* mt76 */
6139 		TRACE_RATES("M_EAPOL -> TX_CTL_USE_MINRATE");
6140 	}
6141 	info->control.vif = vif;
6142 
6143 	/* IMPROVE("MLO"); */
6144 	info->control.flags |=
6145 	    u32_encode_bits(IEEE80211_LINK_UNSPECIFIED, IEEE80211_TX_CTRL_MLO_LINK);
6146 
6147 	if (tid != IEEE80211_NONQOS_TID) {
6148 		struct ieee80211_tx_ampdu *tap;
6149 
6150 		tap = &ni->ni_tx_ampdu[tid];
6151 		if (ieee80211_is_data_qos(hdr->frame_control) &&
6152 		    !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
6153 		    !is_multicast_ether_addr(hdr->addr1) &&
6154 		    IEEE80211_AMPDU_RUNNING(tap))
6155 			info->flags |= IEEE80211_TX_CTL_AMPDU;
6156 	}
6157 
6158 	/* XXX-BZ info->control.rates for non-HW rate control and injected packets. */
6159 #ifdef __notyet__
6160 #ifdef LKPI_80211_HT
6161 	info->control.rts_cts_rate_idx=
6162 	info->control.use_rts= /* RTS */
6163 	info->control.use_cts_prot= /* RTS/CTS*/
6164 #endif
6165 #endif
6166 
6167 	sta = LSTA_TO_STA(lsta);
6168 #ifdef LKPI_80211_HW_CRYPTO
6169 	if (lkpi_hwcrypto && keyix != IEEE80211_KEYIX_NONE) {
6170 		int error;
6171 
6172 		error = lkpi_hw_crypto_prepare(lsta, k, skb);
6173 		if (error != 0) {
6174 			/*
6175 			 * We only have to free the skb which will free the
6176 			 * mbuf and release the reference on the ni.
6177 			 */
6178 			dev_kfree_skb(skb);
6179 			return;
6180 		}
6181 		/* Reset header as data might have moved. */
6182 		hdr = (void *)skb->data;
6183 	}
6184 #endif
6185 
6186 	IMPROVE();
6187 
6188 	ltxq = NULL;
6189 	if (!ieee80211_is_data_present(hdr->frame_control)) {
6190 		if (vif->type == NL80211_IFTYPE_STATION &&
6191 		    lsta->added_to_drv &&
6192 		    sta->txq[IEEE80211_NUM_TIDS] != NULL)
6193 			ltxq = TXQ_TO_LTXQ(sta->txq[IEEE80211_NUM_TIDS]);
6194 	} else if (lsta->added_to_drv &&
6195 	    sta->txq[skb->priority] != NULL) {
6196 		ltxq = TXQ_TO_LTXQ(sta->txq[skb->priority]);
6197 	}
6198 	if (ltxq == NULL)
6199 		goto ops_tx;
6200 
6201 	KASSERT(ltxq != NULL, ("%s: lsta %p sta %p m %p skb %p "
6202 	    "ltxq %p != NULL\n", __func__, lsta, sta, m, skb, ltxq));
6203 
6204 	LKPI_80211_LTXQ_LOCK(ltxq);
6205 	skb_queue_tail(&ltxq->skbq, skb);
6206 	ltxq->frms_enqueued++;
6207 #ifdef LINUXKPI_DEBUG_80211
6208 	if (linuxkpi_debug_80211 & D80211_TRACE_TX)
6209 		printf("%s:%d mo_wake_tx_queue :: %d %lu lsta %p sta %p "
6210 		    "ni %p %6D skb %p lxtq %p { qlen %u, ac %d tid %u } "
6211 		    "WAKE_TX_Q ac %d prio %u qmap %u\n",
6212 		    __func__, __LINE__,
6213 		    curthread->td_tid, jiffies,
6214 		    lsta, sta, ni, ni->ni_macaddr, ":", skb, ltxq,
6215 		    skb_queue_len(&ltxq->skbq), ltxq->txq.ac,
6216 		    ltxq->txq.tid, ac, skb->priority, skb->qmap);
6217 #endif
6218 	LKPI_80211_LTXQ_UNLOCK(ltxq);
6219 	wiphy_lock(hw->wiphy);
6220 	lkpi_80211_mo_wake_tx_queue(hw, &ltxq->txq, true);
6221 	wiphy_unlock(hw->wiphy);
6222 	return;
6223 
6224 ops_tx:
6225 #ifdef LINUXKPI_DEBUG_80211
6226 	if (linuxkpi_debug_80211 & D80211_TRACE_TX)
6227 		printf("%s:%d mo_tx :: lsta %p { added_to_drv %d } sta %p "
6228 		    "ni %p %6D skb %p TX ac %d prio %u qmap %u\n",
6229 		    __func__, __LINE__, lsta, lsta->added_to_drv, sta,
6230 		    ni, ni->ni_macaddr, ":", skb, ac, skb->priority, skb->qmap);
6231 #endif
6232 	memset(&control, 0, sizeof(control));
6233 	if (lsta->added_to_drv)
6234 		control.sta = sta;
6235 	wiphy_lock(hw->wiphy);
6236 	lkpi_80211_mo_tx(hw, &control, skb);
6237 	lsta->frms_tx++;
6238 	wiphy_unlock(hw->wiphy);
6239 }
6240 
6241 static void
6242 lkpi_80211_txq_task(void *ctx, int pending)
6243 {
6244 	struct lkpi_sta *lsta;
6245 	struct mbufq mq;
6246 	struct mbuf *m;
6247 	bool shall_tx;
6248 
6249 	lsta = ctx;
6250 
6251 #ifdef LINUXKPI_DEBUG_80211
6252 	if (linuxkpi_debug_80211 & D80211_TRACE_TX)
6253 		printf("%s:%d lsta %p ni %p %6D pending %d mbuf_qlen %d\n",
6254 		    __func__, __LINE__, lsta, lsta->ni, lsta->ni->ni_macaddr, ":",
6255 		    pending, mbufq_len(&lsta->txq));
6256 #endif
6257 
6258 	mbufq_init(&mq, IFQ_MAXLEN);
6259 
6260 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
6261 	/*
6262 	 * Do not re-check lsta->txq_ready here; we may have a pending
6263 	 * disassoc/deauth frame still.  On the contrary if txq_ready is
6264 	 * false we do not have a valid sta anymore in the firmware so no
6265 	 * point to try to TX.
6266 	 * We also use txq_ready as a semaphore and will drain the txq manually
6267 	 * if needed on our way towards SCAN/INIT in the state machine.
6268 	 */
6269 #if 0
6270 	shall_tx = lsta->added_to_drv && lsta->txq_ready;
6271 #else
6272 	/*
6273 	 * Backout this part of 886653492945f which breaks rtw88 or
6274 	 * in general drivers without (*sta_state)() but only the
6275 	 * legacy fallback to (*sta_add)().
6276 	 */
6277 	shall_tx = lsta->txq_ready;
6278 #endif
6279 	if (__predict_true(shall_tx))
6280 		mbufq_concat(&mq, &lsta->txq);
6281 	/*
6282 	 * else a state change will push the packets out manually or
6283 	 * lkpi_lsta_free() will drain the lsta->txq and free the mbufs.
6284 	 */
6285 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
6286 
6287 	m = mbufq_dequeue(&mq);
6288 	while (m != NULL) {
6289 		lkpi_80211_txq_tx_one(lsta, m);
6290 		m = mbufq_dequeue(&mq);
6291 	}
6292 }
6293 
6294 static int
6295 lkpi_ic_transmit(struct ieee80211com *ic, struct mbuf *m)
6296 {
6297 
6298 	/* XXX TODO */
6299 	IMPROVE();
6300 
6301 	/* Quick and dirty cheating hack. */
6302 	struct ieee80211_node *ni;
6303 
6304 	ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
6305 	return (lkpi_xmit(ni, m, NULL, false));
6306 }
6307 
6308 #ifdef LKPI_80211_HT
6309 static int
6310 lkpi_ic_recv_action(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
6311     const uint8_t *frm, const uint8_t *efrm)
6312 {
6313 	struct ieee80211com *ic;
6314 	struct lkpi_hw *lhw;
6315 
6316 	ic = ni->ni_ic;
6317 	lhw = ic->ic_softc;
6318 
6319 	TRACEOK("recv_action called");
6320 
6321 	return (lhw->ic_recv_action(ni, wh, frm, efrm));
6322 }
6323 
6324 static int
6325 lkpi_ic_send_action(struct ieee80211_node *ni, int category, int action, void *sa)
6326 {
6327 	struct ieee80211com *ic;
6328 	struct lkpi_hw *lhw;
6329 
6330 	ic = ni->ni_ic;
6331 	lhw = ic->ic_softc;
6332 
6333 	TRACEOK("send_action with action %d called", action);
6334 
6335 	return (lhw->ic_send_action(ni, category, action, sa));
6336 }
6337 
6338 
6339 static int
6340 lkpi_ic_ampdu_enable(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
6341 {
6342 	struct ieee80211com *ic;
6343 	struct lkpi_hw *lhw;
6344 
6345 	ic = ni->ni_ic;
6346 	lhw = ic->ic_softc;
6347 
6348 	TRACEOK("ieee80211_ampdu_enable called");
6349 
6350 	return (lhw->ic_ampdu_enable(ni, tap));
6351 }
6352 
6353 /*
6354  * (*ic_addba_request)() is called by ieee80211_ampdu_request() before
6355  * calling send_action(CAT_BA, BA_ADDBA_REQUEST).
6356  *
6357  * NB: returns 0 on ERROR!
6358  */
6359 static int
6360 lkpi_ic_addba_request(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap,
6361     int dialogtoken, int baparamset, int batimeout)
6362 {
6363 	struct ieee80211com *ic;
6364 	struct lkpi_hw *lhw;
6365 	struct ieee80211_hw *hw;
6366 	struct ieee80211vap *vap;
6367 	struct lkpi_vif *lvif;
6368 	struct ieee80211_vif *vif;
6369 	struct lkpi_sta *lsta;
6370 	struct ieee80211_sta *sta;
6371 	struct ieee80211_ampdu_params params = { };
6372 	int error;
6373 
6374 	ic = ni->ni_ic;
6375 	lhw = ic->ic_softc;
6376 	hw = LHW_TO_HW(lhw);
6377 	vap = ni->ni_vap;
6378 	lvif = VAP_TO_LVIF(vap);
6379 	vif = LVIF_TO_VIF(lvif);
6380 	lsta = ni->ni_drv_data;
6381 	sta = LSTA_TO_STA(lsta);
6382 
6383 	TRACEOK("ADDBA REQ tid %u", tap->txa_tid);
6384 
6385 	if (!lsta->added_to_drv) {
6386 		ic_printf(ic, "%s: lsta %p ni %p, sta %p not added to firmware\n",
6387 		    __func__, lsta, ni, sta);
6388 		return (0);
6389 	}
6390 
6391 	params.sta = sta;
6392 	params.action = IEEE80211_AMPDU_TX_START;
6393 	/* Keep 0 here! */
6394 	params.buf_size = 0;
6395 	params.timeout = 0;
6396 	params.ssn = tap->txa_start & (IEEE80211_SEQ_RANGE-1);
6397 	params.tid = tap->txa_tid;
6398 	params.amsdu = false;
6399 
6400 	/* We get called from if_transmit all the way up unlocked in net80211. */
6401 	IEEE80211_UNLOCK_ASSERT(ic);
6402 	wiphy_lock(hw->wiphy);
6403 	error = lkpi_80211_mo_ampdu_action(hw, vif, &params);
6404 	wiphy_unlock(hw->wiphy);
6405 	if (error == IEEE80211_AMPDU_TX_START_IMMEDIATE) {
6406 		ic_printf(ic, "%s: mo_ampdu_action returned AMPDU_TX_START_IMMEDIATE. "
6407 		    "ni %p tap %p\n", __func__, ni, tap);
6408 	} else if (error != 0) {
6409 		ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p tap %p\n",
6410 		    __func__, error, ni, tap);
6411 		return (0);
6412 	}
6413 
6414 	if (sta->txq[tap->txa_tid] != NULL) {
6415 		struct lkpi_txq *ltxq;
6416 
6417 		ltxq = TXQ_TO_LTXQ(sta->txq[tap->txa_tid]);
6418 		TRACEOK("ADDBA REQ ltxq tid %u flags %b qlen %d", tap->txa_tid,
6419 		    ltxq->flags, LKPI_TXQ_FLAGS_BITS, skb_queue_len(&ltxq->skbq));
6420 		ltxq->flags |= LKPI_TXQ_STOPPED_BA;
6421 	}
6422 
6423 	return (lhw->ic_addba_request(ni, tap, dialogtoken, baparamset, batimeout));
6424 }
6425 
6426 /*
6427  * (*ic_addba_response)() is called from ht_recv_action_ba_addba_response()
6428  * and calls the default ieee80211_addba_response() which always returns 1.
6429  *
6430  * NB: No error checking in net80211!
6431  * Staying with 0 is an error.
6432  */
6433 static int
6434 lkpi_ic_addba_response(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap,
6435     int status, int baparamset, int batimeout)
6436 {
6437 	struct ieee80211com *ic;
6438 	struct lkpi_hw *lhw;
6439 	struct ieee80211_hw *hw;
6440 	struct ieee80211vap *vap;
6441 	struct lkpi_vif *lvif;
6442 	struct ieee80211_vif *vif;
6443 	struct lkpi_sta *lsta;
6444 	struct ieee80211_sta *sta;
6445 	struct ieee80211_ampdu_params params = { };
6446 	int error;
6447 
6448 	ic = ni->ni_ic;
6449 	lhw = ic->ic_softc;
6450 	hw = LHW_TO_HW(lhw);
6451 	vap = ni->ni_vap;
6452 	lvif = VAP_TO_LVIF(vap);
6453 	vif = LVIF_TO_VIF(lvif);
6454 	lsta = ni->ni_drv_data;
6455 	sta = LSTA_TO_STA(lsta);
6456 
6457 	TRACEOK("ADDBA RESP status %d (0 == SUCCESS) tid %u", status, tap->txa_tid);
6458 
6459 	if (!lsta->added_to_drv) {
6460 		ic_printf(ic, "%s: lsta %p ni %p, sta %p not added to firmware\n",
6461 		    __func__, lsta, ni, sta);
6462 		return (0);
6463 	}
6464 
6465 	if (status == IEEE80211_STATUS_SUCCESS) {
6466 		params.sta = sta;
6467 		params.action = IEEE80211_AMPDU_TX_OPERATIONAL;
6468 		params.buf_size = tap->txa_wnd;
6469 		params.timeout = 0;
6470 		params.ssn = 0;
6471 		params.tid = tap->txa_tid;
6472 		if ((tap->txa_flags & IEEE80211_AGGR_AMSDU) != 0)
6473 			params.amsdu = true;
6474 		else
6475 			params.amsdu = false;
6476 	} else {
6477 		/* We need to free the allocated resources. */
6478 		params.sta = sta;
6479 		switch (status) {
6480 			/* params.action = FLUSH, FLUSH_CONT */
6481 		default:
6482 			params.action = IEEE80211_AMPDU_TX_STOP_CONT;
6483 			break;
6484 		}
6485 		params.buf_size = 0;
6486 		params.timeout = 0;
6487 		params.ssn = 0;
6488 		params.tid = tap->txa_tid;
6489 		params.amsdu = false;
6490 	}
6491 
6492 	/* We are called all they way up from ieee80211_input* without lock. */
6493 	wiphy_lock(hw->wiphy);
6494 	error = lkpi_80211_mo_ampdu_action(hw, vif, &params);
6495 	wiphy_unlock(hw->wiphy);
6496 	if (error != 0) {
6497 		ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p tap %p\n",
6498 		    __func__, error, ni, tap);
6499 		return (0);
6500 	}
6501 
6502 	if (sta->txq[tap->txa_tid] != NULL) {
6503 		struct lkpi_txq *ltxq;
6504 
6505 		ltxq = TXQ_TO_LTXQ(sta->txq[tap->txa_tid]);
6506 		TRACEOK("ADDBA RESP ltxq tid %u flags %b qlen %d", tap->txa_tid,
6507 		    ltxq->flags, LKPI_TXQ_FLAGS_BITS, skb_queue_len(&ltxq->skbq));
6508 		ltxq->flags &= ~LKPI_TXQ_STOPPED_BA;
6509 
6510 		lkpi_80211_mo_wake_tx_queue(hw, sta->txq[tap->txa_tid], true);
6511 	}
6512 
6513 	IMPROVE_HT("who unleashes the TXQ? and when?, do we need to ni->ni_txseqs[tid] = tap->txa_start & 0xfff;");
6514 
6515 	return (lhw->ic_addba_response(ni, tap, status, baparamset, batimeout));
6516 }
6517 
6518 /*
6519  * (*ic_addba_stop)() is called from ampdu_tx_stop(), ht_recv_action_ba_delba(),
6520  * and ieee80211_ampdu_stop() and calls the default ieee80211_addba_stop().
6521  */
6522 static void
6523 lkpi_ic_addba_stop(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
6524 {
6525 	struct ieee80211com *ic;
6526 	struct lkpi_hw *lhw;
6527 	struct ieee80211_hw *hw;
6528 	struct ieee80211vap *vap;
6529 	struct lkpi_vif *lvif;
6530 	struct ieee80211_vif *vif;
6531 	struct lkpi_sta *lsta;
6532 	struct ieee80211_sta *sta;
6533 	struct ieee80211_ampdu_params params = { };
6534 	int error;
6535 
6536 	ic = ni->ni_ic;
6537 	lhw = ic->ic_softc;
6538 	hw = LHW_TO_HW(lhw);
6539 	vap = ni->ni_vap;
6540 	lvif = VAP_TO_LVIF(vap);
6541 	vif = LVIF_TO_VIF(lvif);
6542 	lsta = ni->ni_drv_data;
6543 	sta = LSTA_TO_STA(lsta);
6544 
6545 	if (!lsta->added_to_drv) {
6546 		ic_printf(ic, "%s: lsta %p ni %p, sta %p not added to firmware\n",
6547 		    __func__, lsta, ni, sta);
6548 		goto n80211;
6549 	}
6550 
6551 	/* We need to free the allocated resources. */
6552 	params.sta = sta;
6553 	IMPROVE("net80211 does not provide a reason to us");
6554 	params.action = IEEE80211_AMPDU_TX_STOP_CONT; /* params.action = FLUSH, FLUSH_CONT */
6555 	params.buf_size = 0;
6556 	params.timeout = 0;
6557 	params.ssn = 0;
6558 	params.tid = tap->txa_tid;
6559 	params.amsdu = false;
6560 
6561 	IEEE80211_UNLOCK(ic);
6562 	wiphy_lock(hw->wiphy);
6563 	error = lkpi_80211_mo_ampdu_action(hw, vif, &params);
6564 	wiphy_unlock(hw->wiphy);
6565 	IEEE80211_LOCK(ic);
6566 	if (error != 0) {
6567 		ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p tap %p\n",
6568 		    __func__, error, ni, tap);
6569 		goto n80211;
6570 	}
6571 
6572 	IMPROVE_HT("anyting else?");
6573 
6574 n80211:
6575 	lhw->ic_addba_stop(ni, tap);
6576 }
6577 
6578 static void
6579 lkpi_ic_addba_response_timeout(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
6580 {
6581 	struct ieee80211com *ic;
6582 	struct lkpi_hw *lhw;
6583 	struct lkpi_sta *lsta;
6584 	struct ieee80211_sta *sta;
6585 
6586 	ic = ni->ni_ic;
6587 	lhw = ic->ic_softc;
6588 	lsta = ni->ni_drv_data;
6589 	sta = LSTA_TO_STA(lsta);
6590 
6591 	TRACEOK("ADDBA RESP TIMEO tid %u", tap->txa_tid);
6592 
6593 	IMPROVE_HT();
6594 
6595 	if (!lsta->added_to_drv) {
6596 		ic_printf(ic, "%s: lsta %p ni %p, sta %p not added to firmware\n",
6597 		    __func__, lsta, ni, sta);
6598 		goto n80211;
6599 	}
6600 
6601 	/* We need to re-enable the txq and get packets out. */
6602 	if (sta->txq[tap->txa_tid] != NULL) {
6603 		struct lkpi_txq *ltxq;
6604 		struct ieee80211_hw *hw;
6605 
6606 		ltxq = TXQ_TO_LTXQ(sta->txq[tap->txa_tid]);
6607 		TRACEOK("ADDBA RESP TIMEO ltxq tid %u flags %b qlen %d",
6608 		    tap->txa_tid, ltxq->flags, LKPI_TXQ_FLAGS_BITS,
6609 		    skb_queue_len(&ltxq->skbq));
6610 		ltxq->flags &= ~LKPI_TXQ_STOPPED_BA;
6611 
6612 		hw = LHW_TO_HW(lhw);
6613 		lkpi_80211_mo_wake_tx_queue(hw, sta->txq[tap->txa_tid], true);
6614 	}
6615 
6616 n80211:
6617 	lhw->ic_addba_response_timeout(ni, tap);
6618 }
6619 
6620 static void
6621 lkpi_ic_bar_response(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap,
6622     int status)
6623 {
6624 	struct ieee80211com *ic;
6625 	struct lkpi_hw *lhw;
6626 
6627 	ic = ni->ni_ic;
6628 	lhw = ic->ic_softc;
6629 
6630 	IMPROVE_HT();
6631 
6632 	lhw->ic_bar_response(ni, tap, status);
6633 }
6634 
6635 static int
6636 lkpi_ic_ampdu_rx_start(struct ieee80211_node *ni, struct ieee80211_rx_ampdu *rap,
6637     int baparamset, int batimeout, int baseqctl)
6638 {
6639 	struct ieee80211com *ic;
6640 	struct lkpi_hw *lhw;
6641 	struct ieee80211_hw *hw;
6642 	struct ieee80211vap *vap;
6643 	struct lkpi_vif *lvif;
6644 	struct ieee80211_vif *vif;
6645 	struct lkpi_sta *lsta;
6646 	struct ieee80211_sta *sta;
6647 	struct ieee80211_ampdu_params params = { };
6648 	int error;
6649 
6650 	ic = ni->ni_ic;
6651 	lhw = ic->ic_softc;
6652 	hw = LHW_TO_HW(lhw);
6653 	vap = ni->ni_vap;
6654 	lvif = VAP_TO_LVIF(vap);
6655 	vif = LVIF_TO_VIF(lvif);
6656 	lsta = ni->ni_drv_data;
6657 	sta = LSTA_TO_STA(lsta);
6658 
6659 	IEEE80211_UNLOCK_ASSERT(ic);
6660 
6661 	if (!lsta->added_to_drv) {
6662 		ic_printf(ic, "%s: lsta %p ni %p vap %p, sta %p not added to firmware\n",
6663 		    __func__, lsta, ni, vap, sta);
6664 		return (-ENXIO);
6665 	}
6666 
6667 	if (lsta->state != IEEE80211_STA_AUTHORIZED) {
6668 		ic_printf(ic, "%s: lsta %p ni %p vap %p, sta %p state %d not AUTHORIZED\n",
6669 		    __func__, lsta, ni, vap, sta, lsta->state);
6670 		return (-ENXIO);
6671 	}
6672 
6673 	params.sta = sta;
6674 	params.action = IEEE80211_AMPDU_RX_START;
6675 	params.buf_size = _IEEE80211_MASKSHIFT(le16toh(baparamset), IEEE80211_BAPS_BUFSIZ);
6676 	if (params.buf_size == 0)
6677 		params.buf_size = IEEE80211_MAX_AMPDU_BUF_HT;
6678 	else
6679 		params.buf_size = min(params.buf_size, IEEE80211_MAX_AMPDU_BUF_HT);
6680 	if (hw->max_rx_aggregation_subframes > 0 &&
6681 	    params.buf_size > hw->max_rx_aggregation_subframes)
6682 		params.buf_size = hw->max_rx_aggregation_subframes;
6683 	params.timeout = le16toh(batimeout);
6684 	params.ssn = _IEEE80211_MASKSHIFT(le16toh(baseqctl), IEEE80211_BASEQ_START);
6685 	params.tid = _IEEE80211_MASKSHIFT(le16toh(baparamset), IEEE80211_BAPS_TID);
6686 
6687 	/* Based on net80211::ampdu_rx_start(). */
6688 	if ((vap->iv_htcaps & IEEE80211_HTC_RX_AMSDU_AMPDU) &&
6689 	    (_IEEE80211_MASKSHIFT(baparamset, IEEE80211_BAPS_AMSDU)))
6690 		params.amsdu = true;
6691 	else
6692 		params.amsdu = false;
6693 
6694 	wiphy_lock(hw->wiphy);
6695 	error = lkpi_80211_mo_ampdu_action(hw, vif, &params);
6696 	wiphy_unlock(hw->wiphy);
6697 	if (error != 0) {
6698 		ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p rap %p\n",
6699 		    __func__, error, ni, rap);
6700 		return (error);
6701 	}
6702 
6703 	if (!ieee80211_hw_check(hw, SUPPORTS_REORDERING_BUFFER)) {
6704 		IMPROVE("%s: TODO: SUPPORTS_REORDERING_BUFFER not set; check net80211\n", __func__);
6705 	}
6706 
6707 	IMPROVE_HT("net80211 is missing the error check on return and assumes success");
6708 
6709 	error = lhw->ic_ampdu_rx_start(ni, rap, baparamset, batimeout, baseqctl);
6710 	return (error);
6711 }
6712 
6713 static void
6714 lkpi_ic_ampdu_rx_stop(struct ieee80211_node *ni, struct ieee80211_rx_ampdu *rap)
6715 {
6716 	struct ieee80211com *ic;
6717 	struct lkpi_hw *lhw;
6718 	struct ieee80211_hw *hw;
6719 	struct ieee80211vap *vap;
6720 	struct lkpi_vif *lvif;
6721 	struct ieee80211_vif *vif;
6722 	struct lkpi_sta *lsta;
6723 	struct ieee80211_sta *sta;
6724 	struct ieee80211_ampdu_params params = { };
6725 	int error;
6726 	uint8_t tid;
6727 	bool ic_locked;
6728 
6729 	ic = ni->ni_ic;
6730 	lhw = ic->ic_softc;
6731 
6732 	/*
6733 	 * We should not (cannot) call into mac80211 ops with AMPDU_RX_STOP if
6734 	 * we did not START.  Some drivers pass it down to firmware which will
6735 	 * simply barf and net80211 calls ieee80211_ht_node_cleanup() from
6736 	 * ieee80211_ht_node_init() amongst others which will iterate over all
6737 	 * tid and call ic_ampdu_rx_stop() unconditionally.
6738 	 * XXX net80211 should probably be more "gentle" in these cases and
6739 	 * track some state itself.
6740 	 */
6741 	if ((rap->rxa_flags & IEEE80211_AGGR_RUNNING) == 0)
6742 		goto net80211_only;
6743 
6744 	hw = LHW_TO_HW(lhw);
6745 	vap = ni->ni_vap;
6746 	lvif = VAP_TO_LVIF(vap);
6747 	vif = LVIF_TO_VIF(lvif);
6748 	lsta = ni->ni_drv_data;
6749 	if (lsta == NULL) {
6750 		ic_printf(ic, "%s: lsta %p ni %p vap %p, lsta is NULL\n",
6751 		    __func__, lsta, ni, vap);
6752 		goto net80211_only;
6753 	}
6754 	sta = LSTA_TO_STA(lsta);
6755 
6756 	if (!lsta->added_to_drv) {
6757 		ic_printf(ic, "%s: lsta %p ni %p vap %p, sta %p not added to firmware\n",
6758 		    __func__, lsta, ni, vap, sta);
6759 		goto net80211_only;
6760 	}
6761 
6762 	if (lsta->state != IEEE80211_STA_AUTHORIZED) {
6763 		ic_printf(ic, "%s: lsta %p ni %p vap %p, sta %p state %d not AUTHORIZED\n",
6764 		    __func__, lsta, ni, vap, sta, lsta->state);
6765 		goto net80211_only;
6766 	}
6767 
6768 	IMPROVE_HT("This really should be passed from ht_recv_action_ba_delba.");
6769 	for (tid = 0; tid < WME_NUM_TID; tid++) {
6770 		if (&ni->ni_rx_ampdu[tid] == rap)
6771 			break;
6772 	}
6773 	if (tid == WME_NUM_TID) {
6774 		ic_printf(ic, "%s: lsta %p ni %p vap %p, sta %p TID not found\n",
6775 		    __func__, lsta, ni, vap, sta);
6776 		goto net80211_only;
6777 	}
6778 
6779 	params.sta = sta;
6780 	params.action = IEEE80211_AMPDU_RX_STOP;
6781 	params.buf_size = 0;
6782 	params.timeout = 0;
6783 	params.ssn = 0;
6784 	params.tid = tid;
6785 	params.amsdu = false;
6786 
6787 	ic_locked = IEEE80211_IS_LOCKED(ic);
6788 	if (ic_locked)
6789 		IEEE80211_UNLOCK(ic);
6790 	wiphy_lock(hw->wiphy);
6791 	error = lkpi_80211_mo_ampdu_action(hw, vif, &params);
6792 	wiphy_unlock(hw->wiphy);
6793 	if (ic_locked)
6794 		IEEE80211_LOCK(ic);
6795 	if (error != 0)
6796 		ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p rap %p\n",
6797 		    __func__, error, ni, rap);
6798 
6799 net80211_only:
6800 	lhw->ic_ampdu_rx_stop(ni, rap);
6801 }
6802 #endif
6803 
6804 int
6805 linuxkpi_ieee80211_start_tx_ba_session(struct ieee80211_sta *sta, uint8_t tid,
6806     int timeout)
6807 {
6808 	struct lkpi_sta *lsta;
6809 	struct ieee80211_hw *hw;
6810 	struct lkpi_hw *lhw;
6811 	struct ieee80211_tx_ampdu *tap;
6812 	int worked;
6813 
6814 	lsta = STA_TO_LSTA(sta);
6815 
6816 	/* If tid is out of range, fail gracefully. */
6817 	/* XXX-BZ are we limited to 8? */
6818 	if (tid >= IEEE80211_NUM_TIDS) {
6819 		net80211_vap_printf(lsta->ni->ni_vap, "%s: tid %u out of range "
6820 		    ">= %u\n", __func__, tid, IEEE80211_NUM_TIDS);
6821 		return (-EINVAL);
6822 	}
6823 
6824 	hw = lsta->hw;
6825 	lhw = HW_TO_LHW(hw);
6826 
6827 	/* No ampdu_action support, just error. */
6828 	if (lhw->ops->ampdu_action == NULL) {
6829 		net80211_vap_printf(lsta->ni->ni_vap, "%s: (*ampdu_action) "
6830 		    "not supported\n", __func__);
6831 		return (-ENOTSUPP);
6832 	}
6833 
6834 	/* Does HW allow us to set this up? */
6835 	if (!ieee80211_hw_check(hw, AMPDU_AGGREGATION)) {
6836 		net80211_vap_printf(lsta->ni->ni_vap, "%s: !AMPDU_AGGREGATION\n",
6837 		    __func__);
6838 		return (-ENOTSUPP);
6839 	}
6840 	if (ieee80211_hw_check(hw, TX_AMPDU_SETUP_IN_HW)) {
6841 		net80211_vap_printf(lsta->ni->ni_vap, "%s: TX_AMPDU_SETUP_IN_HW\n",
6842 		    __func__);
6843 		return (-EPERM);
6844 	}
6845 
6846 	/* We need at least HT or higher support enabled. */
6847 	if (!sta->deflink.ht_cap.ht_supported &&
6848 	    !sta->deflink.vht_cap.vht_supported &&
6849 	    !sta->deflink.he_cap.has_he &&
6850 	    !sta->deflink.eht_cap.has_eht) {
6851 		net80211_vap_printf(lsta->ni->ni_vap, "%s: HT or later not "
6852 		    "supported\n", __func__);
6853 		return (-EINVAL);
6854 	}
6855 
6856 #ifdef __notyet__
6857 	/*
6858 	 * We need some rate limiting/disabling in case we try too hard and
6859 	 * get NACKed over and over.
6860 	 * XXX-BZ This check should likely go to addba_req along with a counter.
6861 	 */
6862 	if (lsta->block_ba)
6863 		return (-EACCESS);
6864 #endif
6865 
6866 	/* XXX-BZ locking? */
6867 
6868 	/* Do we have a running session already? */
6869 	tap = &lsta->ni->ni_tx_ampdu[tid];
6870 	if (IEEE80211_AMPDU_REQUESTED(tap)) {
6871 		net80211_vap_printf(lsta->ni->ni_vap, "%s: "
6872 		    "AMPDU requested/running\n", __func__);
6873 		return (-EINPROGRESS);
6874 	}
6875 
6876 	/* Tell net80211 to setup an aggr sessions. */
6877 	/* XXX-BZ we have no way to carry the timeout forward easily. */
6878 	worked = ieee80211_ampdu_tx_request_ext(lsta->ni, tid);
6879 	TRACEOK("ieee80211_ampdu_tx_request_ext %d", worked);
6880 
6881 	if (worked != 1) {
6882 		net80211_vap_printf(lsta->ni->ni_vap, "%s: "
6883 		    "ieee80211_ampdu_tx_request_ext returned %d != 1\n",
6884 		    __func__, worked);
6885 		return (-EINVAL);
6886 	}
6887 
6888 	/*
6889 	 * How do we make sure the EAPOL handshake has completed?
6890 	 * Let ieee80211_output do it.
6891 	 */
6892 	if (1) {
6893 		/* Immediately trigger the setup and output of the action frame. */
6894 		worked = ieee80211_ampdu_request(lsta->ni, tap);
6895 		if (worked != 1) {
6896 			net80211_vap_printf(lsta->ni->ni_vap, "%s: "
6897 			    "ieee80211_ampdu_request returned %d != 1\n",
6898 			    __func__, worked);
6899 			return (-EAGAIN);
6900 		}
6901 	}
6902 
6903 	return (0);
6904 }
6905 
6906 static void
6907 lkpi_ic_getradiocaps_ht(struct ieee80211com *ic, struct ieee80211_hw *hw,
6908     uint8_t *bands, int *chan_flags, enum nl80211_band band)
6909 {
6910 #ifdef LKPI_80211_HT
6911 	struct ieee80211_sta_ht_cap *ht_cap;
6912 
6913 	ht_cap = &hw->wiphy->bands[band]->ht_cap;
6914 	if (!ht_cap->ht_supported)
6915 		return;
6916 
6917 	switch (band) {
6918 	case NL80211_BAND_2GHZ:
6919 		setbit(bands, IEEE80211_MODE_11NG);
6920 		break;
6921 	case NL80211_BAND_5GHZ:
6922 		setbit(bands, IEEE80211_MODE_11NA);
6923 		break;
6924 	default:
6925 		IMPROVE("Unsupported band %d", band);
6926 		return;
6927 	}
6928 
6929 	ic->ic_htcaps = IEEE80211_HTC_HT;	/* HT operation */
6930 
6931 	/*
6932 	 * Rather than manually checking each flag and
6933 	 * translating IEEE80211_HT_CAP_ to IEEE80211_HTCAP_,
6934 	 * simply copy the 16bits.
6935 	 */
6936 	ic->ic_htcaps |= ht_cap->cap;
6937 
6938 	/* Then deal with the other flags. */
6939 	if (ieee80211_hw_check(hw, AMPDU_AGGREGATION))
6940 		ic->ic_htcaps |= IEEE80211_HTC_AMPDU;
6941 #ifdef __notyet__
6942 	if (ieee80211_hw_check(hw, TX_AMSDU))
6943 		ic->ic_htcaps |= IEEE80211_HTC_AMSDU;
6944 	if (ieee80211_hw_check(hw, SUPPORTS_AMSDU_IN_AMPDU))
6945 		ic->ic_htcaps |= (IEEE80211_HTC_RX_AMSDU_AMPDU |
6946 		    IEEE80211_HTC_TX_AMSDU_AMPDU);
6947 #endif
6948 
6949 	IMPROVE("PS, ampdu_*, ht_cap.mcs.tx_params, ...");
6950 
6951 	/* Only add HT40 channels if supported. */
6952 	if ((ic->ic_htcaps & IEEE80211_HTCAP_CHWIDTH40) != 0 &&
6953 	    chan_flags != NULL)
6954 		*chan_flags |= NET80211_CBW_FLAG_HT40;
6955 #endif
6956 }
6957 
6958 static void
6959 lkpi_ic_getradiocaps(struct ieee80211com *ic, int maxchan,
6960     int *n, struct ieee80211_channel *c)
6961 {
6962 	struct lkpi_hw *lhw;
6963 	struct ieee80211_hw *hw;
6964 	struct linuxkpi_ieee80211_channel *channels;
6965 	uint8_t bands[IEEE80211_MODE_BYTES];
6966 	int chan_flags, error, i, nchans;
6967 
6968 	/* Channels */
6969 	lhw = ic->ic_softc;
6970 	hw = LHW_TO_HW(lhw);
6971 
6972 	/* NL80211_BAND_2GHZ */
6973 	nchans = 0;
6974 	if (hw->wiphy->bands[NL80211_BAND_2GHZ] != NULL)
6975 		nchans = hw->wiphy->bands[NL80211_BAND_2GHZ]->n_channels;
6976 	if (nchans > 0) {
6977 		struct ieee80211_supported_band *supband;
6978 
6979 		memset(bands, 0, sizeof(bands));
6980 		chan_flags = 0;
6981 		setbit(bands, IEEE80211_MODE_11B);
6982 
6983 		/* Check for 11g (simplified). */
6984 		supband = hw->wiphy->bands[NL80211_BAND_2GHZ];
6985 		for (i = 0; i < supband->n_bitrates; i++) {
6986 			if ((supband->bitrates[i].flags &
6987 			    IEEE80211_RATE_MANDATORY_G) != 0) {
6988 				setbit(bands, IEEE80211_MODE_11G);
6989 				break;
6990 			}
6991 		}
6992 
6993 		IMPROVE("the bitrates may have flags?");
6994 
6995 		lkpi_ic_getradiocaps_ht(ic, hw, bands, &chan_flags,
6996 		    NL80211_BAND_2GHZ);
6997 
6998 		channels = supband->channels;
6999 		for (i = 0; i < nchans && *n < maxchan; i++) {
7000 			uint32_t nflags = 0;
7001 			int cflags = chan_flags;
7002 
7003 			if (channels[i].flags & IEEE80211_CHAN_DISABLED) {
7004 				ic_printf(ic, "%s: Skipping disabled chan "
7005 				    "[%u/%u/%#x]\n", __func__,
7006 				    channels[i].hw_value,
7007 				    channels[i].center_freq, channels[i].flags);
7008 				continue;
7009 			}
7010 			if (channels[i].flags & IEEE80211_CHAN_NO_IR)
7011 				nflags |= (IEEE80211_CHAN_NOADHOC|IEEE80211_CHAN_PASSIVE);
7012 			if (channels[i].flags & IEEE80211_CHAN_RADAR)
7013 				nflags |= IEEE80211_CHAN_DFS;
7014 			if (channels[i].flags & IEEE80211_CHAN_NO_160MHZ)
7015 				cflags &= ~(NET80211_CBW_FLAG_VHT160|NET80211_CBW_FLAG_VHT80P80);
7016 			if (channels[i].flags & IEEE80211_CHAN_NO_80MHZ)
7017 				cflags &= ~NET80211_CBW_FLAG_VHT80;
7018 			/* XXX how to map the remaining enum ieee80211_channel_flags? */
7019 			if (channels[i].flags & IEEE80211_CHAN_NO_HT40)
7020 				cflags &= ~NET80211_CBW_FLAG_HT40;
7021 
7022 			error = ieee80211_add_channel_cbw(c, maxchan, n,
7023 			    ieee80211_mhz2ieee(channels[i].center_freq,
7024 				lkpi_nl80211_band_to_net80211_band(channels[i].band)),
7025 			    channels[i].center_freq, channels[i].max_power,
7026 			    nflags, bands, cflags);
7027 			/* net80211::ENOBUFS: *n >= maxchans */
7028 			if (error != 0 && error != ENOBUFS)
7029 				ic_printf(ic, "%s: Adding chan %u/%u/%#x/%#x/%#x/%#x "
7030 				    "returned error %d\n",
7031 				    __func__, channels[i].hw_value,
7032 				    channels[i].center_freq, channels[i].flags,
7033 				    nflags, chan_flags, cflags, error);
7034 			if (error != 0)
7035 				break;
7036 		}
7037 	}
7038 
7039 	/* NL80211_BAND_5GHZ */
7040 	nchans = 0;
7041 	if (hw->wiphy->bands[NL80211_BAND_5GHZ] != NULL)
7042 		nchans = hw->wiphy->bands[NL80211_BAND_5GHZ]->n_channels;
7043 	if (nchans > 0) {
7044 		memset(bands, 0, sizeof(bands));
7045 		chan_flags = 0;
7046 		setbit(bands, IEEE80211_MODE_11A);
7047 
7048 		lkpi_ic_getradiocaps_ht(ic, hw, bands, &chan_flags,
7049 		    NL80211_BAND_5GHZ);
7050 
7051 #ifdef LKPI_80211_VHT
7052 		if (hw->wiphy->bands[NL80211_BAND_5GHZ]->vht_cap.vht_supported) {
7053 
7054 			ic->ic_flags_ext |= IEEE80211_FEXT_VHT;
7055 			ic->ic_vht_cap.vht_cap_info =
7056 			    hw->wiphy->bands[NL80211_BAND_5GHZ]->vht_cap.cap;
7057 			ic->ic_vht_cap.supp_mcs =
7058 			    hw->wiphy->bands[NL80211_BAND_5GHZ]->vht_cap.vht_mcs;
7059 
7060 			setbit(bands, IEEE80211_MODE_VHT_5GHZ);
7061 			chan_flags |= NET80211_CBW_FLAG_VHT80;
7062 			if (IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_IS_160MHZ(
7063 			    ic->ic_vht_cap.vht_cap_info))
7064 				chan_flags |= NET80211_CBW_FLAG_VHT160;
7065 			if (IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_IS_160_80P80MHZ(
7066 			    ic->ic_vht_cap.vht_cap_info))
7067 				chan_flags |= NET80211_CBW_FLAG_VHT80P80;
7068 		}
7069 #endif
7070 
7071 		channels = hw->wiphy->bands[NL80211_BAND_5GHZ]->channels;
7072 		for (i = 0; i < nchans && *n < maxchan; i++) {
7073 			uint32_t nflags = 0;
7074 			int cflags = chan_flags;
7075 
7076 			if (channels[i].flags & IEEE80211_CHAN_DISABLED) {
7077 				ic_printf(ic, "%s: Skipping disabled chan "
7078 				    "[%u/%u/%#x]\n", __func__,
7079 				    channels[i].hw_value,
7080 				    channels[i].center_freq, channels[i].flags);
7081 				continue;
7082 			}
7083 			if (channels[i].flags & IEEE80211_CHAN_NO_IR)
7084 				nflags |= (IEEE80211_CHAN_NOADHOC|IEEE80211_CHAN_PASSIVE);
7085 			if (channels[i].flags & IEEE80211_CHAN_RADAR)
7086 				nflags |= IEEE80211_CHAN_DFS;
7087 			if (channels[i].flags & IEEE80211_CHAN_NO_160MHZ)
7088 				cflags &= ~(NET80211_CBW_FLAG_VHT160|NET80211_CBW_FLAG_VHT80P80);
7089 			if (channels[i].flags & IEEE80211_CHAN_NO_80MHZ)
7090 				cflags &= ~NET80211_CBW_FLAG_VHT80;
7091 			/* XXX hwo to map the remaining enum ieee80211_channel_flags? */
7092 			if (channels[i].flags & IEEE80211_CHAN_NO_HT40)
7093 				cflags &= ~NET80211_CBW_FLAG_HT40;
7094 
7095 			error = ieee80211_add_channel_cbw(c, maxchan, n,
7096 			    ieee80211_mhz2ieee(channels[i].center_freq,
7097 				lkpi_nl80211_band_to_net80211_band(channels[i].band)),
7098 			    channels[i].center_freq, channels[i].max_power,
7099 			    nflags, bands, cflags);
7100 			/* net80211::ENOBUFS: *n >= maxchans */
7101 			if (error != 0 && error != ENOBUFS)
7102 				ic_printf(ic, "%s: Adding chan %u/%u/%#x/%#x/%#x/%#x "
7103 				    "returned error %d\n",
7104 				    __func__, channels[i].hw_value,
7105 				    channels[i].center_freq, channels[i].flags,
7106 				    nflags, chan_flags, cflags, error);
7107 			if (error != 0)
7108 				break;
7109 		}
7110 	}
7111 }
7112 
7113 static void *
7114 lkpi_ieee80211_ifalloc(void)
7115 {
7116 	struct ieee80211com *ic;
7117 
7118 	ic = malloc(sizeof(*ic), M_LKPI80211, M_WAITOK | M_ZERO);
7119 
7120 	/* Setting these happens later when we have device information. */
7121 	ic->ic_softc = NULL;
7122 	ic->ic_name = "linuxkpi";
7123 
7124 	return (ic);
7125 }
7126 
7127 struct ieee80211_hw *
7128 linuxkpi_ieee80211_alloc_hw(size_t priv_len, const struct ieee80211_ops *ops)
7129 {
7130 	struct ieee80211_hw *hw;
7131 	struct lkpi_hw *lhw;
7132 	struct wiphy *wiphy;
7133 	int ac;
7134 	bool emuchanctx;
7135 
7136 	/*
7137 	 * Do certain checks before starting to allocate resources.
7138 	 * Store results in temporary variables.
7139 	 */
7140 
7141 	/* ac1d519c01ca introduced emulating chanctx changes. */
7142 	emuchanctx = false;
7143 	if (ops->add_chanctx == ieee80211_emulate_add_chanctx &&
7144 	    ops->change_chanctx == ieee80211_emulate_change_chanctx &&
7145 	    ops->remove_chanctx == ieee80211_emulate_remove_chanctx) {
7146 		/*
7147 		 * If we emulate the chanctx ops, we must not have
7148 		 * assign_vif_chanctx and unassign_vif_chanctx.
7149 		 */
7150 		if (ops->assign_vif_chanctx != NULL ||
7151 		    ops->unassign_vif_chanctx != NULL) {
7152 			/* Fail gracefully. */
7153 			printf("%s: emulate_chanctx but "
7154 			    "assign_vif_chanctx %p != NULL || "
7155 			    "unassign_vif_chanctx %p != NULL\n", __func__,
7156 			    ops->assign_vif_chanctx, ops->unassign_vif_chanctx);
7157 			return (NULL);
7158 		}
7159 		emuchanctx = true;
7160 	}
7161 	if (!emuchanctx && (ops->add_chanctx == ieee80211_emulate_add_chanctx ||
7162 	    ops->change_chanctx == ieee80211_emulate_change_chanctx ||
7163 	    ops->remove_chanctx == ieee80211_emulate_remove_chanctx)) {
7164 		printf("%s: not emulating chanctx changes but emulating "
7165 		    "function set: %d/%d/%d\n", __func__,
7166 		    ops->add_chanctx == ieee80211_emulate_add_chanctx,
7167 		    ops->change_chanctx == ieee80211_emulate_change_chanctx,
7168 		    ops->remove_chanctx == ieee80211_emulate_remove_chanctx);
7169 		return (NULL);
7170 	}
7171 	if (!emuchanctx && (ops->add_chanctx == NULL || ops->change_chanctx == NULL ||
7172 	    ops->remove_chanctx == NULL || ops->assign_vif_chanctx == NULL ||
7173 	    ops->unassign_vif_chanctx == NULL)) {
7174 		printf("%s: not all functions set for chanctx operations "
7175 		    "(emulating chanctx %d): %p/%p/%p %p/%p\n",
7176 		    __func__, emuchanctx,
7177 		    ops->add_chanctx, ops->change_chanctx, ops->remove_chanctx,
7178 		    ops->assign_vif_chanctx, ops->unassign_vif_chanctx);
7179 		return (NULL);
7180 	}
7181 
7182 	/* Get us and the driver data also allocated. */
7183 	wiphy = wiphy_new(&linuxkpi_mac80211cfgops, sizeof(*lhw) + priv_len);
7184 	if (wiphy == NULL)
7185 		return (NULL);
7186 
7187 	lhw = wiphy_priv(wiphy);
7188 	lhw->ops = ops;
7189 
7190 	LKPI_80211_LHW_SCAN_LOCK_INIT(lhw);
7191 	LKPI_80211_LHW_TXQ_LOCK_INIT(lhw);
7192 	spin_lock_init(&lhw->txq_lock);
7193 	sx_init_flags(&lhw->lvif_sx, "lhw-lvif", SX_RECURSE | SX_DUPOK);
7194 	LKPI_80211_LHW_MC_LOCK_INIT(lhw);
7195 	TAILQ_INIT(&lhw->lvif_head);
7196 	__hw_addr_init(&lhw->mc_list);
7197 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
7198 		spin_lock_init(&lhw->txq_scheduled_lock[ac]);
7199 		lhw->txq_generation[ac] = 1;
7200 		TAILQ_INIT(&lhw->txq_scheduled[ac]);
7201 	}
7202 
7203 	/* Chanctx_conf */
7204 	INIT_LIST_HEAD(&lhw->lchanctx_list);
7205 	INIT_LIST_HEAD(&lhw->lchanctx_list_reserved);
7206 	lhw->emulate_chanctx = emuchanctx;
7207 
7208 	/* Deferred RX path. */
7209 	LKPI_80211_LHW_RXQ_LOCK_INIT(lhw);
7210 	TASK_INIT(&lhw->rxq_task, 0, lkpi_80211_lhw_rxq_task, lhw);
7211 	mbufq_init(&lhw->rxq, 32 * NAPI_POLL_WEIGHT);
7212 	lhw->rxq_stopped = false;
7213 
7214 	/*
7215 	 * XXX-BZ TODO make sure there is a "_null" function to all ops
7216 	 * not initialized.
7217 	 */
7218 	hw = LHW_TO_HW(lhw);
7219 	hw->wiphy = wiphy;
7220 	hw->conf.flags |= IEEE80211_CONF_IDLE;
7221 	hw->priv = (void *)(lhw + 1);
7222 
7223 	/* BSD Specific. */
7224 	lhw->ic = lkpi_ieee80211_ifalloc();
7225 
7226 	if (lhw->emulate_chanctx)
7227 		ic_printf(lhw->ic, "Using chanctx emulation.\n");
7228 	IMPROVE();
7229 
7230 	return (hw);
7231 }
7232 
7233 void
7234 linuxkpi_ieee80211_iffree(struct ieee80211_hw *hw)
7235 {
7236 	struct lkpi_hw *lhw;
7237 	struct mbuf *m;
7238 	int ac;
7239 
7240 	lhw = HW_TO_LHW(hw);
7241 	free(lhw->ic, M_LKPI80211);
7242 	lhw->ic = NULL;
7243 
7244 	/*
7245 	 * Drain the deferred RX path.
7246 	 */
7247 	LKPI_80211_LHW_RXQ_LOCK(lhw);
7248 	lhw->rxq_stopped = true;
7249 	LKPI_80211_LHW_RXQ_UNLOCK(lhw);
7250 
7251 	/* Drain taskq, won't be restarted due to rxq_stopped being set. */
7252 	while (taskqueue_cancel(taskqueue_thread, &lhw->rxq_task, NULL) != 0)
7253 		taskqueue_drain(taskqueue_thread, &lhw->rxq_task);
7254 
7255 	/* Flush mbufq (make sure to release ni refs!). */
7256 	m = mbufq_dequeue(&lhw->rxq);
7257 	while (m != NULL) {
7258 #ifdef LKPI_80211_USE_MTAG
7259 		struct m_tag *mtag;
7260 
7261 		mtag = m_tag_locate(m, MTAG_ABI_LKPI80211, LKPI80211_TAG_RXNI, NULL);
7262 		if (mtag != NULL) {
7263 			struct lkpi_80211_tag_rxni *rxni;
7264 
7265 			rxni = (struct lkpi_80211_tag_rxni *)(mtag + 1);
7266 			ieee80211_free_node(rxni->ni);
7267 		}
7268 #else
7269 		if (m->m_pkthdr.PH_loc.ptr != NULL) {
7270 			struct ieee80211_node *ni;
7271 
7272 			ni = m->m_pkthdr.PH_loc.ptr;
7273 			ieee80211_free_node(ni);
7274 		}
7275 #endif
7276 		m_freem(m);
7277 		m = mbufq_dequeue(&lhw->rxq);
7278 	}
7279 	KASSERT(mbufq_empty(&lhw->rxq), ("%s: lhw %p has rxq len %d != 0\n",
7280 	    __func__, lhw, mbufq_len(&lhw->rxq)));
7281 	LKPI_80211_LHW_RXQ_LOCK_DESTROY(lhw);
7282 
7283 	wiphy_lock(hw->wiphy);
7284 	/* Chanctx_conf. */
7285 	if (!list_empty_careful(&lhw->lchanctx_list)) {
7286 		struct lkpi_chanctx *lchanctx, *next;
7287 		struct ieee80211_chanctx_conf *chanctx_conf;
7288 
7289 		list_for_each_entry_safe(lchanctx, next, &lhw->lchanctx_list, entry) {
7290 			if (lchanctx->added_to_drv) {
7291 				/* In reality we should panic? */
7292 				chanctx_conf = &lchanctx->chanctx_conf;
7293 				lkpi_80211_mo_remove_chanctx(hw, chanctx_conf);
7294 			}
7295 			list_del(&lchanctx->entry);
7296 			/* No need to reset the lchanctx here as we will free it below. */
7297 			list_add_rcu(&lchanctx->entry, &lhw->lchanctx_list_reserved);
7298 		}
7299 	}
7300 	if (!list_empty_careful(&lhw->lchanctx_list_reserved)) {
7301 		struct lkpi_chanctx *lchanctx, *next;
7302 
7303 		list_for_each_entry_safe(lchanctx, next, &lhw->lchanctx_list_reserved, entry) {
7304 			list_del(&lchanctx->entry);
7305 			if (lchanctx->added_to_drv)
7306 				panic("%s: lchanctx %p on reserved list still added_to_drv\n",
7307 				    __func__, lchanctx);
7308 			free(lchanctx, M_LKPI80211);
7309 		}
7310 	}
7311 	wiphy_unlock(hw->wiphy);
7312 
7313 	LKPI_80211_LHW_MC_LOCK(lhw);
7314 	lkpi_cleanup_mcast_list_locked(lhw);
7315 	LKPI_80211_LHW_MC_UNLOCK(lhw);
7316 
7317 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
7318 		spin_lock_destroy(&lhw->txq_scheduled_lock[ac]);
7319 
7320 	/* Cleanup more of lhw here or in wiphy_free()? */
7321 	spin_lock_destroy(&lhw->txq_lock);
7322 	LKPI_80211_LHW_TXQ_LOCK_DESTROY(lhw);
7323 	LKPI_80211_LHW_SCAN_LOCK_DESTROY(lhw);
7324 	sx_destroy(&lhw->lvif_sx);
7325 	LKPI_80211_LHW_MC_LOCK_DESTROY(lhw)
7326 	IMPROVE();
7327 }
7328 
7329 void
7330 linuxkpi_set_ieee80211_dev(struct ieee80211_hw *hw)
7331 {
7332 	struct lkpi_hw *lhw;
7333 	struct ieee80211com *ic;
7334 	struct device *dev;
7335 
7336 	lhw = HW_TO_LHW(hw);
7337 	ic = lhw->ic;
7338 
7339 	/* Save the backpointer from net80211 to LinuxKPI. */
7340 	ic->ic_softc = lhw;
7341 
7342 	/*
7343 	 * Set a proper name before ieee80211_ifattach() if dev is set.
7344 	 * ath1xk also unset the dev so we need to check.
7345 	 * Also we will (ab)use this opportunity to register the
7346 	 * power management sub-children if thay exist (for suspend/resume).
7347 	 */
7348 	dev = wiphy_dev(hw->wiphy);
7349 	if (dev != NULL) {
7350 		ic->ic_name = dev_name(dev);
7351 		if (dev->bsddev != NULL) {
7352 			bus_identify_children(dev->bsddev);
7353 			bus_enumerate_hinted_children(dev->bsddev);
7354 			bus_topo_lock();
7355 			bus_attach_children(dev->bsddev);
7356 			bus_topo_unlock();
7357 		}
7358 	} else {
7359 		TODO("adjust arguments to still have the old dev or go through "
7360 		    "the hoops of getting the bsddev from hw and detach; "
7361 		    "or do in XXX; check ath1kx drivers");
7362 	}
7363 
7364 	/* XXX-BZ do we also need to set wiphy name? */
7365 }
7366 
7367 struct ieee80211_hw *
7368 linuxkpi_wiphy_to_ieee80211_hw(struct wiphy *wiphy)
7369 {
7370 	struct lkpi_hw *lhw;
7371 
7372 	lhw = wiphy_priv(wiphy);
7373 	return (LHW_TO_HW(lhw));
7374 }
7375 
7376 static void
7377 lkpi_radiotap_attach(struct lkpi_hw *lhw)
7378 {
7379 	struct ieee80211com *ic;
7380 
7381 	ic = lhw->ic;
7382 	ieee80211_radiotap_attach(ic,
7383 	    &lhw->rtap_tx.wt_ihdr, sizeof(lhw->rtap_tx),
7384 	    LKPI_RTAP_TX_FLAGS_PRESENT,
7385 	    &lhw->rtap_rx.wr_ihdr, sizeof(lhw->rtap_rx),
7386 	    LKPI_RTAP_RX_FLAGS_PRESENT);
7387 }
7388 
7389 int
7390 linuxkpi_ieee80211_ifattach(struct ieee80211_hw *hw)
7391 {
7392 	struct ieee80211com *ic;
7393 	struct lkpi_hw *lhw;
7394 	int band, i;
7395 
7396 	lhw = HW_TO_LHW(hw);
7397 	ic = lhw->ic;
7398 
7399 	/* We do it this late as wiphy->dev should be set for the name. */
7400 	lhw->workq = alloc_ordered_workqueue(wiphy_name(hw->wiphy), 0);
7401 	if (lhw->workq == NULL)
7402 		return (-EAGAIN);
7403 
7404 	/* XXX-BZ figure this out how they count his... */
7405 	if (!is_zero_ether_addr(hw->wiphy->perm_addr)) {
7406 		IEEE80211_ADDR_COPY(ic->ic_macaddr,
7407 		    hw->wiphy->perm_addr);
7408 	} else if (hw->wiphy->n_addresses > 0) {
7409 		/* We take the first one. */
7410 		IEEE80211_ADDR_COPY(ic->ic_macaddr,
7411 		    hw->wiphy->addresses[0].addr);
7412 	} else {
7413 		ic_printf(ic, "%s: warning, no hardware address!\n", __func__);
7414 	}
7415 
7416 #ifdef __not_yet__
7417 	/* See comment in lkpi_80211_txq_tx_one(). */
7418 	ic->ic_headroom = hw->extra_tx_headroom;
7419 #endif
7420 
7421 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
7422 	ic->ic_opmode = IEEE80211_M_STA;
7423 
7424 	/* Set device capabilities. */
7425 	/* XXX-BZ we need to get these from linux80211/drivers and convert. */
7426 	ic->ic_caps =
7427 	    IEEE80211_C_STA |
7428 	    IEEE80211_C_MONITOR |
7429 	    IEEE80211_C_WPA |		/* WPA/RSN */
7430 #ifdef LKPI_80211_WME
7431 	    IEEE80211_C_WME |
7432 #endif
7433 #if 0
7434 	    IEEE80211_C_PMGT |
7435 #endif
7436 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
7437 	    IEEE80211_C_SHPREAMBLE	/* short preamble supported */
7438 	    ;
7439 
7440 #ifdef LKPI_80211_BGSCAN
7441 	if (lhw->ops->hw_scan)
7442 		ic->ic_caps |= IEEE80211_C_BGSCAN;
7443 #endif
7444 
7445 	lkpi_enable_hw_scan(lhw);
7446 
7447 	/* Does the driver/firmware handle rate countrol? */
7448 	/* Currently only older iwlwifi mvm devices are in this category. */
7449 	if (bootverbose && !ieee80211_hw_check(hw, HAS_RATE_CONTROL))
7450 		ic_printf(ic, "NOTE: rate control not supported by LinuxKPI; "
7451 		    "expect low rates only\n");
7452 
7453 	/* Does HW support Fragmentation offload? */
7454 	if (ieee80211_hw_check(hw, SUPPORTS_TX_FRAG))
7455 		ic->ic_flags_ext |= IEEE80211_FEXT_FRAG_OFFLOAD;
7456 
7457 	/* Does HW support full AMPDU[-TX] offload? */
7458 	if (ieee80211_hw_check(hw, AMPDU_AGGREGATION))
7459 		ic->ic_flags_ext |= IEEE80211_FEXT_AMPDU_OFFLOAD;
7460 #ifdef __notyet__
7461 	if (ieee80211_hw_check(hw, TX_AMSDU))
7462 	if (ieee80211_hw_check(hw, SUPPORTS_AMSDU_IN_AMPDU))
7463 #endif
7464 
7465 	/*
7466 	 * The wiphy variables report bitmasks of avail antennas.
7467 	 * (*get_antenna) get the current bitmask sets which can be
7468 	 * altered by (*set_antenna) for some drivers.
7469 	 * XXX-BZ will the count alone do us much good long-term in net80211?
7470 	 */
7471 	if (hw->wiphy->available_antennas_rx ||
7472 	    hw->wiphy->available_antennas_tx) {
7473 		uint32_t rxs, txs;
7474 
7475 		if (lkpi_80211_mo_get_antenna(hw, &txs, &rxs) == 0) {
7476 			ic->ic_rxstream = bitcount32(rxs);
7477 			ic->ic_txstream = bitcount32(txs);
7478 		}
7479 	}
7480 
7481 	ic->ic_cryptocaps = 0;
7482 #ifdef LKPI_80211_HW_CRYPTO
7483 	if (lkpi_hwcrypto && hw->wiphy->n_cipher_suites > 0) {
7484 		uint32_t hwciphers;
7485 
7486 		hwciphers = 0;
7487 		for (i = 0; i < hw->wiphy->n_cipher_suites; i++) {
7488 			uint32_t cs;
7489 
7490 			cs = lkpi_l80211_to_net80211_cyphers(
7491 			    ic, hw->wiphy->cipher_suites[i]);
7492 			if (cs == IEEE80211_CRYPTO_TKIP) {
7493 				/*
7494 				 * We do set this here.  We will only find out
7495 				 * when doing a SET_KEY operation depending on
7496 				 * what the driver returns.
7497 				 * net80211::ieee80211_crypto_newkey()
7498 				 * checks this so we will have to do flags
7499 				 * surgery later.
7500 				 */
7501 				cs |= IEEE80211_CRYPTO_TKIPMIC;
7502 			}
7503 			hwciphers |= cs;
7504 		}
7505 		/*
7506 		 * (20250415) nothing anywhere in the path checks we actually
7507 		 * support all these in net80211.
7508 		 * net80211 supports _256 variants but the ioctl does not.
7509 		 */
7510 		IMPROVE("as net80211 grows more support, enable them");
7511 		hwciphers &= (IEEE80211_CRYPTO_WEP |
7512 		    IEEE80211_CRYPTO_TKIP | IEEE80211_CRYPTO_TKIPMIC |
7513 		    IEEE80211_CRYPTO_AES_CCM | IEEE80211_CRYPTO_AES_GCM_128);
7514 		/*
7515 		 * We only support CCMP here, so further filter.
7516 		 * Also permit TKIP if turned on.
7517 		 */
7518 		hwciphers &= (IEEE80211_CRYPTO_AES_CCM |
7519 		    IEEE80211_CRYPTO_AES_GCM_128 |
7520 		    (lkpi_hwcrypto_tkip ? (IEEE80211_CRYPTO_TKIP |
7521 		    IEEE80211_CRYPTO_TKIPMIC) : 0));
7522 		ieee80211_set_hardware_ciphers(ic, hwciphers);
7523 	}
7524 #endif
7525 
7526 	lkpi_ic_getradiocaps(ic, IEEE80211_CHAN_MAX, &ic->ic_nchans,
7527 	    ic->ic_channels);
7528 
7529 	ieee80211_ifattach(ic);
7530 
7531 	ic->ic_update_mcast = lkpi_ic_update_mcast;
7532 	ic->ic_update_promisc = lkpi_ic_update_promisc;
7533 	ic->ic_update_chw = lkpi_ic_update_chw;
7534 	ic->ic_parent = lkpi_ic_parent;
7535 	ic->ic_scan_start = lkpi_ic_scan_start;
7536 	ic->ic_scan_end = lkpi_ic_scan_end;
7537 	ic->ic_set_channel = lkpi_ic_set_channel;
7538 	ic->ic_transmit = lkpi_ic_transmit;
7539 	ic->ic_raw_xmit = lkpi_ic_raw_xmit;
7540 	ic->ic_vap_create = lkpi_ic_vap_create;
7541 	ic->ic_vap_delete = lkpi_ic_vap_delete;
7542 	ic->ic_getradiocaps = lkpi_ic_getradiocaps;
7543 	ic->ic_wme.wme_update = lkpi_ic_wme_update;
7544 
7545 	lhw->ic_scan_curchan = ic->ic_scan_curchan;
7546 	ic->ic_scan_curchan = lkpi_ic_scan_curchan;
7547 	lhw->ic_scan_mindwell = ic->ic_scan_mindwell;
7548 	ic->ic_scan_mindwell = lkpi_ic_scan_mindwell;
7549 
7550 	lhw->ic_node_alloc = ic->ic_node_alloc;
7551 	ic->ic_node_alloc = lkpi_ic_node_alloc;
7552 	lhw->ic_node_init = ic->ic_node_init;
7553 	ic->ic_node_init = lkpi_ic_node_init;
7554 	lhw->ic_node_cleanup = ic->ic_node_cleanup;
7555 	ic->ic_node_cleanup = lkpi_ic_node_cleanup;
7556 	lhw->ic_node_free = ic->ic_node_free;
7557 	ic->ic_node_free = lkpi_ic_node_free;
7558 
7559 #ifdef LKPI_80211_HT
7560 	/*
7561 	 * Only attach if the driver/firmware supports (*ampdu_action)().
7562 	 * Otherwise it is in the hands of net80211.
7563 	 */
7564 	if (lhw->ops->ampdu_action != NULL) {
7565 		lhw->ic_recv_action = ic->ic_recv_action;
7566 		ic->ic_recv_action = lkpi_ic_recv_action;
7567 		lhw->ic_send_action = ic->ic_send_action;
7568 		ic->ic_send_action = lkpi_ic_send_action;
7569 
7570 		lhw->ic_ampdu_enable = ic->ic_ampdu_enable;
7571 		ic->ic_ampdu_enable = lkpi_ic_ampdu_enable;
7572 
7573 		lhw->ic_addba_request = ic->ic_addba_request;
7574 		ic->ic_addba_request = lkpi_ic_addba_request;
7575 		lhw->ic_addba_response = ic->ic_addba_response;
7576 		ic->ic_addba_response = lkpi_ic_addba_response;
7577 		lhw->ic_addba_stop = ic->ic_addba_stop;
7578 		ic->ic_addba_stop = lkpi_ic_addba_stop;
7579 		lhw->ic_addba_response_timeout = ic->ic_addba_response_timeout;
7580 		ic->ic_addba_response_timeout = lkpi_ic_addba_response_timeout;
7581 
7582 		lhw->ic_bar_response = ic->ic_bar_response;
7583 		ic->ic_bar_response = lkpi_ic_bar_response;
7584 
7585 		lhw->ic_ampdu_rx_start = ic->ic_ampdu_rx_start;
7586 		ic->ic_ampdu_rx_start = lkpi_ic_ampdu_rx_start;
7587 		lhw->ic_ampdu_rx_stop = ic->ic_ampdu_rx_stop;
7588 		ic->ic_ampdu_rx_stop = lkpi_ic_ampdu_rx_stop;
7589 	}
7590 #endif
7591 
7592 	lkpi_radiotap_attach(lhw);
7593 
7594 	/*
7595 	 * Assign the first possible channel for now;  seems Realtek drivers
7596 	 * expect one.
7597 	 * Also remember the amount of bands we support and the most rates
7598 	 * in any band so we can scale [(ext) sup rates] IE(s) accordingly.
7599 	 */
7600 	lhw->supbands = lhw->max_rates = 0;
7601 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
7602 		struct ieee80211_supported_band *supband;
7603 		struct linuxkpi_ieee80211_channel *channels;
7604 
7605 		supband = hw->wiphy->bands[band];
7606 		if (supband == NULL || supband->n_channels == 0)
7607 			continue;
7608 
7609 		lhw->supbands++;
7610 		lhw->max_rates = max(lhw->max_rates, supband->n_bitrates);
7611 
7612 		/* If we have a channel, we need to keep counting supbands. */
7613 		if (hw->conf.chandef.chan != NULL)
7614 			continue;
7615 
7616 		channels = supband->channels;
7617 		for (i = 0; i < supband->n_channels; i++) {
7618 
7619 			if (channels[i].flags & IEEE80211_CHAN_DISABLED)
7620 				continue;
7621 
7622 			cfg80211_chandef_create(&hw->conf.chandef, &channels[i],
7623 #ifdef LKPI_80211_HT
7624 			    (ic->ic_flags_ht & IEEE80211_FHT_HT) ? NL80211_CHAN_HT20 :
7625 #endif
7626 			    NL80211_CHAN_NO_HT);
7627 			lhw->dflt_chandef = hw->conf.chandef;
7628 #ifdef LINUXKPI_DEBUG_80211
7629 			if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
7630 				ic_printf(ic, "%s:%d: initialized "
7631 				    "hw->conf.chandef and dflt_chandef to %p\n",
7632 				    __func__, __LINE__, &lhw->dflt_chandef);
7633 #endif
7634 			break;
7635 		}
7636 	}
7637 
7638 	IMPROVE("see net80211::ieee80211_chan_init vs. wiphy->bands[].bitrates possibly in lkpi_ic_getradiocaps?");
7639 
7640 	/* Make sure we do not support more than net80211 is willing to take. */
7641 	if (lhw->max_rates > IEEE80211_RATE_MAXSIZE) {
7642 		ic_printf(ic, "%s: limiting max_rates %d to %d!\n", __func__,
7643 		    lhw->max_rates, IEEE80211_RATE_MAXSIZE);
7644 		lhw->max_rates = IEEE80211_RATE_MAXSIZE;
7645 	}
7646 
7647 	/*
7648 	 * The maximum supported bitrates on any band + size for
7649 	 * DSSS Parameter Set give our per-band IE size.
7650 	 * SSID is the responsibility of the driver and goes on the side.
7651 	 * The user specified bits coming from the vap go into the
7652 	 * "common ies" fields.
7653 	 */
7654 	lhw->scan_ie_len = 2 + IEEE80211_RATE_SIZE;
7655 	if (lhw->max_rates > IEEE80211_RATE_SIZE)
7656 		lhw->scan_ie_len += 2 + (lhw->max_rates - IEEE80211_RATE_SIZE);
7657 
7658 	if (hw->wiphy->features & NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) {
7659 		/*
7660 		 * net80211 does not seem to support the DSSS Parameter Set but
7661 		 * some of the drivers insert it so calculate the extra fixed
7662 		 * space in.
7663 		 */
7664 		lhw->scan_ie_len += 2 + 1;
7665 	}
7666 
7667 #if defined(LKPI_80211_HT)
7668 	if ((ic->ic_htcaps & IEEE80211_HTC_HT) != 0)
7669 		lhw->scan_ie_len += sizeof(struct ieee80211_ie_htcap);
7670 #endif
7671 #if defined(LKPI_80211_VHT)
7672 	if (IEEE80211_CONF_VHT(ic))
7673 		lhw->scan_ie_len += 2 + sizeof(struct ieee80211_vht_cap);
7674 #endif
7675 
7676 	/* Reduce the max_scan_ie_len "left" by the amount we consume already. */
7677 	if (hw->wiphy->max_scan_ie_len > 0) {
7678 		if (lhw->scan_ie_len > hw->wiphy->max_scan_ie_len)
7679 			goto err;
7680 		hw->wiphy->max_scan_ie_len -= lhw->scan_ie_len;
7681 	}
7682 
7683 	if (bootverbose) {
7684 		if (hw->netdev_features != 0)
7685 			ic_printf(ic, "netdev_features %b\n",
7686 			    hw->netdev_features, NETIF_F_BITS);
7687 		ieee80211_announce(ic);
7688 	}
7689 
7690 	return (0);
7691 err:
7692 	IMPROVE("TODO FIXME CLEANUP");
7693 	return (-EAGAIN);
7694 }
7695 
7696 void
7697 linuxkpi_ieee80211_ifdetach(struct ieee80211_hw *hw)
7698 {
7699 	struct lkpi_hw *lhw;
7700 	struct ieee80211com *ic;
7701 
7702 	lhw = HW_TO_LHW(hw);
7703 	ic = lhw->ic;
7704 	ieee80211_ifdetach(ic);
7705 }
7706 
7707 void
7708 linuxkpi_ieee80211_iterate_interfaces(struct ieee80211_hw *hw,
7709     enum ieee80211_iface_iter flags,
7710     void(*iterfunc)(void *, uint8_t *, struct ieee80211_vif *),
7711     void *arg)
7712 {
7713 	struct lkpi_hw *lhw;
7714 	struct lkpi_vif *lvif;
7715 	struct ieee80211_vif *vif;
7716 	bool active, atomic, nin_drv;
7717 
7718 	lhw = HW_TO_LHW(hw);
7719 
7720 	if (flags & ~(IEEE80211_IFACE_ITER_NORMAL|
7721 	    IEEE80211_IFACE_ITER_RESUME_ALL|
7722 	    IEEE80211_IFACE_SKIP_SDATA_NOT_IN_DRIVER|
7723 	    IEEE80211_IFACE_ITER_ACTIVE|IEEE80211_IFACE_ITER__ATOMIC|
7724 	    IEEE80211_IFACE_ITER__MTX)) {
7725 		ic_printf(lhw->ic, "XXX TODO %s flags(%#x) not yet supported.\n",
7726 		    __func__, flags);
7727 	}
7728 
7729 	if ((flags & IEEE80211_IFACE_ITER__MTX) != 0)
7730 		lockdep_assert_wiphy(hw->wiphy);
7731 
7732 	active = (flags & IEEE80211_IFACE_ITER_ACTIVE) != 0;
7733 	atomic = (flags & IEEE80211_IFACE_ITER__ATOMIC) != 0;
7734 	nin_drv = (flags & IEEE80211_IFACE_SKIP_SDATA_NOT_IN_DRIVER) != 0;
7735 
7736 	if (atomic) {
7737 		IMPROVE("LKPI_80211_LHW_LVIF_LOCK atomic assume to be rcu?");
7738 		LKPI_80211_LHW_LVIF_LOCK(lhw);
7739 	}
7740 	TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
7741 		struct ieee80211vap *vap;
7742 
7743 		vif = LVIF_TO_VIF(lvif);
7744 
7745 		/*
7746 		 * If we want "active" interfaces, we need to distinguish on
7747 		 * whether the driver knows about them or not to be able to
7748 		 * handle the "resume" case correctly.  Skip the ones the
7749 		 * driver does not know about.
7750 		 */
7751 		if (active && !lvif->added_to_drv &&
7752 		    (flags & IEEE80211_IFACE_ITER_RESUME_ALL) != 0)
7753 			continue;
7754 
7755 		/*
7756 		 * If we shall skip interfaces not added to the driver do so
7757 		 * if we haven't yet.
7758 		 */
7759 		if (nin_drv && !lvif->added_to_drv)
7760 			continue;
7761 
7762 		/*
7763 		 * Run the iterator function if we are either not asking
7764 		 * asking for active only or if the VAP is "running".
7765 		 */
7766 		/* XXX-BZ probably should have state in the lvif as well. */
7767 		vap = LVIF_TO_VAP(lvif);
7768 		if (!active || (vap->iv_state != IEEE80211_S_INIT))
7769 			iterfunc(arg, vif->addr, vif);
7770 	}
7771 	if (atomic)
7772 		LKPI_80211_LHW_LVIF_UNLOCK(lhw);
7773 }
7774 
7775 static void
7776 lkpi_ieee80211_iterate_keys(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
7777     ieee80211_keyix keyix, struct lkpi_sta *lsta,
7778     void(*iterfunc)(struct ieee80211_hw *, struct ieee80211_vif *,
7779 	struct ieee80211_sta *, struct ieee80211_key_conf *, void *),
7780     void *arg)
7781 {
7782 #ifdef LINUXKPI_DEBUG_80211
7783 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
7784 		net80211_vap_printf(LVIF_TO_VAP(VIF_TO_LVIF(vif)),
7785 		    "%s:%d: lsta %6D added_to_drv %d kc[keyix %u] %p\n",
7786 		    __func__, __LINE__, LSTA_TO_STA(lsta)->addr, ":",
7787 		    lsta->added_to_drv, keyix, lsta->kc[keyix]);
7788 #endif
7789 
7790 	if (!lsta->added_to_drv)
7791 		return;
7792 
7793 	if (lsta->kc[keyix] == NULL)
7794 		return;
7795 
7796 	iterfunc(hw, vif, LSTA_TO_STA(lsta), lsta->kc[keyix], arg);
7797 }
7798 
7799 void
7800 linuxkpi_ieee80211_iterate_keys(struct ieee80211_hw *hw,
7801     struct ieee80211_vif *vif,
7802     void(*iterfunc)(struct ieee80211_hw *, struct ieee80211_vif *,
7803         struct ieee80211_sta *, struct ieee80211_key_conf *, void *),
7804     void *arg, bool rcu)
7805 {
7806 	struct lkpi_sta *lsta;
7807 	struct lkpi_vif *lvif;
7808 
7809 	lvif = VIF_TO_LVIF(vif);
7810 
7811 	if (rcu) {
7812 		rcu_read_lock_held();		/* XXX-BZ is this correct? */
7813 
7814 		if (vif == NULL) {
7815 			TODO();
7816 		} else {
7817 			list_for_each_entry_rcu(lsta, &lvif->lsta_list, lsta_list) {
7818 				for (ieee80211_keyix keyix = 0; keyix < nitems(lsta->kc);
7819 				    keyix++)
7820 					lkpi_ieee80211_iterate_keys(hw, vif,
7821 					    keyix, lsta, iterfunc, arg);
7822 			}
7823 		}
7824 	} else {
7825 		TODO("Used by suspend/resume; order of keys as installed to "
7826 		"firmware is important; we'll need to rewrite some code for that");
7827 		lockdep_assert_wiphy(hw->wiphy);
7828 
7829 		if (vif == NULL) {
7830 			TODO();
7831 		} else {
7832 			list_for_each_entry(lsta, &lvif->lsta_list, lsta_list) {
7833 				for (ieee80211_keyix keyix = 0; keyix < nitems(lsta->kc);
7834 				    keyix++)
7835 					lkpi_ieee80211_iterate_keys(hw, vif,
7836 					    keyix, lsta, iterfunc, arg);
7837 			}
7838 		}
7839 	}
7840 }
7841 
7842 void
7843 linuxkpi_ieee80211_iterate_chan_contexts(struct ieee80211_hw *hw,
7844     void(*iterfunc)(struct ieee80211_hw *, struct ieee80211_chanctx_conf *,
7845 	void *),
7846     void *arg)
7847 {
7848 	struct lkpi_hw *lhw;
7849 	struct lkpi_chanctx *lchanctx;
7850 
7851 	KASSERT(hw != NULL && iterfunc != NULL,
7852 	    ("%s: hw %p iterfunc %p arg %p\n", __func__, hw, iterfunc, arg));
7853 
7854 	lhw = HW_TO_LHW(hw);
7855 
7856 	rcu_read_lock();
7857 	list_for_each_entry_rcu(lchanctx, &lhw->lchanctx_list, entry) {
7858 		if (!lchanctx->added_to_drv)
7859 			continue;
7860 		iterfunc(hw, &lchanctx->chanctx_conf, arg);
7861 	}
7862 	rcu_read_unlock();
7863 }
7864 
7865 void
7866 linuxkpi_ieee80211_iterate_stations_atomic(struct ieee80211_hw *hw,
7867    void (*iterfunc)(void *, struct ieee80211_sta *), void *arg)
7868 {
7869 	struct lkpi_hw *lhw;
7870 	struct lkpi_vif *lvif;
7871 	struct lkpi_sta *lsta;
7872 	struct ieee80211_sta *sta;
7873 
7874 	KASSERT(hw != NULL && iterfunc != NULL,
7875 	    ("%s: hw %p iterfunc %p arg %p\n", __func__, hw, iterfunc, arg));
7876 
7877 	lhw = HW_TO_LHW(hw);
7878 
7879 	LKPI_80211_LHW_LVIF_LOCK(lhw);
7880 	TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
7881 
7882 		rcu_read_lock();
7883 		list_for_each_entry_rcu(lsta, &lvif->lsta_list, lsta_list) {
7884 			if (!lsta->added_to_drv)
7885 				continue;
7886 			sta = LSTA_TO_STA(lsta);
7887 			iterfunc(arg, sta);
7888 		}
7889 		rcu_read_unlock();
7890 	}
7891 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
7892 }
7893 
7894 struct linuxkpi_ieee80211_regdomain *
7895 lkpi_get_linuxkpi_ieee80211_regdomain(size_t n)
7896 {
7897 	struct linuxkpi_ieee80211_regdomain *regd;
7898 
7899 	regd = kzalloc(sizeof(*regd) + n * sizeof(struct ieee80211_reg_rule),
7900 	    GFP_KERNEL);
7901 	return (regd);
7902 }
7903 
7904 int
7905 linuxkpi_regulatory_set_wiphy_regd_sync(struct wiphy *wiphy,
7906     struct linuxkpi_ieee80211_regdomain *regd)
7907 {
7908 	struct lkpi_hw *lhw;
7909 	struct ieee80211com *ic;
7910 	struct ieee80211_regdomain *rd;
7911 
7912 	lhw = wiphy_priv(wiphy);
7913 	ic = lhw->ic;
7914 
7915 	rd = &ic->ic_regdomain;
7916 	if (rd->isocc[0] == '\0') {
7917 		rd->isocc[0] = regd->alpha2[0];
7918 		rd->isocc[1] = regd->alpha2[1];
7919 	}
7920 
7921 	TODO();
7922 	/* XXX-BZ finish the rest. */
7923 
7924 	return (0);
7925 }
7926 
7927 void
7928 linuxkpi_ieee80211_scan_completed(struct ieee80211_hw *hw,
7929     struct cfg80211_scan_info *info)
7930 {
7931 	struct lkpi_hw *lhw;
7932 	struct ieee80211com *ic;
7933 	struct ieee80211_scan_state *ss;
7934 
7935 	lhw = wiphy_priv(hw->wiphy);
7936 	ic = lhw->ic;
7937 	ss = ic->ic_scan;
7938 
7939 	TRACE_SCAN(ic, "scan_flags %b info { %ju, %6D, aborted %d }",
7940 	    lhw->scan_flags, LKPI_LHW_SCAN_BITS,
7941 	    (uintmax_t)info->scan_start_tsf, info->tsf_bssid, ":",
7942 	    info->aborted);
7943 
7944 	ieee80211_scan_done(ss->ss_vap);
7945 
7946 	LKPI_80211_LHW_SCAN_LOCK(lhw);
7947 	free(lhw->hw_req, M_LKPI80211);
7948 	lhw->hw_req = NULL;
7949 	lhw->scan_flags &= ~LKPI_LHW_SCAN_RUNNING;
7950 	/* The wakeup(lhw) will be called from lkpi_ic_scan_end(). */
7951 	/* wakeup(lhw); */
7952 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
7953 
7954 	return;
7955 }
7956 
7957 static void
7958 lkpi_80211_lhw_rxq_rx_one(struct lkpi_hw *lhw, struct mbuf *m)
7959 {
7960 	struct ieee80211_node *ni;
7961 #ifdef LKPI_80211_USE_MTAG
7962 	struct m_tag *mtag;
7963 #endif
7964 	int ok;
7965 
7966 	ni = NULL;
7967 #ifdef LKPI_80211_USE_MTAG
7968         mtag = m_tag_locate(m, MTAG_ABI_LKPI80211, LKPI80211_TAG_RXNI, NULL);
7969 	if (mtag != NULL) {
7970 		struct lkpi_80211_tag_rxni *rxni;
7971 
7972 		rxni = (struct lkpi_80211_tag_rxni *)(mtag + 1);
7973 		ni = rxni->ni;
7974 	}
7975 #else
7976 	if (m->m_pkthdr.PH_loc.ptr != NULL) {
7977 		ni = m->m_pkthdr.PH_loc.ptr;
7978 		m->m_pkthdr.PH_loc.ptr = NULL;
7979 	}
7980 #endif
7981 
7982 	if (ni != NULL) {
7983 		ok = ieee80211_input_mimo(ni, m);
7984 		ieee80211_free_node(ni);		/* Release the reference. */
7985 		if (ok < 0)
7986 			m_freem(m);
7987 	} else {
7988 		ok = ieee80211_input_mimo_all(lhw->ic, m);
7989 		/* mbuf got consumed. */
7990 	}
7991 
7992 #ifdef LINUXKPI_DEBUG_80211
7993 	if (linuxkpi_debug_80211 & D80211_TRACE_RX)
7994 		printf("TRACE-RX: %s: handled frame type %#0x\n", __func__, ok);
7995 #endif
7996 }
7997 
7998 static void
7999 lkpi_80211_lhw_rxq_task(void *ctx, int pending)
8000 {
8001 	struct lkpi_hw *lhw;
8002 	struct mbufq mq;
8003 	struct mbuf *m;
8004 
8005 	lhw = ctx;
8006 
8007 #ifdef LINUXKPI_DEBUG_80211
8008 	if (linuxkpi_debug_80211 & D80211_TRACE_RX)
8009 		printf("TRACE-RX: %s: lhw %p pending %d mbuf_qlen %d\n",
8010 		    __func__, lhw, pending, mbufq_len(&lhw->rxq));
8011 #endif
8012 
8013 	mbufq_init(&mq, IFQ_MAXLEN);
8014 
8015 	LKPI_80211_LHW_RXQ_LOCK(lhw);
8016 	mbufq_concat(&mq, &lhw->rxq);
8017 	LKPI_80211_LHW_RXQ_UNLOCK(lhw);
8018 
8019 	m = mbufq_dequeue(&mq);
8020 	while (m != NULL) {
8021 		lkpi_80211_lhw_rxq_rx_one(lhw, m);
8022 		m = mbufq_dequeue(&mq);
8023 	}
8024 }
8025 
8026 static void
8027 lkpi_convert_rx_status(struct ieee80211_hw *hw, struct lkpi_sta *lsta,
8028     struct ieee80211_rx_status *rx_status,
8029     struct ieee80211_rx_stats *rx_stats,
8030     uint8_t *rssip)
8031 {
8032 	struct ieee80211_supported_band *supband;
8033 	struct rate_info rxrate;
8034 	int i;
8035 	uint8_t rssi;
8036 
8037 	memset(&rxrate, 0, sizeof(rxrate));
8038 	memset(rx_stats, 0, sizeof(*rx_stats));
8039 	rx_stats->r_flags = IEEE80211_R_NF | IEEE80211_R_RSSI;
8040 	/* XXX-BZ correct hardcoded noise floor, survey data? */
8041 	rx_stats->c_nf = -96;
8042 	if (ieee80211_hw_check(hw, SIGNAL_DBM) &&
8043 	    !(rx_status->flag & RX_FLAG_NO_SIGNAL_VAL))
8044 		rssi = rx_status->signal;
8045 	else
8046 		rssi = rx_stats->c_nf;
8047 	/*
8048 	 * net80211 signal strength data are in .5 dBm units relative to
8049 	 * the current noise floor (see comment in ieee80211_node.h).
8050 	 */
8051 	rssi -= rx_stats->c_nf;
8052 	if (rssip != NULL)
8053 		*rssip = rssi;
8054 	rx_stats->c_rssi = rssi * 2;
8055 	rx_stats->r_flags |= IEEE80211_R_BAND;
8056 	rx_stats->c_band =
8057 	    lkpi_nl80211_band_to_net80211_band(rx_status->band);
8058 	rx_stats->r_flags |= IEEE80211_R_FREQ | IEEE80211_R_IEEE;
8059 	rx_stats->c_freq = rx_status->freq;
8060 	rx_stats->c_ieee = ieee80211_mhz2ieee(rx_stats->c_freq, rx_stats->c_band);
8061 
8062 	rx_stats->c_rx_tsf = rx_status->mactime;
8063 
8064 	/* XXX RX_FLAG_MACTIME_IS_RTAP_TS64 ? */
8065 	if ((rx_status->flag & RX_FLAG_MACTIME) ==
8066 	    (RX_FLAG_MACTIME_START|RX_FLAG_MACTIME_END)) {
8067 		rx_stats->r_flags |= IEEE80211_R_TSF64;
8068 		/* XXX RX_FLAG_MACTIME_PLCP_START ? */
8069 		if ((rx_status->flag & RX_FLAG_MACTIME) == RX_FLAG_MACTIME_START)
8070 			rx_stats->r_flags |= IEEE80211_R_TSF_START;
8071 		if ((rx_status->flag & RX_FLAG_MACTIME) == RX_FLAG_MACTIME_END)
8072 			rx_stats->r_flags |= IEEE80211_R_TSF_END;
8073 		/* XXX-BZ if TSF_END will net80211 do the unwind of time? */
8074 	}
8075 
8076 	if (rx_status->chains != 0) {
8077 		int cc;
8078 		int8_t crssi;
8079 
8080 		rx_stats->c_chain = rx_status->chains;
8081 		rx_stats->r_flags |= IEEE80211_R_C_CHAIN;
8082 
8083 		cc = 0;
8084 		for (i = 0; i < nitems(rx_status->chain_signal); i++) {
8085 			if (!(rx_status->chains & BIT(i)))
8086 				continue;
8087 			crssi = rx_status->chain_signal[i];
8088 			crssi -= rx_stats->c_nf;
8089 			rx_stats->c_rssi_ctl[i] = crssi * 2;
8090 			rx_stats->c_rssi_ext[i] = crssi * 2;	/* XXX _ext ??? ATH thing? */
8091 			/* We currently only have the global noise floor value. */
8092 			rx_stats->c_nf_ctl[i] = rx_stats->c_nf;
8093 			rx_stats->c_nf_ext[i] = rx_stats->c_nf;
8094 			cc++;
8095 		}
8096 		if (cc > 0)
8097 			 rx_stats->r_flags |= (IEEE80211_R_C_NF | IEEE80211_R_C_RSSI);
8098 	}
8099 
8100 	/* XXX-NET80211 We are not going to populate c_phytype! */
8101 
8102 	switch (rx_status->encoding) {
8103 	case RX_ENC_LEGACY:
8104 	{
8105 		uint32_t legacy = 0;
8106 
8107 		supband = hw->wiphy->bands[rx_status->band];
8108 		if (supband != NULL)
8109 			legacy = supband->bitrates[rx_status->rate_idx].bitrate;
8110 		rx_stats->c_rate = legacy;
8111 		rxrate.legacy = legacy;
8112 		/* Is there a LinuxKPI way of reporting IEEE80211_RX_F_CCK / _OFDM? */
8113 		break;
8114 	}
8115 	case RX_ENC_HT:
8116 		rx_stats->c_pktflags |= IEEE80211_RX_F_HT;
8117 		rx_stats->c_rate = rx_status->rate_idx;		/* mcs */
8118 		rxrate.flags |= RATE_INFO_FLAGS_MCS;
8119 		rxrate.mcs = rx_status->rate_idx;
8120 		if ((rx_status->enc_flags & RX_ENC_FLAG_SHORT_GI) != 0) {
8121 			rx_stats->c_pktflags |= IEEE80211_RX_F_SHORTGI;
8122 			rxrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
8123 		}
8124 		break;
8125 	case RX_ENC_VHT:
8126 		rx_stats->c_pktflags |= IEEE80211_RX_F_VHT;
8127 		rx_stats->c_rate = rx_status->rate_idx;		/* mcs */
8128 		rx_stats->c_vhtnss = rx_status->nss;
8129 		rxrate.flags |= RATE_INFO_FLAGS_VHT_MCS;
8130 		rxrate.mcs = rx_status->rate_idx;
8131 		rxrate.nss = rx_status->nss;
8132 		if ((rx_status->enc_flags & RX_ENC_FLAG_SHORT_GI) != 0) {
8133 			rx_stats->c_pktflags |= IEEE80211_RX_F_SHORTGI;
8134 			rxrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
8135 		}
8136 		break;
8137 	case RX_ENC_HE:
8138 		rxrate.flags |= RATE_INFO_FLAGS_HE_MCS;
8139 		rxrate.mcs = rx_status->rate_idx;
8140 		rxrate.nss = rx_status->nss;
8141 		/* XXX TODO */
8142 		TODO("net80211 has not matching encoding for %u", rx_status->encoding);
8143 		break;
8144 	case RX_ENC_EHT:
8145 		rxrate.flags |= RATE_INFO_FLAGS_EHT_MCS;
8146 		rxrate.mcs = rx_status->rate_idx;
8147 		rxrate.nss = rx_status->nss;
8148 		/* XXX TODO */
8149 		TODO("net80211 has not matching encoding for %u", rx_status->encoding);
8150 		break;
8151 	}
8152 
8153 	rxrate.bw = rx_status->bw;
8154 	switch (rx_status->bw) {
8155 	case RATE_INFO_BW_20:
8156 		rx_stats->c_width = IEEE80211_RX_FW_20MHZ;
8157 		break;
8158 	case RATE_INFO_BW_40:
8159 		rx_stats->c_width = IEEE80211_RX_FW_40MHZ;
8160 		break;
8161 	case RATE_INFO_BW_80:
8162 		rx_stats->c_width = IEEE80211_RX_FW_80MHZ;
8163 		break;
8164 	case RATE_INFO_BW_160:
8165 		rx_stats->c_width = IEEE80211_RX_FW_160MHZ;
8166 		break;
8167 	case RATE_INFO_BW_320:
8168 	case RATE_INFO_BW_HE_RU:
8169 	case RATE_INFO_BW_EHT_RU:
8170 	case RATE_INFO_BW_5:
8171 	case RATE_INFO_BW_10:
8172 		TODO("net80211 has not matching bandwidth for %u", rx_status->bw);
8173 		break;
8174 	}
8175 
8176 	if ((rx_status->enc_flags & RX_ENC_FLAG_LDPC) != 0)
8177 		rx_stats->c_pktflags |= IEEE80211_RX_F_LDPC;
8178 	if ((rx_status->enc_flags & RX_ENC_FLAG_STBC_MASK) != 0)
8179 		 rx_stats->c_pktflags |= IEEE80211_RX_F_STBC;
8180 
8181 	/*
8182 	 * We only need these for LKPI_80211_HW_CRYPTO in theory but in
8183 	 * case the hardware does something we do not expect always leave
8184 	 * these enabled.  Leaving this commant as documentation for the || 1.
8185 	 */
8186 #if defined(LKPI_80211_HW_CRYPTO) || 1
8187 	if (rx_status->flag & RX_FLAG_DECRYPTED) {
8188 		rx_stats->c_pktflags |= IEEE80211_RX_F_DECRYPTED;
8189 		/* Only valid if decrypted is set. */
8190 		if (rx_status->flag & RX_FLAG_PN_VALIDATED)
8191 			rx_stats->c_pktflags |= IEEE80211_RX_F_PN_VALIDATED;
8192 	}
8193 	if (rx_status->flag & RX_FLAG_IV_STRIPPED)
8194 		rx_stats->c_pktflags |= IEEE80211_RX_F_IV_STRIP;
8195 	if (rx_status->flag & RX_FLAG_ICV_STRIPPED)
8196 		rx_stats->c_pktflags |= IEEE80211_RX_F_ICV_STRIP;
8197 	if (rx_status->flag & RX_FLAG_MIC_STRIPPED)
8198 		rx_stats->c_pktflags |= IEEE80211_RX_F_MIC_STRIP;
8199 	if (rx_status->flag & RX_FLAG_MMIC_STRIPPED)
8200 		rx_stats->c_pktflags |= IEEE80211_RX_F_MMIC_STRIP;
8201 	if (rx_status->flag & RX_FLAG_MMIC_ERROR)
8202 		rx_stats->c_pktflags |= IEEE80211_RX_F_FAIL_MMIC;
8203 	if (rx_status->flag & RX_FLAG_FAILED_FCS_CRC)
8204 		rx_stats->c_pktflags |= IEEE80211_RX_F_FAIL_FCSCRC;
8205 #endif
8206 
8207 	/* Fill in some sinfo bits to fill gaps not reported byt the driver. */
8208 	if (lsta != NULL) {
8209 		memcpy(&lsta->sinfo.rxrate, &rxrate, sizeof(rxrate));
8210 		lsta->sinfo.filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
8211 
8212 		if (rx_status->chains != 0) {
8213 			lsta->sinfo.chains = rx_status->chains;
8214 			memcpy(lsta->sinfo.chain_signal, rx_status->chain_signal,
8215 			    sizeof(lsta->sinfo.chain_signal));
8216 			lsta->sinfo.filled |= BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL);
8217 		}
8218 	}
8219 }
8220 
8221 #ifdef LINUXKPI_DEBUG_80211
8222 static void
8223 lkpi_rx_log_beacon(struct mbuf *m, struct lkpi_hw *lhw,
8224     struct ieee80211_rx_status *rx_status)
8225 {
8226 	struct ieee80211_mgmt *f;
8227 	uint8_t *e;
8228 	char ssid[IEEE80211_NWID_LEN * 4 + 1];
8229 
8230 	memset(ssid, '\0', sizeof(ssid));
8231 
8232 	f = mtod(m, struct ieee80211_mgmt *);
8233 	e = f->u.beacon.variable;
8234 	/*
8235 	 * Usually SSID is right after the fixed part and for debugging we will
8236 	 * be fine should we miss it if it is not.
8237 	 */
8238 	while ((e - (uint8_t *)f) < m->m_len) {
8239 		if (*e == IEEE80211_ELEMID_SSID)
8240 			break;
8241 		e += (2 + *(e + 1));
8242 	}
8243 	if (*e == IEEE80211_ELEMID_SSID) {
8244 		int i, len;
8245 		char *p;
8246 
8247 		p = ssid;
8248 		len = m->m_len - ((e + 2) - (uint8_t *)f);
8249 		if (len > *(e + 1))
8250 			len = *(e + 1);
8251 		e += 2;
8252 		for (i = 0; i < len; i++) {
8253 			/* Printable character? */
8254 			if (*e >= 0x20 && *e < 0x7f) {
8255 				*p++ = *e++;
8256 			} else {
8257 				snprintf(p, 5, "%#04x", *e++);
8258 				p += 4;
8259 			}
8260 		}
8261 		*p = '\0';
8262 	}
8263 
8264 	/* We print skb, skb->data, m as we are seeing 'ghost beacons'. */
8265 	TRACE_SCAN_BEACON(lhw->ic, "Beacon: scan_flags %b, band %s freq %u chan %-4d "
8266 	    "len %d { %#06x %#06x %6D %6D %6D %#06x %ju %u %#06x SSID '%s' }",
8267 	    lhw->scan_flags, LKPI_LHW_SCAN_BITS,
8268 	    lkpi_nl80211_band_name(rx_status->band), rx_status->freq,
8269 	    linuxkpi_ieee80211_frequency_to_channel(rx_status->freq, 0),
8270 	    m->m_pkthdr.len, f->frame_control, f->duration_id,
8271 	    f->da, ":", f->sa, ":", f->bssid, ":", f->seq_ctrl,
8272 	    (uintmax_t)le64_to_cpu(f->u.beacon.timestamp),
8273 	    le16_to_cpu(f->u.beacon.beacon_int),
8274 	    le16_to_cpu(f->u.beacon.capab_info), ssid);
8275 }
8276 #endif
8277 
8278 /* For %list see comment towards the end of the function. */
8279 void
8280 linuxkpi_ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
8281     struct ieee80211_sta *sta, struct napi_struct *napi __unused,
8282     struct list_head *list __unused)
8283 {
8284 	struct lkpi_hw *lhw;
8285 	struct ieee80211com *ic;
8286 	struct mbuf *m;
8287 	struct skb_shared_info *shinfo;
8288 	struct ieee80211_rx_status *rx_status;
8289 	struct ieee80211_rx_stats rx_stats;
8290 	struct ieee80211_node *ni;
8291 	struct ieee80211vap *vap;
8292 	struct ieee80211_hdr *hdr;
8293 	struct lkpi_sta *lsta;
8294 	int i, offset, ok, error;
8295 	uint8_t rssi;
8296 	bool is_beacon;
8297 
8298 	lhw = HW_TO_LHW(hw);
8299 	ic = lhw->ic;
8300 
8301 	if (skb->len < 2) {
8302 		/* Need 80211 stats here. */
8303 		counter_u64_add(ic->ic_ierrors, 1);
8304 		IMPROVE();
8305 		goto err;
8306 	}
8307 
8308 	/*
8309 	 * For now do the data copy; we can later improve things. Might even
8310 	 * have an mbuf backing the skb data then?
8311 	 */
8312 	m = m_get3(skb->len, M_NOWAIT, MT_DATA, M_PKTHDR);
8313 	if (m == NULL) {
8314 		counter_u64_add(ic->ic_ierrors, 1);
8315 		goto err;
8316 	}
8317 	m_copyback(m, 0, skb->tail - skb->data, skb->data);
8318 
8319 	shinfo = skb_shinfo(skb);
8320 	offset = m->m_len;
8321 	for (i = 0; i < shinfo->nr_frags; i++) {
8322 		m_copyback(m, offset, shinfo->frags[i].size,
8323 		    (uint8_t *)linux_page_address(shinfo->frags[i].page) +
8324 		    shinfo->frags[i].offset);
8325 		offset += shinfo->frags[i].size;
8326 	}
8327 
8328 	rx_status = IEEE80211_SKB_RXCB(skb);
8329 
8330 	hdr = (void *)skb->data;
8331 	is_beacon = ieee80211_is_beacon(hdr->frame_control);
8332 
8333 #ifdef LINUXKPI_DEBUG_80211
8334 	/*
8335 	 * We use the mbuf here as otherwise the variable part might
8336 	 * be in skb frags.
8337 	 */
8338 	if (is_beacon && ((linuxkpi_debug_80211 & D80211_SCAN_BEACON) != 0))
8339 		lkpi_rx_log_beacon(m, lhw, rx_status);
8340 
8341 	if (is_beacon && (linuxkpi_debug_80211 & D80211_TRACE_RX_BEACONS) == 0 &&
8342 	   (linuxkpi_debug_80211 & D80211_SCAN_BEACON) == 0)
8343 		goto no_trace_beacons;
8344 
8345 	if (linuxkpi_debug_80211 & D80211_TRACE_RX)
8346 		printf("TRACE-RX: %s: skb %p l/d/t-len (%u/%u/%u) "
8347 		    "h %p d %p t %p e %p sh %p (%u) m %p plen %u len %u%s\n",
8348 		    __func__, skb, skb->len, skb->data_len,
8349 		    skb->truesize, skb->head, skb->data, skb->tail, skb->end,
8350 		    shinfo, shinfo->nr_frags,
8351 		    m, m->m_pkthdr.len, m->m_len, is_beacon ? " beacon" : "");
8352 
8353 	if (linuxkpi_debug_80211 & D80211_TRACE_RX_DUMP)
8354 		hexdump(mtod(m, const void *), m->m_len, "RX (raw) ", 0);
8355 
8356 	/* Implement a dump_rxcb() !!! */
8357 	if ((linuxkpi_debug_80211 & D80211_TRACE_RX) != 0 ||
8358 	    (linuxkpi_debug_80211 & D80211_SCAN_BEACON) != 0)
8359 		printf("TRACE-RX: %s: RXCB: %ju %ju %u, %b, %u, %#0x, %#0x, "
8360 		    "%u band %u, %u { %d %d %d %d }, %d, %#x %#x %#x %#x %u %u %u\n",
8361 			__func__,
8362 			(uintmax_t)rx_status->boottime_ns,
8363 			(uintmax_t)rx_status->mactime,
8364 			rx_status->device_timestamp,
8365 			rx_status->flag, IEEE80211_RX_STATUS_FLAGS_BITS,
8366 			rx_status->freq,
8367 			rx_status->bw,
8368 			rx_status->encoding,
8369 			rx_status->ampdu_reference,
8370 			rx_status->band,
8371 			rx_status->chains,
8372 			rx_status->chain_signal[0],
8373 			rx_status->chain_signal[1],
8374 			rx_status->chain_signal[2],
8375 			rx_status->chain_signal[3],
8376 			rx_status->signal,
8377 			rx_status->enc_flags,
8378 			rx_status->he_dcm,
8379 			rx_status->he_gi,
8380 			rx_status->he_ru,
8381 			rx_status->zero_length_psdu_type,
8382 			rx_status->nss,
8383 			rx_status->rate_idx);
8384 no_trace_beacons:
8385 #endif
8386 
8387 	lsta = NULL;
8388 	if (sta != NULL) {
8389 		lsta = STA_TO_LSTA(sta);
8390 		ni = ieee80211_ref_node(lsta->ni);
8391 	} else {
8392 		struct ieee80211_frame_min *wh;
8393 
8394 		wh = mtod(m, struct ieee80211_frame_min *);
8395 		ni = ieee80211_find_rxnode(ic, wh);
8396 		if (ni != NULL)
8397 			lsta = ni->ni_drv_data;
8398 	}
8399 
8400 	rssi = 0;
8401 	lkpi_convert_rx_status(hw, lsta, rx_status, &rx_stats, &rssi);
8402 
8403 	ok = ieee80211_add_rx_params(m, &rx_stats);
8404 	if (ok == 0) {
8405 		m_freem(m);
8406 		counter_u64_add(ic->ic_ierrors, 1);
8407 		goto err;
8408 	}
8409 
8410 	if (ni != NULL)
8411 		vap = ni->ni_vap;
8412 	else
8413 		/*
8414 		 * XXX-BZ can we improve this by looking at the frame hdr
8415 		 * or other meta-data passed up?
8416 		 */
8417 		vap = TAILQ_FIRST(&ic->ic_vaps);
8418 
8419 #ifdef LINUXKPI_DEBUG_80211
8420 	if (linuxkpi_debug_80211 & D80211_TRACE_RX)
8421 		printf("TRACE-RX: %s: sta %p lsta %p state %d ni %p vap %p%s\n",
8422 		    __func__, sta, lsta, (lsta != NULL) ? lsta->state : -1,
8423 		    ni, vap, is_beacon ? " beacon" : "");
8424 #endif
8425 
8426 	if (ni != NULL && vap != NULL && is_beacon &&
8427 	    rx_status->device_timestamp > 0 &&
8428 	    m->m_pkthdr.len >= sizeof(struct ieee80211_frame)) {
8429 		struct lkpi_vif *lvif;
8430 		struct ieee80211_vif *vif;
8431 		struct ieee80211_frame *wh;
8432 
8433 		lvif = VAP_TO_LVIF(vap);
8434 		vif = LVIF_TO_VIF(lvif);
8435 
8436 		wh = mtod(m, struct ieee80211_frame *);
8437 		if (!IEEE80211_ADDR_EQ(wh->i_addr2, vif->cfg.ap_addr))
8438 			goto skip_device_ts;
8439 
8440 		IMPROVE("TIMING_BEACON_ONLY?");
8441 		/* mac80211 specific (not net80211) so keep it here. */
8442 		vif->bss_conf.sync_device_ts = rx_status->device_timestamp;
8443 		/*
8444 		 * net80211 should take care of the other information (sync_tsf,
8445 		 * sync_dtim_count) as otherwise we need to parse the beacon.
8446 		 */
8447 skip_device_ts:
8448 		;
8449 	}
8450 
8451 	if (vap != NULL && vap->iv_state > IEEE80211_S_INIT &&
8452 	    ieee80211_radiotap_active_vap(vap)) {
8453 		struct lkpi_radiotap_rx_hdr *rtap;
8454 
8455 		rtap = &lhw->rtap_rx;
8456 		rtap->wr_tsft = rx_status->device_timestamp;
8457 		rtap->wr_flags = 0;
8458 		if (rx_status->enc_flags & RX_ENC_FLAG_SHORTPRE)
8459 			rtap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
8460 		if (rx_status->enc_flags & RX_ENC_FLAG_SHORT_GI)
8461 			rtap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTGI;
8462 #if 0	/* .. or it does not given we strip it below. */
8463 		if (ieee80211_hw_check(hw, RX_INCLUDES_FCS))
8464 			rtap->wr_flags |= IEEE80211_RADIOTAP_F_FCS;
8465 #endif
8466 		if (rx_status->flag & RX_FLAG_FAILED_FCS_CRC)
8467 			rtap->wr_flags |= IEEE80211_RADIOTAP_F_BADFCS;
8468 		rtap->wr_rate = 0;
8469 		IMPROVE();
8470 		/* XXX TODO status->encoding / rate_index / bw */
8471 		rtap->wr_chan_freq = htole16(rx_stats.c_freq);
8472 		if (ic->ic_curchan->ic_ieee == rx_stats.c_ieee)
8473 			rtap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
8474 		rtap->wr_dbm_antsignal = rssi;
8475 		rtap->wr_dbm_antnoise = rx_stats.c_nf;
8476 	}
8477 
8478 	if (ieee80211_hw_check(hw, RX_INCLUDES_FCS))
8479 		m_adj(m, -IEEE80211_CRC_LEN);
8480 
8481 #if 0
8482 	if (list != NULL) {
8483 		/*
8484 		* Normally this would be queued up and delivered by
8485 		* netif_receive_skb_list(), napi_gro_receive(), or the like.
8486 		* See mt76::mac80211.c as only current possible consumer.
8487 		*/
8488 		IMPROVE("we simply pass the packet to net80211 to deal with.");
8489 	}
8490 #endif
8491 
8492 	/* Attach meta-information to the mbuf for the deferred RX path. */
8493 	if (ni != NULL) {
8494 #ifdef LKPI_80211_USE_MTAG
8495 		struct m_tag *mtag;
8496 		struct lkpi_80211_tag_rxni *rxni;
8497 
8498 		mtag = m_tag_alloc(MTAG_ABI_LKPI80211, LKPI80211_TAG_RXNI,
8499 		    sizeof(*rxni), IEEE80211_M_NOWAIT);
8500 		if (mtag == NULL) {
8501 			m_freem(m);
8502 			counter_u64_add(ic->ic_ierrors, 1);
8503 			goto err;
8504 		}
8505 		rxni = (struct lkpi_80211_tag_rxni *)(mtag + 1);
8506 		rxni->ni = ni;		/* We hold a reference. */
8507 		m_tag_prepend(m, mtag);
8508 #else
8509 		m->m_pkthdr.PH_loc.ptr = ni;	/* We hold a reference. */
8510 #endif
8511 	}
8512 
8513 	LKPI_80211_LHW_RXQ_LOCK(lhw);
8514 	if (lhw->rxq_stopped) {
8515 		LKPI_80211_LHW_RXQ_UNLOCK(lhw);
8516 		m_freem(m);
8517 		counter_u64_add(ic->ic_ierrors, 1);
8518 		goto err;
8519 	}
8520 
8521 	error = mbufq_enqueue(&lhw->rxq, m);
8522 	if (error != 0) {
8523 		LKPI_80211_LHW_RXQ_UNLOCK(lhw);
8524 		m_freem(m);
8525 		counter_u64_add(ic->ic_ierrors, 1);
8526 #ifdef LINUXKPI_DEBUG_80211
8527 		if (linuxkpi_debug_80211 & D80211_TRACE_RX)
8528 			ic_printf(ni->ni_ic, "%s: mbufq_enqueue failed: %d\n",
8529 			    __func__, error);
8530 #endif
8531 		goto err;
8532 	}
8533 	taskqueue_enqueue(taskqueue_thread, &lhw->rxq_task);
8534 	LKPI_80211_LHW_RXQ_UNLOCK(lhw);
8535 
8536 	IMPROVE();
8537 
8538 err:
8539 	/* The skb is ours so we can free it :-) */
8540 	kfree_skb(skb);
8541 }
8542 
8543 uint8_t
8544 linuxkpi_ieee80211_get_tid(struct ieee80211_hdr *hdr, bool nonqos_ok)
8545 {
8546 	const struct ieee80211_frame *wh;
8547 	uint8_t tid;
8548 
8549 	/* Linux seems to assume this is a QOS-Data-Frame */
8550 	KASSERT(nonqos_ok || ieee80211_is_data_qos(hdr->frame_control),
8551 	   ("%s: hdr %p fc %#06x not qos_data\n", __func__, hdr,
8552 	   hdr->frame_control));
8553 
8554 	wh = (const struct ieee80211_frame *)hdr;
8555 	tid = ieee80211_gettid(wh);
8556 	KASSERT(nonqos_ok || tid == (tid & IEEE80211_QOS_TID), ("%s: tid %u "
8557 	   "not expected (%u?)\n", __func__, tid, IEEE80211_NONQOS_TID));
8558 
8559 	return (tid);
8560 }
8561 
8562 /* -------------------------------------------------------------------------- */
8563 
8564 static void
8565 lkpi_wiphy_work(struct work_struct *work)
8566 {
8567 	struct lkpi_wiphy *lwiphy;
8568 	struct wiphy *wiphy;
8569 	struct wiphy_work *wk;
8570 
8571 	lwiphy = container_of(work, struct lkpi_wiphy, wwk);
8572 	wiphy = LWIPHY_TO_WIPHY(lwiphy);
8573 
8574 	wiphy_lock(wiphy);
8575 
8576 	LKPI_80211_LWIPHY_WORK_LOCK(lwiphy);
8577 	wk = list_first_entry_or_null(&lwiphy->wwk_list, struct wiphy_work, entry);
8578 	/* If there is nothing we do nothing. */
8579 	if (wk == NULL) {
8580 		LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8581 		wiphy_unlock(wiphy);
8582 		return;
8583 	}
8584 	list_del_init(&wk->entry);
8585 
8586 	/* More work to do? */
8587 	if (!list_empty(&lwiphy->wwk_list))
8588 		schedule_work(work);
8589 	LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8590 
8591 	/* Finally call the (*wiphy_work_fn)() function. */
8592 	wk->fn(wiphy, wk);
8593 
8594 	wiphy_unlock(wiphy);
8595 }
8596 
8597 void
8598 linuxkpi_wiphy_work_queue(struct wiphy *wiphy, struct wiphy_work *wwk)
8599 {
8600 	struct lkpi_wiphy *lwiphy;
8601 
8602 	lwiphy = WIPHY_TO_LWIPHY(wiphy);
8603 
8604 	LKPI_80211_LWIPHY_WORK_LOCK(lwiphy);
8605 	/* Do not double-queue. */
8606 	if (list_empty(&wwk->entry))
8607 		list_add_tail(&wwk->entry, &lwiphy->wwk_list);
8608 	LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8609 
8610 	/*
8611 	 * See how ieee80211_queue_work() work continues in Linux or if things
8612 	 * migrate here over time?
8613 	 * Use a system queue from linux/workqueue.h for now.
8614 	 */
8615 	queue_work(system_wq, &lwiphy->wwk);
8616 }
8617 
8618 void
8619 linuxkpi_wiphy_work_cancel(struct wiphy *wiphy, struct wiphy_work *wwk)
8620 {
8621 	struct lkpi_wiphy *lwiphy;
8622 
8623 	lwiphy = WIPHY_TO_LWIPHY(wiphy);
8624 
8625 	LKPI_80211_LWIPHY_WORK_LOCK(lwiphy);
8626 	/* Only cancel if queued. */
8627 	if (!list_empty(&wwk->entry))
8628 		list_del_init(&wwk->entry);
8629 	LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8630 }
8631 
8632 void
8633 linuxkpi_wiphy_work_flush(struct wiphy *wiphy, struct wiphy_work *wwk)
8634 {
8635 	struct lkpi_wiphy *lwiphy;
8636 	struct wiphy_work *wk;
8637 
8638 	lwiphy = WIPHY_TO_LWIPHY(wiphy);
8639 	LKPI_80211_LWIPHY_WORK_LOCK(lwiphy);
8640 	/* If wwk is unset, flush everything; called when wiphy is shut down. */
8641 	if (wwk != NULL && list_empty(&wwk->entry)) {
8642 		LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8643 		return;
8644 	}
8645 
8646 	while (!list_empty(&lwiphy->wwk_list)) {
8647 
8648 		wk = list_first_entry(&lwiphy->wwk_list, struct wiphy_work,
8649 		    entry);
8650 		list_del_init(&wk->entry);
8651 		LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8652 		wk->fn(wiphy, wk);
8653 		LKPI_80211_LWIPHY_WORK_LOCK(lwiphy);
8654 		if (wk == wwk)
8655 			break;
8656 	}
8657 	LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8658 }
8659 
8660 void
8661 lkpi_wiphy_delayed_work_timer(struct timer_list *tl)
8662 {
8663 	struct wiphy_delayed_work *wdwk;
8664 
8665 	wdwk = timer_container_of(wdwk, tl, timer);
8666 	wiphy_work_queue(wdwk->wiphy, &wdwk->work);
8667 }
8668 
8669 void
8670 linuxkpi_wiphy_delayed_work_queue(struct wiphy *wiphy,
8671     struct wiphy_delayed_work *wdwk, unsigned long delay)
8672 {
8673 	if (delay == 0) {
8674 		/* Run right away. */
8675 		del_timer(&wdwk->timer);
8676 		wiphy_work_queue(wiphy, &wdwk->work);
8677 	} else {
8678 		wdwk->wiphy = wiphy;
8679 		mod_timer(&wdwk->timer, jiffies + delay);
8680 	}
8681 }
8682 
8683 void
8684 linuxkpi_wiphy_delayed_work_cancel(struct wiphy *wiphy,
8685     struct wiphy_delayed_work *wdwk)
8686 {
8687 	del_timer_sync(&wdwk->timer);
8688 	wiphy_work_cancel(wiphy, &wdwk->work);
8689 }
8690 
8691 void
8692 linuxkpi_wiphy_delayed_work_flush(struct wiphy *wiphy,
8693     struct wiphy_delayed_work *wdwk)
8694 {
8695 	lockdep_assert_held(&wiphy->mtx);
8696 
8697 	del_timer_sync(&wdwk->timer);
8698 	wiphy_work_flush(wiphy, &wdwk->work);
8699 }
8700 
8701 /* -------------------------------------------------------------------------- */
8702 
8703 struct wiphy *
8704 linuxkpi_wiphy_new(const struct cfg80211_ops *ops, size_t priv_len)
8705 {
8706 	struct lkpi_wiphy *lwiphy;
8707 	struct wiphy *wiphy;
8708 
8709 	lwiphy = kzalloc(sizeof(*lwiphy) + priv_len, GFP_KERNEL);
8710 	if (lwiphy == NULL)
8711 		return (NULL);
8712 	lwiphy->ops = ops;
8713 
8714 	LKPI_80211_LWIPHY_WORK_LOCK_INIT(lwiphy);
8715 	INIT_LIST_HEAD(&lwiphy->wwk_list);
8716 	INIT_WORK(&lwiphy->wwk, lkpi_wiphy_work);
8717 
8718 	wiphy = LWIPHY_TO_WIPHY(lwiphy);
8719 
8720 	mutex_init(&wiphy->mtx);
8721 	TODO();
8722 
8723 	return (wiphy);
8724 }
8725 
8726 void
8727 linuxkpi_wiphy_free(struct wiphy *wiphy)
8728 {
8729 	struct lkpi_wiphy *lwiphy;
8730 
8731 	if (wiphy == NULL)
8732 		return;
8733 
8734 	linuxkpi_wiphy_work_flush(wiphy, NULL);
8735 	mutex_destroy(&wiphy->mtx);
8736 
8737 	lwiphy = WIPHY_TO_LWIPHY(wiphy);
8738 	LKPI_80211_LWIPHY_WORK_LOCK_DESTROY(lwiphy);
8739 
8740 	kfree(lwiphy);
8741 }
8742 
8743 static void
8744 lkpi_wiphy_band_annotate(struct wiphy *wiphy)
8745 {
8746 	int band;
8747 
8748 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
8749 		struct ieee80211_supported_band *supband;
8750 		int i;
8751 
8752 		supband = wiphy->bands[band];
8753 		if (supband == NULL)
8754 			continue;
8755 
8756 		switch (band) {
8757 		case NL80211_BAND_2GHZ:
8758 		case NL80211_BAND_5GHZ:
8759 			break;
8760 		default:
8761 #ifdef LINUXKPI_DEBUG_80211
8762 			IMPROVE("band %d(%s) not yet supported",
8763 			    band, lkpi_nl80211_band_name(band));
8764 			/* For bands added here, also check lkpi_lsta_alloc(). */
8765 #endif
8766 			continue;
8767 		}
8768 
8769 		/* Band bitrates are times 10; e.g., 55 is 5.5Mbit/s. */
8770 		for (i = 0; i < supband->n_bitrates; i++) {
8771 			switch (band) {
8772 			case NL80211_BAND_2GHZ:
8773 				switch (supband->bitrates[i].bitrate) {
8774 				case 110:
8775 				case 55:
8776 				case 20:
8777 				case 10:
8778 					supband->bitrates[i].flags |=
8779 					    IEEE80211_RATE_MANDATORY_B;
8780 					/* FALLTHROUGH */
8781 				/* 11g only */
8782 				case 240:
8783 				case 120:
8784 				case 60:
8785 					supband->bitrates[i].flags |=
8786 					    IEEE80211_RATE_MANDATORY_G;
8787 					break;
8788 				}
8789 				break;
8790 			case NL80211_BAND_5GHZ:
8791 				switch (supband->bitrates[i].bitrate) {
8792 				case 240:
8793 				case 120:
8794 				case 60:
8795 					supband->bitrates[i].flags |=
8796 					    IEEE80211_RATE_MANDATORY_A;
8797 					break;
8798 				}
8799 				break;
8800 			}
8801 			TRACE_RATES("band %d bitrate[%d/%u] %u flags %#010x",
8802 			    band, i, supband->n_bitrates,
8803 			    supband->bitrates[i].bitrate,
8804 			    supband->bitrates[i].flags);
8805 		}
8806 	}
8807 }
8808 
8809 int
8810 linuxkpi_80211_wiphy_register(struct wiphy *wiphy)
8811 {
8812 	TODO("Lots of checks and initialization");
8813 
8814 	lkpi_wiphy_band_annotate(wiphy);
8815 
8816 	return (0);
8817 }
8818 
8819 static uint32_t
8820 lkpi_cfg80211_calculate_bitrate_ht(struct rate_info *rate)
8821 {
8822 	TODO("cfg80211_calculate_bitrate_ht");
8823 	return (rate->legacy);
8824 }
8825 
8826 static uint32_t
8827 lkpi_cfg80211_calculate_bitrate_vht(struct rate_info *rate)
8828 {
8829 	TODO("cfg80211_calculate_bitrate_vht");
8830 	return (rate->legacy);
8831 }
8832 
8833 uint32_t
8834 linuxkpi_cfg80211_calculate_bitrate(struct rate_info *rate)
8835 {
8836 
8837 	/* Beware: order! */
8838 	if (rate->flags & RATE_INFO_FLAGS_MCS)
8839 		return (lkpi_cfg80211_calculate_bitrate_ht(rate));
8840 
8841 	if (rate->flags & RATE_INFO_FLAGS_VHT_MCS)
8842 		return (lkpi_cfg80211_calculate_bitrate_vht(rate));
8843 
8844 	IMPROVE("HE/EHT/...");
8845 
8846 	return (rate->legacy);
8847 }
8848 
8849 uint32_t
8850 linuxkpi_ieee80211_channel_to_frequency(uint32_t channel,
8851     enum nl80211_band band)
8852 {
8853 
8854 	switch (band) {
8855 	case NL80211_BAND_2GHZ:
8856 		return (ieee80211_ieee2mhz(channel, IEEE80211_CHAN_2GHZ));
8857 		break;
8858 	case NL80211_BAND_5GHZ:
8859 		return (ieee80211_ieee2mhz(channel, IEEE80211_CHAN_5GHZ));
8860 		break;
8861 	default:
8862 		/* XXX abort, retry, error, panic? */
8863 		break;
8864 	}
8865 
8866 	return (0);
8867 }
8868 
8869 uint32_t
8870 linuxkpi_ieee80211_frequency_to_channel(uint32_t freq, uint32_t flags __unused)
8871 {
8872 
8873 	return (ieee80211_mhz2ieee(freq, 0));
8874 }
8875 
8876 #if 0
8877 static struct lkpi_sta *
8878 lkpi_find_lsta_by_ni(struct lkpi_vif *lvif, struct ieee80211_node *ni)
8879 {
8880 	struct lkpi_sta *lsta, *temp;
8881 
8882 	rcu_read_lock();
8883 	list_for_each_entry_rcu(lsta, &lvif->lsta_list, lsta_list) {
8884 		if (lsta->ni == ni) {
8885 			rcu_read_unlock();
8886 			return (lsta);
8887 		}
8888 	}
8889 	rcu_read_unlock();
8890 
8891 	return (NULL);
8892 }
8893 #endif
8894 
8895 struct ieee80211_sta *
8896 linuxkpi_ieee80211_find_sta(struct ieee80211_vif *vif, const u8 *peer)
8897 {
8898 	struct lkpi_vif *lvif;
8899 	struct lkpi_sta *lsta;
8900 	struct ieee80211_sta *sta;
8901 
8902 	lvif = VIF_TO_LVIF(vif);
8903 
8904 	rcu_read_lock();
8905 	list_for_each_entry_rcu(lsta, &lvif->lsta_list, lsta_list) {
8906 		sta = LSTA_TO_STA(lsta);
8907 		if (IEEE80211_ADDR_EQ(sta->addr, peer)) {
8908 			rcu_read_unlock();
8909 			return (sta);
8910 		}
8911 	}
8912 	rcu_read_unlock();
8913 	return (NULL);
8914 }
8915 
8916 struct ieee80211_sta *
8917 linuxkpi_ieee80211_find_sta_by_ifaddr(struct ieee80211_hw *hw,
8918     const uint8_t *addr, const uint8_t *ourvifaddr)
8919 {
8920 	struct lkpi_hw *lhw;
8921 	struct lkpi_vif *lvif;
8922 	struct lkpi_sta *lsta;
8923 	struct ieee80211_vif *vif;
8924 	struct ieee80211_sta *sta;
8925 
8926 	lhw = wiphy_priv(hw->wiphy);
8927 	sta = NULL;
8928 
8929 	LKPI_80211_LHW_LVIF_LOCK(lhw);
8930 	TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
8931 
8932 		/* XXX-BZ check our address from the vif. */
8933 
8934 		vif = LVIF_TO_VIF(lvif);
8935 		if (ourvifaddr != NULL &&
8936 		    !IEEE80211_ADDR_EQ(vif->addr, ourvifaddr))
8937 			continue;
8938 		sta = linuxkpi_ieee80211_find_sta(vif, addr);
8939 		if (sta != NULL)
8940 			break;
8941 	}
8942 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
8943 
8944 	if (sta != NULL) {
8945 		lsta = STA_TO_LSTA(sta);
8946 		if (!lsta->added_to_drv)
8947 			return (NULL);
8948 	}
8949 
8950 	return (sta);
8951 }
8952 
8953 struct sk_buff *
8954 linuxkpi_ieee80211_tx_dequeue(struct ieee80211_hw *hw,
8955     struct ieee80211_txq *txq)
8956 {
8957 	struct lkpi_txq *ltxq;
8958 	struct lkpi_vif *lvif;
8959 	struct sk_buff *skb;
8960 
8961 	IMPROVE("wiphy_lock? or assert?");
8962 	skb = NULL;
8963 	ltxq = TXQ_TO_LTXQ(txq);
8964 	ltxq->flags |= LKPI_TXQ_SEEN_DEQUEUE;
8965 
8966 	if ((ltxq->flags & (LKPI_TXQ_STOPPED|LKPI_TXQ_STOPPED_BA)) != 0)
8967 		goto stopped;
8968 
8969 	lvif = VIF_TO_LVIF(ltxq->txq.vif);
8970 	if (lvif->hw_queue_stopped[ltxq->txq.ac]) {
8971 		ltxq->flags |= LKPI_TXQ_STOPPED;
8972 		goto stopped;
8973 	}
8974 
8975 	IMPROVE("hw(TX_FRAG_LIST)");
8976 
8977 	LKPI_80211_LTXQ_LOCK(ltxq);
8978 	skb = skb_dequeue(&ltxq->skbq);
8979 	if (skb != NULL)
8980 		ltxq->frms_dequeued++;
8981 	LKPI_80211_LTXQ_UNLOCK(ltxq);
8982 
8983 stopped:
8984 	return (skb);
8985 }
8986 
8987 void
8988 linuxkpi_ieee80211_txq_get_depth(struct ieee80211_txq *txq,
8989     unsigned long *frame_cnt, unsigned long *byte_cnt)
8990 {
8991 	struct lkpi_txq *ltxq;
8992 	struct sk_buff *skb;
8993 	unsigned long fc, bc;
8994 
8995 	ltxq = TXQ_TO_LTXQ(txq);
8996 
8997 	fc = bc = 0;
8998 	LKPI_80211_LTXQ_LOCK(ltxq);
8999 	skb_queue_walk(&ltxq->skbq, skb) {
9000 		fc++;
9001 		bc += skb->len;
9002 	}
9003 	LKPI_80211_LTXQ_UNLOCK(ltxq);
9004 	if (frame_cnt)
9005 		*frame_cnt = fc;
9006 	if (byte_cnt)
9007 		*byte_cnt = bc;
9008 
9009 	/* Validate that this is doing the correct thing. */
9010 	/* Should we keep track on en/dequeue? */
9011 	IMPROVE();
9012 }
9013 
9014 /*
9015  * We are called from ieee80211_free_txskb() or ieee80211_tx_status().
9016  * The latter tries to derive the success status from the info flags
9017  * passed back from the driver.  rawx_mit() saves the ni on the m and the
9018  * m on the skb for us to be able to give feedback to net80211.
9019  */
9020 static void
9021 _lkpi_ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb,
9022     int status)
9023 {
9024 	struct ieee80211_node *ni;
9025 	struct mbuf *m;
9026 
9027 	if (skb == NULL)
9028 		return;
9029 
9030 	m = skb->m;
9031 	skb->m = NULL;
9032 
9033 	if (m != NULL) {
9034 		ni = m->m_pkthdr.PH_loc.ptr;
9035 		/* Status: 0 is ok, != 0 is error. */
9036 		ieee80211_tx_complete(ni, m, status);
9037 		/* ni & mbuf were consumed. */
9038 	}
9039 }
9040 
9041 void
9042 linuxkpi_ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb,
9043     int status)
9044 {
9045 
9046 	_lkpi_ieee80211_free_txskb(hw, skb, status);
9047 	kfree_skb(skb);
9048 }
9049 
9050 void
9051 linuxkpi_ieee80211_tx_status_ext(struct ieee80211_hw *hw,
9052     struct ieee80211_tx_status *txstat)
9053 {
9054 	struct sk_buff *skb;
9055 	struct ieee80211_tx_info *info, _info = { };
9056 	struct ieee80211_ratectl_tx_status txs;
9057 	struct ieee80211_node *ni;
9058 	int status;
9059 
9060 	skb = txstat->skb;
9061 	if (skb != NULL && skb->m != NULL) {
9062 		struct mbuf *m;
9063 
9064 		m = skb->m;
9065 		ni = m->m_pkthdr.PH_loc.ptr;
9066 		memset(&txs, 0, sizeof(txs));
9067 	} else {
9068 		ni = NULL;
9069 	}
9070 
9071 	/*
9072 	 * If we have no info information on tx, set info to an all-zero struct
9073 	 * to make the code (and debug output) simpler.
9074 	 */
9075 	info = txstat->info;
9076 	if (info == NULL)
9077 		info = &_info;
9078 	if (info->flags & IEEE80211_TX_STAT_ACK) {
9079 		status = 0;	/* No error. */
9080 		txs.status = IEEE80211_RATECTL_TX_SUCCESS;
9081 	} else {
9082 		status = 1;
9083 		txs.status = IEEE80211_RATECTL_TX_FAIL_UNSPECIFIED;
9084 	}
9085 
9086 	if (ni != NULL) {
9087 		txs.pktlen = skb->len;
9088 		txs.flags |= IEEE80211_RATECTL_STATUS_PKTLEN;
9089 		if (info->status.rates[0].count > 1) {
9090 			txs.long_retries = info->status.rates[0].count - 1;	/* 1 + retries in drivers. */
9091 			txs.flags |= IEEE80211_RATECTL_STATUS_LONG_RETRY;
9092 		}
9093 #if 0		/* Unused in net80211 currently. */
9094 		/* XXX-BZ convert check .flags for MCS/VHT/.. */
9095 		txs.final_rate = info->status.rates[0].idx;
9096 		txs.flags |= IEEE80211_RATECTL_STATUS_FINAL_RATE;
9097 #endif
9098 		if (info->status.flags & IEEE80211_TX_STATUS_ACK_SIGNAL_VALID) {
9099 			txs.rssi = info->status.ack_signal;		/* XXX-BZ CONVERT? */
9100 			txs.flags |= IEEE80211_RATECTL_STATUS_RSSI;
9101 		}
9102 
9103 		IMPROVE("only update rate if needed but that requires us to get a proper rate from mo_sta_statistics");
9104 		ieee80211_ratectl_tx_complete(ni, &txs);
9105 		ieee80211_ratectl_rate(ni->ni_vap->iv_bss, NULL, 0);
9106 
9107 #ifdef LINUXKPI_DEBUG_80211
9108 		if (linuxkpi_debug_80211 & D80211_TRACE_TX) {
9109 			printf("TX-RATE: %s: long_retries %d\n", __func__,
9110 			    txs.long_retries);
9111 		}
9112 #endif
9113 	}
9114 
9115 #ifdef LINUXKPI_DEBUG_80211
9116 	if (linuxkpi_debug_80211 & D80211_TRACE_TX)
9117 		printf("TX-STATUS: %s: hw %p skb %p status %d : flags %b "
9118 		    "band %u hw_queue %u tx_time_est %d : "
9119 		    "rates [ %u %u %#x, %u %u %#x, %u %u %#x, %u %u %#x ] "
9120 		    "ack_signal %u ampdu_ack_len %u ampdu_len %u antenna %u "
9121 		    "tx_time %u flags %b "
9122 		    "status_driver_data [ %p %p ]\n",
9123 		    __func__, hw, skb, status, info->flags, IEEE80211_TX_INFO_FLAGS,
9124 		    info->band, info->hw_queue, info->tx_time_est,
9125 		    info->status.rates[0].idx, info->status.rates[0].count,
9126 		    info->status.rates[0].flags,
9127 		    info->status.rates[1].idx, info->status.rates[1].count,
9128 		    info->status.rates[1].flags,
9129 		    info->status.rates[2].idx, info->status.rates[2].count,
9130 		    info->status.rates[2].flags,
9131 		    info->status.rates[3].idx, info->status.rates[3].count,
9132 		    info->status.rates[3].flags,
9133 		    info->status.ack_signal, info->status.ampdu_ack_len,
9134 		    info->status.ampdu_len, info->status.antenna,
9135 		    info->status.tx_time, info->status.flags, IEEE80211_TX_STATUS_FLAGS,
9136 		    info->status.status_driver_data[0],
9137 		    info->status.status_driver_data[1]);
9138 #endif
9139 
9140 	if (txstat->free_list) {
9141 		_lkpi_ieee80211_free_txskb(hw, skb, status);
9142 		if (skb != NULL)
9143 			list_add_tail(&skb->list, txstat->free_list);
9144 	} else {
9145 		linuxkpi_ieee80211_free_txskb(hw, skb, status);
9146 	}
9147 }
9148 
9149 void
9150 linuxkpi_ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
9151 {
9152 	struct ieee80211_tx_status status;
9153 
9154 	memset(&status, 0, sizeof(status));
9155 	status.info = IEEE80211_SKB_CB(skb);
9156 	status.skb = skb;
9157 	/* sta, n_rates, rates, free_list? */
9158 
9159 	ieee80211_tx_status_ext(hw, &status);
9160 }
9161 
9162 /*
9163  * This is an internal bandaid for the moment for the way we glue
9164  * skbs and mbufs together for TX.  Once we have skbs backed by
9165  * mbufs this should go away.
9166  * This is a public function but kept on the private KPI (lkpi_)
9167  * and is not exposed by a header file.
9168  */
9169 static void
9170 lkpi_ieee80211_free_skb_mbuf(void *p)
9171 {
9172 	struct ieee80211_node *ni;
9173 	struct mbuf *m;
9174 
9175 	if (p == NULL)
9176 		return;
9177 
9178 	m = (struct mbuf *)p;
9179 	M_ASSERTPKTHDR(m);
9180 
9181 	ni = m->m_pkthdr.PH_loc.ptr;
9182 	m->m_pkthdr.PH_loc.ptr = NULL;
9183 	if (ni != NULL)
9184 		ieee80211_free_node(ni);
9185 	m_freem(m);
9186 }
9187 
9188 void
9189 linuxkpi_ieee80211_queue_delayed_work(struct ieee80211_hw *hw,
9190     struct delayed_work *w, int delay)
9191 {
9192 	struct lkpi_hw *lhw;
9193 
9194 	/* Need to make sure hw is in a stable (non-suspended) state. */
9195 	IMPROVE();
9196 
9197 	lhw = HW_TO_LHW(hw);
9198 	queue_delayed_work(lhw->workq, w, delay);
9199 }
9200 
9201 void
9202 linuxkpi_ieee80211_queue_work(struct ieee80211_hw *hw,
9203     struct work_struct *w)
9204 {
9205 	struct lkpi_hw *lhw;
9206 
9207 	/* Need to make sure hw is in a stable (non-suspended) state. */
9208 	IMPROVE();
9209 
9210 	lhw = HW_TO_LHW(hw);
9211 	queue_work(lhw->workq, w);
9212 }
9213 
9214 struct sk_buff *
9215 linuxkpi_ieee80211_probereq_get(struct ieee80211_hw *hw, const uint8_t *addr,
9216     const uint8_t *ssid, size_t ssid_len, size_t tailroom)
9217 {
9218 	struct sk_buff *skb;
9219 	struct ieee80211_frame *wh;
9220 	uint8_t *p;
9221 	size_t len;
9222 
9223 	len = sizeof(*wh);
9224 	len += 2 + ssid_len;
9225 
9226 	skb = dev_alloc_skb(hw->extra_tx_headroom + len + tailroom);
9227 	if (skb == NULL)
9228 		return (NULL);
9229 
9230 	skb_reserve(skb, hw->extra_tx_headroom);
9231 
9232 	wh = skb_put_zero(skb, sizeof(*wh));
9233 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0;
9234 	wh->i_fc[0] |= IEEE80211_FC0_SUBTYPE_PROBE_REQ | IEEE80211_FC0_TYPE_MGT;
9235 	IEEE80211_ADDR_COPY(wh->i_addr1, ieee80211broadcastaddr);
9236 	IEEE80211_ADDR_COPY(wh->i_addr2, addr);
9237 	IEEE80211_ADDR_COPY(wh->i_addr3, ieee80211broadcastaddr);
9238 
9239 	p = skb_put(skb, 2 + ssid_len);
9240 	*p++ = IEEE80211_ELEMID_SSID;
9241 	*p++ = ssid_len;
9242 	if (ssid_len > 0)
9243 		memcpy(p, ssid, ssid_len);
9244 
9245 	return (skb);
9246 }
9247 
9248 struct sk_buff *
9249 linuxkpi_ieee80211_pspoll_get(struct ieee80211_hw *hw,
9250     struct ieee80211_vif *vif)
9251 {
9252 	struct lkpi_vif *lvif;
9253 	struct ieee80211vap *vap;
9254 	struct sk_buff *skb;
9255 	struct ieee80211_frame_pspoll *psp;
9256 	uint16_t v;
9257 
9258 	skb = dev_alloc_skb(hw->extra_tx_headroom + sizeof(*psp));
9259 	if (skb == NULL)
9260 		return (NULL);
9261 
9262 	skb_reserve(skb, hw->extra_tx_headroom);
9263 
9264 	lvif = VIF_TO_LVIF(vif);
9265 	vap = LVIF_TO_VAP(lvif);
9266 
9267 	psp = skb_put_zero(skb, sizeof(*psp));
9268 	psp->i_fc[0] = IEEE80211_FC0_VERSION_0;
9269 	psp->i_fc[0] |= IEEE80211_FC0_SUBTYPE_PS_POLL | IEEE80211_FC0_TYPE_CTL;
9270 	v = htole16(vif->cfg.aid | 1<<15 | 1<<16);
9271 	memcpy(&psp->i_aid, &v, sizeof(v));
9272 	IEEE80211_ADDR_COPY(psp->i_bssid, vap->iv_bss->ni_macaddr);
9273 	IEEE80211_ADDR_COPY(psp->i_ta, vif->addr);
9274 
9275 	return (skb);
9276 }
9277 
9278 struct sk_buff *
9279 linuxkpi_ieee80211_nullfunc_get(struct ieee80211_hw *hw,
9280     struct ieee80211_vif *vif, int linkid, bool qos)
9281 {
9282 	struct sk_buff *skb;
9283 	struct ieee80211_frame *nullf;
9284 
9285 	IMPROVE("linkid");
9286 
9287 	skb = dev_alloc_skb(hw->extra_tx_headroom + sizeof(*nullf));
9288 	if (skb == NULL)
9289 		return (NULL);
9290 
9291 	skb_reserve(skb, hw->extra_tx_headroom);
9292 
9293 	nullf = skb_put_zero(skb, sizeof(*nullf));
9294 	nullf->i_fc[0] = IEEE80211_FC0_VERSION_0;
9295 	nullf->i_fc[0] |= IEEE80211_FC0_SUBTYPE_NODATA | IEEE80211_FC0_TYPE_DATA;
9296 	nullf->i_fc[1] = IEEE80211_FC1_DIR_TODS;
9297 
9298 	/* XXX-BZ if link is given, this is different. */
9299 	IEEE80211_ADDR_COPY(nullf->i_addr1, vif->cfg.ap_addr);
9300 	IEEE80211_ADDR_COPY(nullf->i_addr2, vif->addr);
9301 	IEEE80211_ADDR_COPY(nullf->i_addr3, vif->cfg.ap_addr);
9302 
9303 	return (skb);
9304 }
9305 
9306 struct wireless_dev *
9307 linuxkpi_ieee80211_vif_to_wdev(struct ieee80211_vif *vif)
9308 {
9309 	struct lkpi_vif *lvif;
9310 
9311 	lvif = VIF_TO_LVIF(vif);
9312 	return (&lvif->wdev);
9313 }
9314 
9315 void
9316 linuxkpi_ieee80211_connection_loss(struct ieee80211_vif *vif)
9317 {
9318 	struct lkpi_vif *lvif;
9319 	struct ieee80211vap *vap;
9320 	enum ieee80211_state nstate;
9321 	int arg;
9322 
9323 	lvif = VIF_TO_LVIF(vif);
9324 	vap = LVIF_TO_VAP(lvif);
9325 
9326 	/*
9327 	 * Go to init; otherwise we need to elaborately check state and
9328 	 * handle accordingly, e.g., if in RUN we could call iv_bmiss.
9329 	 * Let the statemachine handle all neccessary changes.
9330 	 */
9331 	nstate = IEEE80211_S_INIT;
9332 	arg = 0;	/* Not a valid reason. */
9333 
9334 	ic_printf(vap->iv_ic, "%s: vif %p vap %p state %s (synched %d, assoc %d "
9335 	    "beacons %d dtim_period %d)\n", __func__, vif, vap,
9336 	    ieee80211_state_name[vap->iv_state],
9337 	    lvif->lvif_bss_synched, vif->cfg.assoc, lvif->beacons,
9338 	    vif->bss_conf.dtim_period);
9339 	ieee80211_new_state(vap, nstate, arg);
9340 }
9341 
9342 void
9343 linuxkpi_ieee80211_beacon_loss(struct ieee80211_vif *vif)
9344 {
9345 	struct lkpi_vif *lvif;
9346 	struct ieee80211vap *vap;
9347 
9348 	lvif = VIF_TO_LVIF(vif);
9349 	vap = LVIF_TO_VAP(lvif);
9350 
9351 	ic_printf(vap->iv_ic, "%s: vif %p vap %p state %s (synched %d, assoc %d "
9352 	    "beacons %d dtim_period %d)\n", __func__, vif, vap,
9353 	    ieee80211_state_name[vap->iv_state],
9354 	    lvif->lvif_bss_synched, vif->cfg.assoc, lvif->beacons,
9355 	    vif->bss_conf.dtim_period);
9356 	ieee80211_beacon_miss(vap->iv_ic);
9357 }
9358 
9359 /* -------------------------------------------------------------------------- */
9360 
9361 void
9362 linuxkpi_ieee80211_stop_queue(struct ieee80211_hw *hw, int qnum)
9363 {
9364 	struct lkpi_hw *lhw;
9365 	struct lkpi_vif *lvif;
9366 	struct ieee80211_vif *vif;
9367 	int ac_count, ac;
9368 
9369 	KASSERT(qnum < hw->queues, ("%s: qnum %d >= hw->queues %d, hw %p\n",
9370 	    __func__, qnum, hw->queues, hw));
9371 
9372 	lhw = wiphy_priv(hw->wiphy);
9373 
9374 	/* See lkpi_ic_vap_create(). */
9375 	if (hw->queues >= IEEE80211_NUM_ACS)
9376 		ac_count = IEEE80211_NUM_ACS;
9377 	else
9378 		ac_count = 1;
9379 
9380 	LKPI_80211_LHW_LVIF_LOCK(lhw);
9381 	TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
9382 
9383 		vif = LVIF_TO_VIF(lvif);
9384 		for (ac = 0; ac < ac_count; ac++) {
9385 			IMPROVE_TXQ("LOCKING");
9386 			if (qnum == vif->hw_queue[ac]) {
9387 #ifdef LINUXKPI_DEBUG_80211
9388 				/*
9389 				 * For now log this to better understand
9390 				 * how this is supposed to work.
9391 				 */
9392 				if (lvif->hw_queue_stopped[ac] &&
9393 				    (linuxkpi_debug_80211 & D80211_IMPROVE_TXQ) != 0)
9394 					ic_printf(lhw->ic, "%s:%d: lhw %p hw %p "
9395 					    "lvif %p vif %p ac %d qnum %d already "
9396 					    "stopped\n", __func__, __LINE__,
9397 					    lhw, hw, lvif, vif, ac, qnum);
9398 #endif
9399 				lvif->hw_queue_stopped[ac] = true;
9400 			}
9401 		}
9402 	}
9403 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
9404 }
9405 
9406 void
9407 linuxkpi_ieee80211_stop_queues(struct ieee80211_hw *hw)
9408 {
9409 	int i;
9410 
9411 	IMPROVE_TXQ("Locking; do we need further info?");
9412 	for (i = 0; i < hw->queues; i++)
9413 		linuxkpi_ieee80211_stop_queue(hw, i);
9414 }
9415 
9416 
9417 static void
9418 lkpi_ieee80211_wake_queues(struct ieee80211_hw *hw, int hwq)
9419 {
9420 	struct lkpi_hw *lhw;
9421 	struct lkpi_vif *lvif;
9422 	struct lkpi_sta *lsta;
9423 	int ac_count, ac, tid;
9424 
9425 	/* See lkpi_ic_vap_create(). */
9426 	if (hw->queues >= IEEE80211_NUM_ACS)
9427 		ac_count = IEEE80211_NUM_ACS;
9428 	else
9429 		ac_count = 1;
9430 
9431 	lhw = wiphy_priv(hw->wiphy);
9432 
9433 	IMPROVE_TXQ("Locking");
9434 	LKPI_80211_LHW_LVIF_LOCK(lhw);
9435 	TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
9436 		struct ieee80211_vif *vif;
9437 
9438 		vif = LVIF_TO_VIF(lvif);
9439 		for (ac = 0; ac < ac_count; ac++) {
9440 
9441 			if (hwq == vif->hw_queue[ac]) {
9442 
9443 				/* XXX-BZ what about software scan? */
9444 
9445 #ifdef LINUXKPI_DEBUG_80211
9446 				/*
9447 				 * For now log this to better understand
9448 				 * how this is supposed to work.
9449 				 */
9450 				if (!lvif->hw_queue_stopped[ac] &&
9451 				    (linuxkpi_debug_80211 & D80211_IMPROVE_TXQ) != 0)
9452 					ic_printf(lhw->ic, "%s:%d: lhw %p hw %p "
9453 					    "lvif %p vif %p ac %d hw_q not stopped\n",
9454 					    __func__, __LINE__,
9455 					    lhw, hw, lvif, vif, ac);
9456 #endif
9457 				lvif->hw_queue_stopped[ac] = false;
9458 
9459 				rcu_read_lock();
9460 				list_for_each_entry_rcu(lsta, &lvif->lsta_list, lsta_list) {
9461 					struct ieee80211_sta *sta;
9462 
9463 					sta = LSTA_TO_STA(lsta);
9464 					for (tid = 0; tid < nitems(sta->txq); tid++) {
9465 						struct lkpi_txq *ltxq;
9466 
9467 						if (sta->txq[tid] == NULL)
9468 							continue;
9469 
9470 						if (sta->txq[tid]->ac != ac)
9471 							continue;
9472 
9473 						ltxq = TXQ_TO_LTXQ(sta->txq[tid]);
9474 						if ((ltxq->flags & LKPI_TXQ_STOPPED) == 0)
9475 							continue;
9476 
9477 						ltxq->flags &= ~LKPI_TXQ_STOPPED;
9478 
9479 						if (!skb_queue_empty(&ltxq->skbq))
9480 							lkpi_80211_mo_wake_tx_queue(hw, sta->txq[tid], false);
9481 					}
9482 				}
9483 				rcu_read_unlock();
9484 			}
9485 		}
9486 	}
9487 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
9488 }
9489 
9490 static void
9491 lkpi_ieee80211_wake_queues_locked(struct ieee80211_hw *hw)
9492 {
9493 	int i;
9494 
9495 	IMPROVE_TXQ("Is this all/enough here?");
9496 	for (i = 0; i < hw->queues; i++)
9497 		lkpi_ieee80211_wake_queues(hw, i);
9498 }
9499 
9500 void
9501 linuxkpi_ieee80211_wake_queues(struct ieee80211_hw *hw)
9502 {
9503 	struct lkpi_hw *lhw;
9504 	unsigned long flags;
9505 
9506 	lhw = HW_TO_LHW(hw);
9507 
9508 	spin_lock_irqsave(&lhw->txq_lock, flags);
9509 	lkpi_ieee80211_wake_queues_locked(hw);
9510 	spin_unlock_irqrestore(&lhw->txq_lock, flags);
9511 }
9512 
9513 void
9514 linuxkpi_ieee80211_wake_queue(struct ieee80211_hw *hw, int qnum)
9515 {
9516 	struct lkpi_hw *lhw;
9517 	unsigned long flags;
9518 
9519 	KASSERT(qnum < hw->queues, ("%s: qnum %d >= hw->queues %d, hw %p\n",
9520 	    __func__, qnum, hw->queues, hw));
9521 
9522 	lhw = HW_TO_LHW(hw);
9523 
9524 	spin_lock_irqsave(&lhw->txq_lock, flags);
9525 	lkpi_ieee80211_wake_queues(hw, qnum);
9526 	spin_unlock_irqrestore(&lhw->txq_lock, flags);
9527 }
9528 
9529 void
9530 linuxkpi_ieee80211_handle_wake_tx_queue(struct ieee80211_hw *hw,
9531     struct ieee80211_txq *txq)
9532 {
9533 	struct lkpi_hw *lhw;
9534 
9535 	lhw = HW_TO_LHW(hw);
9536 
9537 	LKPI_80211_LHW_TXQ_LOCK(lhw);
9538 	ieee80211_txq_schedule_start(hw, txq->ac);
9539 	do {
9540 		struct lkpi_txq *ltxq;
9541 		struct ieee80211_txq *ntxq;
9542 		struct ieee80211_tx_control control;
9543 		struct sk_buff *skb;
9544 
9545 		ntxq = ieee80211_next_txq(hw, txq->ac);
9546 		if (ntxq == NULL)
9547 			break;
9548 		ltxq = TXQ_TO_LTXQ(ntxq);
9549 
9550 		memset(&control, 0, sizeof(control));
9551 		control.sta = ntxq->sta;
9552 		do {
9553 			skb = linuxkpi_ieee80211_tx_dequeue(hw, ntxq);
9554 			if (skb == NULL)
9555 				break;
9556 			ltxq->frms_tx++;
9557 			lkpi_80211_mo_tx(hw, &control, skb);
9558 		} while(1);
9559 
9560 		ieee80211_return_txq(hw, ntxq, false);
9561 	} while (1);
9562 	ieee80211_txq_schedule_end(hw, txq->ac);
9563 	LKPI_80211_LHW_TXQ_UNLOCK(lhw);
9564 }
9565 
9566 /* -------------------------------------------------------------------------- */
9567 
9568 /* This is just hardware queues. */
9569 /*
9570  * Being called from the driver thus use _bh() locking.
9571  */
9572 void
9573 linuxkpi_ieee80211_txq_schedule_start(struct ieee80211_hw *hw, uint8_t ac)
9574 {
9575 	struct lkpi_hw *lhw;
9576 
9577 	lhw = HW_TO_LHW(hw);
9578 
9579 	if (ac >= IEEE80211_NUM_ACS) {
9580 		ic_printf(lhw->ic, "%s: ac %u out of bounds.\n", __func__, ac);
9581 		return;
9582 	}
9583 
9584 	spin_lock_bh(&lhw->txq_scheduled_lock[ac]);
9585 	IMPROVE("check AIRTIME_FAIRNESS");
9586 	if (++lhw->txq_generation[ac] == 0)
9587 		lhw->txq_generation[ac]++;
9588 	spin_unlock_bh(&lhw->txq_scheduled_lock[ac]);
9589 }
9590 
9591 struct ieee80211_txq *
9592 linuxkpi_ieee80211_next_txq(struct ieee80211_hw *hw, uint8_t ac)
9593 {
9594 	struct lkpi_hw *lhw;
9595 	struct ieee80211_txq *txq;
9596 	struct lkpi_txq *ltxq;
9597 
9598 	lhw = HW_TO_LHW(hw);
9599 	txq = NULL;
9600 
9601 	if (ac >= IEEE80211_NUM_ACS) {
9602 		ic_printf(lhw->ic, "%s: ac %u out of bounds.\n", __func__, ac);
9603 		return (NULL);
9604 	}
9605 
9606 	spin_lock_bh(&lhw->txq_scheduled_lock[ac]);
9607 
9608 	/* Check that we are scheduled. */
9609 	if (lhw->txq_generation[ac] == 0)
9610 		goto out;
9611 
9612 	ltxq = TAILQ_FIRST(&lhw->txq_scheduled[ac]);
9613 	if (ltxq == NULL)
9614 		goto out;
9615 	if (ltxq->txq_generation == lhw->txq_generation[ac])
9616 		goto out;
9617 	if ((ltxq->flags & (LKPI_TXQ_STOPPED|LKPI_TXQ_STOPPED_BA)) != 0)
9618 		goto out;
9619 
9620 	IMPROVE("check AIRTIME_FAIRNESS");
9621 
9622 	TAILQ_REMOVE(&lhw->txq_scheduled[ac], ltxq, txq_entry);
9623 	ltxq->txq_generation = lhw->txq_generation[ac];
9624 	txq = &ltxq->txq;
9625 	TAILQ_ELEM_INIT(ltxq, txq_entry);
9626 
9627 out:
9628 	spin_unlock_bh(&lhw->txq_scheduled_lock[ac]);
9629 
9630 	return (txq);
9631 }
9632 
9633 void linuxkpi_ieee80211_schedule_txq(struct ieee80211_hw *hw,
9634     struct ieee80211_txq *txq, bool withoutpkts)
9635 {
9636 	struct lkpi_hw *lhw;
9637 	struct lkpi_txq *ltxq;
9638 	bool ltxq_empty;
9639 
9640 	ltxq = TXQ_TO_LTXQ(txq);
9641 
9642 	/* Only schedule if work to do or asked to anyway. */
9643 	LKPI_80211_LTXQ_LOCK(ltxq);
9644 	ltxq_empty = skb_queue_empty(&ltxq->skbq);
9645 	LKPI_80211_LTXQ_UNLOCK(ltxq);
9646 	if (!withoutpkts && ltxq_empty)
9647 		goto out;
9648 
9649 	lhw = HW_TO_LHW(hw);
9650 	spin_lock_bh(&lhw->txq_scheduled_lock[txq->ac]);
9651 	/*
9652 	 * Make sure we do not double-schedule. We do this by checking tqe_prev,
9653 	 * the previous entry in our tailq. tqe_prev is always valid if this entry
9654 	 * is queued, tqe_next may be NULL if this is the only element in the list.
9655 	 */
9656 	if (ltxq->txq_entry.tqe_prev != NULL)
9657 		goto unlock;
9658 
9659 	TAILQ_INSERT_TAIL(&lhw->txq_scheduled[txq->ac], ltxq, txq_entry);
9660 unlock:
9661 	spin_unlock_bh(&lhw->txq_scheduled_lock[txq->ac]);
9662 
9663 out:
9664 	return;
9665 }
9666 
9667 /* -------------------------------------------------------------------------- */
9668 
9669 struct lkpi_cfg80211_bss {
9670 	u_int refcnt;
9671 	struct cfg80211_bss bss;
9672 };
9673 
9674 struct lkpi_cfg80211_get_bss_iter_lookup {
9675 	struct wiphy *wiphy;
9676 	struct linuxkpi_ieee80211_channel *chan;
9677 	const uint8_t *bssid;
9678 	const uint8_t *ssid;
9679 	size_t ssid_len;
9680 	enum ieee80211_bss_type bss_type;
9681 	enum ieee80211_privacy privacy;
9682 
9683 	/*
9684 	 * Something to store a copy of the result as the net80211 scan cache
9685 	 * is not refoucnted so a scan entry might go away any time.
9686 	 */
9687 	bool match;
9688 	struct cfg80211_bss *bss;
9689 };
9690 
9691 static void
9692 lkpi_cfg80211_get_bss_iterf(void *arg, const struct ieee80211_scan_entry *se)
9693 {
9694 	struct lkpi_cfg80211_get_bss_iter_lookup *lookup;
9695 	size_t ielen;
9696 
9697 	lookup = arg;
9698 
9699 	/* Do not try to find another match. */
9700 	if (lookup->match)
9701 		return;
9702 
9703 	/* Nothing to store result. */
9704 	if (lookup->bss == NULL)
9705 		return;
9706 
9707 	if (lookup->privacy != IEEE80211_PRIVACY_ANY) {
9708 		/* if (se->se_capinfo & IEEE80211_CAPINFO_PRIVACY) */
9709 		/* We have no idea what to compare to as the drivers only request ANY */
9710 		return;
9711 	}
9712 
9713 	if (lookup->bss_type != IEEE80211_BSS_TYPE_ANY) {
9714 		/* if (se->se_capinfo & (IEEE80211_CAPINFO_IBSS|IEEE80211_CAPINFO_ESS)) */
9715 		/* We have no idea what to compare to as the drivers only request ANY */
9716 		return;
9717 	}
9718 
9719 	if (lookup->chan != NULL) {
9720 		struct linuxkpi_ieee80211_channel *chan;
9721 
9722 		chan = linuxkpi_ieee80211_get_channel(lookup->wiphy,
9723 		    se->se_chan->ic_freq);
9724 		if (chan == NULL || chan != lookup->chan)
9725 			return;
9726 	}
9727 
9728 	if (lookup->bssid && !IEEE80211_ADDR_EQ(lookup->bssid, se->se_bssid))
9729 		return;
9730 
9731 	if (lookup->ssid) {
9732 		if (lookup->ssid_len != se->se_ssid[1] ||
9733 		    se->se_ssid[1] == 0)
9734 			return;
9735 		if (memcmp(lookup->ssid, se->se_ssid+2, lookup->ssid_len) != 0)
9736 			return;
9737 	}
9738 
9739 	ielen = se->se_ies.len;
9740 
9741 	lookup->bss->ies = malloc(sizeof(*lookup->bss->ies) + ielen,
9742 	    M_LKPI80211, M_NOWAIT | M_ZERO);
9743 	if (lookup->bss->ies == NULL)
9744 		return;
9745 
9746 	lookup->bss->ies->data = (uint8_t *)lookup->bss->ies + sizeof(*lookup->bss->ies);
9747 	lookup->bss->ies->len = ielen;
9748 	if (ielen)
9749 		memcpy(lookup->bss->ies->data, se->se_ies.data, ielen);
9750 
9751 	lookup->match = true;
9752 }
9753 
9754 struct cfg80211_bss *
9755 linuxkpi_cfg80211_get_bss(struct wiphy *wiphy, struct linuxkpi_ieee80211_channel *chan,
9756     const uint8_t *bssid, const uint8_t *ssid, size_t ssid_len,
9757     enum ieee80211_bss_type bss_type, enum ieee80211_privacy privacy)
9758 {
9759 	struct lkpi_cfg80211_bss *lbss;
9760 	struct lkpi_cfg80211_get_bss_iter_lookup lookup;
9761 	struct lkpi_hw *lhw;
9762 	struct ieee80211vap *vap;
9763 
9764 	lhw = wiphy_priv(wiphy);
9765 
9766 	/* Let's hope we can alloc. */
9767 	lbss = malloc(sizeof(*lbss), M_LKPI80211, M_NOWAIT | M_ZERO);
9768 	if (lbss == NULL) {
9769 		ic_printf(lhw->ic, "%s: alloc failed.\n", __func__);
9770 		return (NULL);
9771 	}
9772 
9773 	lookup.wiphy = wiphy;
9774 	lookup.chan = chan;
9775 	lookup.bssid = bssid;
9776 	lookup.ssid = ssid;
9777 	lookup.ssid_len = ssid_len;
9778 	lookup.bss_type = bss_type;
9779 	lookup.privacy = privacy;
9780 	lookup.match = false;
9781 	lookup.bss = &lbss->bss;
9782 
9783 	IMPROVE("Iterate over all VAPs comparing perm_addr and addresses?");
9784 	vap = TAILQ_FIRST(&lhw->ic->ic_vaps);
9785 	ieee80211_scan_iterate(vap, lkpi_cfg80211_get_bss_iterf, &lookup);
9786 	if (!lookup.match) {
9787 		free(lbss, M_LKPI80211);
9788 		return (NULL);
9789 	}
9790 
9791 	refcount_init(&lbss->refcnt, 1);
9792 	return (&lbss->bss);
9793 }
9794 
9795 void
9796 linuxkpi_cfg80211_put_bss(struct wiphy *wiphy, struct cfg80211_bss *bss)
9797 {
9798 	struct lkpi_cfg80211_bss *lbss;
9799 
9800 	lbss = container_of(bss, struct lkpi_cfg80211_bss, bss);
9801 
9802 	/* Free everything again on refcount ... */
9803 	if (refcount_release(&lbss->refcnt)) {
9804 		free(lbss->bss.ies, M_LKPI80211);
9805 		free(lbss, M_LKPI80211);
9806 	}
9807 }
9808 
9809 void
9810 linuxkpi_cfg80211_bss_flush(struct wiphy *wiphy)
9811 {
9812 	struct lkpi_hw *lhw;
9813 	struct ieee80211com *ic;
9814 	struct ieee80211vap *vap;
9815 
9816 	lhw = wiphy_priv(wiphy);
9817 	ic = lhw->ic;
9818 
9819 	/*
9820 	 * If we haven't called ieee80211_ifattach() yet
9821 	 * or there is no VAP, there are no scans to flush.
9822 	 */
9823 	if (ic == NULL ||
9824 	    (lhw->sc_flags & LKPI_MAC80211_DRV_STARTED) == 0)
9825 		return;
9826 
9827 	/* Should only happen on the current one? Not seen it late enough. */
9828 	IEEE80211_LOCK(ic);
9829 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
9830 		ieee80211_scan_flush(vap);
9831 	IEEE80211_UNLOCK(ic);
9832 }
9833 
9834 /* -------------------------------------------------------------------------- */
9835 
9836 static bool
9837 cfg80211_chan_def_are_same(struct cfg80211_chan_def *cd1,
9838     struct cfg80211_chan_def *cd2)
9839 {
9840 
9841 	if (cd1 == cd2)
9842 		return (true);
9843 
9844 	if (cd1 == NULL || cd2 == NULL)
9845 		return (false);
9846 
9847 	if (cd1->chan != cd2->chan)
9848 		return (false);
9849 
9850 	if (cd1->width != cd2->width)
9851 		return (false);
9852 
9853 	if (cd1->center_freq1 != cd2->center_freq1)
9854 		return (false);
9855 
9856 	if (cd1->center_freq2 != cd2->center_freq2)
9857 		return (false);
9858 
9859 	if (cd1->punctured != cd2->punctured)
9860 		return (false);
9861 
9862 	return (true);
9863 }
9864 
9865 /*
9866  * hw->conf get initialized/set in various places for us:
9867  * - linuxkpi_ieee80211_alloc_hw(): flags
9868  * - linuxkpi_ieee80211_ifattach(): chandef
9869  * - lkpi_ic_vap_create(): listen_interval
9870  * - lkpi_ic_set_channel(): chandef, flags
9871  */
9872 
9873 static int
9874 lkpi_80211_update_chandef(struct ieee80211_hw *hw,
9875     struct ieee80211_chanctx_conf *new)
9876 {
9877 	struct lkpi_hw *lhw;
9878 	struct cfg80211_chan_def *cd;
9879 	uint32_t changed;
9880 	int error;
9881 	bool same;
9882 
9883 	lockdep_assert_wiphy(hw->wiphy);
9884 
9885 	lhw = HW_TO_LHW(hw);
9886 	if (!lhw->emulate_chanctx)
9887 		return (0);
9888 
9889 	if (new == NULL || new->def.chan == NULL) {
9890 		/*
9891 		 * In case of remove "new" is NULL, we need to get us to some
9892 		 * basic channel width but we'd also need to set the channel
9893 		 * accordingly somewhere.
9894 		 * The same is true if we are scanning in which case the
9895 		 * scan_chandef should have a channel set.
9896 		 */
9897 		if (lhw->scan_chandef.chan != NULL) {
9898 #ifdef LINUXKPI_DEBUG_80211
9899 			if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
9900 				ic_printf(lhw->ic, "%s:%d: using scan_chandef %p\n",
9901 				    __func__, __LINE__, &lhw->scan_chandef);
9902 #endif
9903 			cd = &lhw->scan_chandef;
9904 		} else {
9905 #ifdef LINUXKPI_DEBUG_80211
9906 			if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
9907 				ic_printf(lhw->ic, "%s:%d: using dflt_chandef %p\n",
9908 				    __func__, __LINE__, &lhw->dflt_chandef);
9909 #endif
9910 			cd = &lhw->dflt_chandef;
9911 		}
9912 	} else {
9913 #ifdef LINUXKPI_DEBUG_80211
9914 		if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
9915 			ic_printf(lhw->ic, "%s:%d: using chanctx %p chandef %p\n",
9916 			    __func__, __LINE__, new, &new->def);
9917 #endif
9918 		cd = &new->def;
9919 	}
9920 
9921 	changed = 0;
9922 	same = cfg80211_chan_def_are_same(cd, &hw->conf.chandef);
9923 	if (!same) {
9924 		/* Copy; the chan pointer is fine and will stay valid. */
9925 		hw->conf.chandef = *cd;
9926 		changed |= IEEE80211_CONF_CHANGE_CHANNEL;
9927 	}
9928 	IMPROVE("IEEE80211_CONF_CHANGE_PS, IEEE80211_CONF_CHANGE_POWER");
9929 
9930 #ifdef LINUXKPI_DEBUG_80211
9931 	if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
9932 		ic_printf(lhw->ic, "%s:%d: chanctx %p { %u } cd %p { %u } "
9933 		    "hw->conf.chandef %p { %u %d %u %u %u }, "
9934 		    "changed %#04x same %d\n",
9935 		    __func__, __LINE__,
9936 		    new, (new != NULL && new->def.chan != NULL) ?
9937 			new->def.chan->center_freq : 0,
9938 		    cd, cd->chan->center_freq,
9939 		    &hw->conf.chandef, hw->conf.chandef.chan->center_freq,
9940 		    hw->conf.chandef.width,
9941 		    hw->conf.chandef.center_freq1,
9942 		    hw->conf.chandef.center_freq2,
9943 		    hw->conf.chandef.punctured,
9944 		    changed, same);
9945 #endif
9946 
9947 	if (changed == 0)
9948 		return (0);
9949 
9950 	error = lkpi_80211_mo_config(hw, changed);
9951 	return (error);
9952 }
9953 
9954 int
9955 ieee80211_emulate_add_chanctx(struct ieee80211_hw *hw,
9956     struct ieee80211_chanctx_conf *chanctx_conf)
9957 {
9958 	int error;
9959 
9960 	lockdep_assert_wiphy(hw->wiphy);
9961 
9962 #ifdef LINUXKPI_DEBUG_80211
9963 	if ((linuxkpi_debug_80211 & D80211_TRACE) != 0) {
9964 		struct lkpi_hw *lhw;
9965 
9966 		lhw = HW_TO_LHW(hw);
9967 		ic_printf(lhw->ic, "%s:%d: chanctx_conf %p\n",
9968 		    __func__, __LINE__, chanctx_conf);
9969 	}
9970 #endif
9971 
9972 	hw->conf.radar_enabled = chanctx_conf->radar_enabled;
9973 	error = lkpi_80211_update_chandef(hw, chanctx_conf);
9974 	return (error);
9975 }
9976 
9977 void
9978 ieee80211_emulate_remove_chanctx(struct ieee80211_hw *hw,
9979     struct ieee80211_chanctx_conf *chanctx_conf __unused)
9980 {
9981 
9982 	lockdep_assert_wiphy(hw->wiphy);
9983 
9984 #ifdef LINUXKPI_DEBUG_80211
9985 	if ((linuxkpi_debug_80211 & D80211_TRACE) != 0) {
9986 		struct lkpi_hw *lhw;
9987 
9988 		lhw = HW_TO_LHW(hw);
9989 		ic_printf(lhw->ic, "%s:%d: chanctx_conf %p\n",
9990 		    __func__, __LINE__, chanctx_conf);
9991 	}
9992 #endif
9993 
9994 	hw->conf.radar_enabled = false;
9995 	lkpi_80211_update_chandef(hw, NULL);
9996 }
9997 
9998 void
9999 ieee80211_emulate_change_chanctx(struct ieee80211_hw *hw,
10000     struct ieee80211_chanctx_conf *chanctx_conf, uint32_t changed __unused)
10001 {
10002 
10003 	lockdep_assert_wiphy(hw->wiphy);
10004 
10005 #ifdef LINUXKPI_DEBUG_80211
10006 	if ((linuxkpi_debug_80211 & D80211_TRACE) != 0) {
10007 		struct lkpi_hw *lhw;
10008 
10009 		lhw = HW_TO_LHW(hw);
10010 		ic_printf(lhw->ic, "%s:%d: chanctx_conf %p\n",
10011 		    __func__, __LINE__, chanctx_conf);
10012 	}
10013 #endif
10014 
10015 	hw->conf.radar_enabled = chanctx_conf->radar_enabled;
10016 	lkpi_80211_update_chandef(hw, chanctx_conf);
10017 }
10018 
10019 int
10020 ieee80211_emulate_switch_vif_chanctx(struct ieee80211_hw *hw,
10021     struct ieee80211_vif_chanctx_switch *vifs, int n_vifs,
10022     enum ieee80211_chanctx_switch_mode mode __unused)
10023 {
10024 	struct ieee80211_chanctx_conf *chanctx_conf;
10025 	int error;
10026 
10027 	lockdep_assert_wiphy(hw->wiphy);
10028 
10029 	/* Sanity check. */
10030 	if (n_vifs <= 0)
10031 		return (-EINVAL);
10032 	if (vifs == NULL || vifs[0].new_ctx == NULL)
10033 		return (-EINVAL);
10034 
10035 	/*
10036 	 * What to do if n_vifs > 1?
10037 	 * Does that make sense for drivers not supporting chanctx?
10038 	 */
10039 	hw->conf.radar_enabled = vifs[0].new_ctx->radar_enabled;
10040 	chanctx_conf = vifs[0].new_ctx;
10041 	error = lkpi_80211_update_chandef(hw, chanctx_conf);
10042 	return (error);
10043 }
10044 
10045 /* -------------------------------------------------------------------------- */
10046 /* LinuxKPI 802.11 PM. */
10047 int
10048 lkpi_80211_suspend(struct ieee80211com *ic, pm_message_t state)
10049 {
10050 	struct lkpi_hw *lhw;
10051 	struct ieee80211_hw *hw;
10052 	int error;
10053 
10054 	lhw = ic->ic_softc;
10055 	hw = LHW_TO_HW(lhw);
10056 	error = 0;
10057 
10058 	/* Check:
10059 	 * - device_set_wakeup_capable() / device_can_wakeup()
10060 	 * - hw->wiphy->wowlan to be non-NULL, if so contents.
10061 	 * - hw->wiphy->max_sched_scan_ssids (rtw88)
10062 	 */
10063 	if ((lkpi_suspend_type & 0x2) != 0) {
10064 		struct cfg80211_wowlan wowlan;
10065 
10066 		IMPROVE("various options for WoWLAN");
10067 		memset(&wowlan, 0, sizeof(wowlan));
10068 		wiphy_lock(hw->wiphy);
10069 		error = lkpi_80211_mo_suspend(hw, &wowlan);
10070 		wiphy_unlock(hw->wiphy);
10071 		if (error == EOPNOTSUPP)
10072 			error = 0;
10073 	}
10074 	if ((lkpi_suspend_type & 0x1) != 0) {
10075 		struct lkpi_vif *lvif;
10076 
10077 		ieee80211_suspend_all(ic);
10078 
10079 		wiphy_lock(hw->wiphy);
10080 		/*
10081 		 * At the end of this net80211 will run a task to call
10082 		 * (*ic_parent)() which is entirely unhelpful as we do not
10083 		 * know when it will happen.  So deal with it here.
10084 		 */
10085 		TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
10086 			lkpi_80211_mo_remove_interface(hw, LVIF_TO_VIF(lvif));
10087 		}
10088 
10089 		if ((lhw->sc_flags & LKPI_MAC80211_DRV_STARTED) != 0)
10090 			lkpi_80211_mo_stop(hw, true);
10091 		wiphy_unlock(hw->wiphy);
10092 	}
10093 
10094 	if (error < 0)
10095 		error = -error;
10096 
10097 	if (error != 0)
10098 		ic_printf(ic, "%s: SUSPEND FAILED: %d\n", __func__, error);
10099 
10100 	return (error);
10101 }
10102 
10103 int
10104 lkpi_80211_resume(struct ieee80211com *ic)
10105 {
10106 	struct lkpi_hw *lhw;
10107 	struct ieee80211_hw *hw;
10108 	int error;
10109 	bool hw_scan_running;
10110 
10111 	lhw = ic->ic_softc;
10112 	hw = LHW_TO_HW(lhw);
10113 	error = 0;
10114 
10115 	/*
10116 	 * Ongoing HW scans during suspend are a problem on resume.
10117 	 * Be verbose about that.
10118 	 */
10119 	LKPI_80211_LHW_SCAN_LOCK(lhw);
10120 	hw_scan_running = (lhw->scan_flags & (LKPI_LHW_SCAN_RUNNING|LKPI_LHW_SCAN_HW)) != 0;
10121 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
10122 	if (hw_scan_running)
10123 		ic_printf(ic, "%s: WARNING: ongoing hw scan on resume!\n", __func__);
10124 
10125 	if ((lkpi_suspend_type & 0x1) != 0) {
10126 		struct lkpi_vif *lvif;
10127 
10128 		wiphy_lock(hw->wiphy);
10129 		error = lkpi_80211_mo_start(hw);
10130 		if (error != 0 && error != EEXIST) {
10131 			ic_printf(ic, "%s: mo_start failed: %d\n",
10132 			    __func__, error);
10133 			wiphy_unlock(hw->wiphy);
10134 			goto err;
10135 		}
10136 
10137 		TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
10138 			error = lkpi_80211_mo_add_interface(hw, LVIF_TO_VIF(lvif));
10139 			if (error != 0) {
10140 				struct ieee80211vap *vap;
10141 
10142 				vap = LVIF_TO_VAP(lvif);
10143 				ic_printf(ic, "%s: mo_add_interface %s failed: %d\n",
10144 				    __func__, if_name(vap->iv_ifp), error);
10145 				wiphy_unlock(hw->wiphy);
10146 				goto err;
10147 			}
10148 		}
10149 		wiphy_unlock(hw->wiphy);
10150 
10151 		ieee80211_resume_all(ic);
10152 	}
10153 
10154 	if ((lkpi_suspend_type & 0x2) != 0) {
10155 		wiphy_lock(hw->wiphy);
10156 		error = lkpi_80211_mo_resume(hw);
10157 		wiphy_unlock(hw->wiphy);
10158 		if (error == EOPNOTSUPP)
10159 			error = 0;
10160 	}
10161 
10162 err:
10163 	if (error < 0)
10164 		error = -error;
10165 
10166 	return (error);
10167 }
10168 
10169 /* -------------------------------------------------------------------------- */
10170 MODULE_VERSION(linuxkpi_wlan, 1);
10171 MODULE_DEPEND(linuxkpi_wlan, linuxkpi, 1, 1, 1);
10172 MODULE_DEPEND(linuxkpi_wlan, wlan, 1, 1, 1);
10173