xref: /freebsd/sys/compat/linuxkpi/common/src/linux_80211.c (revision 96759ab67a42226679675e24e35549aea2aa49e0)
1 /*-
2  * Copyright (c) 2020-2026 The FreeBSD Foundation
3  * Copyright (c) 2020-2025 Bjoern A. Zeeb
4  *
5  * This software was developed by Björn Zeeb under sponsorship from
6  * the FreeBSD Foundation.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  */
29 
30 /*
31  * Public functions are called linuxkpi_*().
32  * Internal (static) functions are called lkpi_*().
33  *
34  * The internal structures holding metadata over public structures are also
35  * called lkpi_xxx (usually with a member at the end called xxx).
36  * Note: we do not replicate the structure names but the general variable names
37  * for these (e.g., struct hw -> struct lkpi_hw, struct sta -> struct lkpi_sta).
38  * There are macros to access one from the other.
39  * We call the internal versions lxxx (e.g., hw -> lhw, sta -> lsta).
40  */
41 
42 /*
43  * TODO:
44  * - lots :)
45  * - HW_CRYPTO: we need a "keystore" and an ordered list for suspend/resume.
46  */
47 
48 #include <sys/param.h>
49 #include <sys/types.h>
50 #include <sys/kernel.h>
51 #include <sys/errno.h>
52 #include <sys/malloc.h>
53 #include <sys/module.h>
54 #include <sys/mutex.h>
55 #include <sys/sbuf.h>
56 #include <sys/socket.h>
57 #include <sys/sysctl.h>
58 #include <sys/queue.h>
59 #include <sys/taskqueue.h>
60 #include <sys/libkern.h>
61 
62 #include <net/if.h>
63 #include <net/if_var.h>
64 #include <net/if_media.h>
65 #include <net/ethernet.h>
66 
67 #include <net80211/ieee80211_var.h>
68 #include <net80211/ieee80211_proto.h>
69 #include <net80211/ieee80211_ratectl.h>
70 #include <net80211/ieee80211_radiotap.h>
71 #include <net80211/ieee80211_vht.h>
72 
73 #define	LINUXKPI_NET80211
74 #include <net/mac80211.h>
75 
76 #include <linux/workqueue.h>
77 #include <linux/rculist.h>
78 #include "linux_80211.h"
79 
80 /* #define	LKPI_80211_USE_SCANLIST */
81 /* #define	LKPI_80211_BGSCAN */
82 #define	LKPI_80211_WME
83 #define	LKPI_80211_HW_CRYPTO
84 #define	LKPI_80211_HT
85 #define	LKPI_80211_VHT
86 
87 #if defined(LKPI_80211_VHT) && !defined(LKPI_80211_HT)
88 #define	LKPI_80211_HT
89 #endif
90 #if defined(LKPI_80211_HT) && !defined(LKPI_80211_HW_CRYPTO)
91 #define	LKPI_80211_HW_CRYPTO
92 #endif
93 
94 static MALLOC_DEFINE(M_LKPI80211, "lkpi80211", "LinuxKPI 80211 compat");
95 
96 /* XXX-BZ really want this and others in queue.h */
97 #define	TAILQ_ELEM_INIT(elm, field) do {				\
98 	(elm)->field.tqe_next = NULL;					\
99 	(elm)->field.tqe_prev = NULL;					\
100 } while (0)
101 
102 /* -------------------------------------------------------------------------- */
103 
104 SYSCTL_DECL(_compat_linuxkpi);
105 SYSCTL_NODE(_compat_linuxkpi, OID_AUTO, 80211, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
106     "LinuxKPI 802.11 compatibility layer");
107 
108 static int lkpi_suspend_type = 1;
109 SYSCTL_INT(_compat_linuxkpi_80211, OID_AUTO, suspend_type, CTLFLAG_RW,
110     &lkpi_suspend_type, 0,
111     "LinuxKPI 802.11 suspend type bitmask (0=off, 1=net80211, 2=wowlan");
112 
113 static bool lkpi_order_scanlist = false;
114 SYSCTL_BOOL(_compat_linuxkpi_80211, OID_AUTO, order_scanlist, CTLFLAG_RW,
115     &lkpi_order_scanlist, 0, "Enable LinuxKPI 802.11 scan list shuffeling");
116 
117 #if defined(LKPI_80211_HW_CRYPTO)
118 static bool lkpi_hwcrypto = false;
119 SYSCTL_BOOL(_compat_linuxkpi_80211, OID_AUTO, hw_crypto, CTLFLAG_RDTUN,
120     &lkpi_hwcrypto, 0, "Enable LinuxKPI 802.11 hardware crypto offload");
121 
122 static bool lkpi_hwcrypto_tkip = false;
123 SYSCTL_BOOL(_compat_linuxkpi_80211, OID_AUTO, tkip, CTLFLAG_RDTUN,
124     &lkpi_hwcrypto_tkip, 0, "Enable LinuxKPI 802.11 TKIP crypto offload");
125 #endif
126 
127 /* Keep public for as long as header files are using it too. */
128 int linuxkpi_debug_80211;
129 
130 #ifdef LINUXKPI_DEBUG_80211
131 SYSCTL_INT(_compat_linuxkpi_80211, OID_AUTO, debug, CTLFLAG_RWTUN,
132     &linuxkpi_debug_80211, 0, "LinuxKPI 802.11 debug level");
133 
134 #define	UNIMPLEMENTED		if (linuxkpi_debug_80211 & D80211_TODO)		\
135     printf("XXX-TODO %s:%d: UNIMPLEMENTED\n", __func__, __LINE__)
136 #define	TRACEOK(_fmt, ...)	if (linuxkpi_debug_80211 & D80211_TRACEOK)	\
137     printf("%s:%d: TRACEPOINT " _fmt "\n", __func__, __LINE__, ##__VA_ARGS__)
138 #else
139 #define	UNIMPLEMENTED		do { } while (0)
140 #define	TRACEOK(...)		do { } while (0)
141 #endif
142 
143 /* #define	PREP_TX_INFO_DURATION	(IEEE80211_TRANS_WAIT * 1000) */
144 #ifndef PREP_TX_INFO_DURATION
145 #define	PREP_TX_INFO_DURATION	0 /* Let the driver do its thing. */
146 #endif
147 
148 /* This is DSAP | SSAP | CTRL | ProtoID/OrgCode{3}. */
149 const uint8_t rfc1042_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
150 
151 /* IEEE 802.11-05/0257r1 */
152 const uint8_t bridge_tunnel_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
153 
154 /* IEEE 802.11e Table 20i-UP-to-AC mappings. */
155 static const uint8_t ieee80211e_up_to_ac[] = {
156 	IEEE80211_AC_BE,
157 	IEEE80211_AC_BK,
158 	IEEE80211_AC_BK,
159 	IEEE80211_AC_BE,
160 	IEEE80211_AC_VI,
161 	IEEE80211_AC_VI,
162 	IEEE80211_AC_VO,
163 	IEEE80211_AC_VO,
164 #if 0
165 	IEEE80211_AC_VO, /* We treat MGMT as TID 8, which is set as AC_VO */
166 #endif
167 };
168 
169 const struct cfg80211_ops linuxkpi_mac80211cfgops = {
170 	/*
171 	 * XXX TODO need a "glue layer" to link cfg80211 ops to
172 	 * mac80211 and to the driver or net80211.
173 	 * Can we pass some on 1:1? Need to compare the (*f)().
174 	 */
175 };
176 
177 #if 0
178 static struct lkpi_sta *lkpi_find_lsta_by_ni(struct lkpi_vif *,
179     struct ieee80211_node *);
180 #endif
181 static void lkpi_sw_scan_task(void *, int);
182 static void lkpi_80211_txq_tx_one(struct lkpi_sta *, struct mbuf *);
183 static void lkpi_80211_txq_task(void *, int);
184 static void lkpi_80211_lhw_rxq_task(void *, int);
185 static void lkpi_ieee80211_free_skb_mbuf(void *);
186 #ifdef LKPI_80211_WME
187 static int lkpi_wme_update(struct lkpi_hw *, struct ieee80211vap *, bool);
188 #endif
189 static int lkpi_80211_update_chandef(struct ieee80211_hw *,
190     struct ieee80211_chanctx_conf *);
191 static void lkpi_ieee80211_wake_queues_locked(struct ieee80211_hw *);
192 
193 static const char *
194 lkpi_rate_info_bw_to_str(enum rate_info_bw bw)
195 {
196 
197 	switch (bw) {
198 
199         case RATE_INFO_BW_20:
200 		return ("20");
201 		break;
202         case RATE_INFO_BW_5:
203 		return ("5");
204 		break;
205         case RATE_INFO_BW_10:
206 		return ("10");
207 		break;
208         case RATE_INFO_BW_40:
209 		return ("40");
210 		break;
211         case RATE_INFO_BW_80:
212 		return ("80");
213 		break;
214         case RATE_INFO_BW_160:
215 		return ("160");
216 		break;
217         case RATE_INFO_BW_HE_RU:
218 		IMPROVE("nl80211_he_ru_alloc");
219 		return ("HE_RU");
220 		break;
221         case RATE_INFO_BW_320:
222 		return ("320");
223 		break;
224         case RATE_INFO_BW_EHT_RU:
225 		IMPROVE("nl80211_eht_ru_alloc");
226 		return ("EHT_RU");
227 		break;
228 	default:
229 		return ("?");
230 		break;
231 	}
232 }
233 
234 static void
235 lkpi_nl80211_sta_info_to_str(struct sbuf *s, const char *prefix,
236     const uint64_t flags)
237 {
238 	int bit, i;
239 
240 	sbuf_printf(s, "%s %#010jx", prefix, flags);
241 
242 	i = 0;
243 	for (bit = 0; bit < BITS_PER_TYPE(flags); bit++) {
244 
245 		if ((flags & BIT_ULL(bit)) == 0)
246 			continue;
247 
248 #define	EXPAND_CASE(_flag)						\
249 	case NL80211_STA_INFO_ ## _flag:				\
250 		sbuf_printf(s, "%c%s", (i == 0) ? '<' : ',', #_flag);	\
251 		i++;							\
252 		break;
253 
254 		switch (bit) {
255 		EXPAND_CASE(BEACON_RX)
256 		EXPAND_CASE(BEACON_SIGNAL_AVG)
257 		EXPAND_CASE(BSS_PARAM)
258 		EXPAND_CASE(CHAIN_SIGNAL)
259 		EXPAND_CASE(CHAIN_SIGNAL_AVG)
260 		EXPAND_CASE(CONNECTED_TIME)
261 		EXPAND_CASE(INACTIVE_TIME)
262 		EXPAND_CASE(SIGNAL)
263 		EXPAND_CASE(SIGNAL_AVG)
264 		EXPAND_CASE(STA_FLAGS)
265 		EXPAND_CASE(RX_BITRATE)
266 		EXPAND_CASE(RX_PACKETS)
267 		EXPAND_CASE(RX_BYTES)
268 		EXPAND_CASE(RX_DROP_MISC)
269 		EXPAND_CASE(TX_BITRATE)
270 		EXPAND_CASE(TX_PACKETS)
271 		EXPAND_CASE(TX_BYTES)
272 		EXPAND_CASE(TX_BYTES64)
273 		EXPAND_CASE(RX_BYTES64)
274 		EXPAND_CASE(TX_FAILED)
275 		EXPAND_CASE(TX_RETRIES)
276 		EXPAND_CASE(RX_DURATION)
277 		EXPAND_CASE(TX_DURATION)
278 		EXPAND_CASE(ACK_SIGNAL)
279 		EXPAND_CASE(ACK_SIGNAL_AVG)
280 		default:
281 			sbuf_printf(s, "%c?%d", (i == 0) ? '<' : ',', bit);
282 			break;
283 		}
284 	}
285 #undef	EXPAND_CASE
286 	if (i > 0)
287 		sbuf_printf(s, ">");
288 	sbuf_printf(s, "\n");
289 }
290 
291 static void
292 lkpi_80211_dump_lvif_stas(struct lkpi_vif *lvif, struct sbuf *s, bool dump_queues)
293 {
294 	struct lkpi_hw *lhw;
295 	struct ieee80211_hw *hw;
296 	struct ieee80211vap *vap;
297 	struct ieee80211_vif *vif;
298 	struct lkpi_sta *lsta;
299 	struct ieee80211_sta *sta;
300 	struct station_info sinfo;
301 	int error;
302 	uint8_t tid;
303 
304 	vif = LVIF_TO_VIF(lvif);
305 	vap = LVIF_TO_VAP(lvif);
306 	lhw = vap->iv_ic->ic_softc;
307 	hw = LHW_TO_HW(lhw);
308 
309 	wiphy_lock(hw->wiphy);
310 	list_for_each_entry(lsta, &lvif->lsta_list, lsta_list) {
311 		sta = LSTA_TO_STA(lsta);
312 
313 		sbuf_putc(s, '\n');
314 		sbuf_printf(s, "lsta %p sta %p added_to_drv %d\n", lsta, sta, lsta->added_to_drv);
315 
316 		memset(&sinfo, 0, sizeof(sinfo));
317 		error = lkpi_80211_mo_sta_statistics(hw, vif, sta, &sinfo);
318 		if (error == EEXIST)	/* Not added to driver. */
319 			continue;
320 		if (error == ENOTSUPP) {
321 			sbuf_printf(s, " sta_statistics not supported\n");
322 			continue;
323 		}
324 		if (error != 0) {
325 			sbuf_printf(s, " sta_statistics failed: %d\n", error);
326 			continue;
327 		}
328 
329 		/* If no RX_BITRATE is reported, try to fill it in from the lsta sinfo. */
330 		if ((sinfo.filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) == 0 &&
331 		    (lsta->sinfo.filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) != 0) {
332 			memcpy(&sinfo.rxrate, &lsta->sinfo.rxrate, sizeof(sinfo.rxrate));
333 			sinfo.filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
334 		}
335 		/* If no CHAIN_SIGNAL is reported,  try to fill it in from the lsta sinfo. */
336 		if ((sinfo.filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) == 0 &&
337 		    (lsta->sinfo.filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) != 0) {
338 			sinfo.chains = lsta->sinfo.chains;
339 			memcpy(sinfo.chain_signal, lsta->sinfo.chain_signal,
340 			    sizeof(sinfo.chain_signal));
341 			sinfo.filled |= BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL);
342 		}
343 
344 		lkpi_nl80211_sta_info_to_str(s, " nl80211_sta_info (valid fields)", sinfo.filled);
345 		sbuf_printf(s, " connected_time %u inactive_time %u\n",
346 		    sinfo.connected_time, sinfo.inactive_time);
347 		sbuf_printf(s, " rx_bytes %ju rx_packets %u rx_dropped_misc %u\n",
348 		    (uintmax_t)sinfo.rx_bytes, sinfo.rx_packets, sinfo.rx_dropped_misc);
349 		sbuf_printf(s, " rx_duration %ju rx_beacon %u rx_beacon_signal_avg %d\n",
350 		    (uintmax_t)sinfo.rx_duration, sinfo.rx_beacon, (int8_t)sinfo.rx_beacon_signal_avg);
351 
352 		sbuf_printf(s, " tx_bytes %ju tx_packets %u tx_failed %u\n",
353 		    (uintmax_t)sinfo.tx_bytes, sinfo.tx_packets, sinfo.tx_failed);
354 		sbuf_printf(s, " tx_duration %ju tx_retries %u\n",
355 		    (uintmax_t)sinfo.tx_duration, sinfo.tx_retries);
356 
357 		sbuf_printf(s, " signal %d signal_avg %d ack_signal %d avg_ack_signal %d\n",
358 		    sinfo.signal, sinfo.signal_avg, sinfo.ack_signal, sinfo.avg_ack_signal);
359 		sbuf_printf(s, " generation %d assoc_req_ies_len %zu chains %#04x\n",
360 		    sinfo.generation, sinfo.assoc_req_ies_len, sinfo.chains);
361 
362 		for (int i = 0; i < nitems(sinfo.chain_signal) && i < IEEE80211_MAX_CHAINS; i++) {
363 			if (!(sinfo.chains & BIT(i)))
364 				continue;
365 			sbuf_printf(s, "  chain[%d] signal %d signal_avg %d\n",
366 			    i, (int8_t)sinfo.chain_signal[i], (int8_t)sinfo.chain_signal_avg[i]);
367 		}
368 
369 		/* assoc_req_ies, bss_param, sta_flags */
370 
371 		sbuf_printf(s, " rxrate: flags %b bw %u(%s) legacy %u kbit/s mcs %u nss %u\n",
372 		    sinfo.rxrate.flags, CFG80211_RATE_INFO_FLAGS_BITS,
373 		    sinfo.rxrate.bw, lkpi_rate_info_bw_to_str(sinfo.rxrate.bw),
374 		    sinfo.rxrate.legacy * 100,
375 		    sinfo.rxrate.mcs, sinfo.rxrate.nss);
376 		sbuf_printf(s, "         he_dcm %u he_gi %u he_ru_alloc %u eht_gi %u\n",
377 		    sinfo.rxrate.he_dcm, sinfo.rxrate.he_gi, sinfo.rxrate.he_ru_alloc,
378 		    sinfo.rxrate.eht_gi);
379 		sbuf_printf(s, " txrate: flags %b bw %u(%s) legacy %u kbit/s mcs %u nss %u\n",
380 		    sinfo.txrate.flags, CFG80211_RATE_INFO_FLAGS_BITS,
381 		    sinfo.txrate.bw, lkpi_rate_info_bw_to_str(sinfo.txrate.bw),
382 		    sinfo.txrate.legacy * 100,
383 		    sinfo.txrate.mcs, sinfo.txrate.nss);
384 		sbuf_printf(s, "         he_dcm %u he_gi %u he_ru_alloc %u eht_gi %u\n",
385 		    sinfo.txrate.he_dcm, sinfo.txrate.he_gi, sinfo.txrate.he_ru_alloc,
386 		    sinfo.txrate.eht_gi);
387 
388 		if (!dump_queues)
389 			continue;
390 
391 		/* Dump queue information. */
392 		sbuf_printf(s, " Queue information:\n");
393 		sbuf_printf(s, "  frms direct tx %ju\n", lsta->frms_tx);
394 		for (tid = 0; tid <= IEEE80211_NUM_TIDS; tid++) {
395 			struct lkpi_txq *ltxq;
396 
397 			if (sta->txq[tid] == NULL) {
398 				sbuf_printf(s, "  tid %-2u NOQ\n", tid);
399 				continue;
400 			}
401 
402 			ltxq = TXQ_TO_LTXQ(sta->txq[tid]);
403 #ifdef __notyet__
404 			sbuf_printf(s, "  tid %-2u flags: %b "
405 			    "txq_generation %u skbq len %d\n",
406 			    tid, ltxq->flags, LKPI_TXQ_FLAGS_BITS,
407 			    ltxq->txq_generation,
408 			    skb_queue_len_lockless(&ltxq->skbq));
409 #else
410 			sbuf_printf(s, "  tid %-2u "
411 			    "txq_generation %u skbq len %d\n",
412 			    tid,
413 			    ltxq->txq_generation,
414 			    skb_queue_len_lockless(&ltxq->skbq));
415 #endif
416 			sbuf_printf(s, "         frms_enqueued %ju frms_dequeued %ju "
417 			    "frms_tx %ju\n",
418 			    ltxq->frms_enqueued, ltxq->frms_dequeued, ltxq->frms_tx);
419 		}
420 	}
421 	wiphy_unlock(hw->wiphy);
422 }
423 
424 static int
425 lkpi_80211_dump_stas(SYSCTL_HANDLER_ARGS)
426 {
427 	struct lkpi_vif *lvif;
428 	struct sbuf s;
429 
430 	if (req->newptr)
431 		return (EPERM);
432 
433 	lvif = (struct lkpi_vif *)arg1;
434 
435 	sbuf_new_for_sysctl(&s, NULL, 1024, req);
436 
437 	lkpi_80211_dump_lvif_stas(lvif, &s, false);
438 
439 	sbuf_finish(&s);
440 	sbuf_delete(&s);
441 
442 	return (0);
443 }
444 
445 static int
446 lkpi_80211_dump_sta_queues(SYSCTL_HANDLER_ARGS)
447 {
448 	struct lkpi_vif *lvif;
449 	struct sbuf s;
450 
451 	if (req->newptr)
452 		return (EPERM);
453 
454 	lvif = (struct lkpi_vif *)arg1;
455 
456 	sbuf_new_for_sysctl(&s, NULL, 1024, req);
457 
458 	lkpi_80211_dump_lvif_stas(lvif, &s, true);
459 
460 	sbuf_finish(&s);
461 	sbuf_delete(&s);
462 
463 	return (0);
464 }
465 
466 static enum ieee80211_sta_rx_bandwidth
467 lkpi_cw_to_rx_bw(enum nl80211_chan_width cw)
468 {
469 	switch (cw) {
470 	case NL80211_CHAN_WIDTH_320:
471 		return (IEEE80211_STA_RX_BW_320);
472 	case NL80211_CHAN_WIDTH_160:
473 	case NL80211_CHAN_WIDTH_80P80:
474 		return (IEEE80211_STA_RX_BW_160);
475 	case NL80211_CHAN_WIDTH_80:
476 		return (IEEE80211_STA_RX_BW_80);
477 	case NL80211_CHAN_WIDTH_40:
478 		return (IEEE80211_STA_RX_BW_40);
479 	case NL80211_CHAN_WIDTH_20:
480 	case NL80211_CHAN_WIDTH_20_NOHT:
481 		return (IEEE80211_STA_RX_BW_20);
482 	case NL80211_CHAN_WIDTH_5:
483 	case NL80211_CHAN_WIDTH_10:
484 		/* Unsupported input. */
485 		return (IEEE80211_STA_RX_BW_20);
486 	}
487 }
488 
489 static enum nl80211_chan_width
490 lkpi_rx_bw_to_cw(enum ieee80211_sta_rx_bandwidth rx_bw)
491 {
492 	switch (rx_bw) {
493 	case IEEE80211_STA_RX_BW_20:
494 		return (NL80211_CHAN_WIDTH_20);	/* _NOHT */
495 	case IEEE80211_STA_RX_BW_40:
496 		return (NL80211_CHAN_WIDTH_40);
497 	case IEEE80211_STA_RX_BW_80:
498 		return (NL80211_CHAN_WIDTH_80);
499 	case IEEE80211_STA_RX_BW_160:
500 		return (NL80211_CHAN_WIDTH_160); /* 80P80 */
501 	case IEEE80211_STA_RX_BW_320:
502 		return (NL80211_CHAN_WIDTH_320);
503 	}
504 }
505 
506 static void
507 lkpi_sync_chanctx_cw_from_rx_bw(struct ieee80211_hw *hw,
508     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
509 {
510 	struct ieee80211_chanctx_conf *chanctx_conf;
511 	enum ieee80211_sta_rx_bandwidth old_bw;
512 	uint32_t changed;
513 
514 	lockdep_assert_wiphy(hw->wiphy);
515 
516 	chanctx_conf = rcu_dereference_protected(vif->bss_conf.chanctx_conf,
517 	    lockdep_is_held(&hw->wiphy->mtx));
518 	if (chanctx_conf == NULL)
519 		return;
520 
521 	old_bw = lkpi_cw_to_rx_bw(chanctx_conf->def.width);
522 	if (old_bw == sta->deflink.bandwidth)
523 		return;
524 
525 	chanctx_conf->def.width = lkpi_rx_bw_to_cw(sta->deflink.bandwidth);
526 	if (chanctx_conf->def.width == NL80211_CHAN_WIDTH_20 &&
527 	    !sta->deflink.ht_cap.ht_supported)
528 		chanctx_conf->def.width = NL80211_CHAN_WIDTH_20_NOHT;
529 
530 	chanctx_conf->min_def = chanctx_conf->def;
531 
532 	vif->bss_conf.chanreq.oper.width = chanctx_conf->def.width;
533 
534 	changed = IEEE80211_CHANCTX_CHANGE_MIN_WIDTH;
535 	changed |= IEEE80211_CHANCTX_CHANGE_WIDTH;
536 	lkpi_80211_mo_change_chanctx(hw, chanctx_conf, changed);
537 }
538 
539 #if defined(LKPI_80211_HT)
540 static void
541 lkpi_sta_sync_ht_from_ni(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
542     struct ieee80211_sta *sta, struct ieee80211_node *ni)
543 {
544 	struct ieee80211vap *vap;
545 	uint8_t *ie;
546 	struct ieee80211_ht_cap *htcap;
547 	struct ieee80211_sta_ht_cap *ht_cap, *sta_ht_cap;
548 	enum nl80211_band band;
549 	int i, rx_nss;
550 
551 	if ((ni->ni_flags & IEEE80211_NODE_HT) == 0) {
552 		sta->deflink.ht_cap.ht_supported = false;
553 		return;
554 	}
555 
556 	sta->deflink.ht_cap.ht_supported = true;
557 
558 	/* htcap->ampdu_params_info */
559 	vap = ni->ni_vap;
560 	sta->deflink.ht_cap.ampdu_density = _IEEE80211_MASKSHIFT(ni->ni_htparam, IEEE80211_HTCAP_MPDUDENSITY);
561 	if (sta->deflink.ht_cap.ampdu_density > vap->iv_ampdu_density)
562 		sta->deflink.ht_cap.ampdu_density = vap->iv_ampdu_density;
563 	sta->deflink.ht_cap.ampdu_factor = _IEEE80211_MASKSHIFT(ni->ni_htparam, IEEE80211_HTCAP_MAXRXAMPDU);
564 	if (sta->deflink.ht_cap.ampdu_factor > vap->iv_ampdu_rxmax)
565 		sta->deflink.ht_cap.ampdu_factor = vap->iv_ampdu_rxmax;
566 
567 	ie = ni->ni_ies.htcap_ie;
568 	KASSERT(ie != NULL, ("%s: HT but no htcap_ie on ni %p\n", __func__, ni));
569 	if (ie[0] == IEEE80211_ELEMID_VENDOR)
570 		ie += 4;
571 	ie += 2;
572 	htcap = (struct ieee80211_ht_cap *)ie;
573 	sta->deflink.ht_cap.cap = htcap->cap_info;
574 	sta->deflink.ht_cap.mcs = htcap->mcs;
575 
576 	/*
577 	 * 802.11n-2009 20.6 Parameters for HT MCSs gives the mandatory/
578 	 * optional MCS for Nss=1..4.  We need to check the first four
579 	 * MCS sets from the Rx MCS Bitmask; then there is MCS 32 and
580 	 * MCS33.. is UEQM.
581 	 */
582 	band = vif->bss_conf.chanctx_conf->def.chan->band;
583 	ht_cap = &hw->wiphy->bands[band]->ht_cap;
584 	sta_ht_cap = &sta->deflink.ht_cap;
585 	rx_nss = 0;
586 	for (i = 0; i < 4; i++) {
587 		TRACEOK("HT rx_mask[%d] sta %#04x & hw %#04x", i,
588 		    sta_ht_cap->mcs.rx_mask[i], ht_cap->mcs.rx_mask[i]);
589 		sta_ht_cap->mcs.rx_mask[i] =
590 			sta_ht_cap->mcs.rx_mask[i] & ht_cap->mcs.rx_mask[i];
591 		/* XXX-BZ masking unequal modulation? */
592 
593 		if (sta_ht_cap->mcs.rx_mask[i] != 0)
594 			rx_nss++;
595 	}
596 	if (rx_nss > 0) {
597 		TRACEOK("HT rx_nss = max(%d, %d)", rx_nss, sta->deflink.rx_nss);
598 		sta->deflink.rx_nss = MAX(rx_nss, sta->deflink.rx_nss);
599 	} else {
600 		sta->deflink.ht_cap.ht_supported = false;
601 		return;
602 	}
603 
604 	if ((sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) != 0 &&
605 	    IEEE80211_IS_CHAN_HT40(ni->ni_chan))
606 		sta->deflink.bandwidth = IEEE80211_STA_RX_BW_40;
607 	else
608 		sta->deflink.bandwidth = IEEE80211_STA_RX_BW_20;
609 
610 	IMPROVE("sta->wme");
611 
612 	if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_MAX_AMSDU)
613 		sta->deflink.agg.max_amsdu_len = IEEE80211_MAX_MPDU_LEN_HT_7935;
614 	else
615 		sta->deflink.agg.max_amsdu_len = IEEE80211_MAX_MPDU_LEN_HT_3839;
616 	sta->deflink.agg.max_rc_amsdu_len = IEEE80211_MAX_MPDU_LEN_HT_BA;
617 #ifdef __handled_by_driver__	/* iwlwifi only? actually unused? */
618 	for (i = 0; i < nitems(sta.deflink.agg.max_tid_amsdu_len); i++) {
619 		sta->deflink.agg.max_tid_amsdu_len[j] = ;
620 	}
621 #endif
622 }
623 #endif
624 
625 #if defined(LKPI_80211_VHT)
626 static void
627 lkpi_sta_sync_vht_from_ni(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
628     struct ieee80211_sta *sta, struct ieee80211_node *ni)
629 {
630 	struct ieee80211_sta_vht_cap *vht_cap, *sta_vht_cap;;
631 	enum ieee80211_sta_rx_bandwidth bw;
632 	enum nl80211_band band;
633 	uint32_t width;
634 	int rx_nss;
635 	uint16_t rx_map, tx_map;
636 
637 	if ((ni->ni_flags & IEEE80211_NODE_VHT) == 0 ||
638 	    !IEEE80211_IS_CHAN_VHT_5GHZ(ni->ni_chan)) {
639 		sta->deflink.vht_cap.vht_supported = false;
640 		return;
641 	}
642 
643 	sta->deflink.vht_cap.vht_supported = true;
644 
645 	sta->deflink.vht_cap.cap = ni->ni_vhtcap;
646 	sta->deflink.vht_cap.vht_mcs = ni->ni_vht_mcsinfo;
647 
648 	/*
649 	 * If VHT20/40 are selected do not update the bandwidth
650 	 * from HT but stya on VHT.
651 	 */
652 	if (ni->ni_vht_chanwidth == IEEE80211_VHT_CHANWIDTH_USE_HT)
653 		goto skip_bw;
654 
655 	bw = sta->deflink.bandwidth;
656 	width = (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK);
657 	switch (width) {
658 	/* Deprecated. */
659 	case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ:
660 	case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ:
661 		bw = IEEE80211_STA_RX_BW_160;
662 		break;
663 	default:
664 		/* Check if we do support 160Mhz somehow after all. */
665 		if ((sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_EXT_NSS_BW_MASK) != 0)
666 			bw = IEEE80211_STA_RX_BW_160;
667 		else
668 			bw = IEEE80211_STA_RX_BW_80;
669 	}
670 	/*
671 	 * While we can set what is possibly supported we also need to be
672 	 * on a channel which supports that bandwidth; e.g., we can support
673 	 * VHT160 but the AP only does VHT80.
674 	 * Further ni_chan will also have filtered out what we disabled
675 	 * by configuration.
676 	 * Once net80211 channel selection is fixed for 802.11-2020 and
677 	 * VHT160 we can possibly spare ourselves the above.
678 	 */
679 	if (bw == IEEE80211_STA_RX_BW_160 &&
680 	    !IEEE80211_IS_CHAN_VHT160(ni->ni_chan) &&
681 	    !IEEE80211_IS_CHAN_VHT80P80(ni->ni_chan))
682 		bw = IEEE80211_STA_RX_BW_80;
683 	if (bw == IEEE80211_STA_RX_BW_80 &&
684 	    !IEEE80211_IS_CHAN_VHT80(ni->ni_chan))
685 		bw = sta->deflink.bandwidth;
686 	sta->deflink.bandwidth = bw;
687 skip_bw:
688 
689 	band = vif->bss_conf.chanctx_conf->def.chan->band;
690 	vht_cap = &hw->wiphy->bands[band]->vht_cap;
691 	sta_vht_cap = &sta->deflink.vht_cap;
692 
693 	rx_nss = 0;
694 	rx_map = tx_map = 0;
695 	for (int i = 7; i >= 0; i--) {
696 		uint8_t card, sta;
697 
698 		card = (vht_cap->vht_mcs.rx_mcs_map >> (2 * i)) & 0x3;
699 		sta  = (sta_vht_cap->vht_mcs.rx_mcs_map >> (2 * i)) & 0x3;
700 		if (sta != IEEE80211_VHT_MCS_NOT_SUPPORTED) {
701 			if (card == IEEE80211_VHT_MCS_NOT_SUPPORTED)
702 				sta = IEEE80211_VHT_MCS_NOT_SUPPORTED;
703 			else {
704 				sta = MIN(sta, card);
705 				if (rx_nss == 0)
706 					rx_nss = i + 1;
707 			}
708 		}
709 		rx_map |= (sta << (2 * i));
710 
711 		card = (vht_cap->vht_mcs.tx_mcs_map >> (2 * i)) & 0x3;
712 		sta  = (sta_vht_cap->vht_mcs.tx_mcs_map >> (2 * i)) & 0x3;
713 		if (sta != IEEE80211_VHT_MCS_NOT_SUPPORTED) {
714 			if (card == IEEE80211_VHT_MCS_NOT_SUPPORTED)
715 				sta = IEEE80211_VHT_MCS_NOT_SUPPORTED;
716 			else
717 				sta = MIN(sta, card);
718 		}
719 		tx_map |= (sta << (2 * i));
720 	}
721 	TRACEOK("VHT rx_mcs_map %#010x->%#010x, tx_mcs_map %#010x->%#010x, rx_nss = %d",
722 	    sta_vht_cap->vht_mcs.rx_mcs_map, rx_map,
723 	    sta_vht_cap->vht_mcs.tx_mcs_map, tx_map, rx_nss);
724 	sta_vht_cap->vht_mcs.rx_mcs_map = rx_map;
725 	sta_vht_cap->vht_mcs.tx_mcs_map = tx_map;
726 	if (rx_nss > 0) {
727 		TRACEOK("VHT rx_nss = max(%d, %d)", rx_nss, sta->deflink.rx_nss);
728 		sta->deflink.rx_nss = MAX(rx_nss, sta->deflink.rx_nss);
729 	} else {
730 		sta->deflink.vht_cap.vht_supported = false;
731 		return;
732 	}
733 
734 	switch (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MAX_MPDU_MASK) {
735 	case IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454:
736 		sta->deflink.agg.max_amsdu_len = IEEE80211_MAX_MPDU_LEN_VHT_11454;
737 		break;
738 	case IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991:
739 		sta->deflink.agg.max_amsdu_len = IEEE80211_MAX_MPDU_LEN_VHT_7991;
740 		break;
741 	case IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895:
742 	default:
743 		sta->deflink.agg.max_amsdu_len = IEEE80211_MAX_MPDU_LEN_VHT_3895;
744 		break;
745 	}
746 }
747 #endif
748 
749 static void
750 lkpi_sta_sync_from_ni(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
751     struct ieee80211_sta *sta, struct ieee80211_node *ni, bool updchnctx)
752 {
753 
754 	if (updchnctx)
755 		lockdep_assert_wiphy(hw->wiphy);
756 
757 	/*
758 	 * Ensure rx_nss is at least 1 as otherwise drivers run into
759 	 * unexpected problems.
760 	 */
761 	sta->deflink.rx_nss = 1;
762 
763 #if defined(LKPI_80211_HT)
764 	lkpi_sta_sync_ht_from_ni(hw, vif, sta, ni);
765 #endif
766 #if defined(LKPI_80211_VHT)
767 	lkpi_sta_sync_vht_from_ni(hw, vif, sta, ni);
768 #endif
769 
770 	/*
771 	 * We are also called from node allocation which net80211
772 	 * can do even on `ifconfig down`; in that case the chanctx
773 	 * may still be valid and we get a discrepancy between
774 	 * sta and chanctx.  Thus do not try to update the chanctx
775 	 * when called from lkpi_lsta_alloc().
776 	 */
777 	if (updchnctx)
778 		lkpi_sync_chanctx_cw_from_rx_bw(hw, vif, sta);
779 }
780 
781 #if 0
782 static uint8_t
783 lkpi_get_max_rx_chains(struct ieee80211_node *ni)
784 {
785 	uint8_t chains;
786 #if defined(LKPI_80211_HT) || defined(LKPI_80211_VHT)
787 	struct lkpi_sta *lsta;
788 	struct ieee80211_sta *sta;
789 
790 	lsta = ni->ni_drv_data;
791 	sta = LSTA_TO_STA(lsta);
792 #endif
793 
794 	chains = 1;
795 #if defined(LKPI_80211_HT)
796 	IMPROVE("We should factor counting MCS/NSS out for sync and here");
797 	if (sta->deflink.ht_cap.ht_supported)
798 		chains = MAX(chains, sta->deflink.rx_nss);
799 #endif
800 
801 #if defined(LKPI_80211_VHT)
802 	if (sta->deflink.vht_cap.vht_supported)
803 		chains = MAX(chains, sta->deflink.rx_nss);
804 #endif
805 
806 	return (chains);
807 }
808 #endif
809 
810 static void
811 lkpi_lsta_dump(struct lkpi_sta *lsta, struct ieee80211_node *ni,
812     const char *_f, int _l)
813 {
814 
815 #ifdef LINUXKPI_DEBUG_80211
816 	if ((linuxkpi_debug_80211 & D80211_TRACE_STA) == 0)
817 		return;
818 	if (lsta == NULL)
819 		return;
820 
821 	printf("%s:%d lsta %p ni %p sta %p\n",
822 	    _f, _l, lsta, ni, &lsta->sta);
823 	if (ni != NULL)
824 		ieee80211_dump_node(NULL, ni);
825 	printf("\ttxq_task txq len %d mtx\n", mbufq_len(&lsta->txq));
826 	printf("\tkc %p state %d added_to_drv %d in_mgd %d\n",
827 		&lsta->kc[0], lsta->state, lsta->added_to_drv, lsta->in_mgd);
828 #endif
829 }
830 
831 static void
832 lkpi_lsta_remove(struct lkpi_sta *lsta, struct lkpi_vif *lvif)
833 {
834 
835 	lockdep_assert_wiphy(lsta->hw->wiphy);
836 
837 	KASSERT(!list_empty(&lsta->lsta_list),
838 	    ("%s: lsta %p ni %p\n", __func__, lsta, lsta->ni));
839 	list_del_init(&lsta->lsta_list);
840 }
841 
842 static struct lkpi_sta *
843 lkpi_lsta_alloc(struct ieee80211vap *vap, const uint8_t mac[IEEE80211_ADDR_LEN],
844     struct ieee80211_hw *hw, struct ieee80211_node *ni)
845 {
846 	struct lkpi_sta *lsta;
847 	struct lkpi_vif *lvif;
848 	struct ieee80211_vif *vif;
849 	struct ieee80211_sta *sta;
850 	int band, i, tid;
851 
852 	lsta = malloc(sizeof(*lsta) + hw->sta_data_size, M_LKPI80211,
853 	    M_NOWAIT | M_ZERO);
854 	if (lsta == NULL)
855 		return (NULL);
856 
857 	lsta->hw = hw;
858 	lsta->added_to_drv = false;
859 	lsta->state = IEEE80211_STA_NOTEXIST;
860 	/*
861 	 * Link the ni to the lsta here without taking a reference.
862 	 * For one we would have to take the reference in node_init()
863 	 * as ieee80211_alloc_node() will initialise the refcount after us.
864 	 * For the other a ni and an lsta are 1:1 mapped and always together
865 	 * from [ic_]node_alloc() to [ic_]node_free() so we are essentally
866 	 * using the ni references for the lsta as well despite it being
867 	 * two separate allocations.
868 	 */
869 	lsta->ni = ni;
870 	/* The back-pointer "drv_data" to net80211_node let's us get lsta. */
871 	ni->ni_drv_data = lsta;
872 
873 	lvif = VAP_TO_LVIF(vap);
874 	vif = LVIF_TO_VIF(lvif);
875 	sta = LSTA_TO_STA(lsta);
876 
877 	IEEE80211_ADDR_COPY(sta->addr, mac);
878 
879 	/* TXQ */
880 	for (tid = 0; tid < nitems(sta->txq); tid++) {
881 		struct lkpi_txq *ltxq;
882 
883 		/* We are not limiting ourselves to hw.queues here. */
884 		ltxq = malloc(sizeof(*ltxq) + hw->txq_data_size,
885 		    M_LKPI80211, M_NOWAIT | M_ZERO);
886 		if (ltxq == NULL)
887 			goto cleanup;
888 		/* iwlwifi//mvm/sta.c::tid_to_mac80211_ac[] */
889 		if (tid == IEEE80211_NUM_TIDS) {
890 			if (!ieee80211_hw_check(hw, STA_MMPDU_TXQ)) {
891 				free(ltxq, M_LKPI80211);
892 				continue;
893 			}
894 			IMPROVE("AP/if we support non-STA here too");
895 			ltxq->txq.ac = IEEE80211_AC_VO;
896 		} else {
897 			ltxq->txq.ac = ieee80211e_up_to_ac[tid & 7];
898 		}
899 		ltxq->flags = 0;
900 		ltxq->txq.vif = vif;
901 		ltxq->txq.tid = tid;
902 		ltxq->txq.sta = sta;
903 		TAILQ_ELEM_INIT(ltxq, txq_entry);
904 		skb_queue_head_init(&ltxq->skbq);
905 		LKPI_80211_LTXQ_LOCK_INIT(ltxq);
906 		sta->txq[tid] = &ltxq->txq;
907 	}
908 
909 	/* Deflink information. */
910 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
911 		struct ieee80211_supported_band *supband;
912 		uint32_t rate_mandatory;;
913 
914 		supband = hw->wiphy->bands[band];
915 		if (supband == NULL)
916 			continue;
917 
918 		switch (band) {
919 		case NL80211_BAND_2GHZ:
920 			/* We have to assume 11g support here. */
921 			rate_mandatory = IEEE80211_RATE_MANDATORY_G |
922 			    IEEE80211_RATE_MANDATORY_B;
923 			break;
924 		case NL80211_BAND_5GHZ:
925 			rate_mandatory = IEEE80211_RATE_MANDATORY_A;
926 			break;
927 		default:
928 			continue;
929 		}
930 
931 		for (i = 0; i < supband->n_bitrates; i++) {
932 			if ((supband->bitrates[i].flags & rate_mandatory) != 0)
933 				sta->deflink.supp_rates[band] |= BIT(i);
934 		}
935 	}
936 
937 	sta->deflink.smps_mode = IEEE80211_SMPS_OFF;
938 	sta->deflink.bandwidth = IEEE80211_STA_RX_BW_20;
939 	sta->deflink.agg.max_rc_amsdu_len = IEEE80211_MAX_MPDU_LEN_HT_BA;
940 	sta->deflink.rx_nss = 1;
941 	sta->deflink.sta = sta;
942 
943 	lkpi_sta_sync_from_ni(hw, vif, sta, ni, false);
944 
945 	IMPROVE("he, eht, bw_320, ... smps_mode, ..");
946 
947 	/* Link configuration. */
948 	IEEE80211_ADDR_COPY(sta->deflink.addr, sta->addr);
949 	sta->link[0] = &sta->deflink;
950 	for (i = 1; i < nitems(sta->link); i++) {
951 		IMPROVE("more links; only link[0] = deflink currently.");
952 	}
953 	IMPROVE("11be");
954 	sta->mlo = false;
955 
956 	/* Deferred TX path. */
957 	LKPI_80211_LSTA_TXQ_LOCK_INIT(lsta);
958 	TASK_INIT(&lsta->txq_task, 0, lkpi_80211_txq_task, lsta);
959 	mbufq_init(&lsta->txq, 32 * NAPI_POLL_WEIGHT);
960 	lsta->txq_ready = true;
961 
962 	return (lsta);
963 
964 cleanup:
965 	for (; tid >= 0; tid--) {
966 		struct lkpi_txq *ltxq;
967 
968 		ltxq = TXQ_TO_LTXQ(sta->txq[tid]);
969 		LKPI_80211_LTXQ_LOCK_DESTROY(ltxq);
970 		free(sta->txq[tid], M_LKPI80211);
971 	}
972 	free(lsta, M_LKPI80211);
973 	return (NULL);
974 }
975 
976 static void
977 lkpi_lsta_free(struct lkpi_sta *lsta, struct ieee80211_node *ni)
978 {
979 	struct mbuf *m;
980 
981 	if (lsta->added_to_drv)
982 		panic("%s: Trying to free an lsta still known to firmware: "
983 		    "lsta %p ni %p added_to_drv %d\n",
984 		    __func__, lsta, ni, lsta->added_to_drv);
985 
986 	/* XXX-BZ free resources, ... */
987 	IMPROVE();
988 
989 	/* Drain sta->txq[] */
990 
991 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
992 	lsta->txq_ready = false;
993 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
994 
995 	/* Drain taskq, won't be restarted until added_to_drv is set again. */
996 	while (taskqueue_cancel(taskqueue_thread, &lsta->txq_task, NULL) != 0)
997 		taskqueue_drain(taskqueue_thread, &lsta->txq_task);
998 
999 	/* Flush mbufq (make sure to release ni refs!). */
1000 	m = mbufq_dequeue(&lsta->txq);
1001 	while (m != NULL) {
1002 		struct ieee80211_node *nim;
1003 
1004 		nim = (struct ieee80211_node *)m->m_pkthdr.rcvif;
1005 		if (nim != NULL)
1006 			ieee80211_free_node(nim);
1007 		m_freem(m);
1008 		m = mbufq_dequeue(&lsta->txq);
1009 	}
1010 	KASSERT(mbufq_empty(&lsta->txq), ("%s: lsta %p has txq len %d != 0\n",
1011 	    __func__, lsta, mbufq_len(&lsta->txq)));
1012 	LKPI_80211_LSTA_TXQ_LOCK_DESTROY(lsta);
1013 
1014 	/* Remove lsta from vif; that is done by the state machine.  Should assert it? */
1015 
1016 	IMPROVE("Make sure everything is cleaned up.");
1017 
1018 	/* Free lsta. */
1019 	lsta->ni = NULL;
1020 	ni->ni_drv_data = NULL;
1021 	free(lsta, M_LKPI80211);
1022 }
1023 
1024 
1025 static enum nl80211_band
1026 lkpi_net80211_chan_to_nl80211_band(struct ieee80211_channel *c)
1027 {
1028 
1029 	if (IEEE80211_IS_CHAN_2GHZ(c))
1030 		return (NL80211_BAND_2GHZ);
1031 	else if (IEEE80211_IS_CHAN_5GHZ(c))
1032 		return (NL80211_BAND_5GHZ);
1033 #ifdef __notyet__
1034 	else if ()
1035 		return (NL80211_BAND_6GHZ);
1036 	else if ()
1037 		return (NL80211_BAND_60GHZ);
1038 	else if (IEEE80211_IS_CHAN_GSM(c))
1039 		return (NL80211_BAND_XXX);
1040 #endif
1041 	else
1042 		panic("%s: unsupported band. c %p flags %#x\n",
1043 		    __func__, c, c->ic_flags);
1044 }
1045 
1046 static uint32_t
1047 lkpi_nl80211_band_to_net80211_band(enum nl80211_band band)
1048 {
1049 
1050 	/* XXX-BZ this is just silly; net80211 is too convoluted. */
1051 	/* IEEE80211_CHAN_A / _G / .. doesn't really work either. */
1052 	switch (band) {
1053 	case NL80211_BAND_2GHZ:
1054 		return (IEEE80211_CHAN_2GHZ);
1055 		break;
1056 	case NL80211_BAND_5GHZ:
1057 		return (IEEE80211_CHAN_5GHZ);
1058 		break;
1059 	case NL80211_BAND_60GHZ:
1060 		break;
1061 	case NL80211_BAND_6GHZ:
1062 		break;
1063 	default:
1064 		panic("%s: unsupported band %u\n", __func__, band);
1065 		break;
1066 	}
1067 
1068 	IMPROVE();
1069 	return (0x00);
1070 }
1071 
1072 #ifdef LINUXKPI_DEBUG_80211
1073 static const char *
1074 lkpi_nl80211_band_name(enum nl80211_band band)
1075 {
1076 	switch (band) {
1077 	case NL80211_BAND_2GHZ:
1078 		return "2Ghz";
1079 		break;
1080 	case NL80211_BAND_5GHZ:
1081 		return "5Ghz";
1082 		break;
1083 	case NL80211_BAND_60GHZ:
1084 		return "60Ghz";
1085 		break;
1086 	case NL80211_BAND_6GHZ:
1087 		return "6Ghz";
1088 		break;
1089 	default:
1090 		panic("%s: unsupported band %u\n", __func__, band);
1091 		break;
1092 	}
1093 }
1094 #endif
1095 
1096 #if 0
1097 static enum ieee80211_ac_numbers
1098 lkpi_ac_net_to_l80211(int ac)
1099 {
1100 
1101 	switch (ac) {
1102 	case WME_AC_VO:
1103 		return (IEEE80211_AC_VO);
1104 	case WME_AC_VI:
1105 		return (IEEE80211_AC_VI);
1106 	case WME_AC_BE:
1107 		return (IEEE80211_AC_BE);
1108 	case WME_AC_BK:
1109 		return (IEEE80211_AC_BK);
1110 	default:
1111 		printf("%s: invalid WME_AC_* input: ac = %d\n", __func__, ac);
1112 		return (IEEE80211_AC_BE);
1113 	}
1114 }
1115 #endif
1116 
1117 static enum nl80211_iftype
1118 lkpi_opmode_to_vif_type(enum ieee80211_opmode opmode)
1119 {
1120 
1121 	switch (opmode) {
1122 	case IEEE80211_M_IBSS:
1123 		return (NL80211_IFTYPE_ADHOC);
1124 		break;
1125 	case IEEE80211_M_STA:
1126 		return (NL80211_IFTYPE_STATION);
1127 		break;
1128 	case IEEE80211_M_WDS:
1129 		return (NL80211_IFTYPE_WDS);
1130 		break;
1131 	case IEEE80211_M_HOSTAP:
1132 		return (NL80211_IFTYPE_AP);
1133 		break;
1134 	case IEEE80211_M_MONITOR:
1135 		return (NL80211_IFTYPE_MONITOR);
1136 		break;
1137 	case IEEE80211_M_MBSS:
1138 		return (NL80211_IFTYPE_MESH_POINT);
1139 		break;
1140 	case IEEE80211_M_AHDEMO:
1141 		/* FALLTHROUGH */
1142 	default:
1143 		printf("ERROR: %s: unsupported opmode %d\n", __func__, opmode);
1144 		/* FALLTHROUGH */
1145 	}
1146 	return (NL80211_IFTYPE_UNSPECIFIED);
1147 }
1148 
1149 #ifdef LKPI_80211_HW_CRYPTO
1150 static const char *
1151 lkpi_cipher_suite_to_name(uint32_t wlan_cipher_suite)
1152 {
1153 	switch (wlan_cipher_suite) {
1154 	case WLAN_CIPHER_SUITE_WEP40:
1155 		return ("WEP40");
1156 	case WLAN_CIPHER_SUITE_WEP104:
1157 		return ("WEP104");
1158 	case WLAN_CIPHER_SUITE_TKIP:
1159 		return ("TKIP");
1160 	case WLAN_CIPHER_SUITE_CCMP:
1161 		return ("CCMP");
1162 	case WLAN_CIPHER_SUITE_CCMP_256:
1163 		return ("CCMP_256");
1164 	case WLAN_CIPHER_SUITE_GCMP:
1165 		return ("GCMP");
1166 	case WLAN_CIPHER_SUITE_GCMP_256:
1167 		return ("GCMP_256");
1168 	case WLAN_CIPHER_SUITE_AES_CMAC:
1169 		return ("AES_CMAC");
1170 	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
1171 		return ("BIP_CMAC_256");
1172 	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
1173 		return ("BIP_GMAC_128");
1174 	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
1175 		return ("BIP_GMAC_256");
1176 	default:
1177 		return ("??");
1178 	}
1179 }
1180 
1181 static uint32_t
1182 lkpi_l80211_to_net80211_cyphers(struct ieee80211com *ic,
1183     uint32_t wlan_cipher_suite)
1184 {
1185 	switch (wlan_cipher_suite) {
1186 	case WLAN_CIPHER_SUITE_WEP40:
1187 		return (IEEE80211_CRYPTO_WEP);
1188 	case WLAN_CIPHER_SUITE_WEP104:
1189 		return (IEEE80211_CRYPTO_WEP);
1190 	case WLAN_CIPHER_SUITE_TKIP:
1191 		return (IEEE80211_CRYPTO_TKIP);
1192 	case WLAN_CIPHER_SUITE_CCMP:
1193 		return (IEEE80211_CRYPTO_AES_CCM);
1194 	case WLAN_CIPHER_SUITE_CCMP_256:
1195 		return (IEEE80211_CRYPTO_AES_CCM_256);
1196 	case WLAN_CIPHER_SUITE_GCMP:
1197 		return (IEEE80211_CRYPTO_AES_GCM_128);
1198 	case WLAN_CIPHER_SUITE_GCMP_256:
1199 		return (IEEE80211_CRYPTO_AES_GCM_256);
1200 	case WLAN_CIPHER_SUITE_AES_CMAC:
1201 		return (IEEE80211_CRYPTO_BIP_CMAC_128);
1202 	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
1203 		return (IEEE80211_CRYPTO_BIP_CMAC_256);
1204 	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
1205 		return (IEEE80211_CRYPTO_BIP_GMAC_128);
1206 	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
1207 		return (IEEE80211_CRYPTO_BIP_GMAC_256);
1208 	default:
1209 		ic_printf(ic, "%s: unknown WLAN Cipher Suite %#08x | %u (%s)\n",
1210 		    __func__,
1211 		    wlan_cipher_suite >> 8, wlan_cipher_suite & 0xff,
1212 		    lkpi_cipher_suite_to_name(wlan_cipher_suite));
1213 		return (0);
1214 	}
1215 }
1216 
1217 static uint32_t
1218 lkpi_net80211_to_l80211_cipher_suite(uint32_t cipher, uint8_t keylen)
1219 {
1220 
1221 	switch (cipher) {
1222 	case IEEE80211_CIPHER_WEP:
1223 		if (keylen == (40/NBBY))
1224 			return (WLAN_CIPHER_SUITE_WEP40);
1225 		else if (keylen == (104/NBBY))
1226 			return (WLAN_CIPHER_SUITE_WEP104);
1227 		else {
1228 			printf("%s: WEP with unsupported keylen %d\n",
1229 			    __func__, keylen * NBBY);
1230 			return (0);
1231 		}
1232 		break;
1233 	case IEEE80211_CIPHER_TKIP:
1234 		return (WLAN_CIPHER_SUITE_TKIP);
1235 	case IEEE80211_CIPHER_AES_CCM:
1236 		return (WLAN_CIPHER_SUITE_CCMP);
1237 	case IEEE80211_CIPHER_AES_CCM_256:
1238 		return (WLAN_CIPHER_SUITE_CCMP_256);
1239 	case IEEE80211_CIPHER_AES_GCM_128:
1240 		return (WLAN_CIPHER_SUITE_GCMP);
1241 	case IEEE80211_CIPHER_AES_GCM_256:
1242 		return (WLAN_CIPHER_SUITE_GCMP_256);
1243 	case IEEE80211_CIPHER_BIP_CMAC_128:
1244 		return (WLAN_CIPHER_SUITE_AES_CMAC);
1245 	case IEEE80211_CIPHER_BIP_CMAC_256:
1246 		return (WLAN_CIPHER_SUITE_BIP_CMAC_256);
1247 	case IEEE80211_CIPHER_BIP_GMAC_128:
1248 		return (WLAN_CIPHER_SUITE_BIP_GMAC_128);
1249 	case IEEE80211_CIPHER_BIP_GMAC_256:
1250 		return (WLAN_CIPHER_SUITE_BIP_GMAC_256);
1251 
1252 	case IEEE80211_CIPHER_AES_OCB:
1253 	case IEEE80211_CIPHER_TKIPMIC:
1254 		/*
1255 		 * TKIP w/ hw MIC support
1256 		 * (gone wrong; should really be a crypto flag in net80211).
1257 		 */
1258 	case IEEE80211_CIPHER_CKIP:
1259 	case IEEE80211_CIPHER_NONE:
1260 		printf("%s: unsupported cipher %#010x\n", __func__, cipher);
1261 		break;
1262 	default:
1263 		printf("%s: unknown cipher %#010x\n", __func__, cipher);
1264 	};
1265 	return (0);
1266 }
1267 #endif
1268 
1269 #ifdef __notyet__
1270 static enum ieee80211_sta_state
1271 lkpi_net80211_state_to_sta_state(enum ieee80211_state state)
1272 {
1273 
1274 	/*
1275 	 * XXX-BZ The net80211 states are "try to ..", the lkpi8011 states are
1276 	 * "done".  Also ASSOC/AUTHORIZED are both "RUN" then?
1277 	 */
1278 	switch (state) {
1279 	case IEEE80211_S_INIT:
1280 		return (IEEE80211_STA_NOTEXIST);
1281 	case IEEE80211_S_SCAN:
1282 		return (IEEE80211_STA_NONE);
1283 	case IEEE80211_S_AUTH:
1284 		return (IEEE80211_STA_AUTH);
1285 	case IEEE80211_S_ASSOC:
1286 		return (IEEE80211_STA_ASSOC);
1287 	case IEEE80211_S_RUN:
1288 		return (IEEE80211_STA_AUTHORIZED);
1289 	case IEEE80211_S_CAC:
1290 	case IEEE80211_S_CSA:
1291 	case IEEE80211_S_SLEEP:
1292 	default:
1293 		UNIMPLEMENTED;
1294 	};
1295 
1296 	return (IEEE80211_STA_NOTEXIST);
1297 }
1298 #endif
1299 
1300 static struct linuxkpi_ieee80211_channel *
1301 lkpi_find_lkpi80211_chan(struct lkpi_hw *lhw,
1302     struct ieee80211_channel *c)
1303 {
1304 	struct ieee80211_hw *hw;
1305 	struct linuxkpi_ieee80211_channel *channels;
1306 	enum nl80211_band band;
1307 	int i, nchans;
1308 
1309 	hw = LHW_TO_HW(lhw);
1310 	band = lkpi_net80211_chan_to_nl80211_band(c);
1311 	if (hw->wiphy->bands[band] == NULL)
1312 		return (NULL);
1313 
1314 	nchans = hw->wiphy->bands[band]->n_channels;
1315 	if (nchans <= 0)
1316 		return (NULL);
1317 
1318 	channels = hw->wiphy->bands[band]->channels;
1319 	for (i = 0; i < nchans; i++) {
1320 		if (channels[i].center_freq == c->ic_freq)
1321 			return (&channels[i]);
1322 	}
1323 
1324 	return (NULL);
1325 }
1326 
1327 #if 0
1328 static struct linuxkpi_ieee80211_channel *
1329 lkpi_get_lkpi80211_chan(struct ieee80211com *ic, struct ieee80211_node *ni)
1330 {
1331 	struct linuxkpi_ieee80211_channel *chan;
1332 	struct ieee80211_channel *c;
1333 	struct lkpi_hw *lhw;
1334 
1335 	chan = NULL;
1336 	if (ni != NULL && ni->ni_chan != IEEE80211_CHAN_ANYC)
1337 		c = ni->ni_chan;
1338 	else if (ic->ic_bsschan != IEEE80211_CHAN_ANYC)
1339 		c = ic->ic_bsschan;
1340 	else if (ic->ic_curchan != IEEE80211_CHAN_ANYC)
1341 		c = ic->ic_curchan;
1342 	else
1343 		c = NULL;
1344 
1345 	if (c != NULL && c != IEEE80211_CHAN_ANYC) {
1346 		lhw = ic->ic_softc;
1347 		chan = lkpi_find_lkpi80211_chan(lhw, c);
1348 	}
1349 
1350 	return (chan);
1351 }
1352 #endif
1353 
1354 struct linuxkpi_ieee80211_channel *
1355 linuxkpi_ieee80211_get_channel(struct wiphy *wiphy, uint32_t freq)
1356 {
1357 	enum nl80211_band band;
1358 
1359 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
1360 		struct ieee80211_supported_band *supband;
1361 		struct linuxkpi_ieee80211_channel *channels;
1362 		int i;
1363 
1364 		supband = wiphy->bands[band];
1365 		if (supband == NULL || supband->n_channels == 0)
1366 			continue;
1367 
1368 		channels = supband->channels;
1369 		for (i = 0; i < supband->n_channels; i++) {
1370 			if (channels[i].center_freq == freq)
1371 				return (&channels[i]);
1372 		}
1373 	}
1374 
1375 	return (NULL);
1376 }
1377 
1378 #ifdef LKPI_80211_HW_CRYPTO
1379 static int
1380 lkpi_sta_del_keys(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
1381     struct lkpi_sta *lsta)
1382 {
1383 	int error;
1384 
1385 	if (!lkpi_hwcrypto)
1386 		return (0);
1387 
1388 	lockdep_assert_wiphy(hw->wiphy);
1389 
1390 	if (vif->cfg.assoc && lsta->state == IEEE80211_STA_AUTHORIZED) {
1391 		if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1392 			ic_printf(lsta->ni->ni_ic,
1393 			    "%d %lu %s: vif still assoc; not deleting keys\n",
1394 			    curthread->td_tid, jiffies, __func__);
1395 		return (0);
1396 	}
1397 
1398 	ieee80211_ref_node(lsta->ni);
1399 
1400 	error = 0;
1401 	for (ieee80211_keyix keyix = 0; keyix < nitems(lsta->kc); keyix++) {
1402 		struct ieee80211_key_conf *kc;
1403 		int err;
1404 
1405 		if (lsta->kc[keyix] == NULL)
1406 			continue;
1407 		kc = lsta->kc[keyix];
1408 
1409 #ifdef LINUXKPI_DEBUG_80211
1410 		if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1411 			ic_printf(lsta->ni->ni_ic, "%d %lu %s: running set_key cmd %d(%s) for "
1412 			    "sta %6D: keyidx %u hw_key_idx %u flags %b\n",
1413 			    curthread->td_tid, jiffies, __func__,
1414 			    DISABLE_KEY, "DISABLE", lsta->sta.addr, ":",
1415 			    kc->keyidx, kc->hw_key_idx, kc->flags, IEEE80211_KEY_FLAG_BITS);
1416 #endif
1417 
1418 		err = lkpi_80211_mo_set_key(hw, DISABLE_KEY, vif,
1419 		    LSTA_TO_STA(lsta), kc);
1420 		if (err != 0) {
1421 			ic_printf(lsta->ni->ni_ic, "%d %lu %s: set_key cmd %d(%s) for "
1422 			    "sta %6D failed: %d\n", curthread->td_tid, jiffies, __func__,
1423 			    DISABLE_KEY, "DISABLE", lsta->sta.addr, ":", err);
1424 			error++;
1425 
1426 			/*
1427 			 * If we free the key here we will never be able to get it
1428 			 * removed from the driver/fw which will likely make us
1429 			 * crash (firmware).
1430 			 */
1431 			continue;
1432 		}
1433 #ifdef LINUXKPI_DEBUG_80211
1434 		if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1435 			ic_printf(lsta->ni->ni_ic, "%d %lu %s: set_key cmd %d(%s) for "
1436 			    "sta %6D succeeded: keyidx %u hw_key_idx %u flags %b\n",
1437 			    curthread->td_tid, jiffies, __func__,
1438 			    DISABLE_KEY, "DISABLE", lsta->sta.addr, ":",
1439 			    kc->keyidx, kc->hw_key_idx, kc->flags, IEEE80211_KEY_FLAG_BITS);
1440 #endif
1441 
1442 		lsta->kc[keyix] = NULL;
1443 		free(kc, M_LKPI80211);
1444 	}
1445 	ieee80211_free_node(lsta->ni);
1446 	return (error);
1447 }
1448 
1449 /* XXX-BZ one day we should replace this iterating over VIFs, or node list? */
1450 /* See also lkpi_sta_del_keys() these days. */
1451 static int
1452 lkpi_iv_key_delete(struct ieee80211vap *vap, const struct ieee80211_key *k)
1453 {
1454 	struct ieee80211com *ic;
1455 	struct lkpi_hw *lhw;
1456 	struct ieee80211_hw *hw;
1457 	struct lkpi_vif *lvif;
1458 	struct lkpi_sta *lsta;
1459 	struct ieee80211_vif *vif;
1460 	struct ieee80211_sta *sta;
1461 	struct ieee80211_node *ni;
1462 	struct ieee80211_key_conf *kc;
1463 	int error;
1464 
1465 	ic = vap->iv_ic;
1466 	lhw = ic->ic_softc;
1467 	hw = LHW_TO_HW(lhw);
1468 	lvif = VAP_TO_LVIF(vap);
1469 	vif = LVIF_TO_VIF(lvif);
1470 
1471 	/*
1472 	 * Make sure we do not make it here without going through
1473 	 * lkpi_iv_key_update_begin() first.
1474 	 */
1475 	lockdep_assert_wiphy(hw->wiphy);
1476 
1477 	ni = ieee80211_ref_node(vap->iv_bss);
1478 	lsta = ni->ni_drv_data;
1479 	if (lsta == NULL) {
1480 		ic_printf(ic, "%s: ni %p (%6D) with lsta NULL\n",
1481 		    __func__, ni, ni->ni_bssid, ":");
1482 		ieee80211_free_node(ni);
1483 		return (0);
1484 	}
1485 
1486 	/*
1487 	 * While we are assoc we may still send packets.  We cannot delete the
1488 	 * keys as otherwise packets could go out unencrypted.  Some firmware
1489 	 * does not like this and will fire an assert.
1490 	 * net80211 needs to drive this better but given we want the disassoc
1491 	 * frame out and have to unlock we are open to a race currently.
1492 	 * This check should prevent problems.
1493 	 * How to test: run 800Mbit/s UDP traffic and during that restart your
1494 	 * supplicant.  You want to survive that.
1495 	 */
1496 	if (vif->cfg.assoc && lsta->state == IEEE80211_STA_AUTHORIZED) {
1497 		if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1498 			ic_printf(ic, "%d %lu %s: vif still assoc; not deleting keys\n",
1499 			    curthread->td_tid, jiffies, __func__);
1500 		ieee80211_free_node(ni);
1501 		return (0);
1502 	}
1503 
1504 	if (IEEE80211_KEY_UNDEFINED(k)) {
1505 		ic_printf(ic, "%s: vap %p key %p is undefined: %p %u\n",
1506 		    __func__, vap, k, k->wk_cipher, k->wk_keyix);
1507 		ieee80211_free_node(ni);
1508 		return (0);
1509 	}
1510 
1511 	if (vap->iv_bss == NULL) {
1512 		ic_printf(ic, "%s: iv_bss %p for vap %p is NULL\n",
1513 		    __func__, vap->iv_bss, vap);
1514 		ieee80211_free_node(ni);
1515 		return (0);
1516 	}
1517 	sta = LSTA_TO_STA(lsta);
1518 
1519 	if (lsta->kc[k->wk_keyix] == NULL) {
1520 #ifdef LINUXKPI_DEBUG_80211
1521 		if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1522 			ic_printf(ic, "%d %lu %s: sta %6D and no key information, "
1523 			    "keyidx %u wk_macaddr %6D; returning success\n",
1524 			    curthread->td_tid, jiffies, __func__, sta->addr, ":",
1525 			    k->wk_keyix, k->wk_macaddr, ":");
1526 #endif
1527 		ieee80211_free_node(ni);
1528 		return (1);
1529 	}
1530 	kc = lsta->kc[k->wk_keyix];
1531 
1532 #ifdef LINUXKPI_DEBUG_80211
1533 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1534 		ic_printf(ic, "%d %lu %s: running set_key cmd %d(%s) for sta %6D: "
1535 		    "keyidx %u hw_key_idx %u flags %b\n",
1536 		    curthread->td_tid, jiffies, __func__,
1537 		    DISABLE_KEY, "DISABLE", sta->addr, ":",
1538 		    kc->keyidx, kc->hw_key_idx, kc->flags, IEEE80211_KEY_FLAG_BITS);
1539 #endif
1540 
1541 	error = lkpi_80211_mo_set_key(hw, DISABLE_KEY, vif, sta, kc);
1542 	if (error != 0) {
1543 		ic_printf(ic, "%d %lu %s: set_key cmd %d(%s) for sta %6D failed: %d\n",
1544 		    curthread->td_tid, jiffies, __func__,
1545 		    DISABLE_KEY, "DISABLE", sta->addr, ":", error);
1546 		error = 0;
1547 		goto out;
1548 	}
1549 
1550 #ifdef LINUXKPI_DEBUG_80211
1551 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1552 		ic_printf(ic, "%d %lu %s: set_key cmd %d(%s) for sta %6D succeeded: "
1553 		    "keyidx %u hw_key_idx %u flags %b\n",
1554 		    curthread->td_tid, jiffies, __func__,
1555 		    DISABLE_KEY, "DISABLE", sta->addr, ":",
1556 		    kc->keyidx, kc->hw_key_idx, kc->flags, IEEE80211_KEY_FLAG_BITS);
1557 #endif
1558 	lsta->kc[k->wk_keyix] = NULL;
1559 	free(kc, M_LKPI80211);
1560 	error = 1;
1561 out:
1562 	ieee80211_free_node(ni);
1563 	return (error);
1564 }
1565 
1566 static int
1567 lkpi_iv_key_set(struct ieee80211vap *vap, const struct ieee80211_key *k)
1568 {
1569 	struct ieee80211com *ic;
1570 	struct lkpi_hw *lhw;
1571 	struct ieee80211_hw *hw;
1572 	struct lkpi_vif *lvif;
1573 	struct lkpi_sta *lsta;
1574 	struct ieee80211_vif *vif;
1575 	struct ieee80211_sta *sta;
1576 	struct ieee80211_node *ni;
1577 	struct ieee80211_key_conf *kc;
1578 	struct ieee80211_key *wk;
1579 	uint32_t lcipher;
1580 	uint16_t exp_flags;
1581 	uint8_t keylen;
1582 	int error;
1583 
1584 	ic = vap->iv_ic;
1585 	lhw = ic->ic_softc;
1586 	hw = LHW_TO_HW(lhw);
1587 
1588 	/*
1589 	 * Make sure we do not make it here without going through
1590 	 * lkpi_iv_key_update_begin() first.
1591 	 */
1592 	lockdep_assert_wiphy(hw->wiphy);
1593 
1594 	if (IEEE80211_KEY_UNDEFINED(k)) {
1595 		ic_printf(ic, "%s: vap %p key %p is undefined: %p %u\n",
1596 		    __func__, vap, k, k->wk_cipher, k->wk_keyix);
1597 		return (0);
1598 	}
1599 
1600 	if (vap->iv_bss == NULL) {
1601 		ic_printf(ic, "%s: iv_bss %p for vap %p is NULL\n",
1602 		    __func__, vap->iv_bss, vap);
1603 		return (0);
1604 	}
1605 	ni = ieee80211_ref_node(vap->iv_bss);
1606 	lsta = ni->ni_drv_data;
1607 	if (lsta == NULL) {
1608 		ic_printf(ic, "%s: ni %p (%6D) with lsta NULL\n",
1609 		    __func__, ni, ni->ni_bssid, ":");
1610 		ieee80211_free_node(ni);
1611 		return (0);
1612 	}
1613 	sta = LSTA_TO_STA(lsta);
1614 
1615 	keylen = ieee80211_crypto_get_key_len(k);
1616 	lcipher = lkpi_net80211_to_l80211_cipher_suite(
1617 	    k->wk_cipher->ic_cipher, ieee80211_crypto_get_key_len(k));
1618 	switch (lcipher) {
1619 	case WLAN_CIPHER_SUITE_TKIP:
1620 		keylen += ieee80211_crypto_get_key_txmic_len(k);
1621 		keylen += ieee80211_crypto_get_key_rxmic_len(k);
1622 		break;
1623 	case WLAN_CIPHER_SUITE_CCMP:
1624 	case WLAN_CIPHER_SUITE_GCMP:
1625 		break;
1626 	default:
1627 		ic_printf(ic, "%s: CIPHER SUITE %#x (%s) not supported\n",
1628 		    __func__, lcipher, lkpi_cipher_suite_to_name(lcipher));
1629 		IMPROVE();
1630 		ieee80211_free_node(ni);
1631 		return (0);
1632 	}
1633 
1634 	if (lsta->kc[k->wk_keyix] != NULL) {
1635 		IMPROVE("Still in firmware? Del first. Can we assert this cannot happen?");
1636 		ic_printf(ic, "%s: sta %6D found with key information\n",
1637 		    __func__, sta->addr, ":");
1638 		kc = lsta->kc[k->wk_keyix];
1639 		lsta->kc[k->wk_keyix] = NULL;
1640 		free(kc, M_LKPI80211);
1641 		kc = NULL;	/* safeguard */
1642 	}
1643 
1644 	kc = malloc(sizeof(*kc) + keylen, M_LKPI80211, M_WAITOK | M_ZERO);
1645 	kc->_k = k;		/* Save the pointer to net80211. */
1646 	kc->cipher = lcipher;
1647 	kc->keyidx = k->wk_keyix;
1648 #if 0
1649 	kc->hw_key_idx = /* set by hw and needs to be passed for TX */;
1650 #endif
1651 	atomic64_set(&kc->tx_pn, k->wk_keytsc);
1652 	kc->keylen = ieee80211_crypto_get_key_len(k);
1653 	memcpy(kc->key, ieee80211_crypto_get_key_data(k),
1654 	    ieee80211_crypto_get_key_len(k));
1655 
1656 	if (k->wk_flags & (IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV))
1657 		kc->flags |= IEEE80211_KEY_FLAG_PAIRWISE;
1658 	if (k->wk_flags & IEEE80211_KEY_GROUP)
1659 		kc->flags &= ~IEEE80211_KEY_FLAG_PAIRWISE;
1660 
1661 	kc->iv_len = k->wk_cipher->ic_header;
1662 	kc->icv_len = k->wk_cipher->ic_trailer;
1663 
1664 	switch (kc->cipher) {
1665 	case WLAN_CIPHER_SUITE_TKIP:
1666 		memcpy(kc->key + NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY,
1667 		    ieee80211_crypto_get_key_txmic_data(k),
1668 		    ieee80211_crypto_get_key_txmic_len(k));
1669 		memcpy(kc->key + NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY,
1670 		    ieee80211_crypto_get_key_rxmic_data(k),
1671 		    ieee80211_crypto_get_key_rxmic_len(k));
1672 		break;
1673 	case WLAN_CIPHER_SUITE_CCMP:
1674 	case WLAN_CIPHER_SUITE_GCMP:
1675 		break;
1676 	default:
1677 		/* currently UNREACH */
1678 		IMPROVE();
1679 		break;
1680 	};
1681 	lsta->kc[k->wk_keyix] = kc;
1682 
1683 #ifdef LINUXKPI_DEBUG_80211
1684 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1685 		ic_printf(ic, "%d %lu %s: running set_key cmd %d(%s) for sta %6D: "
1686 		    "kc %p keyidx %u hw_key_idx %u keylen %u flags %b\n",
1687 		    curthread->td_tid, jiffies, __func__,
1688 		    SET_KEY, "SET", sta->addr, ":", kc, kc->keyidx, kc->hw_key_idx,
1689 		    kc->keylen, kc->flags, IEEE80211_KEY_FLAG_BITS);
1690 #endif
1691 
1692 	lvif = VAP_TO_LVIF(vap);
1693 	vif = LVIF_TO_VIF(lvif);
1694 	error = lkpi_80211_mo_set_key(hw, SET_KEY, vif, sta, kc);
1695 	if (error != 0) {
1696 		ic_printf(ic, "%d %lu %s: set_key cmd %d(%s) for sta %6D failed: %d\n",
1697 		    curthread->td_tid, jiffies, __func__,
1698 		    SET_KEY, "SET", sta->addr, ":", error);
1699 		lsta->kc[k->wk_keyix] = NULL;
1700 		free(kc, M_LKPI80211);
1701 		ieee80211_free_node(ni);
1702 		return (0);
1703 	}
1704 
1705 #ifdef LINUXKPI_DEBUG_80211
1706 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1707 		ic_printf(ic, "%d %lu %s: set_key cmd %d(%s) for sta %6D succeeded: "
1708 		    "kc %p keyidx %u hw_key_idx %u flags %b\n",
1709 		    curthread->td_tid, jiffies, __func__,
1710 		    SET_KEY, "SET", sta->addr, ":",
1711 		    kc, kc->keyidx, kc->hw_key_idx, kc->flags, IEEE80211_KEY_FLAG_BITS);
1712 #endif
1713 
1714 	/*
1715 	 * Getting here means we support HW crypto offload.
1716 	 * Some drivers do not set the wiphy [n_]cipher_suites and thus we
1717 	 * never populate ic_cryptocaps. which means SWCRYPT will be set and we
1718 	 * should disable this now (before possibly setting other SW flags
1719 	 * again for when we need partial SW support).
1720 	 */
1721 	wk = __DECONST(struct ieee80211_key *, k);
1722 	wk->wk_flags &= ~IEEE80211_KEY_SWCRYPT;
1723 
1724 	exp_flags = 0;
1725 	switch (kc->cipher) {
1726 	case WLAN_CIPHER_SUITE_TKIP:
1727 		exp_flags = (IEEE80211_KEY_FLAG_PAIRWISE |
1728 			IEEE80211_KEY_FLAG_PUT_IV_SPACE |
1729 			IEEE80211_KEY_FLAG_GENERATE_MMIC |
1730 			IEEE80211_KEY_FLAG_PUT_MIC_SPACE);
1731 #define	TKIP_INVAL_COMBINATION						\
1732      (IEEE80211_KEY_FLAG_PUT_MIC_SPACE|IEEE80211_KEY_FLAG_GENERATE_MMIC)
1733 		if ((kc->flags & TKIP_INVAL_COMBINATION) == TKIP_INVAL_COMBINATION) {
1734 			ic_printf(ic, "%s: SET_KEY for %s returned invalid "
1735 			    "combination %b\n", __func__,
1736 			    lkpi_cipher_suite_to_name(kc->cipher),
1737 			    kc->flags, IEEE80211_KEY_FLAG_BITS);
1738 		}
1739 #undef	TKIP_INVAL_COMBINATION
1740 #ifdef __notyet__
1741 		/* Do flags surgery; special see linuxkpi_ieee80211_ifattach(). */
1742 		if ((kc->flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) != 0) {
1743 			wk->wk_flags &= ~(IEEE80211_KEY_NOMICMGT|IEEE80211_KEY_NOMIC);
1744 			wk->wk_flags |= IEEE80211_KEY_SWMIC;
1745 			ic->ic_cryptocaps &= ~IEEE80211_CRYPTO_TKIPMIC
1746 		}
1747 #endif
1748 		break;
1749 	case WLAN_CIPHER_SUITE_CCMP:
1750 	case WLAN_CIPHER_SUITE_GCMP:
1751 		exp_flags = (IEEE80211_KEY_FLAG_PAIRWISE |
1752 		    IEEE80211_KEY_FLAG_PUT_IV_SPACE |
1753 		    IEEE80211_KEY_FLAG_GENERATE_IV |
1754 		    IEEE80211_KEY_FLAG_GENERATE_IV_MGMT |	/* Only needs IV geeration for MGMT frames. */
1755 		    IEEE80211_KEY_FLAG_SW_MGMT_TX);		/* MFP in software */
1756 		break;
1757 	}
1758 	if ((kc->flags & ~exp_flags) != 0)
1759 		ic_printf(ic, "%s: SET_KEY for %s returned unexpected key flags: "
1760 		    " %#06x & ~%#06x = %b\n", __func__,
1761 		    lkpi_cipher_suite_to_name(kc->cipher), kc->flags, exp_flags,
1762 		    (kc->flags & ~exp_flags), IEEE80211_KEY_FLAG_BITS);
1763 
1764 #ifdef __notyet__
1765 	/* Do flags surgery. */
1766 	if ((kc->flags & IEEE80211_KEY_FLAG_GENERATE_IV_MGMT) == 0)
1767 		wk->wk_flags |= IEEE80211_KEY_NOIVMGT;
1768 	if ((kc->flags & IEEE80211_KEY_FLAG_GENERATE_IV) == 0)
1769 		wk->wk_flags |= IEEE80211_KEY_NOIV;
1770 #endif
1771 
1772 	ieee80211_free_node(ni);
1773 	return (1);
1774 }
1775 
1776 static void
1777 lkpi_iv_key_update_begin(struct ieee80211vap *vap)
1778 {
1779 	struct ieee80211_node_table *nt;
1780 	struct ieee80211com *ic;
1781 	struct lkpi_hw *lhw;
1782 	struct ieee80211_hw *hw;
1783 	struct lkpi_vif *lvif;
1784 	struct ieee80211_node *ni;
1785 	bool icislocked, ntislocked;
1786 
1787 	ic = vap->iv_ic;
1788 	lhw = ic->ic_softc;
1789 	hw = LHW_TO_HW(lhw);
1790 	lvif = VAP_TO_LVIF(vap);
1791 	nt = &ic->ic_sta;
1792 
1793 	icislocked = IEEE80211_IS_LOCKED(ic);
1794 	ntislocked = IEEE80211_NODE_IS_LOCKED(nt);
1795 
1796 #ifdef LINUXKPI_DEBUG_80211
1797 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1798 		ic_printf(ic, "%d %lu %s: vap %p ic %p %slocked nt %p %slocked "
1799 		    "lvif ic_unlocked %d nt_unlocked %d\n",
1800 		    curthread->td_tid, jiffies, __func__, vap,
1801 		    ic, icislocked ? "" : "un", nt, ntislocked ? "" : "un",
1802 		    lvif->ic_unlocked, lvif->nt_unlocked);
1803 #endif
1804 
1805 	/*
1806 	 * This is inconsistent net80211 locking to be fixed one day.
1807 	 */
1808 	/* Try to make sure the node does not go away while possibly unlocked. */
1809 	ni = NULL;
1810 	if (icislocked || ntislocked) {
1811 		if (vap->iv_bss != NULL)
1812 			ni = ieee80211_ref_node(vap->iv_bss);
1813 	}
1814 
1815 	if (icislocked)
1816 		IEEE80211_UNLOCK(ic);
1817 	if (ntislocked)
1818 		IEEE80211_NODE_UNLOCK(nt);
1819 
1820 	wiphy_lock(hw->wiphy);
1821 
1822 	KASSERT(lvif->key_update_iv_bss == NULL, ("%s: key_update_iv_bss not NULL %p",
1823 	    __func__, lvif->key_update_iv_bss));
1824 	lvif->key_update_iv_bss = ni;
1825 
1826 	/*
1827 	 * ic/nt_unlocked could be a bool given we are under the lock and there
1828 	 * must only be a single thread.
1829 	 * In case anything in the future disturbs the order the refcnt will
1830 	 * help us catching problems a lot easier.
1831 	 */
1832 	if (icislocked)
1833 		refcount_acquire(&lvif->ic_unlocked);
1834 	if (ntislocked)
1835 		refcount_acquire(&lvif->nt_unlocked);
1836 
1837 	/*
1838 	 * Stop the queues while doing key updates.
1839 	 */
1840 	ieee80211_stop_queues(hw);
1841 }
1842 
1843 static void
1844 lkpi_iv_key_update_end(struct ieee80211vap *vap)
1845 {
1846 	struct ieee80211_node_table *nt;
1847 	struct ieee80211com *ic;
1848 	struct lkpi_hw *lhw;
1849 	struct ieee80211_hw *hw;
1850 	struct lkpi_vif *lvif;
1851 	bool icislocked, ntislocked;
1852 
1853 	ic = vap->iv_ic;
1854 	lhw = ic->ic_softc;
1855 	hw = LHW_TO_HW(lhw);
1856 	lvif = VAP_TO_LVIF(vap);
1857 	nt = &ic->ic_sta;
1858 
1859 	/*
1860 	 * Re-enabled the queues after the key update.
1861 	 */
1862 	lkpi_ieee80211_wake_queues_locked(hw);
1863 
1864 	icislocked = IEEE80211_IS_LOCKED(ic);
1865 	MPASS(!icislocked);
1866 	ntislocked = IEEE80211_NODE_IS_LOCKED(nt);
1867 	MPASS(!ntislocked);
1868 
1869 #ifdef LINUXKPI_DEBUG_80211
1870 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1871 		ic_printf(ic, "%d %lu %s: vap %p ic %p %slocked nt %p %slocked "
1872 		    "lvif ic_unlocked %d nt_unlocked %d\n",
1873 		    curthread->td_tid, jiffies, __func__, vap,
1874 		    ic, icislocked ? "" : "un", nt, ntislocked ? "" : "un",
1875 		    lvif->ic_unlocked, lvif->nt_unlocked);
1876 #endif
1877 
1878 	/*
1879 	 * Check under lock; see comment in lkpi_iv_key_update_begin().
1880 	 * In case the refcnt gets out of sync locking in net80211 will
1881 	 * quickly barf as well (trying to unlock a lock not held).
1882 	 */
1883 	icislocked = refcount_release_if_last(&lvif->ic_unlocked);
1884 	ntislocked = refcount_release_if_last(&lvif->nt_unlocked);
1885 
1886 	if (lvif->key_update_iv_bss != NULL) {
1887 		ieee80211_free_node(lvif->key_update_iv_bss);
1888 		lvif->key_update_iv_bss = NULL;
1889 	}
1890 
1891 	wiphy_unlock(hw->wiphy);
1892 
1893 	/*
1894 	 * This is inconsistent net80211 locking to be fixed one day.
1895 	 * ic before nt to avoid a LOR.
1896 	 */
1897 	if (icislocked)
1898 		IEEE80211_LOCK(ic);
1899 	if (ntislocked)
1900 		IEEE80211_NODE_LOCK(nt);
1901 }
1902 #endif
1903 
1904 static void
1905 lkpi_cleanup_mcast_list_locked(struct lkpi_hw *lhw)
1906 {
1907 	struct list_head *le, *next;
1908 	struct netdev_hw_addr *addr;
1909 
1910 	if (lhw->mc_list.count != 0) {
1911 		list_for_each_safe(le, next, &lhw->mc_list.addr_list) {
1912 			addr = list_entry(le, struct netdev_hw_addr, addr_list);
1913 			list_del(le);
1914 			lhw->mc_list.count--;
1915 			free(addr, M_LKPI80211);
1916 		}
1917 	}
1918 	KASSERT(lhw->mc_list.count == 0, ("%s: mc_list %p count %d != 0\n",
1919 	    __func__, &lhw->mc_list, lhw->mc_list.count));
1920 }
1921 
1922 static u_int
1923 lkpi_ic_update_mcast_copy(void *arg, struct sockaddr_dl *sdl, u_int cnt)
1924 {
1925 	struct netdev_hw_addr_list *mc_list;
1926 	struct netdev_hw_addr *addr;
1927 
1928 	KASSERT(arg != NULL && sdl != NULL, ("%s: arg %p sdl %p cnt %u\n",
1929 	    __func__, arg, sdl, cnt));
1930 
1931 	mc_list = arg;
1932 	/* If it is on the list already skip it. */
1933 	netdev_hw_addr_list_for_each(addr, mc_list) {
1934 		if (!memcmp(addr->addr, LLADDR(sdl), sdl->sdl_alen))
1935 			return (0);
1936 	}
1937 
1938 	addr = malloc(sizeof(*addr), M_LKPI80211, M_NOWAIT | M_ZERO);
1939 	if (addr == NULL)
1940 		return (0);
1941 
1942 	INIT_LIST_HEAD(&addr->addr_list);
1943 	memcpy(addr->addr, LLADDR(sdl), sdl->sdl_alen);
1944 	/* XXX this should be a netdev function? */
1945 	list_add(&addr->addr_list, &mc_list->addr_list);
1946 	mc_list->count++;
1947 
1948 #ifdef LINUXKPI_DEBUG_80211
1949 	if (linuxkpi_debug_80211 & D80211_TRACE)
1950 		printf("%s:%d: mc_list count %d: added %6D\n",
1951 		    __func__, __LINE__, mc_list->count, addr->addr, ":");
1952 #endif
1953 
1954 	return (1);
1955 }
1956 
1957 static void
1958 lkpi_update_mcast_filter_locked(struct ieee80211com *ic)
1959 {
1960 	struct lkpi_hw *lhw;
1961 	struct ieee80211_hw *hw;
1962 	u64 mc;
1963 	unsigned int changed_flags, flags;
1964 	bool scanning;
1965 
1966 	lhw = ic->ic_softc;
1967 	hw = LHW_TO_HW(lhw);
1968 
1969 	lockdep_assert_wiphy(hw->wiphy);
1970 
1971 	LKPI_80211_LHW_SCAN_LOCK(lhw);
1972 	scanning = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
1973 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
1974 
1975 	LKPI_80211_LHW_MC_LOCK(lhw);
1976 
1977 	flags = 0;
1978 	if (scanning)
1979 		flags |= FIF_BCN_PRBRESP_PROMISC;
1980 	/* The latter condition may not be as expected but seems wise. */
1981 	if (lhw->mc_all_multi || lhw->ops->prepare_multicast == NULL)
1982 		flags |= FIF_ALLMULTI;
1983 
1984 	mc = lkpi_80211_mo_prepare_multicast(hw, &lhw->mc_list);
1985 
1986 	changed_flags = (lhw->mc_flags ^ flags) & FIF_FLAGS_MASK;
1987 	lkpi_80211_mo_configure_filter(hw, changed_flags, &flags, mc);
1988 	lhw->mc_flags = flags;
1989 
1990 #ifdef LINUXKPI_DEBUG_80211
1991 	if (linuxkpi_debug_80211 & D80211_TRACE)
1992 		printf("%s: changed_flags %#06x count %d mc_flags %#010x\n",
1993 		    __func__, changed_flags, lhw->mc_list.count, lhw->mc_flags);
1994 #endif
1995 
1996 	LKPI_80211_LHW_MC_UNLOCK(lhw);
1997 }
1998 
1999 static void
2000 lkpi_update_mcast_filter(struct ieee80211com *ic)
2001 {
2002 	struct lkpi_hw *lhw;
2003 	struct ieee80211_hw *hw;
2004 
2005 	lhw = ic->ic_softc;
2006 	hw = LHW_TO_HW(lhw);
2007 
2008 	wiphy_lock(hw->wiphy);
2009 	lkpi_update_mcast_filter_locked(ic);
2010 	wiphy_unlock(hw->wiphy);
2011 }
2012 
2013 static enum ieee80211_bss_changed
2014 lkpi_update_dtim_tsf(struct ieee80211_vif *vif, struct ieee80211_node *ni,
2015     struct ieee80211vap *vap, const char *_f, int _l)
2016 {
2017 	enum ieee80211_bss_changed bss_changed;
2018 
2019 	bss_changed = 0;
2020 
2021 #ifdef LINUXKPI_DEBUG_80211
2022 	if (linuxkpi_debug_80211 & D80211_TRACE)
2023 		printf("%s:%d [%s:%d] assoc %d aid %d beacon_int %u "
2024 		    "dtim_period %u sync_dtim_count %u sync_tsf %ju "
2025 		    "sync_device_ts %u bss_changed %#010jx\n",
2026 			__func__, __LINE__, _f, _l,
2027 			vif->cfg.assoc, vif->cfg.aid,
2028 			vif->bss_conf.beacon_int, vif->bss_conf.dtim_period,
2029 			vif->bss_conf.sync_dtim_count,
2030 			(uintmax_t)vif->bss_conf.sync_tsf,
2031 			vif->bss_conf.sync_device_ts,
2032 			(uintmax_t)bss_changed);
2033 #endif
2034 
2035 	if (vif->bss_conf.beacon_int != ni->ni_intval) {
2036 		vif->bss_conf.beacon_int = ni->ni_intval;
2037 		/* iwlwifi FW bug workaround; iwl_mvm_mac_sta_state. */
2038 		if (vif->bss_conf.beacon_int < 16)
2039 			vif->bss_conf.beacon_int = 16;
2040 		bss_changed |= BSS_CHANGED_BEACON_INT;
2041 	}
2042 
2043 	/*
2044 	 * lkpi_iv_sta_recv_mgmt() will directly call into this function.
2045 	 * iwlwifi(4) in iwl_mvm_bss_info_changed_station_common() will
2046 	 * stop seesion protection the moment it sees
2047 	 * BSS_CHANGED_BEACON_INFO (with the expectations that it was
2048 	 * "a beacon from the associated AP"). It will also update
2049 	 * the beacon filter in that case.  This is the only place
2050 	 * we set the BSS_CHANGED_BEACON_INFO on the non-teardown
2051 	 * path so make sure we only do run this check once we are
2052 	 * assoc. (*iv_recv_mgmt)() will be called before we enter
2053 	 * here so the ni will be updated with information from the
2054 	 * beacon via net80211::sta_recv_mgmt().  We also need to
2055 	 * make sure we do not do it on every beacon we still may
2056 	 * get so only do if something changed.  vif->bss_conf.dtim_period
2057 	 * should be 0 as we start up (we also reset it on teardown).
2058 	 *
2059 	 * If we are assoc we need to make sure dtim_period is non-0.
2060 	 * 0 is a reserved value and drivers assume they can DIV by it.
2061 	 * In theory this means we need to wait for the first beacon
2062 	 * before we finalize the vif being assoc.  In practise that
2063 	 * is harder until net80211 learns how to.  Work around like
2064 	 * this for the moment.
2065 	 */
2066 	if (vif->cfg.assoc) {
2067 		if (vif->bss_conf.dtim_period != ni->ni_dtim_period &&
2068 	            ni->ni_dtim_period > 0) {
2069 			vif->bss_conf.dtim_period = ni->ni_dtim_period;
2070 			bss_changed |= BSS_CHANGED_BEACON_INFO;
2071 		} else if (vif->bss_conf.dtim_period == 0) {
2072 			vif->bss_conf.dtim_period = 1;
2073 			bss_changed |= BSS_CHANGED_BEACON_INFO;
2074 		}
2075 	}
2076 
2077 	vif->bss_conf.sync_dtim_count = ni->ni_dtim_count;
2078 	vif->bss_conf.sync_tsf = le64toh(ni->ni_tstamp.tsf);
2079 	/* vif->bss_conf.sync_device_ts = set in linuxkpi_ieee80211_rx. */
2080 
2081 #ifdef LINUXKPI_DEBUG_80211
2082 	if (linuxkpi_debug_80211 & D80211_TRACE)
2083 		printf("%s:%d [%s:%d] assoc %d aid %d beacon_int %u "
2084 		    "dtim_period %u sync_dtim_count %u sync_tsf %ju "
2085 		    "sync_device_ts %u bss_changed %#010jx\n",
2086 			__func__, __LINE__, _f, _l,
2087 			vif->cfg.assoc, vif->cfg.aid,
2088 			vif->bss_conf.beacon_int, vif->bss_conf.dtim_period,
2089 			vif->bss_conf.sync_dtim_count,
2090 			(uintmax_t)vif->bss_conf.sync_tsf,
2091 			vif->bss_conf.sync_device_ts,
2092 			(uintmax_t)bss_changed);
2093 #endif
2094 
2095 	return (bss_changed);
2096 }
2097 
2098 static void
2099 lkpi_stop_hw_scan(struct lkpi_hw *lhw, struct ieee80211_vif *vif)
2100 {
2101 	struct ieee80211_hw *hw;
2102 	int error;
2103 	bool cancel;
2104 
2105 	TRACE_SCAN(lhw->ic, "scan_flags %b", lhw->scan_flags, LKPI_LHW_SCAN_BITS);
2106 
2107 	LKPI_80211_LHW_SCAN_LOCK(lhw);
2108 	cancel = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
2109 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
2110 	if (!cancel)
2111 		return;
2112 
2113 	hw = LHW_TO_HW(lhw);
2114 
2115 	IEEE80211_UNLOCK(lhw->ic);
2116 	wiphy_lock(hw->wiphy);
2117 	/* Need to cancel the scan. */
2118 	lkpi_80211_mo_cancel_hw_scan(hw, vif);
2119 	wiphy_unlock(hw->wiphy);
2120 
2121 	/* Need to make sure we see ieee80211_scan_completed. */
2122 	LKPI_80211_LHW_SCAN_LOCK(lhw);
2123 	if ((lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0)
2124 		error = msleep(lhw, &lhw->scan_mtx, 0, "lhwscanstop", hz/2);
2125 	cancel = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
2126 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
2127 
2128 	IEEE80211_LOCK(lhw->ic);
2129 
2130 	if (cancel)
2131 		ic_printf(lhw->ic, "%s: failed to cancel scan: %d (%p, %p)\n",
2132 		    __func__, error, lhw, vif);
2133 }
2134 
2135 static void
2136 lkpi_hw_conf_idle(struct ieee80211_hw *hw, bool new)
2137 {
2138 	struct lkpi_hw *lhw;
2139 	int error;
2140 	bool old;
2141 
2142 	lockdep_assert_wiphy(hw->wiphy);
2143 
2144 	old = hw->conf.flags & IEEE80211_CONF_IDLE;
2145 	if (old == new)
2146 		return;
2147 
2148 	hw->conf.flags ^= IEEE80211_CONF_IDLE;
2149 	error = lkpi_80211_mo_config(hw, IEEE80211_CONF_CHANGE_IDLE);
2150 	if (error != 0 && error != EOPNOTSUPP) {
2151 		lhw = HW_TO_LHW(hw);
2152 		ic_printf(lhw->ic, "ERROR: %s: config %#0x returned %d\n",
2153 		    __func__, IEEE80211_CONF_CHANGE_IDLE, error);
2154 	}
2155 }
2156 
2157 static enum ieee80211_bss_changed
2158 lkpi_disassoc(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
2159     struct lkpi_hw *lhw)
2160 {
2161 	struct ieee80211_hw *hw;
2162 	struct lkpi_vif *lvif;
2163 	enum ieee80211_bss_changed changed;
2164 
2165 	hw = LHW_TO_HW(lhw);
2166 	lockdep_assert_wiphy(hw->wiphy);
2167 
2168 	changed = 0;
2169 	sta->aid = 0;
2170 	if (vif->cfg.assoc) {
2171 
2172 		vif->cfg.assoc = false;
2173 		vif->cfg.aid = 0;
2174 		changed |= BSS_CHANGED_ASSOC;
2175 		IMPROVE();
2176 
2177 		lkpi_update_mcast_filter_locked(lhw->ic);
2178 
2179 		/*
2180 		 * Executing the bss_info_changed(BSS_CHANGED_ASSOC) with
2181 		 * assoc = false right away here will remove the sta from
2182 		 * firmware for iwlwifi.
2183 		 * We no longer do this but only return the BSS_CHNAGED value.
2184 		 * The caller is responsible for removing the sta gong to
2185 		 * IEEE80211_STA_NOTEXIST and then executing the
2186 		 * bss_info_changed() update.
2187 		 * See DOWN4 for more detailed comment.
2188 		 */
2189 
2190 		lvif = VIF_TO_LVIF(vif);
2191 		lvif->beacons = 0;
2192 	}
2193 
2194 	return (changed);
2195 }
2196 
2197 static void
2198 lkpi_wake_tx_queues(struct ieee80211_hw *hw, struct ieee80211_sta *sta,
2199     bool dequeue_seen, bool no_emptyq)
2200 {
2201 	struct lkpi_txq *ltxq;
2202 	int tid;
2203 	bool ltxq_empty;
2204 
2205 	/* Wake up all queues to know they are allocated in the driver. */
2206 	for (tid = 0; tid < nitems(sta->txq); tid++) {
2207 
2208 		if (tid == IEEE80211_NUM_TIDS) {
2209 			IMPROVE("station specific?");
2210 			if (!ieee80211_hw_check(hw, STA_MMPDU_TXQ))
2211 				continue;
2212 		} else if (tid >= hw->queues)
2213 			continue;
2214 
2215 		if (sta->txq[tid] == NULL)
2216 			continue;
2217 
2218 		ltxq = TXQ_TO_LTXQ(sta->txq[tid]);
2219 		if (dequeue_seen && (ltxq->flags & LKPI_TXQ_SEEN_DEQUEUE) == 0)
2220 			continue;
2221 
2222 		LKPI_80211_LTXQ_LOCK(ltxq);
2223 		ltxq_empty = skb_queue_empty(&ltxq->skbq);
2224 		LKPI_80211_LTXQ_UNLOCK(ltxq);
2225 		if (no_emptyq && ltxq_empty)
2226 			continue;
2227 
2228 		lkpi_80211_mo_wake_tx_queue(hw, sta->txq[tid], false);
2229 	}
2230 }
2231 
2232 /*
2233  * On the way down from RUN -> ASSOC -> AUTH we may send a DISASSOC or DEAUTH
2234  * packet.  The problem is that the state machine functions tend to hold the
2235  * LHW lock which will prevent lkpi_80211_txq_tx_one() from sending the packet.
2236  * We call this after dropping the ic lock and before acquiring the LHW lock.
2237  * we make sure no further packets are queued and if they are queued the task
2238  * will finish or be cancelled.  At the end if a packet is left we manually
2239  * send it.  scan_to_auth() would re-enable sending if the lsta would be
2240  * re-used.
2241  */
2242 static void
2243 lkpi_80211_flush_tx(struct lkpi_hw *lhw, struct lkpi_sta *lsta)
2244 {
2245 	struct ieee80211_hw *hw;
2246 	struct mbufq mq;
2247 	struct mbuf *m;
2248 	int len;
2249 
2250 	/* There is no lockdep_assert_not_held_wiphy(). */
2251 	hw = LHW_TO_HW(lhw);
2252 	lockdep_assert_not_held(&hw->wiphy->mtx);
2253 
2254 	/* Do not accept any new packets until scan_to_auth or lsta_free(). */
2255 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
2256 	lsta->txq_ready = false;
2257 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
2258 
2259 	while (taskqueue_cancel(taskqueue_thread, &lsta->txq_task, NULL) != 0)
2260 		taskqueue_drain(taskqueue_thread, &lsta->txq_task);
2261 
2262 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
2263 	len = mbufq_len(&lsta->txq);
2264 	if (len <= 0) {
2265 		LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
2266 		return;
2267 	}
2268 
2269 	mbufq_init(&mq, IFQ_MAXLEN);
2270 	mbufq_concat(&mq, &lsta->txq);
2271 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
2272 
2273 	m = mbufq_dequeue(&mq);
2274 	while (m != NULL) {
2275 		lkpi_80211_txq_tx_one(lsta, m);
2276 		m = mbufq_dequeue(&mq);
2277 	}
2278 }
2279 
2280 static void
2281 lkpi_init_chandef(struct ieee80211com *ic __unused,
2282     struct cfg80211_chan_def *chandef,
2283     struct linuxkpi_ieee80211_channel *chan, struct ieee80211_channel *c,
2284     bool can_ht)
2285 {
2286 
2287 	cfg80211_chandef_create(chandef, chan,
2288 	    (can_ht) ? NL80211_CHAN_HT20 : NL80211_CHAN_NO_HT);
2289 	chandef->center_freq1 = ieee80211_get_channel_center_freq1(c);
2290 	chandef->center_freq2 = ieee80211_get_channel_center_freq2(c);
2291 
2292 	IMPROVE("Check ht/vht_cap from band not just chan? See lkpi_sta_sync_from_ni...");
2293 #ifdef LKPI_80211_HT
2294 	if (IEEE80211_IS_CHAN_HT(c)) {
2295 		if (IEEE80211_IS_CHAN_HT40(c))
2296 			chandef->width = NL80211_CHAN_WIDTH_40;
2297 		else
2298 			chandef->width = NL80211_CHAN_WIDTH_20;
2299 	}
2300 #endif
2301 #ifdef LKPI_80211_VHT
2302 	if (IEEE80211_IS_CHAN_VHT_5GHZ(c)) {
2303 		if (IEEE80211_IS_CHAN_VHT80P80(c))
2304 			chandef->width = NL80211_CHAN_WIDTH_80P80;
2305 		else if (IEEE80211_IS_CHAN_VHT160(c))
2306 			chandef->width = NL80211_CHAN_WIDTH_160;
2307 		else if (IEEE80211_IS_CHAN_VHT80(c))
2308 			chandef->width = NL80211_CHAN_WIDTH_80;
2309 	}
2310 #endif
2311 
2312 #ifdef LINUXKPI_DEBUG_80211
2313 	if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
2314 		ic_printf(ic, "%s:%d: chandef %p { chan %p { %u }, "
2315 		    "width %d cfreq1 %u cfreq2 %u punctured %u }\n",
2316 		    __func__, __LINE__, chandef,
2317 		    chandef->chan, chandef->chan->center_freq,
2318 		    chandef->width,
2319 		    chandef->center_freq1, chandef->center_freq2,
2320 		    chandef->punctured);
2321 #endif
2322 }
2323 
2324 static uint32_t
2325 lkpi_init_chanctx_conf(struct ieee80211_hw *hw,
2326     struct cfg80211_chan_def *chandef,
2327     struct ieee80211_chanctx_conf *chanctx_conf)
2328 {
2329 	uint32_t changed;
2330 
2331 	lockdep_assert_wiphy(hw->wiphy);
2332 
2333 	changed = 0;
2334 
2335 	chanctx_conf->rx_chains_static = 1;
2336 	chanctx_conf->rx_chains_dynamic = 1;
2337 	changed |= IEEE80211_CHANCTX_CHANGE_RX_CHAINS;
2338 
2339 	if (chanctx_conf->radar_enabled != hw->conf.radar_enabled) {
2340 		chanctx_conf->radar_enabled = hw->conf.radar_enabled;
2341 		changed |= IEEE80211_CHANCTX_CHANGE_RADAR;
2342 	}
2343 
2344 	chanctx_conf->def = *chandef;
2345 	changed |= IEEE80211_CHANCTX_CHANGE_WIDTH;
2346 
2347 	/* One day we should figure this out; is for iwlwifi-only. */
2348 	chanctx_conf->min_def = chanctx_conf->def;
2349 	changed |= IEEE80211_CHANCTX_CHANGE_MIN_WIDTH;
2350 
2351 	/* chanctx_conf->ap = */
2352 
2353 	return (changed);
2354 }
2355 
2356 static struct lkpi_chanctx *
2357 lkpi_alloc_lchanctx(struct ieee80211_hw *hw, struct lkpi_vif *lvif)
2358 {
2359 	struct lkpi_chanctx *lchanctx;
2360 
2361 	lchanctx = malloc(sizeof(*lchanctx) + hw->chanctx_data_size,
2362 	    M_LKPI80211, M_WAITOK | M_ZERO);
2363 	lchanctx->lvif = lvif;
2364 
2365 	return (lchanctx);
2366 }
2367 
2368 static struct lkpi_chanctx *
2369 lkpi_find_lchanctx_reserved(struct ieee80211_hw *hw, struct lkpi_vif *lvif)
2370 {
2371 	struct lkpi_hw *lhw;
2372 	struct lkpi_chanctx *lchanctx;
2373 	bool found;
2374 
2375 	lhw = HW_TO_LHW(hw);
2376 
2377 	found = false;
2378 	rcu_read_lock();
2379 	list_for_each_entry_rcu(lchanctx, &lhw->lchanctx_list_reserved, entry) {
2380 		if (lchanctx->lvif == lvif) {
2381 			found = true;
2382 			break;
2383 		}
2384 	}
2385 	rcu_read_unlock();
2386 
2387 	if (!found) {
2388 		lchanctx = lkpi_alloc_lchanctx(hw, lvif);
2389 		list_add_rcu(&lchanctx->entry, &lhw->lchanctx_list_reserved);
2390 	}
2391 
2392 	return (lchanctx);
2393 }
2394 
2395 static struct ieee80211_chanctx_conf *
2396 lkpi_get_chanctx_conf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
2397 {
2398 	struct ieee80211_chanctx_conf *chanctx_conf;
2399 
2400 	chanctx_conf = rcu_dereference_protected(vif->bss_conf.chanctx_conf,
2401 	    lockdep_is_held(&hw->wiphy->mtx));
2402 	if (chanctx_conf == NULL) {
2403 		struct lkpi_chanctx *lchanctx;
2404 		struct lkpi_vif *lvif;
2405 
2406 		lvif = VIF_TO_LVIF(vif);
2407 		lchanctx = lkpi_find_lchanctx_reserved(hw, lvif);
2408 		KASSERT(lchanctx != NULL, ("%s: hw %p, vif %p no lchanctx\n",
2409 		    __func__, hw, vif));
2410 		list_del(&lchanctx->entry);
2411 		chanctx_conf = &lchanctx->chanctx_conf;
2412 	}
2413 	/* else { IMPROVE("diff changes for changed, working on live copy, rcu"); } */
2414 
2415 	return (chanctx_conf);
2416 }
2417 
2418 static int
2419 lkpi_set_chanctx_conf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
2420     struct ieee80211_chanctx_conf *chanctx_conf,
2421     uint32_t changed, bool changed_set)
2422 {
2423 	struct lkpi_hw *lhw;
2424 	struct lkpi_chanctx *lchanctx;
2425 	int error;
2426 
2427 	lockdep_assert_wiphy(hw->wiphy);
2428 
2429 	if (vif->bss_conf.chanctx_conf == chanctx_conf) {
2430 		if (!changed_set) {
2431 			IMPROVE("OBSOLETE?");
2432 			changed = IEEE80211_CHANCTX_CHANGE_MIN_WIDTH;
2433 			changed |= IEEE80211_CHANCTX_CHANGE_RADAR;
2434 			changed |= IEEE80211_CHANCTX_CHANGE_RX_CHAINS;
2435 			changed |= IEEE80211_CHANCTX_CHANGE_WIDTH;
2436 		}
2437 		lkpi_80211_mo_change_chanctx(hw, chanctx_conf, changed);
2438 
2439 		return (0);
2440 	}
2441 
2442 	lhw = HW_TO_LHW(hw);
2443 
2444 	/* The device is no longer idle. */
2445 	IMPROVE("Once we do multi-vif, only do for 1st chanctx");
2446 	lkpi_hw_conf_idle(hw, false);
2447 
2448 	error = lkpi_80211_mo_add_chanctx(hw, chanctx_conf);
2449 	if (error != 0 && error != EOPNOTSUPP) {
2450 		ic_printf(lhw->ic, "%s:%d: mo_add_chanctx "
2451 		    "failed: %d\n", __func__, __LINE__, error);
2452 		return (error);
2453 	}
2454 
2455 	vif->bss_conf.chanreq.oper.chan = chanctx_conf->def.chan;
2456 	vif->bss_conf.chanreq.oper.width = chanctx_conf->def.width;
2457 	vif->bss_conf.chanreq.oper.center_freq1 =
2458 	    chanctx_conf->def.center_freq1;
2459 	vif->bss_conf.chanreq.oper.center_freq2 =
2460 	    chanctx_conf->def.center_freq2;
2461 
2462 	lchanctx = CHANCTX_CONF_TO_LCHANCTX(chanctx_conf);
2463 	list_add_rcu(&lchanctx->entry, &lhw->lchanctx_list);
2464 	rcu_assign_pointer(vif->bss_conf.chanctx_conf, chanctx_conf);
2465 
2466 	/* Assign vif chanctx. */
2467 	if (error == 0)
2468 		error = lkpi_80211_mo_assign_vif_chanctx(hw, vif,
2469 		    &vif->bss_conf, chanctx_conf);
2470 	if (error == EOPNOTSUPP)
2471 		error = 0;
2472 	if (error != 0) {
2473 		ic_printf(lhw->ic, "%s:%d: mo_assign_vif_chanctx "
2474 		    "failed: %d\n", __func__, __LINE__, error);
2475 		lkpi_80211_mo_remove_chanctx(hw, chanctx_conf);
2476 		rcu_assign_pointer(vif->bss_conf.chanctx_conf, NULL);
2477 		lchanctx = CHANCTX_CONF_TO_LCHANCTX(chanctx_conf);
2478 		list_del(&lchanctx->entry);
2479 		memset(lchanctx, 0, sizeof(*lchanctx));
2480 		lchanctx->lvif = VIF_TO_LVIF(vif);
2481 		list_add_rcu(&lchanctx->entry, &lhw->lchanctx_list_reserved);
2482 	}
2483 
2484 	return (error);
2485 }
2486 
2487 static void
2488 lkpi_remove_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
2489 {
2490 	struct lkpi_hw *lhw;
2491 	struct ieee80211_chanctx_conf *chanctx_conf;
2492 	struct lkpi_chanctx *lchanctx;
2493 
2494 	lockdep_assert_wiphy(hw->wiphy);
2495 
2496 	chanctx_conf = rcu_dereference_protected(vif->bss_conf.chanctx_conf,
2497 	    lockdep_is_held(&hw->wiphy->mtx));
2498 
2499 	if (chanctx_conf == NULL)
2500 		return;
2501 
2502 	/* Remove vif context. */
2503 	lkpi_80211_mo_unassign_vif_chanctx(hw, vif, &vif->bss_conf, chanctx_conf);
2504 
2505 	lkpi_hw_conf_idle(hw, true);
2506 
2507 	/* Remove chan ctx. */
2508 	lkpi_80211_mo_remove_chanctx(hw, chanctx_conf);
2509 
2510 	/* Cleanup. */
2511 	rcu_assign_pointer(vif->bss_conf.chanctx_conf, NULL);
2512 	lchanctx = CHANCTX_CONF_TO_LCHANCTX(chanctx_conf);
2513 	list_del(&lchanctx->entry);
2514 	lhw = HW_TO_LHW(hw);
2515 	memset(lchanctx, 0, sizeof(*lchanctx));
2516 	lchanctx->lvif = VIF_TO_LVIF(vif);
2517 	list_add_rcu(&lchanctx->entry, &lhw->lchanctx_list_reserved);
2518 }
2519 
2520 /* -------------------------------------------------------------------------- */
2521 
2522 /* Any other options belong here? Check more drivers. */
2523 #define	BSS_CHANGED_VIF_CFG_BITS					\
2524     (BSS_CHANGED_SSID | BSS_CHANGED_IDLE | BSS_CHANGED_PS | BSS_CHANGED_ASSOC | \
2525     BSS_CHANGED_ARP_FILTER | BSS_CHANGED_MLD_VALID_LINKS | BSS_CHANGED_MLD_TTLM)
2526 
2527 static void
2528 lkpi_bss_info_change(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
2529     enum ieee80211_bss_changed bss_changed)
2530 {
2531 	struct lkpi_vif *lvif;
2532 	enum ieee80211_bss_changed vif_cfg_bits, link_info_bits;
2533 
2534 	if (ieee80211_vif_is_mld(vif)) {
2535 		TODO("This likely needs a subset only; split up into 3 parts.");
2536 	}
2537 
2538 	/* Nothing to do? */
2539 	if (bss_changed == 0)
2540 		return;
2541 
2542 	/*
2543 	 * If the vif is not known to the driver there is nothing to notifiy for.
2544 	 * We MUST NOT check for !lvif_bss_synched here (the reasonable it seems)
2545 	 * as we need to execute the update(s) or we will have follow-up issues.
2546 	 */
2547 	lvif = VIF_TO_LVIF(vif);
2548 	if (!lvif->added_to_drv)
2549 		return;
2550 
2551 	/*
2552 	 * With the advent of MLO bss_conf got split up into vif and link
2553 	 * change notfications, while historically it was one.
2554 	 * We now need to support all possible models.
2555 	 */
2556 	vif_cfg_bits = bss_changed & BSS_CHANGED_VIF_CFG_BITS;
2557 	if (vif_cfg_bits != 0)
2558 		lkpi_80211_mo_vif_cfg_changed(hw, vif, vif_cfg_bits, false);
2559 
2560 	link_info_bits = bss_changed & ~(BSS_CHANGED_VIF_CFG_BITS);
2561 	if (link_info_bits != 0)
2562 		lkpi_80211_mo_link_info_changed(hw, vif, &vif->bss_conf,
2563 		    link_info_bits, 0, false);
2564 
2565 	lkpi_80211_mo_bss_info_changed(hw, vif, &vif->bss_conf, bss_changed);
2566 }
2567 
2568 /* -------------------------------------------------------------------------- */
2569 
2570 static int
2571 lkpi_sta_state_do_nada(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2572 {
2573 	return (0);
2574 }
2575 
2576 /* UP1 */
2577 static int
2578 lkpi_sta_init_to_scan(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2579 {
2580 	return (lkpi_sta_state_do_nada(vap, nstate, arg));
2581 }
2582 
2583 /* UP2 */
2584 static int
2585 lkpi_sta_scan_to_auth(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2586 {
2587 	struct linuxkpi_ieee80211_channel *chan;
2588 	struct cfg80211_chan_def chandef;
2589 	struct ieee80211_chanctx_conf *chanctx_conf;
2590 	struct lkpi_hw *lhw;
2591 	struct ieee80211_hw *hw;
2592 	struct lkpi_vif *lvif;
2593 	struct ieee80211_vif *vif;
2594 	struct ieee80211_node *ni;
2595 	struct lkpi_sta *lsta;
2596 	enum ieee80211_bss_changed bss_changed;
2597 	struct ieee80211_prep_tx_info prep_tx_info;
2598 	uint32_t changed;
2599 	int error;
2600 	bool synched, can_ht;
2601 
2602 	/*
2603 	 * In here we use vap->iv_bss until lvif->lvif_bss is set.
2604 	 * For all later (STATE >= AUTH) functions we need to use the lvif
2605 	 * cache which will be tracked even through (*iv_update_bss)().
2606 	 */
2607 
2608 	if (vap->iv_bss == NULL) {
2609 		ic_printf(vap->iv_ic, "%s: no iv_bss for vap %p\n", __func__, vap);
2610 		return (EINVAL);
2611 	}
2612 	/*
2613 	 * Keep the ni alive locally.  In theory (and practice) iv_bss can change
2614 	 * once we unlock here.  This is due to net80211 allowing state changes
2615 	 * and new join1() despite having an active node as well as due to
2616 	 * the fact that the iv_bss can be swapped under the hood in (*iv_update_bss).
2617 	 */
2618 	ni = ieee80211_ref_node(vap->iv_bss);
2619 	if (ni->ni_chan == NULL || ni->ni_chan == IEEE80211_CHAN_ANYC) {
2620 		ic_printf(vap->iv_ic, "%s: no channel set for iv_bss ni %p "
2621 		    "on vap %p\n", __func__, ni, vap);
2622 		ieee80211_free_node(ni);	/* Error handling for the local ni. */
2623 		return (EINVAL);
2624 	}
2625 
2626 	lhw = vap->iv_ic->ic_softc;
2627 	chan = lkpi_find_lkpi80211_chan(lhw, ni->ni_chan);
2628 	if (chan == NULL) {
2629 		ic_printf(vap->iv_ic, "%s: failed to get LKPI channel from "
2630 		    "iv_bss ni %p on vap %p\n", __func__, ni, vap);
2631 		ieee80211_free_node(ni);	/* Error handling for the local ni. */
2632 		return (ESRCH);
2633 	}
2634 
2635 	hw = LHW_TO_HW(lhw);
2636 	lvif = VAP_TO_LVIF(vap);
2637 	vif = LVIF_TO_VIF(lvif);
2638 
2639 	LKPI_80211_LVIF_LOCK(lvif);
2640 	/* XXX-BZ KASSERT later? */
2641 	if (lvif->lvif_bss_synched || lvif->lvif_bss != NULL) {
2642 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
2643 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
2644 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
2645 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
2646 		    lvif->lvif_bss_synched);
2647 		LKPI_80211_LVIF_UNLOCK(lvif);
2648 		ieee80211_free_node(ni);	/* Error handling for the local ni. */
2649 		return (EBUSY);
2650 	}
2651 	LKPI_80211_LVIF_UNLOCK(lvif);
2652 
2653 	IEEE80211_UNLOCK(vap->iv_ic);
2654 	wiphy_lock(hw->wiphy);
2655 
2656 	/* Add chanctx (or if exists, change it). */
2657 	chanctx_conf = lkpi_get_chanctx_conf(hw, vif);
2658 
2659 	KASSERT(ni->ni_chan != NULL && ni->ni_chan != IEEE80211_CHAN_ANYC,
2660 	   ("%s:%d: ni %p ni_chan %p\n", __func__, __LINE__, ni, ni->ni_chan));
2661 
2662 #ifdef LKPI_80211_HT
2663 	can_ht = (vap->iv_ic->ic_flags_ht & IEEE80211_FHT_HT) != 0;
2664 #else
2665 	can_ht = false;
2666 #endif
2667 	lkpi_init_chandef(vap->iv_ic, &chandef, chan, ni->ni_chan, can_ht);
2668 	hw->conf.radar_enabled =
2669 	    ((chan->flags & IEEE80211_CHAN_RADAR) != 0) ? true : false;
2670 	hw->conf.chandef = chandef;
2671 	vif->bss_conf.chanreq.oper = hw->conf.chandef;
2672 #ifdef LINUXKPI_DEBUG_80211
2673 	if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
2674 		ic_printf(vap->iv_ic, "%s:%d: hw->conf.chandef %p = chandef %p = "
2675 		    "vif->bss_conf.chanreq.oper %p\n", __func__, __LINE__,
2676 		    &hw->conf.chandef, &chandef, &vif->bss_conf.chanreq.oper);
2677 #endif
2678 
2679 	changed = lkpi_init_chanctx_conf(hw, &chandef, chanctx_conf);
2680 
2681 	/* Responder ... */
2682 
2683 	/* Set bss info (bss_info_changed). */
2684 	bss_changed = 0;
2685 	IEEE80211_ADDR_COPY(vif->cfg.ap_addr, ni->ni_bssid);
2686 	vif->bss_conf.bssid = ni->ni_bssid;
2687 	bss_changed |= BSS_CHANGED_BSSID;
2688 	vif->bss_conf.txpower = ni->ni_txpower;
2689 	bss_changed |= BSS_CHANGED_TXPOWER;
2690 	vif->cfg.idle = false;
2691 	bss_changed |= BSS_CHANGED_IDLE;
2692 
2693 	/* vif->bss_conf.basic_rates ? Where exactly? */
2694 
2695 	lvif->beacons = 0;
2696 	/* Should almost assert it is this. */
2697 	vif->cfg.assoc = false;
2698 	vif->cfg.aid = 0;
2699 
2700 	bss_changed |= lkpi_update_dtim_tsf(vif, ni, vap, __func__, __LINE__);
2701 
2702 	error = lkpi_set_chanctx_conf(hw, vif, chanctx_conf, changed, true);
2703 	if (error != 0)
2704 		goto out;
2705 
2706 	IMPROVE("update radiotap chan fields too");
2707 
2708 	/* RATES */
2709 	IMPROVE("bss info: not all needs to come now and rates are missing");
2710 	lkpi_bss_info_change(hw, vif, bss_changed);
2711 
2712 	/*
2713 	 * Given ni and lsta are 1:1 from alloc to free we can assert that
2714 	 * ni always has lsta data attach despite net80211 node swapping
2715 	 * under the hoods.
2716 	 */
2717 	KASSERT(ni->ni_drv_data != NULL, ("%s: ni %p ni_drv_data %p\n",
2718 	    __func__, ni, ni->ni_drv_data));
2719 	lsta = ni->ni_drv_data;
2720 
2721 	/* Insert the [l]sta into the list of known stations. */
2722 	list_add_tail(&lsta->lsta_list, &lvif->lsta_list);
2723 
2724 	/* Add (or adjust) sta and change state (from NOTEXIST) to NONE. */
2725 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
2726 	KASSERT(lsta->state == IEEE80211_STA_NOTEXIST, ("%s: lsta %p state not "
2727 	    "NOTEXIST: %#x\n", __func__, lsta, lsta->state));
2728 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_NONE);
2729 	if (error != 0) {
2730 		IMPROVE("do we need to undo the chan ctx?");
2731 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(NONE) "
2732 		    "failed: %d\n", __func__, __LINE__, error);
2733 		goto out;
2734 	}
2735 #if 0
2736 	lsta->added_to_drv = true;	/* mo manages. */
2737 #endif
2738 
2739 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
2740 
2741 #if 0
2742 	/*
2743 	 * Wakeup all queues now that sta is there so we have as much time to
2744 	 * possibly prepare the queue in the driver to be ready for the 1st
2745 	 * packet;  lkpi_80211_txq_tx_one() still has a workaround as there
2746 	 * is no guarantee or way to check.
2747 	 * XXX-BZ and by now we know that this does not work on all drivers
2748 	 * for all queues.
2749 	 */
2750 	lkpi_wake_tx_queues(hw, LSTA_TO_STA(lsta), false, false);
2751 #endif
2752 
2753 	/* Start mgd_prepare_tx. */
2754 	memset(&prep_tx_info, 0, sizeof(prep_tx_info));
2755 	prep_tx_info.duration = PREP_TX_INFO_DURATION;		/* SAE */
2756 	prep_tx_info.subtype = IEEE80211_STYPE_AUTH;
2757 	prep_tx_info.link_id = 0;
2758 	lkpi_80211_mo_mgd_prepare_tx(hw, vif, &prep_tx_info);
2759 	lsta->in_mgd = true;
2760 
2761 	/*
2762 	 * What is going to happen next:
2763 	 * - <twiddle> .. we should end up in "auth_to_assoc"
2764 	 * - event_callback
2765 	 * - update sta_state (NONE to AUTH)
2766 	 * - mgd_complete_tx
2767 	 * (ideally we'd do that on a callback for something else ...)
2768 	 */
2769 
2770 	wiphy_unlock(hw->wiphy);
2771 	IEEE80211_LOCK(vap->iv_ic);
2772 
2773 	LKPI_80211_LVIF_LOCK(lvif);
2774 	/* Re-check given (*iv_update_bss) could have happened while we were unlocked. */
2775 	if (lvif->lvif_bss_synched || lvif->lvif_bss != NULL ||
2776 	    lsta->ni != vap->iv_bss)
2777 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
2778 		    "lvif_bss->ni %p synched %d, ni %p lsta %p\n", __func__, __LINE__,
2779 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
2780 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
2781 		    lvif->lvif_bss_synched, ni, lsta);
2782 
2783 	/*
2784 	 * Reference the "ni" for caching the lsta/ni in lvif->lvif_bss.
2785 	 * Given we cache lsta we use lsta->ni instead of ni here (even though
2786 	 * lsta->ni == ni) to be distinct from the rest of the code where we do
2787 	 * assume that ni == vap->iv_bss which it may or may not be.
2788 	 * So do NOT use iv_bss here anymore as that may have diverged from our
2789 	 * function local ni already while ic was unlocked and would lead to
2790 	 * inconsistencies.  Go and see if we lost a race and do not update
2791 	 * lvif_bss_synched in that case.
2792 	 */
2793 	ieee80211_ref_node(lsta->ni);
2794 	lvif->lvif_bss = lsta;
2795 	if (lsta->ni == vap->iv_bss) {
2796 		lvif->lvif_bss_synched = synched = true;
2797 	} else {
2798 		/* Set to un-synched no matter what. */
2799 		lvif->lvif_bss_synched = synched = false;
2800 		/*
2801 		 * We do not error as someone has to take us down.
2802 		 * If we are followed by a 2nd, new net80211::join1() going to
2803 		 * AUTH lkpi_sta_a_to_a() will error, lkpi_sta_auth_to_{scan,init}()
2804 		 * will take the lvif->lvif_bss node down eventually.
2805 		 * What happens with the vap->iv_bss node will entirely be up
2806 		 * to net80211 as we never used the node beyond alloc()/free()
2807 		 * and we do not hold an extra reference for that anymore given
2808 		 * ni : lsta == 1:1.
2809 		 * Problem is if we do not error a MGMT/AUTH frame will be
2810 		 * sent from net80211::sta_newstate(); disable lsta queue below.
2811 		 */
2812 	}
2813 	LKPI_80211_LVIF_UNLOCK(lvif);
2814 	/*
2815 	 * Make sure in case the sta did not change and we re-added it,
2816 	 * that we can tx again but only if the vif/iv_bss are in sync.
2817 	 * Otherwise this should prevent the MGMT/AUTH frame from being
2818 	 * sent triggering a warning in iwlwifi.
2819 	 */
2820 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
2821 	lsta->txq_ready = synched;
2822 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
2823 	goto out_relocked;
2824 
2825 out:
2826 	wiphy_unlock(hw->wiphy);
2827 	IEEE80211_LOCK(vap->iv_ic);
2828 out_relocked:
2829 	/*
2830 	 * Release the reference that kept the ni stable locally
2831 	 * during the work of this function.
2832 	 */
2833 	if (ni != NULL)
2834 		ieee80211_free_node(ni);
2835 	return (error);
2836 }
2837 
2838 /* UP3.1 */
2839 static int
2840 lkpi_sta_auth_to_assoc(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2841 {
2842 	struct lkpi_hw *lhw;
2843 	struct ieee80211_hw *hw;
2844 	struct lkpi_vif *lvif;
2845 	struct ieee80211_vif *vif;
2846 	struct lkpi_sta *lsta;
2847 	struct ieee80211_prep_tx_info prep_tx_info;
2848 	int error;
2849 
2850 	lhw = vap->iv_ic->ic_softc;
2851 	hw = LHW_TO_HW(lhw);
2852 	lvif = VAP_TO_LVIF(vap);
2853 	vif = LVIF_TO_VIF(lvif);
2854 
2855 	IEEE80211_UNLOCK(vap->iv_ic);
2856 	wiphy_lock(hw->wiphy);
2857 
2858 	LKPI_80211_LVIF_LOCK(lvif);
2859 	/* XXX-BZ KASSERT later? */
2860 	if (!lvif->lvif_bss_synched || lvif->lvif_bss == NULL) {
2861 #ifdef LINUXKPI_DEBUG_80211
2862 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
2863 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
2864 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
2865 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
2866 		    lvif->lvif_bss_synched);
2867 #endif
2868 		error = ENOTRECOVERABLE;
2869 		LKPI_80211_LVIF_UNLOCK(lvif);
2870 		goto out;
2871 	}
2872 	lsta = lvif->lvif_bss;
2873 	LKPI_80211_LVIF_UNLOCK(lvif);
2874 
2875 	KASSERT(lsta != NULL, ("%s: lsta %p\n", __func__, lsta));
2876 
2877 	/* Finish auth. */
2878 	IMPROVE("event callback");
2879 
2880 	/* Update sta_state (NONE to AUTH). */
2881 	KASSERT(lsta->state == IEEE80211_STA_NONE, ("%s: lsta %p state not "
2882 	    "NONE: %#x\n", __func__, lsta, lsta->state));
2883 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_AUTH);
2884 	if (error != 0) {
2885 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(AUTH) "
2886 		    "failed: %d\n", __func__, __LINE__, error);
2887 		goto out;
2888 	}
2889 
2890 	/* End mgd_complete_tx. */
2891 	if (lsta->in_mgd) {
2892 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
2893 		prep_tx_info.subtype = IEEE80211_STYPE_AUTH;
2894 		prep_tx_info.success = true;
2895 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
2896 		lsta->in_mgd = false;
2897 	}
2898 
2899 	/* Now start assoc. unless nstate=RUN (auth_to_run). */
2900 
2901 	/* Start mgd_prepare_tx. */
2902 	if (nstate == IEEE80211_S_ASSOC && !lsta->in_mgd) {
2903 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
2904 		prep_tx_info.subtype = IEEE80211_STYPE_ASSOC_REQ;
2905 		prep_tx_info.link_id = 0;
2906 		lkpi_80211_mo_mgd_prepare_tx(hw, vif, &prep_tx_info);
2907 		lsta->in_mgd = true;
2908 	}
2909 
2910 #if 0
2911 	/* We do not yet have a packet to go out. */
2912 	/* Wake tx queue to get packet out. */
2913 	lkpi_wake_tx_queues(hw, LSTA_TO_STA(lsta), false, true);
2914 #endif
2915 
2916 	/*
2917 	 * <twiddle> .. we end up in "assoc_to_run"
2918 	 * - update sta_state (AUTH to ASSOC)
2919 	 * - conf_tx [all]
2920 	 * - bss_info_changed (assoc, aid, ssid, ..)
2921 	 * - change_chanctx (if needed)
2922 	 * - event_callback
2923 	 * - mgd_complete_tx
2924 	 */
2925 
2926 out:
2927 	wiphy_unlock(hw->wiphy);
2928 	IEEE80211_LOCK(vap->iv_ic);
2929 	return (error);
2930 }
2931 
2932 static int lkpi_sta_assoc_to_run(struct ieee80211vap *, enum ieee80211_state, int);
2933 
2934 /* UP3.2 */
2935 static int
2936 lkpi_sta_auth_to_run(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2937 {
2938 	int error;
2939 
2940 	error = lkpi_sta_auth_to_assoc(vap, nstate, arg);
2941 	if (error == 0)
2942 		error = lkpi_sta_assoc_to_run(vap, nstate, arg);
2943 	return (error);
2944 }
2945 
2946 /* UP4 */
2947 static int
2948 lkpi_sta_assoc_to_run(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2949 {
2950 	struct lkpi_hw *lhw;
2951 	struct ieee80211_hw *hw;
2952 	struct lkpi_vif *lvif;
2953 	struct ieee80211_vif *vif;
2954 	struct ieee80211_node *ni;
2955 	struct lkpi_sta *lsta;
2956 	struct ieee80211_sta *sta;
2957 	struct ieee80211_prep_tx_info prep_tx_info;
2958 	enum ieee80211_bss_changed bss_changed;
2959 	int error;
2960 
2961 	lhw = vap->iv_ic->ic_softc;
2962 	hw = LHW_TO_HW(lhw);
2963 	lvif = VAP_TO_LVIF(vap);
2964 	vif = LVIF_TO_VIF(lvif);
2965 
2966 	IEEE80211_UNLOCK(vap->iv_ic);
2967 	wiphy_lock(hw->wiphy);
2968 
2969 	LKPI_80211_LVIF_LOCK(lvif);
2970 	/* XXX-BZ KASSERT later? */
2971 	if (!lvif->lvif_bss_synched || lvif->lvif_bss == NULL) {
2972 #ifdef LINUXKPI_DEBUG_80211
2973 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
2974 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
2975 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
2976 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
2977 		    lvif->lvif_bss_synched);
2978 #endif
2979 		LKPI_80211_LVIF_UNLOCK(lvif);
2980 		error = ENOTRECOVERABLE;
2981 		goto out;
2982 	}
2983 	lsta = lvif->lvif_bss;
2984 	LKPI_80211_LVIF_UNLOCK(lvif);
2985 	KASSERT(lsta != NULL && lsta->ni != NULL, ("%s: lsta %p ni %p "
2986 	    "lvif %p vap %p\n", __func__,
2987 	    lsta, (lsta != NULL) ? lsta->ni : NULL, lvif, vap));
2988 
2989 	ni = lsta->ni;		/* Reference held for lvif_bss. */
2990 
2991 	IMPROVE("ponder some of this moved to ic_newassoc, scan_assoc_success, "
2992 	    "and to lesser extend ieee80211_notify_node_join");
2993 
2994 	/* Finish assoc. (even if this is auth_to_run!) */
2995 	/* Update sta_state (AUTH to ASSOC) and set aid. */
2996 	KASSERT(lsta->state == IEEE80211_STA_AUTH, ("%s: lsta %p state not "
2997 	    "AUTH: %#x\n", __func__, lsta, lsta->state));
2998 	sta = LSTA_TO_STA(lsta);
2999 	sta->aid = IEEE80211_NODE_AID(ni);
3000 #ifdef LKPI_80211_WME
3001 	if (vap->iv_flags & IEEE80211_F_WME)
3002 		sta->wme = true;
3003 #endif
3004 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_ASSOC);
3005 	if (error != 0) {
3006 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(ASSOC) "
3007 		    "failed: %d\n", __func__, __LINE__, error);
3008 		goto out;
3009 	}
3010 
3011 	IMPROVE("wme / conf_tx [all]");
3012 
3013 	/* Update bss info (bss_info_changed) (assoc, aid, ..). */
3014 	bss_changed = 0;
3015 #ifdef LKPI_80211_WME
3016 	bss_changed |= lkpi_wme_update(lhw, vap, true);
3017 #endif
3018 	if (!vif->cfg.assoc || vif->cfg.aid != IEEE80211_NODE_AID(ni)) {
3019 		lvif->beacons = 0;
3020 		vif->cfg.assoc = true;
3021 		vif->cfg.aid = IEEE80211_NODE_AID(ni);
3022 		bss_changed |= BSS_CHANGED_ASSOC;
3023 	}
3024 	/* We set SSID but this is not BSSID! */
3025 	vif->cfg.ssid_len = ni->ni_esslen;
3026 	memcpy(vif->cfg.ssid, ni->ni_essid, ni->ni_esslen);
3027 	if ((vap->iv_flags & IEEE80211_F_SHPREAMBLE) !=
3028 	    vif->bss_conf.use_short_preamble) {
3029 		vif->bss_conf.use_short_preamble ^= 1;
3030 		/* bss_changed |= BSS_CHANGED_??? */
3031 	}
3032 	if ((vap->iv_flags & IEEE80211_F_SHSLOT) !=
3033 	    vif->bss_conf.use_short_slot) {
3034 		vif->bss_conf.use_short_slot ^= 1;
3035 		/* bss_changed |= BSS_CHANGED_??? */
3036 	}
3037 	if ((ni->ni_flags & IEEE80211_NODE_QOS) !=
3038 	    vif->bss_conf.qos) {
3039 		vif->bss_conf.qos ^= 1;
3040 		bss_changed |= BSS_CHANGED_QOS;
3041 	}
3042 
3043 	bss_changed |= lkpi_update_dtim_tsf(vif, ni, vap, __func__, __LINE__);
3044 	lkpi_bss_info_change(hw, vif, bss_changed);
3045 
3046 	/* - change_chanctx (if needed)
3047 	 * - event_callback
3048 	 */
3049 
3050 	/* End mgd_complete_tx. (we do not have to check ostate == IEEE80211_S_ASSOC). */
3051 	if (lsta->in_mgd) {
3052 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3053 		prep_tx_info.subtype = IEEE80211_STYPE_ASSOC_REQ;
3054 		prep_tx_info.success = true;	/* Needs vif->cfg.assoc set! */
3055 		prep_tx_info.link_id = 0;
3056 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
3057 		lsta->in_mgd = false;
3058 	}
3059 
3060 	/*
3061 	 * And then:
3062 	 * - (more packets)?
3063 	 * - set_key
3064 	 * - set_default_unicast_key
3065 	 * - set_key (?)
3066 	 * - ipv6_addr_change (?)
3067 	 */
3068 
3069 	if (!ieee80211_node_is_authorized(ni)) {
3070 		IMPROVE("net80211 does not consider node authorized");
3071 	}
3072 
3073 	IMPROVE("Is this the right spot, has net80211 done all updates already?");
3074 	lkpi_sta_sync_from_ni(hw, vif, sta, ni, true);
3075 
3076 	/* Update thresholds. */
3077 	hw->wiphy->frag_threshold = vap->iv_fragthreshold;
3078 	lkpi_80211_mo_set_frag_threshold(hw, vap->iv_fragthreshold);
3079 	hw->wiphy->rts_threshold = vap->iv_rtsthreshold;
3080 	lkpi_80211_mo_set_rts_threshold(hw, vap->iv_rtsthreshold);
3081 
3082 	/* Update sta_state (ASSOC to AUTHORIZED). */
3083 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
3084 	KASSERT(lsta->state == IEEE80211_STA_ASSOC, ("%s: lsta %p state not "
3085 	    "ASSOC: %#x\n", __func__, lsta, lsta->state));
3086 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_AUTHORIZED);
3087 	if (error != 0) {
3088 		IMPROVE("undo some changes?");
3089 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(AUTHORIZED) "
3090 		    "failed: %d\n", __func__, __LINE__, error);
3091 		goto out;
3092 	}
3093 
3094 	/* - drv_config (?)
3095 	 * - bss_info_changed
3096 	 * - set_rekey_data (?)
3097 	 *
3098 	 * And now we should be passing packets.
3099 	 */
3100 	IMPROVE("Need that bssid setting, and the keys");
3101 
3102 	bss_changed = 0;
3103 	bss_changed |= lkpi_update_dtim_tsf(vif, ni, vap, __func__, __LINE__);
3104 	lkpi_bss_info_change(hw, vif, bss_changed);
3105 
3106 	/* Prepare_multicast && configure_filter. */
3107 	lkpi_update_mcast_filter_locked(vap->iv_ic);
3108 
3109 out:
3110 	wiphy_unlock(hw->wiphy);
3111 	IEEE80211_LOCK(vap->iv_ic);
3112 	return (error);
3113 }
3114 
3115 /*
3116  * DOWN1
3117  * "to assoc" means we are going back to State 2 from State 4[/3].
3118  * This means ni still is authenticated, so we keep sta, chanctx, ..
3119  * We will send a (Re)Assoc Request in case net80211 handles roadming.
3120  * Note: this can be called as part of a DEAUTH going to State 1 as well,
3121  * so for RoC prep_tx_info we need to check nstate (see run_to_{auth,scan,init}).
3122  */
3123 static int
3124 lkpi_sta_run_to_assoc(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3125 {
3126 	struct lkpi_hw *lhw;
3127 	struct ieee80211_hw *hw;
3128 	struct lkpi_vif *lvif;
3129 	struct ieee80211_vif *vif;
3130 	struct ieee80211_node *ni;
3131 	struct lkpi_sta *lsta;
3132 	struct ieee80211_sta *sta;
3133 	struct ieee80211_prep_tx_info prep_tx_info;
3134 #if 0
3135 	enum ieee80211_bss_changed bss_changed;
3136 #endif
3137 	struct ieee80211_rx_ampdu *rap;
3138 	int error;
3139 
3140 	lhw = vap->iv_ic->ic_softc;
3141 	hw = LHW_TO_HW(lhw);
3142 	lvif = VAP_TO_LVIF(vap);
3143 	vif = LVIF_TO_VIF(lvif);
3144 
3145 	IEEE80211_UNLOCK(vap->iv_ic);
3146 	wiphy_lock(hw->wiphy);
3147 
3148 	LKPI_80211_LVIF_LOCK(lvif);
3149 #ifdef LINUXKPI_DEBUG_80211
3150 	/* XXX-BZ KASSERT later; state going down so no action. */
3151 	if (lvif->lvif_bss == NULL)
3152 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
3153 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
3154 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
3155 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
3156 		    lvif->lvif_bss_synched);
3157 #endif
3158 	lsta = lvif->lvif_bss;
3159 	LKPI_80211_LVIF_UNLOCK(lvif);
3160 	KASSERT(lsta != NULL && lsta->ni != NULL, ("%s: lsta %p ni %p "
3161 	    "lvif %p vap %p\n", __func__,
3162 	    lsta, (lsta != NULL) ? lsta->ni : NULL, lvif, vap));
3163 
3164 	ni = lsta->ni;		/* Reference held for lvif_bss. */
3165 	sta = LSTA_TO_STA(lsta);
3166 
3167 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3168 
3169 	/* flush, drop. */
3170 	lkpi_80211_mo_flush(hw, vif,  nitems(sta->txq), true);
3171 
3172 	/* We should make this a KASSERT. */
3173 	if (lsta->in_mgd) {
3174 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p lsta %p in_mgd\n",
3175 		    __func__, __LINE__, lvif, vap, lsta);
3176 	}
3177 	/*
3178 	 * Problem is that we should hook into the tx/rx flow and not
3179 	 * try to re-model the state machine parts.  We may miss a SME
3180 	 * triggered frame this way.
3181 	 */
3182 	memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3183 	if (nstate == IEEE80211_S_ASSOC) {
3184 		if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
3185 			if (arg)
3186 				prep_tx_info.subtype = IEEE80211_STYPE_REASSOC_REQ;
3187 			else
3188 				prep_tx_info.subtype = IEEE80211_STYPE_ASSOC_REQ;
3189 		} else {
3190 			/* wpa_supplicant upon RTM_IEEE80211_LEAVE. */
3191 			prep_tx_info.subtype = IEEE80211_STYPE_DISASSOC;
3192 		}
3193 	} else
3194 		prep_tx_info.subtype = IEEE80211_STYPE_DEAUTH;
3195 	prep_tx_info.was_assoc = true;
3196 	prep_tx_info.link_id = 0;
3197 	lkpi_80211_mo_mgd_prepare_tx(hw, vif, &prep_tx_info);
3198 	lsta->in_mgd = true;
3199 
3200 	wiphy_unlock(hw->wiphy);
3201 	IEEE80211_LOCK(vap->iv_ic);
3202 
3203 	/* Call iv_newstate first so we get potential (RE-)ASSOC/DEAUTH? packet out. */
3204 	error = lvif->iv_newstate(vap, nstate, arg);
3205 	if (error != 0) {
3206 		ic_printf(vap->iv_ic, "%s:%d: iv_newstate(%p, %d, %d) "
3207 		    "failed: %d\n", __func__, __LINE__, vap, nstate, arg, error);
3208 		goto outni;
3209 	}
3210 
3211 	/* Stop any BA sessions if still active. */
3212 	for (int rapn = 0; rapn < WME_NUM_TID; rapn++) {
3213 		rap = &ni->ni_rx_ampdu[rapn];
3214 
3215 		if ((rap->rxa_flags & IEEE80211_AGGR_RUNNING) == 0)
3216 			continue;
3217 
3218 		vap->iv_ic->ic_ampdu_rx_stop(ni, rap);
3219 	}
3220 
3221 	IEEE80211_UNLOCK(vap->iv_ic);
3222 
3223 	/* Ensure the packets get out. */
3224 	lkpi_80211_flush_tx(lhw, lsta);
3225 
3226 	wiphy_lock(hw->wiphy);
3227 
3228 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3229 
3230 	/* Wake tx queues to get packet(s) out. */
3231 	lkpi_wake_tx_queues(hw, sta, false, true);
3232 
3233 	/* flush, no drop */
3234 	lkpi_80211_mo_flush(hw, vif,  nitems(sta->txq), false);
3235 
3236 	/* End mgd_complete_tx. */
3237 	/* We should make this a KASSERT. */
3238 	if (!lsta->in_mgd) {
3239 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p lsta %p !in_mgd\n",
3240 		    __func__, __LINE__, lvif, vap, lsta);
3241 	}
3242 	lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
3243 	lsta->in_mgd = false;
3244 
3245 #if 0
3246 	/* sync_rx_queues */
3247 	lkpi_80211_mo_sync_rx_queues(hw);
3248 
3249 	/* sta_pre_rcu_remove */
3250 	lkpi_80211_mo_sta_pre_rcu_remove(hw, vif, sta);
3251 #endif
3252 
3253 	/* Take the station down. */
3254 
3255 	/* Adjust sta and change state (from AUTHORIZED) to ASSOC. */
3256 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
3257 	KASSERT(lsta->state == IEEE80211_STA_AUTHORIZED, ("%s: lsta %p state not "
3258 	    "AUTHORIZED: %#x\n", __func__, lsta, lsta->state));
3259 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_ASSOC);
3260 	if (error != 0) {
3261 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(ASSOC) "
3262 		    "failed: %d\n", __func__, __LINE__, error);
3263 		goto out;
3264 	}
3265 
3266 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3267 
3268 #ifdef LKPI_80211_HW_CRYPTO
3269 	if (lkpi_hwcrypto) {
3270 		error = lkpi_sta_del_keys(hw, vif, lsta);
3271 		if (error != 0) {
3272 			ic_printf(vap->iv_ic, "%s:%d: lkpi_sta_del_keys "
3273 			    "failed: %d\n", __func__, __LINE__, error);
3274 			/*
3275 			 * Either drv/fw will crash or cleanup itself,
3276 			 * otherwise net80211 will delete the keys (at a
3277 			 * less appropriate time).
3278 			 */
3279 			/* goto out; */
3280 		}
3281 	}
3282 #endif
3283 
3284 	/* Update sta_state (ASSOC to AUTH). */
3285 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
3286 	KASSERT(lsta->state == IEEE80211_STA_ASSOC, ("%s: lsta %p state not "
3287 	    "ASSOC: %#x\n", __func__, lsta, lsta->state));
3288 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_AUTH);
3289 	if (error != 0) {
3290 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(AUTH) "
3291 		    "failed: %d\n", __func__, __LINE__, error);
3292 		goto out;
3293 	}
3294 
3295 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3296 
3297 #if 0
3298 	/* Update bss info (bss_info_changed) (assoc, aid, ..). */
3299 	/* See comment in DOWN4. */
3300 	lkpi_disassoc(sta, vif, lhw);
3301 #endif
3302 
3303 	error = EALREADY;
3304 out:
3305 	wiphy_unlock(hw->wiphy);
3306 	IEEE80211_LOCK(vap->iv_ic);
3307 outni:
3308 	return (error);
3309 }
3310 
3311 /*
3312  * DOWN2
3313  * We are in state 2 and go back to state 1 and will try to auth again
3314  * (to IEEE80211_S_AUTH in FreeBSD means "try to auth").  This should be
3315  * like scan_to_auth but that we keep the "ni" and with that chanctx/bssid,
3316  * which essentially makes this "a_to_a" in LinuxKPI.
3317  */
3318 static int
3319 lkpi_sta_assoc_to_auth(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3320 {
3321 	struct lkpi_hw *lhw;
3322 	struct ieee80211_hw *hw;
3323 	struct lkpi_vif *lvif;
3324 	struct ieee80211_vif *vif;
3325 	struct ieee80211_node *ni;
3326 	struct lkpi_sta *lsta;
3327 	struct ieee80211_prep_tx_info prep_tx_info;
3328 	int error;
3329 
3330 	lhw = vap->iv_ic->ic_softc;
3331 	hw = LHW_TO_HW(lhw);
3332 	lvif = VAP_TO_LVIF(vap);
3333 	vif = LVIF_TO_VIF(lvif);
3334 
3335 	IEEE80211_UNLOCK(vap->iv_ic);
3336 	wiphy_lock(hw->wiphy);
3337 
3338 	LKPI_80211_LVIF_LOCK(lvif);
3339 #ifdef LINUXKPI_DEBUG_80211
3340 	/* XXX-BZ KASSERT later; state going down so no action. */
3341 	if (lvif->lvif_bss == NULL)
3342 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
3343 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
3344 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
3345 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
3346 		    lvif->lvif_bss_synched);
3347 #endif
3348 	lsta = lvif->lvif_bss;
3349 	LKPI_80211_LVIF_UNLOCK(lvif);
3350 	KASSERT(lsta != NULL && lsta->ni != NULL, ("%s: lsta %p ni %p "
3351 	    "lvif %p vap %p\n", __func__,
3352 	    lsta, (lsta != NULL) ? lsta->ni : NULL, lvif, vap));
3353 
3354 	ni = lsta->ni;		/* Reference held for lvif_bss. */
3355 
3356 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3357 
3358 	/* End mgd_complete_tx. */
3359 	if (lsta->in_mgd && vap->iv_state == IEEE80211_S_ASSOC) {
3360 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3361 		prep_tx_info.subtype = IEEE80211_STYPE_ASSOC_REQ;
3362 		prep_tx_info.link_id = 0;
3363 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
3364 		lsta->in_mgd = false;
3365 	} else if (lsta->in_mgd) {
3366 		ic_printf(vap->iv_ic, "%s:%d: in_mgd %d (%s) -> %d (%s) %d\n",
3367 		    __func__, __LINE__,
3368 		    vap->iv_state, ieee80211_state_name[vap->iv_state],
3369 		    nstate, ieee80211_state_name[nstate], arg);
3370 	}
3371 
3372 	/* Take the station down. */
3373 	/* Update sta_state (AUTH to NONE). */
3374 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
3375 	KASSERT(lsta->state == IEEE80211_STA_AUTH, ("%s: lsta %p state not "
3376 	    "AUTH: %#x\n", __func__, lsta, lsta->state));
3377 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_NONE);
3378 	if (error != 0) {
3379 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(NONE) "
3380 		    "failed: %d\n", __func__, __LINE__, error);
3381 		goto out;
3382 	}
3383 
3384 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3385 
3386 out:
3387 	wiphy_unlock(hw->wiphy);
3388 	IEEE80211_LOCK(vap->iv_ic);
3389 	return (error);
3390 }
3391 
3392 /*
3393  * DOWN3
3394  * We are in state 1.  Either auth timed out (arg != 0) or we have an internal
3395  * state change forcing us to give up trying to authenticate.
3396  * Cleanup and remove chanctx, sta, ...
3397  */
3398 static int
3399 lkpi_sta_auth_to_scan(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3400 {
3401 	struct lkpi_hw *lhw;
3402 	struct ieee80211_hw *hw;
3403 	struct lkpi_vif *lvif;
3404 	struct ieee80211_vif *vif;
3405 	struct ieee80211_node *ni;
3406 	struct lkpi_sta *lsta;
3407 	struct ieee80211_sta *sta;
3408 	struct ieee80211_prep_tx_info prep_tx_info;
3409 	enum ieee80211_bss_changed bss_changed;
3410 	int error;
3411 
3412 	lhw = vap->iv_ic->ic_softc;
3413 	hw = LHW_TO_HW(lhw);
3414 	lvif = VAP_TO_LVIF(vap);
3415 	vif = LVIF_TO_VIF(lvif);
3416 
3417 	IEEE80211_UNLOCK(vap->iv_ic);
3418 	wiphy_lock(hw->wiphy);
3419 
3420 	LKPI_80211_LVIF_LOCK(lvif);
3421 	/*
3422 	 * XXX-BZ KASSERT later; state going down so no action in theory
3423 	 * but try to avoid a NULL-pointer derref for now and gracefully
3424 	 * fail for non-debug kernels.
3425 	 */
3426 	if (lvif->lvif_bss == NULL) {
3427 		ic_printf(vap->iv_ic, "%s:%d: ERROR: lvif %p vap %p iv_bss %p "
3428 		    "lvif_bss %p lvif_bss->ni %p synched %d; "
3429 		    "expect follow-up problems\n", __func__, __LINE__,
3430 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
3431 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
3432 		    lvif->lvif_bss_synched);
3433 		LKPI_80211_LVIF_UNLOCK(lvif);
3434 		/*
3435 		 * This will likely lead to a firmware crash (if there
3436 		 * was not one before already) and need a
3437 		 * ieee80211_restart_hw() but still better than a panic
3438 		 * for users as they can at least recover.
3439 		 */
3440 		error = ENOTRECOVERABLE;
3441 		goto out;
3442 	}
3443 	lsta = lvif->lvif_bss;
3444 	LKPI_80211_LVIF_UNLOCK(lvif);
3445 	KASSERT(lsta != NULL && lsta->ni != NULL, ("%s: lsta %p ni %p "
3446 	    "lvif %p vap %p\n", __func__,
3447 	    lsta, (lsta != NULL) ? lsta->ni : NULL, lvif, vap));
3448 	ni = lsta->ni;			/* Reference held for lvif_bss. */
3449 	sta = LSTA_TO_STA(lsta);
3450 
3451 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3452 
3453 	/* flush, drop. */
3454 	lkpi_80211_mo_flush(hw, vif,  nitems(sta->txq), true);
3455 
3456 	/* Wake tx queues to get packet(s) out. */
3457 	lkpi_wake_tx_queues(hw, sta, false, true);
3458 
3459 	/* flush, no drop */
3460 	lkpi_80211_mo_flush(hw, vif,  nitems(sta->txq), false);
3461 
3462 	/* End mgd_complete_tx. */
3463 	if (lsta->in_mgd) {
3464 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3465 		prep_tx_info.subtype = IEEE80211_STYPE_AUTH;
3466 		prep_tx_info.link_id = 0;
3467 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
3468 		lsta->in_mgd = false;
3469 	}
3470 
3471 	/* sync_rx_queues */
3472 	lkpi_80211_mo_sync_rx_queues(hw);
3473 
3474 #ifdef LKPI_80211_HW_CRYPTO
3475 	if (lkpi_hwcrypto) {
3476 		error = lkpi_sta_del_keys(hw, vif, lsta);
3477 		if (error != 0) {
3478 			ic_printf(vap->iv_ic, "%s:%d: lkpi_sta_del_keys "
3479 			    "failed: %d\n", __func__, __LINE__, error);
3480 			/*
3481 			 * Either drv/fw will crash or cleanup itself,
3482 			 * otherwise net80211 will delete the keys (at a
3483 			 * less appropriate time).
3484 			 */
3485 			/* goto out; */
3486 		}
3487 	}
3488 #endif
3489 
3490 	/* sta_pre_rcu_remove */
3491         lkpi_80211_mo_sta_pre_rcu_remove(hw, vif, sta);
3492 
3493 	synchronize_net();
3494 
3495 	/* Take the station down. */
3496 
3497 	bss_changed = 0;
3498 	/*
3499 	 * Start updating bss info (*bss_info_changed) (assoc, aid, ..).
3500 	 *
3501 	 * One would expect this to happen when going off AUTHORIZED but
3502 	 * not so.
3503 	 *
3504 	 * Immediately issuing the (*bss_info_changed) used to also remove the
3505 	 * sta from firmware for iwlwifi; or we have problems with the sta
3506 	 * silently not being removed and then crash upon the next sta add.
3507 	 * Neither seems to be the case or a problem still.
3508 	 *
3509 	 * Contrary for BE200 (iwlwifi/mld) if we do not issue the
3510 	 * (*vif_cfg_change) to tell FW that we are no longer assoc
3511 	 * it will crash now upon sta rm.  So the order now is as we once
3512 	 * expected it:
3513 	 *
3514 	 * 1) lkpi_disassoc(): set vif->cfg.assoc = false and .aid=0
3515 	 * 2) add the remaining BSS_CHANGED changes and call (*bss_info_changed)
3516 	 *    (which may be split up into (*vif_cfg_change) and
3517 	 *    (*link_info_changed) for more modern drivers).
3518 	 * 3) call the last sta_state update -> IEEE80211_STA_NOTEXIST
3519 	 *    (removes the sta given assoc is false) and tidy up our lists.
3520 	 * 4) call unassign_vif_chanctx
3521 	 * 5) call lkpi_hw_conf_idle
3522 	 * 6) call remove_chanctx
3523 	 *
3524 	 * Note: vif->driver_flags & IEEE80211_VIF_REMOVE_AP_AFTER_DISASSOC
3525 	 * might change this.
3526 	 */
3527 	bss_changed |= lkpi_disassoc(sta, vif, lhw);
3528 
3529 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3530 
3531 	IMPROVE("Any bss_info changes to announce?");
3532 	vif->bss_conf.qos = false;
3533 	bss_changed |= BSS_CHANGED_QOS;
3534 	vif->cfg.ssid_len = 0;
3535 	memset(vif->cfg.ssid, '\0', sizeof(vif->cfg.ssid));
3536 	IEEE80211_ADDR_COPY(vif->cfg.ap_addr, ieee80211broadcastaddr);
3537 	bss_changed |= BSS_CHANGED_BSSID;
3538 	vif->bss_conf.use_short_preamble = false;
3539 	/* XXX BSS_CHANGED_???? */
3540 	vif->bss_conf.dtim_period = 0; /* go back to 0. */
3541 	bss_changed |= BSS_CHANGED_BEACON_INFO;
3542 	lkpi_bss_info_change(hw, vif, bss_changed);
3543 
3544 	/* Adjust sta and change state (from NONE) to NOTEXIST. */
3545 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
3546 	KASSERT(lsta->state == IEEE80211_STA_NONE, ("%s: lsta %p state not "
3547 	    "NONE: %#x, nstate %d arg %d\n", __func__, lsta, lsta->state, nstate, arg));
3548 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_NOTEXIST);
3549 	if (error != 0) {
3550 		IMPROVE("do we need to undo the chan ctx?");
3551 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(NOTEXIST) "
3552 		    "failed: %d\n", __func__, __LINE__, error);
3553 		goto out;
3554 	}
3555 
3556 	lkpi_lsta_remove(lsta, lvif);
3557 
3558 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3559 
3560 	LKPI_80211_LVIF_LOCK(lvif);
3561 	/* Remove ni reference for this cache of lsta. */
3562 	lvif->lvif_bss = NULL;
3563 	lvif->lvif_bss_synched = false;
3564 	LKPI_80211_LVIF_UNLOCK(lvif);
3565 
3566 	/* conf_tx */
3567 
3568 	lkpi_remove_chanctx(hw, vif);
3569 
3570 out:
3571 	wiphy_unlock(hw->wiphy);
3572 	IEEE80211_LOCK(vap->iv_ic);
3573 	if (error == 0) {
3574 		/*
3575 		 * We do this outside the wiphy lock as net80211::node_free() may call
3576 		 * into crypto code to delete keys and we have a recursed on
3577 		 * non-recursive sx panic.  Also only do this if we get here w/o error.
3578 		 *
3579 		 * The very last release the reference on the ni for the ni/lsta on
3580 		 * lvif->lvif_bss.  Upon return from this both ni and lsta are invalid
3581 		 * and potentially freed.
3582 		 */
3583 		ieee80211_free_node(ni);
3584 	}
3585 	return (error);
3586 }
3587 
3588 /* DOWN4 */
3589 static int
3590 lkpi_sta_scan_to_init(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3591 {
3592 	/* lkpi_iv_newstate() handles the stop scan case in common code. */
3593 	return (lkpi_sta_state_do_nada(vap, nstate, arg));
3594 }
3595 
3596 /* ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ */
3597 
3598 static int
3599 lkpi_sta_auth_to_init(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3600 {
3601 	int error;
3602 
3603 	error = lkpi_sta_auth_to_scan(vap, nstate, arg);
3604 	if (error == 0)
3605 		error = lkpi_sta_scan_to_init(vap, nstate, arg);
3606 	return (error);
3607 }
3608 
3609 /* auth_to_auth, assoc_to_assoc. */
3610 static int
3611 lkpi_sta_a_to_a(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3612 {
3613 	struct lkpi_hw *lhw;
3614 	struct ieee80211_hw *hw;
3615 	struct lkpi_vif *lvif;
3616 	struct ieee80211_vif *vif;
3617 	struct lkpi_sta *lsta;
3618 	struct ieee80211_prep_tx_info prep_tx_info;
3619 	int error;
3620 
3621 	lhw = vap->iv_ic->ic_softc;
3622 	hw = LHW_TO_HW(lhw);
3623 	lvif = VAP_TO_LVIF(vap);
3624 	vif = LVIF_TO_VIF(lvif);
3625 
3626 	IEEE80211_UNLOCK(vap->iv_ic);
3627 	wiphy_lock(hw->wiphy);
3628 
3629 	LKPI_80211_LVIF_LOCK(lvif);
3630 	/* XXX-BZ KASSERT later? */
3631 	if (!lvif->lvif_bss_synched || lvif->lvif_bss == NULL) {
3632 #ifdef LINUXKPI_DEBUG_80211
3633 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
3634 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
3635 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
3636 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
3637 		    lvif->lvif_bss_synched);
3638 #endif
3639 		LKPI_80211_LVIF_UNLOCK(lvif);
3640 		error = ENOTRECOVERABLE;
3641 		goto out;
3642 	}
3643 	lsta = lvif->lvif_bss;
3644 	LKPI_80211_LVIF_UNLOCK(lvif);
3645 
3646 	KASSERT(lsta != NULL, ("%s: lsta %p! lvif %p vap %p\n", __func__,
3647 	    lsta, lvif, vap));
3648 
3649 	IMPROVE("event callback?");
3650 
3651 	/* End mgd_complete_tx. */
3652 	if (lsta->in_mgd) {
3653 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3654 		if (vap->iv_state == IEEE80211_S_AUTH)
3655 			prep_tx_info.subtype = IEEE80211_STYPE_AUTH;
3656 		else
3657 			prep_tx_info.subtype = IEEE80211_STYPE_ASSOC_REQ;
3658 		prep_tx_info.link_id = 0;
3659 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
3660 		lsta->in_mgd = false;
3661 	}
3662 
3663 	/* Now start auth/assoc. */
3664 
3665 	/* Start mgd_prepare_tx. */
3666 	if (!lsta->in_mgd) {
3667 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3668 		if (nstate == IEEE80211_S_AUTH)
3669 			prep_tx_info.subtype = IEEE80211_STYPE_AUTH;
3670 		else
3671 			prep_tx_info.subtype = IEEE80211_STYPE_ASSOC_REQ;
3672 		prep_tx_info.link_id = 0;
3673 		lkpi_80211_mo_mgd_prepare_tx(hw, vif, &prep_tx_info);
3674 		lsta->in_mgd = true;
3675 	}
3676 
3677 	error = 0;
3678 out:
3679 	wiphy_unlock(hw->wiphy);
3680 	IEEE80211_LOCK(vap->iv_ic);
3681 
3682 	return (error);
3683 }
3684 
3685 static int
3686 lkpi_sta_assoc_to_scan(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3687 {
3688 	int error;
3689 
3690 	error = lkpi_sta_assoc_to_auth(vap, nstate, arg);
3691 	if (error != 0 && error != EALREADY)
3692 		return (error);
3693 
3694 	error = lkpi_sta_auth_to_scan(vap, nstate, arg);
3695 	return (error);
3696 }
3697 
3698 static int
3699 lkpi_sta_assoc_to_init(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3700 {
3701 	int error;
3702 
3703 	error = lkpi_sta_assoc_to_scan(vap, nstate, arg);
3704 	if (error != 0 && error != EALREADY)
3705 		return (error);
3706 
3707 	error = lkpi_sta_scan_to_init(vap, nstate, arg);	/* do_nada */
3708 	return (error);
3709 }
3710 
3711 static int
3712 lkpi_sta_run_to_init(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3713 {
3714 	int error;
3715 
3716 	error = lkpi_sta_run_to_assoc(vap, nstate, arg);
3717 	if (error != 0 && error != EALREADY)
3718 		return (error);
3719 
3720 	error = lkpi_sta_assoc_to_init(vap, nstate, arg);
3721 	return (error);
3722 }
3723 
3724 static int
3725 lkpi_sta_run_to_scan(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3726 {
3727 	int error;
3728 
3729 	error = lkpi_sta_run_to_assoc(vap, nstate, arg);
3730 	if (error != 0 && error != EALREADY)
3731 		return (error);
3732 
3733 	error = lkpi_sta_assoc_to_scan(vap, nstate, arg);
3734 	return (error);
3735 }
3736 
3737 static int
3738 lkpi_sta_run_to_auth(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3739 {
3740 	int error;
3741 
3742 	error = lkpi_sta_run_to_assoc(vap, nstate, arg);
3743 	if (error != 0 && error != EALREADY)
3744 		return (error);
3745 
3746 	error = lkpi_sta_assoc_to_auth(vap, nstate, arg);
3747 	return (error);
3748 }
3749 
3750 /* -------------------------------------------------------------------------- */
3751 
3752 /*
3753  * The matches the documented state changes in net80211::sta_newstate().
3754  * XXX (1) without CSA and SLEEP yet, * XXX (2) not all unhandled cases
3755  * there are "invalid" (so there is a room for failure here).
3756  */
3757 struct fsm_state {
3758 	/* INIT, SCAN, AUTH, ASSOC, CAC, RUN, CSA, SLEEP */
3759 	enum ieee80211_state ostate;
3760 	enum ieee80211_state nstate;
3761 	int (*handler)(struct ieee80211vap *, enum ieee80211_state, int);
3762 } sta_state_fsm[] = {
3763 	{ IEEE80211_S_INIT,	IEEE80211_S_INIT, lkpi_sta_state_do_nada },
3764 	{ IEEE80211_S_SCAN,	IEEE80211_S_INIT, lkpi_sta_state_do_nada },	/* DOWN4 scan_to_init */
3765 	{ IEEE80211_S_AUTH,	IEEE80211_S_INIT, lkpi_sta_auth_to_init },	/* not explicitly in sta_newstate() */
3766 	{ IEEE80211_S_ASSOC,	IEEE80211_S_INIT, lkpi_sta_assoc_to_init },	/* Send DEAUTH. */
3767 	{ IEEE80211_S_RUN,	IEEE80211_S_INIT, lkpi_sta_run_to_init },	/* Send DISASSOC. */
3768 
3769 	{ IEEE80211_S_INIT,	IEEE80211_S_SCAN, lkpi_sta_init_to_scan },	/* UP1 */
3770 	{ IEEE80211_S_SCAN,	IEEE80211_S_SCAN, lkpi_sta_state_do_nada },
3771 	{ IEEE80211_S_AUTH,	IEEE80211_S_SCAN, lkpi_sta_auth_to_scan },	/* DOWN3 */
3772 	{ IEEE80211_S_ASSOC,	IEEE80211_S_SCAN, lkpi_sta_assoc_to_scan },
3773 	{ IEEE80211_S_RUN,	IEEE80211_S_SCAN, lkpi_sta_run_to_scan },	/* Beacon miss. */
3774 
3775 	{ IEEE80211_S_INIT,	IEEE80211_S_AUTH, lkpi_sta_scan_to_auth },	/* Send AUTH. */
3776 	{ IEEE80211_S_SCAN,	IEEE80211_S_AUTH, lkpi_sta_scan_to_auth },	/* UP2 Send AUTH. */
3777 	{ IEEE80211_S_AUTH,	IEEE80211_S_AUTH, lkpi_sta_a_to_a },		/* Send ?AUTH. */
3778 	{ IEEE80211_S_ASSOC,	IEEE80211_S_AUTH, lkpi_sta_assoc_to_auth },	/* DOWN2 Send ?AUTH. */
3779 	{ IEEE80211_S_RUN,	IEEE80211_S_AUTH, lkpi_sta_run_to_auth },	/* Send ?AUTH. */
3780 
3781 	{ IEEE80211_S_AUTH,	IEEE80211_S_ASSOC, lkpi_sta_auth_to_assoc },	/* UP3.1 Send ASSOCREQ. */
3782 	{ IEEE80211_S_ASSOC,	IEEE80211_S_ASSOC, lkpi_sta_a_to_a },		/* Send ASSOCREQ. */
3783 	{ IEEE80211_S_RUN,	IEEE80211_S_ASSOC, lkpi_sta_run_to_assoc },	/* DOWN1 Send ASSOCREQ/REASSOCREQ. */
3784 
3785 	{ IEEE80211_S_AUTH,	IEEE80211_S_RUN, lkpi_sta_auth_to_run },	/* UP3.2 */
3786 	{ IEEE80211_S_ASSOC,	IEEE80211_S_RUN, lkpi_sta_assoc_to_run },	/* UP4 */
3787 	{ IEEE80211_S_RUN,	IEEE80211_S_RUN, lkpi_sta_state_do_nada },
3788 
3789 	/* Dummy at the end without handler. */
3790 	{ IEEE80211_S_INIT,	IEEE80211_S_INIT, NULL },
3791 };
3792 
3793 static int
3794 lkpi_iv_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3795 {
3796 	struct ieee80211com *ic;
3797 	struct lkpi_hw *lhw;
3798 	struct lkpi_vif *lvif;
3799 	struct ieee80211_vif *vif;
3800 	struct fsm_state *s;
3801 	enum ieee80211_state ostate;
3802 	int error;
3803 
3804 	ic = vap->iv_ic;
3805 	IEEE80211_LOCK_ASSERT(ic);
3806 	ostate = vap->iv_state;
3807 
3808 #ifdef LINUXKPI_DEBUG_80211
3809 	if (linuxkpi_debug_80211 & D80211_TRACE)
3810 		ic_printf(vap->iv_ic, "%s:%d: vap %p nstate %#x arg %#x\n",
3811 		    __func__, __LINE__, vap, nstate, arg);
3812 #endif
3813 
3814 	if (vap->iv_opmode == IEEE80211_M_STA) {
3815 
3816 		lhw = ic->ic_softc;
3817 		lvif = VAP_TO_LVIF(vap);
3818 		vif = LVIF_TO_VIF(lvif);
3819 
3820 		/* No need to replicate this in most state handlers. */
3821 		if (nstate > IEEE80211_S_SCAN)
3822 			lkpi_stop_hw_scan(lhw, vif);
3823 
3824 		s = sta_state_fsm;
3825 
3826 	} else {
3827 		ic_printf(vap->iv_ic, "%s: only station mode currently supported: "
3828 		    "vap %p iv_opmode %d\n", __func__, vap, vap->iv_opmode);
3829 		return (ENOSYS);
3830 	}
3831 
3832 	error = 0;
3833 	for (; s->handler != NULL; s++) {
3834 		if (ostate == s->ostate && nstate == s->nstate) {
3835 #ifdef LINUXKPI_DEBUG_80211
3836 			if (linuxkpi_debug_80211 & D80211_TRACE)
3837 				ic_printf(vap->iv_ic, "%s: new state %d (%s) ->"
3838 				    " %d (%s): arg %d.\n", __func__,
3839 				    ostate, ieee80211_state_name[ostate],
3840 				    nstate, ieee80211_state_name[nstate], arg);
3841 #endif
3842 			error = s->handler(vap, nstate, arg);
3843 			break;
3844 		}
3845 	}
3846 	IEEE80211_LOCK_ASSERT(vap->iv_ic);
3847 
3848 	if (s->handler == NULL) {
3849 		IMPROVE("turn this into a KASSERT\n");
3850 		ic_printf(vap->iv_ic, "%s: unsupported state transition "
3851 		    "%d (%s) -> %d (%s)\n", __func__,
3852 		    ostate, ieee80211_state_name[ostate],
3853 		    nstate, ieee80211_state_name[nstate]);
3854 		return (ENOSYS);
3855 	}
3856 
3857 	if (error == EALREADY) {
3858 #ifdef LINUXKPI_DEBUG_80211
3859 		if (linuxkpi_debug_80211 & D80211_TRACE)
3860 			ic_printf(vap->iv_ic, "%s: state transition %d (%s) -> "
3861 			    "%d (%s): iv_newstate already handled: %d.\n",
3862 			    __func__, ostate, ieee80211_state_name[ostate],
3863 			    nstate, ieee80211_state_name[nstate], error);
3864 #endif
3865 		return (0);
3866 	}
3867 
3868 	if (error != 0) {
3869 		ic_printf(vap->iv_ic, "%s: error %d during state transition "
3870 		    "%d (%s) -> %d (%s)\n", __func__, error,
3871 		    ostate, ieee80211_state_name[ostate],
3872 		    nstate, ieee80211_state_name[nstate]);
3873 		return (error);
3874 	}
3875 
3876 #ifdef LINUXKPI_DEBUG_80211
3877 	if (linuxkpi_debug_80211 & D80211_TRACE)
3878 		ic_printf(vap->iv_ic, "%s:%d: vap %p nstate %#x arg %#x "
3879 		    "calling net80211 parent\n",
3880 		    __func__, __LINE__, vap, nstate, arg);
3881 #endif
3882 
3883 	return (lvif->iv_newstate(vap, nstate, arg));
3884 }
3885 
3886 /* -------------------------------------------------------------------------- */
3887 
3888 /*
3889  * We overload (*iv_update_bss) as otherwise we have cases in, e.g.,
3890  * net80211::ieee80211_sta_join1() where vap->iv_bss gets replaced by a
3891  * new node without us knowing and thus our ni/lsta are out of sync.
3892  */
3893 static struct ieee80211_node *
3894 lkpi_iv_update_bss(struct ieee80211vap *vap, struct ieee80211_node *ni)
3895 {
3896 	struct lkpi_vif *lvif;
3897 	struct ieee80211_node *rni;
3898 
3899 	IEEE80211_LOCK_ASSERT(vap->iv_ic);
3900 
3901 	lvif = VAP_TO_LVIF(vap);
3902 
3903 	LKPI_80211_LVIF_LOCK(lvif);
3904 	lvif->lvif_bss_synched = false;
3905 	LKPI_80211_LVIF_UNLOCK(lvif);
3906 
3907 	rni = lvif->iv_update_bss(vap, ni);
3908 	return (rni);
3909 }
3910 
3911 #ifdef LKPI_80211_WME
3912 static int
3913 lkpi_wme_update(struct lkpi_hw *lhw, struct ieee80211vap *vap, bool planned)
3914 {
3915 	struct ieee80211com *ic;
3916 	struct ieee80211_hw *hw;
3917 	struct lkpi_vif *lvif;
3918 	struct ieee80211_vif *vif;
3919 	struct chanAccParams chp;
3920 	struct wmeParams wmeparr[WME_NUM_AC];
3921 	struct ieee80211_tx_queue_params txqp;
3922 	enum ieee80211_bss_changed bss_changed;
3923 	int error;
3924 	uint16_t ac;
3925 
3926 	hw = LHW_TO_HW(lhw);
3927 	lockdep_assert_wiphy(hw->wiphy);
3928 
3929 	IMPROVE();
3930 	KASSERT(WME_NUM_AC == IEEE80211_NUM_ACS, ("%s: WME_NUM_AC %d != "
3931 	    "IEEE80211_NUM_ACS %d\n", __func__, WME_NUM_AC, IEEE80211_NUM_ACS));
3932 
3933 	if (vap == NULL)
3934 		return (0);
3935 
3936 	if ((vap->iv_flags & IEEE80211_F_WME) == 0)
3937 		return (0);
3938 
3939 	if (lhw->ops->conf_tx == NULL)
3940 		return (0);
3941 
3942 	if (!planned && (vap->iv_state != IEEE80211_S_RUN)) {
3943 		lhw->update_wme = true;
3944 		return (0);
3945 	}
3946 	lhw->update_wme = false;
3947 
3948 	ic = lhw->ic;
3949 	ieee80211_wme_ic_getparams(ic, &chp);
3950 	IEEE80211_LOCK(ic);
3951 	for (ac = 0; ac < WME_NUM_AC; ac++)
3952 		wmeparr[ac] = chp.cap_wmeParams[ac];
3953 	IEEE80211_UNLOCK(ic);
3954 
3955 	lvif = VAP_TO_LVIF(vap);
3956 	vif = LVIF_TO_VIF(lvif);
3957 
3958 	/* Configure tx queues (conf_tx) & send BSS_CHANGED_QOS. */
3959 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
3960 		struct wmeParams *wmep;
3961 
3962 		wmep = &wmeparr[ac];
3963 		bzero(&txqp, sizeof(txqp));
3964 		txqp.cw_min = wmep->wmep_logcwmin;
3965 		txqp.cw_max = wmep->wmep_logcwmax;
3966 		txqp.txop = wmep->wmep_txopLimit;
3967 		txqp.aifs = wmep->wmep_aifsn;
3968 		error = lkpi_80211_mo_conf_tx(hw, vif, /* link_id */0, ac, &txqp);
3969 		if (error != 0)
3970 			ic_printf(ic, "%s: conf_tx ac %u failed %d\n",
3971 			    __func__, ac, error);
3972 	}
3973 	bss_changed = BSS_CHANGED_QOS;
3974 	if (!planned)
3975 		lkpi_bss_info_change(hw, vif, bss_changed);
3976 
3977 	return (bss_changed);
3978 }
3979 #endif
3980 
3981 static int
3982 lkpi_ic_wme_update(struct ieee80211com *ic)
3983 {
3984 #ifdef LKPI_80211_WME
3985 	struct ieee80211vap *vap;
3986 	struct lkpi_hw *lhw;
3987 	struct ieee80211_hw *hw;
3988 
3989 	IMPROVE("Use the per-VAP callback in net80211.");
3990 	vap = TAILQ_FIRST(&ic->ic_vaps);
3991 	if (vap == NULL)
3992 		return (0);
3993 
3994 	lhw = ic->ic_softc;
3995 	hw = LHW_TO_HW(lhw);
3996 
3997 	wiphy_lock(hw->wiphy);
3998 	lkpi_wme_update(lhw, vap, false);
3999 	wiphy_unlock(hw->wiphy);
4000 #endif
4001 	return (0);	/* unused */
4002 }
4003 
4004 static void
4005 lkpi_iv_sta_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0,
4006     int subtype, const struct ieee80211_rx_stats *rxs, int rssi, int nf)
4007 {
4008 	struct lkpi_hw *lhw;
4009 	struct ieee80211_hw *hw;
4010 	struct lkpi_vif *lvif;
4011 	struct ieee80211_vif *vif;
4012 	enum ieee80211_bss_changed bss_changed;
4013 
4014 	lvif = VAP_TO_LVIF(ni->ni_vap);
4015 	vif = LVIF_TO_VIF(lvif);
4016 
4017 	lvif->iv_recv_mgmt(ni, m0, subtype, rxs, rssi, nf);
4018 
4019 	switch (subtype) {
4020 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
4021 		break;
4022 	case IEEE80211_FC0_SUBTYPE_BEACON:
4023 		/*
4024 		 * Only count beacons when assoc. SCAN has its own logging.
4025 		 * This is for connection/beacon loss/session protection almost
4026 		 * over debugging when trying to get into a stable RUN state.
4027 		 */
4028 		if (vif->cfg.assoc)
4029 			lvif->beacons++;
4030 		break;
4031 	default:
4032 		return;
4033 	}
4034 
4035 	lhw = ni->ni_ic->ic_softc;
4036 	hw = LHW_TO_HW(lhw);
4037 
4038 	/*
4039 	 * If this direct call to mo_bss_info_changed will not work due to
4040 	 * locking, see if queue_work() is fast enough.
4041 	 */
4042 	bss_changed = lkpi_update_dtim_tsf(vif, ni, ni->ni_vap, __func__, __LINE__);
4043 	lkpi_bss_info_change(hw, vif, bss_changed);
4044 }
4045 
4046 /*
4047  * Change link-layer address on the vif (if the vap is not started/"UP").
4048  * This can happen if a user changes 'ether' using ifconfig.
4049  * The code is based on net80211/ieee80211_freebsd.c::wlan_iflladdr() but
4050  * we do use a per-[l]vif event handler to be sure we exist as we
4051  * cannot assume that from every vap derives a vif and we have a hard
4052  * time checking based on net80211 information.
4053  * Should this ever become a real problem we could add a callback function
4054  * to wlan_iflladdr() to be set optionally but that would be for a
4055  * single-consumer (or needs a list) -- was just too complicated for an
4056  * otherwise perfect mechanism FreeBSD already provides.
4057  */
4058 static void
4059 lkpi_vif_iflladdr(void *arg, struct ifnet *ifp)
4060 {
4061 	struct epoch_tracker et;
4062 	struct ieee80211_vif *vif;
4063 
4064 	NET_EPOCH_ENTER(et);
4065 	/* NB: identify vap's by if_transmit; left as an extra check. */
4066 	if (if_gettransmitfn(ifp) != ieee80211_vap_transmit ||
4067 	    (if_getflags(ifp) & IFF_UP) != 0) {
4068 		NET_EPOCH_EXIT(et);
4069 		return;
4070 	}
4071 
4072 	vif = arg;
4073 	IEEE80211_ADDR_COPY(vif->bss_conf.addr, if_getlladdr(ifp));
4074 	NET_EPOCH_EXIT(et);
4075 }
4076 
4077 static struct ieee80211vap *
4078 lkpi_ic_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ],
4079     int unit, enum ieee80211_opmode opmode, int flags,
4080     const uint8_t bssid[IEEE80211_ADDR_LEN],
4081     const uint8_t mac[IEEE80211_ADDR_LEN])
4082 {
4083 	struct lkpi_hw *lhw;
4084 	struct ieee80211_hw *hw;
4085 	struct lkpi_vif *lvif;
4086 	struct ieee80211vap *vap;
4087 	struct ieee80211_vif *vif;
4088 	struct ieee80211_tx_queue_params txqp;
4089 	enum ieee80211_bss_changed bss_changed;
4090 	struct sysctl_oid *node;
4091 	size_t len;
4092 	int error, i;
4093 	uint16_t ac;
4094 
4095 	if (!TAILQ_EMPTY(&ic->ic_vaps))	/* 1 so far. Add <n> once this works. */
4096 		return (NULL);
4097 
4098 	lhw = ic->ic_softc;
4099 	hw = LHW_TO_HW(lhw);
4100 
4101 	len = sizeof(*lvif);
4102 	len += hw->vif_data_size;	/* vif->drv_priv */
4103 
4104 	lvif = malloc(len, M_80211_VAP, M_WAITOK | M_ZERO);
4105 	mtx_init(&lvif->mtx, "lvif", NULL, MTX_DEF);
4106 	TASK_INIT(&lvif->sw_scan_task, 0, lkpi_sw_scan_task, lvif);
4107 	INIT_LIST_HEAD(&lvif->lsta_list);
4108 	lvif->lvif_bss = NULL;
4109 	refcount_init(&lvif->nt_unlocked, 0);
4110 	lvif->lvif_bss_synched = false;
4111 	vap = LVIF_TO_VAP(lvif);
4112 
4113 	vif = LVIF_TO_VIF(lvif);
4114 	memcpy(vif->addr, mac, IEEE80211_ADDR_LEN);
4115 	vif->p2p = false;
4116 	vif->probe_req_reg = false;
4117 	vif->type = lkpi_opmode_to_vif_type(opmode);
4118 	lvif->wdev.iftype = vif->type;
4119 	/* Need to fill in other fields as well. */
4120 	IMPROVE();
4121 
4122 	/* Create a chanctx to be used later. */
4123 	IMPROVE("lkpi_alloc_lchanctx reserved as many as can be");
4124 	(void) lkpi_find_lchanctx_reserved(hw, lvif);
4125 
4126 	/* XXX-BZ hardcoded for now! */
4127 #if 1
4128 	RCU_INIT_POINTER(vif->bss_conf.chanctx_conf, NULL);
4129 	vif->bss_conf.vif = vif;
4130 	/* vap->iv_myaddr is not set until net80211::vap_setup or vap_attach. */
4131 	IEEE80211_ADDR_COPY(vif->bss_conf.addr, mac);
4132 	lvif->lvif_ifllevent = EVENTHANDLER_REGISTER(iflladdr_event,
4133 	    lkpi_vif_iflladdr, vif, EVENTHANDLER_PRI_ANY);
4134 	vif->bss_conf.link_id = 0;	/* Non-MLO operation. */
4135 	vif->bss_conf.chanreq.oper.chan = lhw->dflt_chandef.chan;
4136 	vif->bss_conf.chanreq.oper.width = NL80211_CHAN_WIDTH_20_NOHT;
4137 	vif->bss_conf.use_short_preamble = false;	/* vap->iv_flags IEEE80211_F_SHPREAMBLE */
4138 	vif->bss_conf.use_short_slot = false;		/* vap->iv_flags IEEE80211_F_SHSLOT */
4139 	vif->bss_conf.qos = false;
4140 	vif->bss_conf.use_cts_prot = false;		/* vap->iv_protmode */
4141 	vif->bss_conf.ht_operation_mode = IEEE80211_HT_OP_MODE_PROTECTION_NONE;
4142 	IEEE80211_ADDR_COPY(vif->cfg.ap_addr, ieee80211broadcastaddr);
4143 	vif->cfg.aid = 0;
4144 	vif->cfg.assoc = false;
4145 	vif->cfg.idle = true;
4146 	vif->cfg.ps = false;
4147 	IMPROVE("Check other fields and then figure out whats is left elsewhere of them");
4148 	/*
4149 	 * We need to initialize it to something as the bss_info_changed call
4150 	 * will try to copy from it in iwlwifi and NULL is a panic.
4151 	 * We will set the proper one in scan_to_auth() before being assoc.
4152 	 */
4153 	vif->bss_conf.bssid = ieee80211broadcastaddr;
4154 #endif
4155 #if 0
4156 	vif->bss_conf.dtim_period = 0; /* IEEE80211_DTIM_DEFAULT ; must stay 0. */
4157 	IEEE80211_ADDR_COPY(vif->bss_conf.bssid, bssid);
4158 	vif->bss_conf.beacon_int = ic->ic_bintval;
4159 	/* iwlwifi bug. */
4160 	if (vif->bss_conf.beacon_int < 16)
4161 		vif->bss_conf.beacon_int = 16;
4162 #endif
4163 
4164 	/* Link Config */
4165 	vif->link_conf[0] = &vif->bss_conf;
4166 	for (i = 0; i < nitems(vif->link_conf); i++) {
4167 		IMPROVE("more than 1 link one day");
4168 	}
4169 
4170 	/* Setup queue defaults; driver may override in (*add_interface). */
4171 	for (i = 0; i < IEEE80211_NUM_ACS; i++) {
4172 		if (ieee80211_hw_check(hw, QUEUE_CONTROL))
4173 			vif->hw_queue[i] = IEEE80211_INVAL_HW_QUEUE;
4174 		else if (hw->queues >= IEEE80211_NUM_ACS)
4175 			vif->hw_queue[i] = i;
4176 		else
4177 			vif->hw_queue[i] = 0;
4178 
4179 		/* Initialize the queue to running. Stopped? */
4180 		lvif->hw_queue_stopped[i] = false;
4181 	}
4182 	vif->cab_queue = IEEE80211_INVAL_HW_QUEUE;
4183 
4184 	IMPROVE();
4185 
4186 	wiphy_lock(hw->wiphy);
4187 	error = lkpi_80211_mo_start(hw);
4188 	if (error != 0) {
4189 		wiphy_unlock(hw->wiphy);
4190 		ic_printf(ic, "%s: failed to start hw: %d\n", __func__, error);
4191 		mtx_destroy(&lvif->mtx);
4192 		free(lvif, M_80211_VAP);
4193 		return (NULL);
4194 	}
4195 
4196 	error = lkpi_80211_mo_add_interface(hw, vif);
4197 	if (error != 0) {
4198 		IMPROVE();	/* XXX-BZ mo_stop()? */
4199 		wiphy_unlock(hw->wiphy);
4200 		ic_printf(ic, "%s: failed to add interface: %d\n", __func__, error);
4201 		mtx_destroy(&lvif->mtx);
4202 		free(lvif, M_80211_VAP);
4203 		return (NULL);
4204 	}
4205 	wiphy_unlock(hw->wiphy);
4206 
4207 	LKPI_80211_LHW_LVIF_LOCK(lhw);
4208 	TAILQ_INSERT_TAIL(&lhw->lvif_head, lvif, lvif_entry);
4209 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
4210 
4211 	/* Set bss_info. */
4212 	bss_changed = 0;
4213 	lkpi_bss_info_change(hw, vif, bss_changed);
4214 
4215 	/* Configure tx queues (conf_tx), default WME & send BSS_CHANGED_QOS. */
4216 	IMPROVE("Hardcoded values; to fix see 802.11-2016, 9.4.2.29 EDCA Parameter Set element");
4217 	wiphy_lock(hw->wiphy);
4218 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
4219 
4220 		bzero(&txqp, sizeof(txqp));
4221 		txqp.cw_min = 15;
4222 		txqp.cw_max = 1023;
4223 		txqp.txop = 0;
4224 		txqp.aifs = 2;
4225 		error = lkpi_80211_mo_conf_tx(hw, vif, /* link_id */0, ac, &txqp);
4226 		if (error != 0)
4227 			ic_printf(ic, "%s: conf_tx ac %u failed %d\n",
4228 			    __func__, ac, error);
4229 	}
4230 	bss_changed = BSS_CHANGED_QOS;
4231 	lkpi_bss_info_change(hw, vif, bss_changed);
4232 
4233 	/* Force MC init. */
4234 	lkpi_update_mcast_filter_locked(ic);
4235 
4236 	wiphy_unlock(hw->wiphy);
4237 
4238 	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
4239 
4240 	/* Now we have a valid vap->iv_ifp.  Any checksum offloading goes below. */
4241 
4242 	IMPROVE();
4243 
4244 	/* Override with LinuxKPI method so we can drive mac80211/cfg80211. */
4245 	lvif->iv_newstate = vap->iv_newstate;
4246 	vap->iv_newstate = lkpi_iv_newstate;
4247 	lvif->iv_update_bss = vap->iv_update_bss;
4248 	vap->iv_update_bss = lkpi_iv_update_bss;
4249 	lvif->iv_recv_mgmt = vap->iv_recv_mgmt;
4250 	vap->iv_recv_mgmt = lkpi_iv_sta_recv_mgmt;
4251 
4252 #ifdef LKPI_80211_HW_CRYPTO
4253 	/* Key management. */
4254 	if (lkpi_hwcrypto && lhw->ops->set_key != NULL) {
4255 		vap->iv_key_set = lkpi_iv_key_set;
4256 		vap->iv_key_delete = lkpi_iv_key_delete;
4257 		vap->iv_key_update_begin = lkpi_iv_key_update_begin;
4258 		vap->iv_key_update_end = lkpi_iv_key_update_end;
4259 	}
4260 #endif
4261 
4262 #ifdef LKPI_80211_HT
4263 	/* Stay with the iv_ampdu_rxmax,limit / iv_ampdu_density defaults until later. */
4264 #endif
4265 
4266 	ieee80211_ratectl_init(vap);
4267 
4268 	/* Complete setup. */
4269 	ieee80211_vap_attach(vap, ieee80211_media_change,
4270 	    ieee80211_media_status, mac);
4271 
4272 #ifdef LKPI_80211_HT
4273 	/*
4274 	 * Modern chipset/fw/drv will do A-MPDU in drv/fw and fail
4275 	 * to do so if they cannot do the crypto too.
4276 	 */
4277 	if (!lkpi_hwcrypto && IEEE80211_CONF_AMPDU_OFFLOAD(ic))
4278 		vap->iv_flags_ht &= ~IEEE80211_FHT_AMPDU_RX;
4279 #endif
4280 
4281 	if (hw->max_listen_interval == 0)
4282 		hw->max_listen_interval = 7 * (ic->ic_lintval / ic->ic_bintval);
4283 	hw->conf.listen_interval = hw->max_listen_interval;
4284 
4285 	/* XXX-BZ do we need to be able to update these? */
4286 	hw->wiphy->frag_threshold = vap->iv_fragthreshold;
4287 	lkpi_80211_mo_set_frag_threshold(hw, vap->iv_fragthreshold);
4288 	hw->wiphy->rts_threshold = vap->iv_rtsthreshold;
4289 	lkpi_80211_mo_set_rts_threshold(hw, vap->iv_rtsthreshold);
4290 	/* any others? */
4291 
4292 	/* Add per-VIF/VAP sysctls. */
4293 	sysctl_ctx_init(&lvif->sysctl_ctx);
4294 
4295 	node = SYSCTL_ADD_NODE(&lvif->sysctl_ctx,
4296 	    SYSCTL_CHILDREN(&sysctl___compat_linuxkpi_80211),
4297 	    OID_AUTO, if_name(vap->iv_ifp),
4298 	    CTLFLAG_RD | CTLFLAG_SKIP | CTLFLAG_MPSAFE, NULL, "VIF Information");
4299 
4300 	SYSCTL_ADD_PROC(&lvif->sysctl_ctx,
4301 	    SYSCTL_CHILDREN(node), OID_AUTO, "dump_stas",
4302 	    CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_MPSAFE, lvif, 0,
4303 	    lkpi_80211_dump_stas, "A", "Dump sta statistics of this vif");
4304 	SYSCTL_ADD_PROC(&lvif->sysctl_ctx,
4305 	    SYSCTL_CHILDREN(node), OID_AUTO, "dump_stas_queues",
4306 	    CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_MPSAFE | CTLFLAG_SKIP, lvif, 0,
4307 	    lkpi_80211_dump_sta_queues, "A",
4308 	    "Dump queue statistics for any sta of this vif");
4309 
4310 	IMPROVE();
4311 
4312 	return (vap);
4313 }
4314 
4315 void
4316 linuxkpi_ieee80211_unregister_hw(struct ieee80211_hw *hw)
4317 {
4318 
4319 	wiphy_unregister(hw->wiphy);
4320 	linuxkpi_ieee80211_ifdetach(hw);
4321 
4322 	IMPROVE();
4323 }
4324 
4325 void
4326 linuxkpi_ieee80211_restart_hw(struct ieee80211_hw *hw)
4327 {
4328 
4329 	TODO();
4330 }
4331 
4332 static void
4333 lkpi_ic_vap_delete(struct ieee80211vap *vap)
4334 {
4335 	struct ieee80211com *ic;
4336 	struct lkpi_hw *lhw;
4337 	struct ieee80211_hw *hw;
4338 	struct lkpi_vif *lvif;
4339 	struct ieee80211_vif *vif;
4340 
4341 	lvif = VAP_TO_LVIF(vap);
4342 	vif = LVIF_TO_VIF(lvif);
4343 	ic = vap->iv_ic;
4344 	lhw = ic->ic_softc;
4345 	hw = LHW_TO_HW(lhw);
4346 
4347 	EVENTHANDLER_DEREGISTER(iflladdr_event, lvif->lvif_ifllevent);
4348 
4349 	/* Clear up per-VIF/VAP sysctls. */
4350 	sysctl_ctx_free(&lvif->sysctl_ctx);
4351 
4352 	ieee80211_draintask(ic, &lvif->sw_scan_task);
4353 
4354 	LKPI_80211_LHW_LVIF_LOCK(lhw);
4355 	TAILQ_REMOVE(&lhw->lvif_head, lvif, lvif_entry);
4356 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
4357 
4358 	ieee80211_ratectl_deinit(vap);
4359 	ieee80211_vap_detach(vap);
4360 
4361 	IMPROVE("clear up other bits in this state");
4362 
4363 	lkpi_80211_mo_remove_interface(hw, vif);
4364 
4365 	/* Single VAP, so we can do this here. */
4366 	lkpi_80211_mo_stop(hw, false);			/* XXX SUSPEND */
4367 
4368 	mtx_destroy(&lvif->mtx);
4369 	free(lvif, M_80211_VAP);
4370 }
4371 
4372 static void
4373 lkpi_ic_update_mcast(struct ieee80211com *ic)
4374 {
4375 	struct ieee80211vap *vap;
4376 	struct lkpi_hw *lhw;
4377 
4378 	lhw = ic->ic_softc;
4379 
4380 	LKPI_80211_LHW_MC_LOCK(lhw);
4381 	/* Cleanup anything on the current list. */
4382 	lkpi_cleanup_mcast_list_locked(lhw);
4383 
4384 	/* Build up the new list (or allmulti). */
4385 	if (ic->ic_allmulti == 0) {
4386 		TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
4387 			if_foreach_llmaddr(vap->iv_ifp,
4388 			    lkpi_ic_update_mcast_copy, &lhw->mc_list);
4389 		lhw->mc_all_multi = false;
4390 	} else {
4391 		lhw->mc_all_multi = true;
4392 	}
4393 	LKPI_80211_LHW_MC_UNLOCK(lhw);
4394 
4395 	lkpi_update_mcast_filter(ic);
4396 	TRACEOK();
4397 }
4398 
4399 static void
4400 lkpi_ic_update_promisc(struct ieee80211com *ic)
4401 {
4402 
4403 	UNIMPLEMENTED;
4404 }
4405 
4406 static void
4407 lkpi_ic_update_chw(struct ieee80211com *ic)
4408 {
4409 
4410 	UNIMPLEMENTED;
4411 }
4412 
4413 /* Start / stop device. */
4414 static void
4415 lkpi_ic_parent(struct ieee80211com *ic)
4416 {
4417 	struct lkpi_hw *lhw;
4418 	struct ieee80211_hw *hw;
4419 #ifdef HW_START_STOP
4420 	int error;
4421 #endif
4422 	bool start_all;
4423 
4424 	IMPROVE();
4425 
4426 	lhw = ic->ic_softc;
4427 	hw = LHW_TO_HW(lhw);
4428 	start_all = false;
4429 
4430 	/* IEEE80211_UNLOCK(ic); */
4431 	wiphy_lock(hw->wiphy);
4432 	if (ic->ic_nrunning > 0) {
4433 #ifdef HW_START_STOP
4434 		error = lkpi_80211_mo_start(hw);
4435 		if (error == 0)
4436 #endif
4437 			start_all = true;
4438 	} else {
4439 #ifdef HW_START_STOP
4440 		lkpi_80211_mo_stop(hw, false);		/* XXX SUSPEND */
4441 #endif
4442 	}
4443 	wiphy_unlock(hw->wiphy);
4444 	/* IEEE80211_LOCK(ic); */
4445 
4446 	if (start_all)
4447 		ieee80211_start_all(ic);
4448 }
4449 
4450 bool
4451 linuxkpi_ieee80211_is_ie_id_in_ie_buf(const u8 ie, const u8 *ie_ids,
4452     size_t ie_ids_len)
4453 {
4454 	int i;
4455 
4456 	for (i = 0; i < ie_ids_len; i++) {
4457 		if (ie == *ie_ids)
4458 			return (true);
4459 	}
4460 
4461 	return (false);
4462 }
4463 
4464 /* Return true if skipped; false if error. */
4465 bool
4466 linuxkpi_ieee80211_ie_advance(size_t *xp, const u8 *ies, size_t ies_len)
4467 {
4468 	size_t x;
4469 	uint8_t l;
4470 
4471 	x = *xp;
4472 
4473 	KASSERT(x < ies_len, ("%s: x %zu ies_len %zu ies %p\n",
4474 	    __func__, x, ies_len, ies));
4475 	l = ies[x + 1];
4476 	x += 2 + l;
4477 
4478 	if (x > ies_len)
4479 		return (false);
4480 
4481 	*xp = x;
4482 	return (true);
4483 }
4484 
4485 static uint8_t *
4486 lkpi_scan_ies_add(uint8_t *p, struct ieee80211_scan_ies *scan_ies,
4487     uint32_t band_mask, struct ieee80211vap *vap, struct ieee80211_hw *hw)
4488 {
4489 	struct ieee80211_supported_band *supband;
4490 	struct linuxkpi_ieee80211_channel *channels;
4491 	struct ieee80211com *ic;
4492 	const struct ieee80211_channel *chan;
4493 	const struct ieee80211_rateset *rs;
4494 	uint8_t *pb;
4495 	int band, i;
4496 
4497 	ic = vap->iv_ic;
4498 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
4499 		if ((band_mask & (1 << band)) == 0)
4500 			continue;
4501 
4502 		supband = hw->wiphy->bands[band];
4503 		/*
4504 		 * This should not happen;
4505 		 * band_mask is a bitmask of valid bands to scan on.
4506 		 */
4507 		if (supband == NULL || supband->n_channels == 0)
4508 			continue;
4509 
4510 		/* Find a first channel to get the mode and rates from. */
4511 		channels = supband->channels;
4512 		chan = NULL;
4513 		for (i = 0; i < supband->n_channels; i++) {
4514 			uint32_t flags;
4515 
4516 			if (channels[i].flags & IEEE80211_CHAN_DISABLED)
4517 				continue;
4518 
4519 			flags = 0;
4520 			switch (band) {
4521 			case NL80211_BAND_2GHZ:
4522 				flags |= IEEE80211_CHAN_G;
4523 				break;
4524 			case NL80211_BAND_5GHZ:
4525 				flags |= IEEE80211_CHAN_A;
4526 				break;
4527 			default:
4528 				panic("%s:%d: unupported band %d\n",
4529 				    __func__, __LINE__, band);
4530 			}
4531 
4532 			chan = ieee80211_find_channel(ic,
4533 			    channels[i].center_freq, flags);
4534 			if (chan != NULL)
4535 				break;
4536 		}
4537 
4538 		/* This really should not happen. */
4539 		if (chan == NULL)
4540 			continue;
4541 
4542 		pb = p;
4543 		rs = ieee80211_get_suprates(ic, chan);	/* calls chan2mode */
4544 		p = ieee80211_add_rates(p, rs);
4545 		p = ieee80211_add_xrates(p, rs);
4546 
4547 #if defined(LKPI_80211_HT)
4548 		if ((vap->iv_flags_ht & IEEE80211_FHT_HT) != 0) {
4549 			struct ieee80211_channel *c;
4550 
4551 			c = ieee80211_ht_adjust_channel(ic, ic->ic_curchan,
4552 			    vap->iv_flags_ht);
4553 			p = ieee80211_add_htcap_ch(p, vap, c);
4554 		}
4555 #endif
4556 #if defined(LKPI_80211_VHT)
4557 		if (band == NL80211_BAND_5GHZ &&
4558 		    (vap->iv_vht_flags & IEEE80211_FVHT_VHT) != 0) {
4559 			struct ieee80211_channel *c;
4560 
4561 			c = ieee80211_ht_adjust_channel(ic, ic->ic_curchan,
4562 			    vap->iv_flags_ht);
4563 			c = ieee80211_vht_adjust_channel(ic, c,
4564 			    vap->iv_vht_flags);
4565 			p = ieee80211_add_vhtcap_ch(p, vap, c);
4566 		}
4567 #endif
4568 
4569 		scan_ies->ies[band] = pb;
4570 		scan_ies->len[band] = p - pb;
4571 	}
4572 
4573 	/* Add common_ies */
4574 	pb = p;
4575 	if ((vap->iv_flags & IEEE80211_F_WPA1) != 0 &&
4576 	    vap->iv_wpa_ie != NULL) {
4577 		memcpy(p, vap->iv_wpa_ie, 2 + vap->iv_wpa_ie[1]);
4578 		p += 2 + vap->iv_wpa_ie[1];
4579 	}
4580 	if (vap->iv_appie_probereq != NULL) {
4581 		memcpy(p, vap->iv_appie_probereq->ie_data,
4582 		    vap->iv_appie_probereq->ie_len);
4583 		p += vap->iv_appie_probereq->ie_len;
4584 	}
4585 	scan_ies->common_ies = pb;
4586 	scan_ies->common_ie_len = p - pb;
4587 
4588 	return (p);
4589 }
4590 
4591 static void
4592 lkpi_enable_hw_scan(struct lkpi_hw *lhw)
4593 {
4594 
4595 	if (lhw->ops->hw_scan) {
4596 		/*
4597 		 * Advertise full-offload scanning.
4598 		 *
4599 		 * Not limiting to SINGLE_SCAN_ON_ALL_BANDS here as otherwise
4600 		 * we essentially disable hw_scan for all drivers not setting
4601 		 * the flag.
4602 		 */
4603 		lhw->ic->ic_flags_ext |= IEEE80211_FEXT_SCAN_OFFLOAD;
4604 		lhw->scan_flags |= LKPI_LHW_SCAN_HW;
4605 	}
4606 }
4607 
4608 #ifndef LKPI_80211_USE_SCANLIST
4609 static const uint32_t chan_pri[] = {
4610 	5180, 5500, 5745,
4611 	5260, 5580, 5660, 5825,
4612 	5220, 5300, 5540, 5620, 5700, 5785, 5865,
4613 	2437, 2412, 2422, 2462, 2472, 2432, 2452
4614 };
4615 
4616 static int
4617 lkpi_scan_chan_list_idx(const struct linuxkpi_ieee80211_channel *lc)
4618 {
4619 	int i;
4620 
4621 	for (i = 0; i < nitems(chan_pri); i++) {
4622 		if (lc->center_freq == chan_pri[i])
4623 			return (i);
4624 	}
4625 
4626 	return (-1);
4627 }
4628 
4629 static int
4630 lkpi_scan_chan_list_comp(const  struct linuxkpi_ieee80211_channel *lc1,
4631     const  struct linuxkpi_ieee80211_channel *lc2)
4632 {
4633 	int idx1, idx2;
4634 
4635 	/* Find index in list. */
4636 	idx1 = lkpi_scan_chan_list_idx(lc1);
4637 	idx2 = lkpi_scan_chan_list_idx(lc2);
4638 
4639 	if (idx1 == -1 && idx2 != -1)
4640 		return (1);
4641 	if (idx1 != -1 && idx2 == -1)
4642 		return (-1);
4643 
4644 	/* Neither on the list, use center_freq. */
4645 	if (idx1 == -1 && idx2 == -1)
4646 		return (lc1->center_freq - lc2->center_freq);
4647 
4648 	/* Whichever is first in the list. */
4649 	return (idx1 - idx2);
4650 }
4651 
4652 static void
4653 lkpi_scan_chan_list_resort(struct linuxkpi_ieee80211_channel **cpp, size_t nchan)
4654 {
4655 	struct linuxkpi_ieee80211_channel *lc, *nc;
4656 	size_t i, j;
4657 	int rc;
4658 
4659 	for (i = (nchan - 1); i > 0; i--) {
4660 		for (j = i; j > 0 ; j--) {
4661 			lc = *(cpp + j);
4662 			nc = *(cpp + j - 1);
4663 			rc = lkpi_scan_chan_list_comp(lc, nc);
4664 			if (rc < 0) {
4665 				*(cpp + j) = nc;
4666 				*(cpp + j - 1) = lc;
4667 			}
4668 		}
4669 	}
4670 }
4671 
4672 static bool
4673 lkpi_scan_chan(struct linuxkpi_ieee80211_channel *c,
4674     struct ieee80211com *ic, bool log)
4675 {
4676 
4677 	if ((c->flags & IEEE80211_CHAN_DISABLED) != 0) {
4678 		if (log)
4679 			TRACE_SCAN(ic, "Skipping disabled chan "
4680 			    "on band %s [%#x/%u/%#x]",
4681 			    lkpi_nl80211_band_name(c->band), c->hw_value,
4682 			    c->center_freq, c->flags);
4683 		return (false);
4684 	}
4685 	if (isclr(ic->ic_chan_active, ieee80211_mhz2ieee(c->center_freq,
4686 	    lkpi_nl80211_band_to_net80211_band(c->band)))) {
4687 		if (log)
4688 			TRACE_SCAN(ic, "Skipping !active chan "
4689 			    "on band %s [%#x/%u/%#x]",
4690 			    lkpi_nl80211_band_name(c->band), c->hw_value,
4691 			    c->center_freq, c->flags);
4692 		return (false);
4693 	}
4694 	return (true);
4695 }
4696 #endif
4697 
4698 static void
4699 lkpi_ic_scan_start(struct ieee80211com *ic)
4700 {
4701 	struct lkpi_hw *lhw;
4702 	struct ieee80211_hw *hw;
4703 	struct lkpi_vif *lvif;
4704 	struct ieee80211_vif *vif;
4705 	struct ieee80211_scan_state *ss;
4706 	struct ieee80211vap *vap;
4707 	int error;
4708 	bool is_hw_scan;
4709 
4710 	lhw = ic->ic_softc;
4711 	ss = ic->ic_scan;
4712 	vap = ss->ss_vap;
4713 	TRACE_SCAN(ic, "scan_flags %b", lhw->scan_flags, LKPI_LHW_SCAN_BITS);
4714 
4715 	LKPI_80211_LHW_SCAN_LOCK(lhw);
4716 	if ((lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0) {
4717 		/* A scan is still running. */
4718 		LKPI_80211_LHW_SCAN_UNLOCK(lhw);
4719 		TRACE_SCAN(ic, "Trying to start new scan while still running; "
4720 		    "cancelling new net80211 scan; scan_flags %b",
4721 		    lhw->scan_flags, LKPI_LHW_SCAN_BITS);
4722 		ieee80211_cancel_scan(vap);
4723 		return;
4724 	}
4725 	is_hw_scan = (lhw->scan_flags & LKPI_LHW_SCAN_HW) != 0;
4726 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
4727 
4728 #if 0
4729 	if (vap->iv_state != IEEE80211_S_SCAN) {
4730 		TODO("We need to be able to scan if not in S_SCAN");
4731 		TRACE_SCAN(ic, "scan_flags %b iv_state %d",
4732 		    lhw->scan_flags, LKPI_LHW_SCAN_BITS, vap->iv_state);
4733 		ieee80211_cancel_scan(vap);
4734 		return;
4735 	}
4736 #endif
4737 
4738 	hw = LHW_TO_HW(lhw);
4739 	if (!is_hw_scan) {
4740 		/* If hw_scan is cleared clear FEXT_SCAN_OFFLOAD too. */
4741 		vap->iv_flags_ext &= ~IEEE80211_FEXT_SCAN_OFFLOAD;
4742 
4743 		lvif = VAP_TO_LVIF(vap);
4744 		vif = LVIF_TO_VIF(lvif);
4745 
4746 		if (vap->iv_state == IEEE80211_S_SCAN) {
4747 			wiphy_lock(hw->wiphy);
4748 			lkpi_hw_conf_idle(hw, false);
4749 			wiphy_unlock(hw->wiphy);
4750 		}
4751 
4752 		LKPI_80211_LHW_SCAN_LOCK(lhw);
4753 		lhw->scan_flags |= LKPI_LHW_SCAN_RUNNING;
4754 		LKPI_80211_LHW_SCAN_UNLOCK(lhw);
4755 
4756 		lkpi_update_mcast_filter(ic);
4757 
4758 		TRACE_SCAN(vap->iv_ic, "Starting SW_SCAN: scan_flags %b",
4759 		    lhw->scan_flags, LKPI_LHW_SCAN_BITS);
4760 		lkpi_80211_mo_sw_scan_start(hw, vif, vif->addr);
4761 		/* net80211::scan_start() handled PS for us. */
4762 		IMPROVE();
4763 		/* XXX Also means it is too late to flush queues?
4764 		 * need to check iv_sta_ps or overload? */
4765 		/* XXX want to adjust ss end time/ maxdwell? */
4766 
4767 	} else {
4768 		struct ieee80211_scan_request *hw_req;
4769 		struct linuxkpi_ieee80211_channel *lc, **cpp;
4770 		struct cfg80211_ssid *ssids;
4771 		struct cfg80211_scan_6ghz_params *s6gp;
4772 		size_t chan_len, nchan, ssids_len, s6ghzlen;
4773 		int band, i, ssid_count, common_ie_len;
4774 #ifndef LKPI_80211_USE_SCANLIST
4775 		int n;
4776 #endif
4777 		uint32_t band_mask;
4778 		uint8_t *ie, *ieend;
4779 		bool running;
4780 
4781 		ssid_count = min(ss->ss_nssid, hw->wiphy->max_scan_ssids);
4782 		ssids_len = ssid_count * sizeof(*ssids);
4783 		s6ghzlen = 0 * (sizeof(*s6gp));			/* XXX-BZ */
4784 
4785 		band_mask = 0;
4786 		nchan = 0;
4787 		if (ieee80211_hw_check(hw, SINGLE_SCAN_ON_ALL_BANDS)) {
4788 #ifdef LKPI_80211_USE_SCANLIST
4789 		/* Avoid net80211 scan lists until it has proper scan offload support. */
4790 			for (i = ss->ss_next; i < ss->ss_last; i++) {
4791 				nchan++;
4792 				band = lkpi_net80211_chan_to_nl80211_band(
4793 				    ss->ss_chans[ss->ss_next + i]);
4794 				band_mask |= (1 << band);
4795 			}
4796 #else
4797 			/* Instead we scan for all channels all the time. */
4798 			for (band = 0; band < NUM_NL80211_BANDS; band++) {
4799 				switch (band) {
4800 				case NL80211_BAND_2GHZ:
4801 				case NL80211_BAND_5GHZ:
4802 					break;
4803 				default:
4804 					continue;
4805 				}
4806 				if (hw->wiphy->bands[band] != NULL) {
4807 					struct linuxkpi_ieee80211_channel *channels;
4808 					int n;
4809 
4810 					band_mask |= (1 << band);
4811 
4812 					channels = hw->wiphy->bands[band]->channels;
4813 					n = hw->wiphy->bands[band]->n_channels;
4814 					for (i = 0; i < n; i++) {
4815 						if (lkpi_scan_chan(&channels[i], ic, true))
4816 							nchan++;
4817 					}
4818 				}
4819 			}
4820 #endif
4821 		} else {
4822 			IMPROVE("individual band scans not yet supported, only scanning first band");
4823 			/* In theory net80211 should drive this. */
4824 			/* Probably we need to add local logic for now;
4825 			 * need to deal with scan_complete
4826 			 * and cancel_scan and keep local state.
4827 			 * Also cut the nchan down above.
4828 			 */
4829 			/* XXX-BZ ath10k does not set this but still does it? &$%^ */
4830 		}
4831 
4832 		chan_len = nchan * (sizeof(lc) + sizeof(*lc));
4833 
4834 		common_ie_len = 0;
4835 		if ((vap->iv_flags & IEEE80211_F_WPA1) != 0 &&
4836 		    vap->iv_wpa_ie != NULL)
4837 			common_ie_len += vap->iv_wpa_ie[1];
4838 		if (vap->iv_appie_probereq != NULL)
4839 			common_ie_len += vap->iv_appie_probereq->ie_len;
4840 
4841 		/* We would love to check this at an earlier stage... */
4842 		if (common_ie_len >  hw->wiphy->max_scan_ie_len) {
4843 			ic_printf(ic, "WARNING: %s: common_ie_len %d > "
4844 			    "wiphy->max_scan_ie_len %d\n", __func__,
4845 			    common_ie_len, hw->wiphy->max_scan_ie_len);
4846 		}
4847 
4848 		hw_req = malloc(sizeof(*hw_req) + ssids_len +
4849 		    s6ghzlen + chan_len + lhw->supbands * lhw->scan_ie_len +
4850 		    common_ie_len, M_LKPI80211, M_WAITOK | M_ZERO);
4851 
4852 		hw_req->req.flags = 0;			/* XXX ??? */
4853 		/* hw_req->req.wdev */
4854 		hw_req->req.wiphy = hw->wiphy;
4855 		hw_req->req.no_cck = false;		/* XXX */
4856 
4857 		/*
4858 		 * In general setting duration[_mandatory] seems to pessimise
4859 		 * default scanning behaviour.  We only use it for BGSCANnig
4860 		 * to keep the dwell times small.
4861 		 * Setting duration_mandatory makes this the maximum dwell
4862 		 * time (otherwise may be shorter).  Duration is in TU.
4863 		 */
4864 		if ((ic->ic_flags_ext & IEEE80211_FEXT_BGSCAN) != 0) {
4865 			unsigned long dwell;
4866 
4867 			if ((ic->ic_caps & IEEE80211_C_BGSCAN) == 0 ||
4868 			    (vap->iv_flags & IEEE80211_F_BGSCAN) == 0)
4869 				ic_printf(ic, "BGSCAN despite off: %b, %b, %b\n",
4870 				    ic->ic_flags_ext, IEEE80211_FEXT_BITS,
4871 				    vap->iv_flags, IEEE80211_F_BITS,
4872 				    ic->ic_caps, IEEE80211_C_BITS);
4873 
4874 			dwell = ss->ss_mindwell;
4875 			if (dwell == 0)
4876 				dwell = msecs_to_ticks(20);
4877 
4878 			hw_req->req.duration_mandatory = true;
4879 			hw_req->req.duration = TICKS_2_USEC(dwell) / 1024;
4880 		}
4881 
4882 #ifdef __notyet__
4883 		hw_req->req.flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
4884 		memcpy(hw_req->req.mac_addr, xxx, IEEE80211_ADDR_LEN);
4885 		memset(hw_req->req.mac_addr_mask, 0xxx, IEEE80211_ADDR_LEN);
4886 #endif
4887 		eth_broadcast_addr(hw_req->req.bssid);
4888 
4889 		hw_req->req.n_channels = nchan;
4890 		cpp = (struct linuxkpi_ieee80211_channel **)(hw_req + 1);
4891 		lc = (struct linuxkpi_ieee80211_channel *)(cpp + nchan);
4892 #ifdef LKPI_80211_USE_SCANLIST
4893 		for (i = 0; i < nchan; i++) {
4894 			*(cpp + i) =
4895 			    (struct linuxkpi_ieee80211_channel *)(lc + i);
4896 		}
4897 		/* Avoid net80211 scan lists until it has proper scan offload support. */
4898 		for (i = 0; i < nchan; i++) {
4899 			struct ieee80211_channel *c;
4900 
4901 			c = ss->ss_chans[ss->ss_next + i];
4902 			lc->center_freq = c->ic_freq;	/* XXX */
4903 			/* lc->flags */
4904 			lc->band = lkpi_net80211_chan_to_nl80211_band(c);
4905 			lc->max_power = c->ic_maxpower;
4906 			/* lc-> ... */
4907 			lc++;
4908 		}
4909 #else
4910 		/* Add bands in reverse order for scanning. */
4911 		n = 0;
4912 		for (band = NUM_NL80211_BANDS - 1; band >= 0; band--) {
4913 			struct ieee80211_supported_band *supband;
4914 			struct linuxkpi_ieee80211_channel *channels;
4915 
4916 			/* Band disabled for scanning? */
4917 			if ((band_mask & (1 << band)) == 0)
4918 				continue;
4919 
4920 			/* Nothing to scan in band? */
4921 			supband = hw->wiphy->bands[band];
4922 			if (supband == NULL || supband->n_channels == 0)
4923 				continue;
4924 
4925 			channels = supband->channels;
4926 			for (i = 0; i < supband->n_channels; i++) {
4927 				if (lkpi_scan_chan(&channels[i], ic, false))
4928 					*(cpp + n++) = &channels[i];
4929 			}
4930 		}
4931 		if (lkpi_order_scanlist)
4932 			lkpi_scan_chan_list_resort(cpp, nchan);
4933 
4934 		if ((linuxkpi_debug_80211 & D80211_SCAN) != 0) {
4935 			printf("%s:%d: %s SCAN Channel List (nchan=%zu): ",
4936 			    __func__, __LINE__, ic->ic_name, nchan);
4937 			for (i = 0; i < nchan; i++) {
4938 				struct linuxkpi_ieee80211_channel *xc;
4939 
4940 				xc = *(cpp + i);
4941 				printf(" %d(%d)",
4942 				    ieee80211_mhz2ieee(xc->center_freq,
4943 				        lkpi_nl80211_band_to_net80211_band(
4944 					xc->band)),
4945 				    xc->center_freq);
4946 			}
4947 			printf("\n");
4948 		}
4949 #endif
4950 
4951 		hw_req->req.n_ssids = ssid_count;
4952 		if (hw_req->req.n_ssids > 0) {
4953 			ssids = (struct cfg80211_ssid *)lc;
4954 			hw_req->req.ssids = ssids;
4955 			for (i = 0; i < ssid_count; i++) {
4956 				ssids->ssid_len = ss->ss_ssid[i].len;
4957 				memcpy(ssids->ssid, ss->ss_ssid[i].ssid,
4958 				    ss->ss_ssid[i].len);
4959 				ssids++;
4960 			}
4961 			s6gp = (struct cfg80211_scan_6ghz_params *)ssids;
4962 		} else {
4963 			s6gp = (struct cfg80211_scan_6ghz_params *)lc;
4964 		}
4965 
4966 		/* 6GHz one day. */
4967 		hw_req->req.n_6ghz_params = 0;
4968 		hw_req->req.scan_6ghz_params = NULL;
4969 		hw_req->req.scan_6ghz = false;	/* Weird boolean; not what you think. */
4970 		/* s6gp->... */
4971 
4972 		ie = ieend = (uint8_t *)s6gp;
4973 		/* Copy per-band IEs, copy common IEs */
4974 		ieend = lkpi_scan_ies_add(ie, &hw_req->ies, band_mask, vap, hw);
4975 		hw_req->req.ie = ie;
4976 		hw_req->req.ie_len = ieend - ie;
4977 		hw_req->req.scan_start = jiffies;
4978 
4979 		lvif = VAP_TO_LVIF(vap);
4980 		vif = LVIF_TO_VIF(lvif);
4981 
4982 		LKPI_80211_LHW_SCAN_LOCK(lhw);
4983 		/* Re-check under lock. */
4984 		running = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
4985 		if (!running) {
4986 			KASSERT(lhw->hw_req == NULL, ("%s: ic %p lhw %p hw_req %p "
4987 			    "!= NULL\n", __func__, ic, lhw, lhw->hw_req));
4988 
4989 			lhw->scan_flags |= LKPI_LHW_SCAN_RUNNING;
4990 			lhw->hw_req = hw_req;
4991 		}
4992 		LKPI_80211_LHW_SCAN_UNLOCK(lhw);
4993 		if (running) {
4994 			free(hw_req, M_LKPI80211);
4995 			TRACE_SCAN(ic, "Trying to start new scan while still "
4996 			    "running (2); cancelling new net80211 scan; "
4997 			    "scan_flags %b",
4998 			    lhw->scan_flags, LKPI_LHW_SCAN_BITS);
4999 			ieee80211_cancel_scan(vap);
5000 			return;
5001 		}
5002 
5003 		wiphy_lock(hw->wiphy);
5004 		lkpi_update_mcast_filter_locked(ic);
5005 		TRACE_SCAN(ic, "Starting HW_SCAN: scan_flags %b, "
5006 		    "ie_len %d, n_ssids %d, n_chan %d, common_ie_len %d [%d, %d]",
5007 		    lhw->scan_flags, LKPI_LHW_SCAN_BITS, hw_req->req.ie_len,
5008 		    hw_req->req.n_ssids, hw_req->req.n_channels,
5009 		    hw_req->ies.common_ie_len,
5010 		    hw_req->ies.len[NL80211_BAND_2GHZ],
5011 		    hw_req->ies.len[NL80211_BAND_5GHZ]);
5012 
5013 		error = lkpi_80211_mo_hw_scan(hw, vif, hw_req);
5014 		wiphy_unlock(hw->wiphy);
5015 		if (error != 0) {
5016 			bool scan_done;
5017 			int e;
5018 
5019 			TRACE_SCAN(ic, "hw_scan failed; scan_flags %b, error %d",
5020 			    lhw->scan_flags, LKPI_LHW_SCAN_BITS, error);
5021 			ieee80211_cancel_scan(vap);
5022 
5023 			/*
5024 			 * ieee80211_scan_completed must be called in either
5025 			 * case of error or none.  So let the free happen there
5026 			 * and only there.
5027 			 * That would be fine in theory but in practice drivers
5028 			 * behave differently:
5029 			 * ath10k does not return hw_scan until after scan_complete
5030 			 *        and can then still return an error.
5031 			 * rtw88 can return 1 or -EBUSY without scan_complete
5032 			 * iwlwifi can return various errors before scan starts
5033 			 * ...
5034 			 * So we cannot rely on that behaviour and have to check
5035 			 * and balance between both code paths.
5036 			 */
5037 			e = 0;
5038 			scan_done = true;
5039 			LKPI_80211_LHW_SCAN_LOCK(lhw);
5040 			if ((lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0) {
5041 
5042 				free(lhw->hw_req, M_LKPI80211);
5043 				lhw->hw_req = NULL;
5044 				/*
5045 				 * The ieee80211_cancel_scan() above runs in a
5046 				 * taskq and it may take ages for the previous
5047 				 * scan to clear;  starting a new one right away
5048 				 * we run into the problem that the old one is
5049 				 * still active.
5050 				 */
5051 				e = msleep(lhw, &lhw->scan_mtx, 0, "lhwscanstop", hz);
5052 				scan_done = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
5053 
5054 				/*
5055 				 * Now we can clear running if no one else did.
5056 				 */
5057 				lhw->scan_flags &= ~LKPI_LHW_SCAN_RUNNING;
5058 			}
5059 			LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5060 			lkpi_update_mcast_filter(ic);
5061 			if (!scan_done) {
5062 				ic_printf(ic, "ERROR: %s: timeout/error to wait "
5063 				    "for ieee80211_cancel_scan: %d\n", __func__, e);
5064 				return;
5065 			}
5066 
5067 			/*
5068 			 * XXX-SIGH magic number.
5069 			 * rtw88 has a magic "return 1" if offloading scan is
5070 			 * not possible.  Fall back to sw scan in that case.
5071 			 */
5072 			if (error == 1) {
5073 				/*
5074 				 * We need to put this into some defered context
5075 				 * the net80211 scan may not be done yet
5076 				 * (ic_flags & IEEE80211_F_SCAN) and we cannot
5077 				 * wait here; if we do scan_curchan_task always
5078 				 * runs after our timeout to finalize the scan.
5079 				 */
5080 				ieee80211_runtask(ic, &lvif->sw_scan_task);
5081 				return;
5082 			}
5083 
5084 			ic_printf(ic, "ERROR: %s: hw_scan returned %d\n",
5085 			    __func__, error);
5086 		}
5087 	}
5088 }
5089 
5090 static void
5091 lkpi_sw_scan_task(void *arg, int pending __unused)
5092 {
5093 	struct lkpi_hw *lhw;
5094 	struct lkpi_vif *lvif;
5095 	struct ieee80211vap *vap;
5096 	struct ieee80211_scan_state *ss;
5097 
5098 	lvif = arg;
5099 	vap = LVIF_TO_VAP(lvif);
5100 	lhw = vap->iv_ic->ic_softc;
5101 	ss = vap->iv_ic->ic_scan;
5102 
5103 	LKPI_80211_LHW_SCAN_LOCK(lhw);
5104 	/*
5105 	 * We will re-enable this at scan_end calling lkpi_enable_hw_scan().
5106 	 * IEEE80211_FEXT_SCAN_OFFLOAD will be cleared by lkpi_ic_scan_start.
5107 	 */
5108 	lhw->scan_flags &= ~LKPI_LHW_SCAN_HW;
5109 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5110 
5111 	TRACE_SCAN(vap->iv_ic, "Triggering SW_SCAN: pending %d, scan_flags %b",
5112 	    pending, lhw->scan_flags, LKPI_LHW_SCAN_BITS);
5113 
5114 	/*
5115 	 * This will call ic_scan_start() and we will get into the right path
5116 	 * unless other scans started in between.
5117 	 */
5118 	ieee80211_start_scan(vap,
5119 	    IEEE80211_SCAN_ONCE,
5120 	    msecs_to_ticks(10000), /* 10000 ms (=~ 50 chan * 200 ms) */
5121 	    ss->ss_mindwell ? ss->ss_mindwell : msecs_to_ticks(20),
5122 	    ss->ss_maxdwell ? ss->ss_maxdwell : msecs_to_ticks(200),
5123 	    vap->iv_des_nssid, vap->iv_des_ssid);
5124 }
5125 
5126 static void
5127 lkpi_ic_scan_end(struct ieee80211com *ic)
5128 {
5129 	struct lkpi_hw *lhw;
5130 	bool is_hw_scan;
5131 
5132 	lhw = ic->ic_softc;
5133 	TRACE_SCAN(ic, "scan_flags %b", lhw->scan_flags, LKPI_LHW_SCAN_BITS);
5134 
5135 	LKPI_80211_LHW_SCAN_LOCK(lhw);
5136 	if ((lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) == 0) {
5137 		LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5138 		return;
5139 	}
5140 	is_hw_scan = (lhw->scan_flags & LKPI_LHW_SCAN_HW) != 0;
5141 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5142 
5143 	if (!is_hw_scan) {
5144 		struct ieee80211_scan_state *ss;
5145 		struct ieee80211vap *vap;
5146 		struct ieee80211_hw *hw;
5147 		struct lkpi_vif *lvif;
5148 		struct ieee80211_vif *vif;
5149 
5150 		ss = ic->ic_scan;
5151 		vap = ss->ss_vap;
5152 		hw = LHW_TO_HW(lhw);
5153 		lvif = VAP_TO_LVIF(vap);
5154 		vif = LVIF_TO_VIF(lvif);
5155 
5156 		lkpi_80211_mo_sw_scan_complete(hw, vif);
5157 
5158 		/* Send PS to stop buffering if n80211 does not for us? */
5159 
5160 		if (vap->iv_state == IEEE80211_S_SCAN) {
5161 			wiphy_lock(hw->wiphy);
5162 			lkpi_hw_conf_idle(hw, true);
5163 			wiphy_unlock(hw->wiphy);
5164 		}
5165 	}
5166 
5167 	/*
5168 	 * In case we disabled the hw_scan in lkpi_ic_scan_start() and
5169 	 * switched to swscan, re-enable hw_scan if available.
5170 	 */
5171 	lkpi_enable_hw_scan(lhw);
5172 
5173 	/* Clear the scanning chandef. */
5174 	memset(&lhw->scan_chandef, 0, sizeof(lhw->scan_chandef));
5175 
5176 	LKPI_80211_LHW_SCAN_LOCK(lhw);
5177 	wakeup(lhw);
5178 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5179 }
5180 
5181 static void
5182 lkpi_ic_scan_curchan(struct ieee80211_scan_state *ss,
5183     unsigned long maxdwell)
5184 {
5185 	struct lkpi_hw *lhw;
5186 	bool is_hw_scan;
5187 
5188 	lhw = ss->ss_ic->ic_softc;
5189 	TRACE_SCAN(ss->ss_ic, "scan_flags %b chan %d maxdwell %lu",
5190 	    lhw->scan_flags, LKPI_LHW_SCAN_BITS,
5191 	    ss->ss_ic->ic_curchan->ic_ieee, maxdwell);
5192 
5193 	LKPI_80211_LHW_SCAN_LOCK(lhw);
5194 	is_hw_scan = (lhw->scan_flags & LKPI_LHW_SCAN_HW) != 0;
5195 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5196 	if (!is_hw_scan)
5197 		lhw->ic_scan_curchan(ss, maxdwell);
5198 }
5199 
5200 static void
5201 lkpi_ic_scan_mindwell(struct ieee80211_scan_state *ss)
5202 {
5203 	struct lkpi_hw *lhw;
5204 	bool is_hw_scan;
5205 
5206 	lhw = ss->ss_ic->ic_softc;
5207 	TRACE_SCAN(ss->ss_ic, "scan_flags %b chan %d mindwell %lu",
5208 	    lhw->scan_flags, LKPI_LHW_SCAN_BITS,
5209 	    ss->ss_ic->ic_curchan->ic_ieee, ss->ss_mindwell);
5210 
5211 	LKPI_80211_LHW_SCAN_LOCK(lhw);
5212 	is_hw_scan = (lhw->scan_flags & LKPI_LHW_SCAN_HW) != 0;
5213 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5214 	if (!is_hw_scan)
5215 		lhw->ic_scan_mindwell(ss);
5216 }
5217 
5218 struct lkpi_ic_set_channel_iter_arg {
5219 	struct linuxkpi_ieee80211_channel *chan;
5220 	struct ieee80211_chanctx_conf *chanctx_conf;
5221 };
5222 
5223 static void
5224 lkpi_ic_set_channel_chanctx_iterf(struct ieee80211_hw *hw,
5225     struct ieee80211_chanctx_conf *chanctx_conf, void *arg)
5226 {
5227 	struct lkpi_ic_set_channel_iter_arg *chanctx_iter_arg;
5228 
5229 	chanctx_iter_arg = arg;
5230 	if (chanctx_iter_arg->chanctx_conf != NULL)
5231 		return;
5232 
5233 	if (chanctx_iter_arg->chan == chanctx_conf->def.chan)
5234 		chanctx_iter_arg->chanctx_conf = chanctx_conf;
5235 }
5236 
5237 static void
5238 lkpi_ic_set_channel(struct ieee80211com *ic)
5239 {
5240 	struct lkpi_hw *lhw;
5241 	struct ieee80211_hw *hw;
5242 	struct ieee80211_channel *c;
5243 	struct linuxkpi_ieee80211_channel *chan;
5244 	struct ieee80211_chanctx_conf *chanctx_conf;
5245 	uint32_t changed;
5246 	int error;
5247 	bool hw_scan, scan_running;
5248 
5249 	IEEE80211_UNLOCK_ASSERT(ic);
5250 
5251 	lhw = ic->ic_softc;
5252 
5253 	c = ic->ic_curchan;
5254 	if (c == NULL || c == IEEE80211_CHAN_ANYC) {
5255 		ic_printf(ic, "%s: Unset channel: c %p, ignoring update\n",
5256 		    __func__, c);
5257 		return;
5258 	}
5259 
5260 	chan = lkpi_find_lkpi80211_chan(lhw, c);
5261 	if (chan == NULL) {
5262 		ic_printf(ic, "%s: No channel found for c %p(%d) chan %p\n",
5263 		    __func__, c, c->ic_ieee, chan);
5264 		return;
5265 	}
5266 
5267 	/*
5268 	 * All net80211 callers call ieee80211_radiotap_chan_change().
5269 	 * That means we have nothing to do ourselves.
5270 	 */
5271 
5272 	/* If we have a hw_scan running do not switch channels. */
5273 	LKPI_80211_LHW_SCAN_LOCK(lhw);
5274 	scan_running = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
5275 	hw_scan = (lhw->scan_flags & LKPI_LHW_SCAN_HW) != 0;
5276 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5277 	if (scan_running && hw_scan) {
5278 		TRACE_SCAN(ic, "scan_flags %b chan %d nothing to do.",
5279 		    lhw->scan_flags, LKPI_LHW_SCAN_BITS,
5280 		    c->ic_ieee);
5281 		/* Let us hope we set tx power levels elsewhere. */
5282 		return;
5283 	}
5284 
5285 	hw = LHW_TO_HW(lhw);
5286 	wiphy_lock(hw->wiphy);
5287 	if (scan_running) {
5288 		struct ieee80211vap *vap;
5289 		struct lkpi_vif *lvif;
5290 		struct ieee80211_vif *vif;
5291 
5292 		/*
5293 		 * For now and for scanning just pick the first VIF.
5294 		 * net80211 will need to grow DBDC/link_id support
5295 		 * for us to find the vif/chanctx otherwise.
5296 		 */
5297 		vap = TAILQ_FIRST(&ic->ic_vaps);
5298 		lvif = VAP_TO_LVIF(vap);
5299 		vif = LVIF_TO_VIF(lvif);
5300 
5301 		/* We always set the chandef to no-HT for scanning. */
5302 		cfg80211_chandef_create(&lhw->scan_chandef, chan,
5303 		    NL80211_CHAN_NO_HT);
5304 #ifdef LINUXKPI_DEBUG_80211
5305 		if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
5306 			ic_printf(ic, "%s:%d: initialized lhw->scan_chandef\n",
5307 			    __func__, __LINE__);
5308 #endif
5309 
5310 		/*
5311 		 * This works for as long as we do not do BGSCANs; otherwise
5312 		 * it'll have to be offchan work.
5313 		 */
5314 		chanctx_conf = lkpi_get_chanctx_conf(hw, vif);
5315 		changed = lkpi_init_chanctx_conf(hw, &lhw->scan_chandef, chanctx_conf);
5316 		error = lkpi_set_chanctx_conf(hw, vif, chanctx_conf, changed, true);
5317 
5318 		TRACE_SCAN(ic, "scan_flags %b chan %d ???, error %d",
5319 		    lhw->scan_flags, LKPI_LHW_SCAN_BITS,
5320 		    c->ic_ieee, error);
5321 
5322 		IMPROVE("max power for scanning; TODO in lkpi_80211_update_chandef");
5323 
5324 	} else if (lhw->emulate_chanctx) {
5325 		/*
5326 		 * We do not set the channel here for normal chanctx operation.
5327 		 * That's just a setup to fail. scan_to_auth will setup all the
5328 		 * other neccessary options for this to work.
5329 		 */
5330 		struct lkpi_ic_set_channel_iter_arg chanctx_iter_arg = {
5331 			.chan		= chan,
5332 			.chanctx_conf	= NULL,
5333 		};
5334 		struct cfg80211_chan_def chandef;
5335 
5336 		lkpi_init_chandef(ic, &chandef, chan, c, false);
5337 
5338 		ieee80211_iter_chan_contexts_mtx(hw,
5339 		    lkpi_ic_set_channel_chanctx_iterf, &chanctx_iter_arg);
5340 
5341 		if (chanctx_iter_arg.chanctx_conf == NULL) {
5342 			/* No chanctx found for this channel. */
5343 			struct ieee80211vap *vap;
5344 			struct lkpi_vif *lvif;
5345 			struct ieee80211_vif *vif;
5346 
5347 			/*
5348 			 * For now just pick the first VIF.
5349 			 * net80211 will need to grow DBDC/link_id support
5350 			 * for us to find the vif/chanctx otherwise.
5351 			 */
5352 			vap = TAILQ_FIRST(&ic->ic_vaps);
5353 			lvif = VAP_TO_LVIF(vap);
5354 			vif = LVIF_TO_VIF(lvif);
5355 
5356 #ifdef LINUXKPI_DEBUG_80211
5357 			if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
5358 				ic_printf(ic, "%s:%d: using on stack chandef\n",
5359 				    __func__, __LINE__);
5360 #endif
5361 			chanctx_conf = lkpi_get_chanctx_conf(hw, vif);
5362 			changed = lkpi_init_chanctx_conf(hw, &chandef, chanctx_conf);
5363 			IMPROVE("update HT, VHT, bw, ...");
5364 			error = lkpi_set_chanctx_conf(hw, vif, chanctx_conf, changed, true);
5365 
5366 		} else {
5367 			/*
5368 			 * We know we are on the same channel.
5369 			 * Do we really have to reset everything?
5370 			 */
5371 			IMPROVE("update HT, VHT, bw, ...");
5372 
5373 #ifdef LINUXKPI_DEBUG_80211
5374 			if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
5375 				ic_printf(ic, "%s:%d: using on stack chandef\n",
5376 				    __func__, __LINE__);
5377 #endif
5378 
5379 			chanctx_conf = chanctx_iter_arg.chanctx_conf;
5380 			changed = lkpi_init_chanctx_conf(hw, &chandef, chanctx_conf);
5381 			lkpi_80211_mo_change_chanctx(hw, chanctx_conf, changed);
5382 		}
5383 	}
5384 
5385 	/* Currently PS is hard coded off! Not sure it belongs here. */
5386 	IMPROVE("PS");
5387 	if (ieee80211_hw_check(hw, SUPPORTS_PS) &&
5388 	    (hw->conf.flags & IEEE80211_CONF_PS) != 0) {
5389 		hw->conf.flags &= ~IEEE80211_CONF_PS;
5390 		error = lkpi_80211_mo_config(hw, IEEE80211_CONF_CHANGE_PS);
5391 		if (error != 0 && error != EOPNOTSUPP)
5392 			ic_printf(ic, "ERROR: %s: config %#0x returned "
5393 			    "%d\n", __func__, IEEE80211_CONF_CHANGE_PS,
5394 			    error);
5395 	}
5396 
5397 	wiphy_unlock(hw->wiphy);
5398 }
5399 
5400 static struct ieee80211_node *
5401 lkpi_ic_node_alloc(struct ieee80211vap *vap,
5402     const uint8_t mac[IEEE80211_ADDR_LEN])
5403 {
5404 	struct ieee80211com *ic;
5405 	struct lkpi_hw *lhw;
5406 	struct ieee80211_node *ni;
5407 	struct ieee80211_hw *hw;
5408 	struct lkpi_sta *lsta;
5409 
5410 	ic = vap->iv_ic;
5411 	lhw = ic->ic_softc;
5412 
5413 	/* We keep allocations de-coupled so we can deal with the two worlds. */
5414 	if (lhw->ic_node_alloc == NULL)
5415 		return (NULL);
5416 
5417 	ni = lhw->ic_node_alloc(vap, mac);
5418 	if (ni == NULL)
5419 		return (NULL);
5420 
5421 	hw = LHW_TO_HW(lhw);
5422 	lsta = lkpi_lsta_alloc(vap, mac, hw, ni);
5423 	if (lsta == NULL) {
5424 		if (lhw->ic_node_free != NULL)
5425 			lhw->ic_node_free(ni);
5426 		return (NULL);
5427 	}
5428 
5429 	return (ni);
5430 }
5431 
5432 static int
5433 lkpi_ic_node_init(struct ieee80211_node *ni)
5434 {
5435 	struct ieee80211com *ic;
5436 	struct lkpi_hw *lhw;
5437 	int error;
5438 
5439 	ic = ni->ni_ic;
5440 	lhw = ic->ic_softc;
5441 
5442 	if (lhw->ic_node_init != NULL) {
5443 		error = lhw->ic_node_init(ni);
5444 		if (error != 0)
5445 			return (error);
5446 	}
5447 
5448 	/* XXX-BZ Sync other state over. */
5449 	IMPROVE();
5450 
5451 	return (0);
5452 }
5453 
5454 static void
5455 lkpi_ic_node_cleanup(struct ieee80211_node *ni)
5456 {
5457 	struct ieee80211com *ic;
5458 	struct lkpi_hw *lhw;
5459 
5460 	ic = ni->ni_ic;
5461 	lhw = ic->ic_softc;
5462 
5463 	/* XXX-BZ remove from driver, ... */
5464 	IMPROVE();
5465 
5466 	if (lhw->ic_node_cleanup != NULL)
5467 		lhw->ic_node_cleanup(ni);
5468 }
5469 
5470 static void
5471 lkpi_ic_node_free(struct ieee80211_node *ni)
5472 {
5473 	struct ieee80211com *ic;
5474 	struct lkpi_hw *lhw;
5475 	struct lkpi_sta *lsta;
5476 
5477 	ic = ni->ni_ic;
5478 	lhw = ic->ic_softc;
5479 	lsta = ni->ni_drv_data;
5480 
5481 	/* KASSERT lsta is not NULL here. Print ni/ni__refcnt. */
5482 
5483 	/*
5484 	 * Pass in the original ni just in case of error we could check that
5485 	 * it is the same as lsta->ni.
5486 	 */
5487 	lkpi_lsta_free(lsta, ni);
5488 
5489 	if (lhw->ic_node_free != NULL)
5490 		lhw->ic_node_free(ni);
5491 }
5492 
5493 /*
5494  * lkpi_xmit() called from both the (*ic_raw_xmit) as well as the (*ic_transmit)
5495  * call path.
5496  * Unfortunately they have slightly different invariants.  See
5497  * ieee80211_raw_output() and ieee80211_parent_xmitpkt().
5498  * Both take care of the ni reference in case of error, and otherwise during
5499  * the callback after transmit.
5500  * The difference is that in case of error (*ic_raw_xmit) needs us to release
5501  * the mbuf, while (*ic_transmit) will free the mbuf itself.
5502  */
5503 static int
5504 lkpi_xmit(struct ieee80211_node *ni, struct mbuf *m,
5505     const struct ieee80211_bpf_params *params __unused,
5506     bool freem)
5507 {
5508 	struct lkpi_sta *lsta;
5509 	int error;
5510 
5511 	lsta = ni->ni_drv_data;
5512 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
5513 #if 0
5514 	if (!lsta->added_to_drv || !lsta->txq_ready) {
5515 #else
5516 	/*
5517 	 * Backout this part of 886653492945f which breaks rtw88 or
5518 	 * in general drivers without (*sta_state)() but only the
5519 	 * legacy fallback to (*sta_add)().
5520 	 */
5521 	if (!lsta->txq_ready) {
5522 #endif
5523 		LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
5524 		if (freem)
5525 			m_freem(m);
5526 		return (ENETDOWN);
5527 	}
5528 
5529 	/* Queue the packet and enqueue the task to handle it. */
5530 	error = mbufq_enqueue(&lsta->txq, m);
5531 	if (error != 0) {
5532 		LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
5533 		if (freem)
5534 			m_freem(m);
5535 #ifdef LINUXKPI_DEBUG_80211
5536 		if (linuxkpi_debug_80211 & D80211_TRACE_TX)
5537 			ic_printf(ni->ni_ic, "%s: mbufq_enqueue failed: %d\n",
5538 			    __func__, error);
5539 #endif
5540 		return (ENETDOWN);
5541 	}
5542 	taskqueue_enqueue(taskqueue_thread, &lsta->txq_task);
5543 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
5544 
5545 #ifdef LINUXKPI_DEBUG_80211
5546 	if (linuxkpi_debug_80211 & D80211_TRACE_TX)
5547 		printf("%s:%d lsta %p ni %p %6D mbuf_qlen %d\n",
5548 		    __func__, __LINE__, lsta, ni, ni->ni_macaddr, ":",
5549 		    mbufq_len(&lsta->txq));
5550 #endif
5551 
5552 	return (0);
5553 }
5554 
5555 static int
5556 lkpi_ic_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
5557         const struct ieee80211_bpf_params *params __unused)
5558 {
5559 	return (lkpi_xmit(ni, m, NULL, true));
5560 }
5561 
5562 #ifdef LKPI_80211_HW_CRYPTO
5563 /*
5564  * This is a bit of a hack given we know we are operating on a
5565  * single frame and we know that hardware will deal with it.
5566  * But otherwise the enmic bit and the encrypt bit need to be
5567  * decoupled.
5568  */
5569 static int
5570 lkpi_hw_crypto_prepare_tkip(struct ieee80211_key *k,
5571     struct ieee80211_key_conf *kc, struct sk_buff *skb)
5572 {
5573 	struct ieee80211_hdr *hdr;
5574 	uint32_t hlen, hdrlen;
5575 	uint8_t *p;
5576 
5577 	/*
5578 	 * TKIP only happens on data.
5579 	 */
5580 	hdr = (void *)skb->data;
5581 	if (!ieee80211_is_data_present(hdr->frame_control))
5582 		return (0);
5583 
5584 	/*
5585 	 * "enmic" (though we do not do that).
5586 	 */
5587 	/* any conditions to not apply this? */
5588 	if (skb_tailroom(skb) < ieee80211_crypto_get_key_txmic_len(k))
5589 		return (ENOBUFS);
5590 
5591 	p = skb_put(skb, ieee80211_crypto_get_key_txmic_len(k));
5592 	if ((kc->flags & IEEE80211_KEY_FLAG_PUT_MIC_SPACE) != 0)
5593 		goto encrypt;
5594 
5595 	/*
5596 	 * (*enmic) which we hopefully do not have to do with hw accel.
5597 	 * That means if we make it here we have a problem.
5598 	 */
5599 	TODO("(*enmic)");
5600 	return (ENXIO);
5601 
5602 encrypt:
5603 	/*
5604 	 * "encrypt" (though we do not do that).
5605 	 */
5606 	/*
5607 	 * Check if we have anything to do as requested by driver
5608 	 * or if we are done?
5609 	 */
5610 	if ((kc->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) == 0 &&
5611 	    (kc->flags & IEEE80211_KEY_FLAG_GENERATE_IV) == 0)
5612 			return (0);
5613 
5614 	hlen = k->wk_cipher->ic_header;
5615 	if (skb_headroom(skb) < hlen)
5616 		return (ENOBUFS);
5617 
5618 	hdr = (void *)skb->data;
5619 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
5620 	p = skb_push(skb, hlen);
5621 	memmove(p, p + hlen, hdrlen);
5622 
5623 	/* If driver request space only we are done. */
5624 	if ((kc->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) != 0)
5625 		return (0);
5626 
5627 	p += hdrlen;
5628 	k->wk_cipher->ic_setiv(k, p);
5629 
5630 	/* If we make it hear we do sw encryption. */
5631 	TODO("sw encrypt");
5632 	return (ENXIO);
5633 }
5634 
5635 static int
5636 lkpi_hw_crypto_prepare_ccmp(struct ieee80211_key *k,
5637     struct ieee80211_key_conf *kc, struct sk_buff *skb)
5638 {
5639 	struct ieee80211_hdr *hdr;
5640 	uint32_t hlen, hdrlen;
5641 	uint8_t *p;
5642 
5643 	hdr = (void *)skb->data;
5644 
5645 	/*
5646 	 * Check if we have anythig to do as requested by driver
5647 	 * or if we are done?
5648 	 */
5649 	if ((kc->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) == 0 &&
5650 	    (kc->flags & IEEE80211_KEY_FLAG_GENERATE_IV) == 0 &&
5651 	    /* MFP */
5652 	    !((kc->flags & IEEE80211_KEY_FLAG_GENERATE_IV_MGMT) != 0 &&
5653 		ieee80211_is_mgmt(hdr->frame_control)))
5654 			return (0);
5655 
5656 	hlen = k->wk_cipher->ic_header;
5657 	if (skb_headroom(skb) < hlen)
5658 		return (ENOBUFS);
5659 
5660 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
5661 	p = skb_push(skb, hlen);
5662 	memmove(p, p + hlen, hdrlen);
5663 
5664 	/* If driver request space only we are done. */
5665 	if ((kc->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) != 0)
5666 		return (0);
5667 
5668 	p += hdrlen;
5669 	k->wk_cipher->ic_setiv(k, p);
5670 
5671 	return (0);
5672 }
5673 
5674 static int
5675 lkpi_hw_crypto_prepare(struct lkpi_sta *lsta, struct ieee80211_key *k,
5676     struct sk_buff *skb)
5677 {
5678 	struct ieee80211_tx_info *info;
5679 	struct ieee80211_key_conf *kc;
5680 
5681 	KASSERT(lsta != NULL, ("%s: lsta is NULL", __func__));
5682 	KASSERT(k != NULL, ("%s: key is NULL", __func__));
5683 	KASSERT(skb != NULL, ("%s: skb is NULL", __func__));
5684 
5685 	kc = lsta->kc[k->wk_keyix];
5686 
5687 	info = IEEE80211_SKB_CB(skb);
5688 	info->control.hw_key = kc;
5689 
5690 	/* MUST NOT happen. KASSERT? */
5691 	if (kc == NULL) {
5692 		ic_printf(lsta->ni->ni_ic, "%s: lsta %p k %p skb %p, "
5693 		    "kc is NULL on hw crypto offload\n", __func__, lsta, k, skb);
5694 		return (ENXIO);
5695 	}
5696 
5697 	switch (kc->cipher) {
5698 	case WLAN_CIPHER_SUITE_TKIP:
5699 		return (lkpi_hw_crypto_prepare_tkip(k, kc, skb));
5700 	case WLAN_CIPHER_SUITE_CCMP:
5701 		return (lkpi_hw_crypto_prepare_ccmp(k, kc, skb));
5702 	case WLAN_CIPHER_SUITE_GCMP:
5703 		return (lkpi_hw_crypto_prepare_ccmp(k, kc, skb));
5704 	case WLAN_CIPHER_SUITE_WEP40:
5705 	case WLAN_CIPHER_SUITE_WEP104:
5706 	case WLAN_CIPHER_SUITE_CCMP_256:
5707 	case WLAN_CIPHER_SUITE_GCMP_256:
5708 	case WLAN_CIPHER_SUITE_AES_CMAC:
5709 	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
5710 	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
5711 	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
5712 	default:
5713 		ic_printf(lsta->ni->ni_ic, "%s: lsta %p k %p kc %p skb %p, "
5714 		    "unsupported cipher suite %u (%s)\n", __func__, lsta, k, kc,
5715 		    skb, kc->cipher, lkpi_cipher_suite_to_name(kc->cipher));
5716 		return (EOPNOTSUPP);
5717 	}
5718 }
5719 
5720 static uint8_t
5721 lkpi_hw_crypto_tailroom(struct lkpi_sta *lsta, struct ieee80211_key *k)
5722 {
5723 	struct ieee80211_key_conf *kc;
5724 
5725 	kc = lsta->kc[k->wk_keyix];
5726 	if (kc == NULL)
5727 		return (0);
5728 
5729 	IMPROVE("which other flags need tailroom?");
5730 	if (kc->flags & (IEEE80211_KEY_FLAG_PUT_MIC_SPACE))
5731 		return (32);	/* Large enough to hold everything and pow2. */
5732 
5733 	return (0);
5734 }
5735 #endif
5736 
5737 static void
5738 lkpi_80211_txq_tx_one(struct lkpi_sta *lsta, struct mbuf *m)
5739 {
5740 	struct ieee80211_node *ni;
5741 	struct ieee80211_frame *wh;
5742 	struct ieee80211_key *k;
5743 	struct sk_buff *skb;
5744 	struct ieee80211com *ic;
5745 	struct lkpi_hw *lhw;
5746 	struct ieee80211_hw *hw;
5747 	struct lkpi_vif *lvif;
5748 	struct ieee80211_vif *vif;
5749 	struct ieee80211_channel *c;
5750 	struct ieee80211_tx_control control;
5751 	struct ieee80211_tx_info *info;
5752 	struct ieee80211_sta *sta;
5753 	struct ieee80211_hdr *hdr;
5754 	struct lkpi_txq *ltxq;
5755 	void *buf;
5756 	ieee80211_keyix keyix;
5757 	uint8_t ac, tid, tailroom;
5758 
5759 	M_ASSERTPKTHDR(m);
5760 #ifdef LINUXKPI_DEBUG_80211
5761 	if (linuxkpi_debug_80211 & D80211_TRACE_TX_DUMP)
5762 		hexdump(mtod(m, const void *), m->m_len, "RAW TX (plain) ", 0);
5763 #endif
5764 
5765 	ni = lsta->ni;
5766 	ieee80211_output_seqno_assign(ni, -1, m);
5767 
5768 	k = NULL;
5769 	keyix = IEEE80211_KEYIX_NONE;
5770 	wh = mtod(m, struct ieee80211_frame *);
5771 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
5772 
5773 #ifdef LKPI_80211_HW_CRYPTO
5774 		if (lkpi_hwcrypto) {
5775 			k = ieee80211_crypto_get_txkey(ni, m);
5776 			if (k != NULL && lsta->kc[k->wk_keyix] != NULL)
5777 				keyix = k->wk_keyix;
5778 		}
5779 #endif
5780 
5781 		/* Encrypt the frame if need be. */
5782 		if (keyix == IEEE80211_KEYIX_NONE) {
5783 			/* Retrieve key for TX && do software encryption. */
5784 			k = ieee80211_crypto_encap(ni, m);
5785 			if (k == NULL) {
5786 				ieee80211_free_node(ni);
5787 				m_freem(m);
5788 				return;
5789 			}
5790 		}
5791 	}
5792 
5793 	ic = ni->ni_ic;
5794 	lhw = ic->ic_softc;
5795 	hw = LHW_TO_HW(lhw);
5796 	c = ni->ni_chan;
5797 
5798 	if (ieee80211_radiotap_active_vap(ni->ni_vap)) {
5799 		struct lkpi_radiotap_tx_hdr *rtap;
5800 
5801 		rtap = &lhw->rtap_tx;
5802 		rtap->wt_flags = 0;
5803 		if (k != NULL)
5804 			rtap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
5805 		if (m->m_flags & M_FRAG)
5806 			rtap->wt_flags |= IEEE80211_RADIOTAP_F_FRAG;
5807 		IMPROVE();
5808 		rtap->wt_rate = 0;
5809 		if (c != NULL && c != IEEE80211_CHAN_ANYC) {
5810 			rtap->wt_chan_freq = htole16(c->ic_freq);
5811 			rtap->wt_chan_flags = htole16(c->ic_flags);
5812 		}
5813 
5814 		ieee80211_radiotap_tx(ni->ni_vap, m);
5815 	}
5816 
5817 #ifdef LKPI_80211_HW_CRYPTO
5818 	if (lkpi_hwcrypto && keyix != IEEE80211_KEYIX_NONE)
5819 		tailroom = lkpi_hw_crypto_tailroom(lsta, k);
5820 	else
5821 #endif
5822 		tailroom = 0;
5823 
5824 	/*
5825 	 * net80211 should handle hw->extra_tx_headroom.
5826 	 * Though for as long as we are copying we don't mind.
5827 	 * XXX-BZ rtw88 asks for too much headroom for ipv6+tcp:
5828 	 * https://lists.freebsd.org/archives/freebsd-transport/2022-February/000012.html
5829 	 */
5830 	skb = dev_alloc_skb(hw->extra_tx_headroom + tailroom + m->m_pkthdr.len);
5831 	if (skb == NULL) {
5832 		static uint8_t skb_alloc_failures = 0;
5833 
5834 		if (skb_alloc_failures++ == 0) {
5835 			int tid;
5836 
5837 			sta = LSTA_TO_STA(lsta);
5838 			ic_printf(ic, "ERROR %s: skb alloc failed %d + %d, lsta %p sta %p ni %p\n",
5839 			    __func__, hw->extra_tx_headroom, m->m_pkthdr.len, lsta, sta, ni);
5840 			for (tid = 0; tid < nitems(sta->txq); tid++) {
5841 				if (sta->txq[tid] == NULL)
5842 					continue;
5843 				ltxq = TXQ_TO_LTXQ(sta->txq[tid]);
5844 				ic_printf(ic, "  tid %d ltxq %p flags %b skb_queue_len %u\n",
5845 				    tid, ltxq, ltxq->flags, LKPI_TXQ_FLAGS_BITS, skb_queue_len(&ltxq->skbq));
5846 			}
5847 		}
5848 		ieee80211_free_node(ni);
5849 		m_freem(m);
5850 		return;
5851 	}
5852 	skb_reserve(skb, hw->extra_tx_headroom);
5853 
5854 	/* XXX-BZ we need a SKB version understanding mbuf. */
5855 	/* Save the mbuf for ieee80211_tx_complete(). */
5856 	skb->m_free_func = lkpi_ieee80211_free_skb_mbuf;
5857 	skb->m = m;
5858 #if 0
5859 	skb_put_data(skb, m->m_data, m->m_pkthdr.len);
5860 #else
5861 	buf = skb_put(skb, m->m_pkthdr.len);
5862 	m_copydata(m, 0, m->m_pkthdr.len, buf);
5863 #endif
5864 	/* Save the ni. */
5865 	m->m_pkthdr.PH_loc.ptr = ni;
5866 
5867 	lvif = VAP_TO_LVIF(ni->ni_vap);
5868 	vif = LVIF_TO_VIF(lvif);
5869 
5870 	hdr = (void *)skb->data;
5871 	tid = linuxkpi_ieee80211_get_tid(hdr, true);
5872 	if (tid == IEEE80211_NONQOS_TID) { /* == IEEE80211_NUM_TIDS */
5873 		if (!ieee80211_is_data(hdr->frame_control)) {
5874 			/* MGMT and CTRL frames go on TID 7/VO. */
5875 			skb->priority = 7;
5876 			ac = IEEE80211_AC_VO;
5877 		} else {
5878 			/* Other non-QOS traffic goes to BE. */
5879 			/* Contrary to net80211 we MUST NOT promote M_EAPOL. */
5880 			skb->priority = 0;
5881 			ac = IEEE80211_AC_BE;
5882 		}
5883 	} else {
5884 		skb->priority = tid & IEEE80211_QOS_CTL_TID_MASK;
5885 		ac = ieee80211e_up_to_ac[tid & 7];
5886 	}
5887 	skb_set_queue_mapping(skb, ac);
5888 
5889 	info = IEEE80211_SKB_CB(skb);
5890 	info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
5891 	/* Slight delay; probably only happens on scanning so fine? */
5892 	if (c == NULL || c == IEEE80211_CHAN_ANYC)
5893 		c = ic->ic_curchan;
5894 	info->band = lkpi_net80211_chan_to_nl80211_band(c);
5895 	info->hw_queue = vif->hw_queue[ac];
5896 	if ((m->m_flags & M_EAPOL) != 0) {
5897 		info->control.flags |= IEEE80211_TX_CTRL_PORT_CTRL_PROTO;
5898 		info->flags |= IEEE80211_TX_CTL_USE_MINRATE;	/* mt76 */
5899 	}
5900 	info->control.vif = vif;
5901 
5902 	/* IMPROVE("MLO"); */
5903 	info->control.flags |=
5904 	    u32_encode_bits(IEEE80211_LINK_UNSPECIFIED, IEEE80211_TX_CTRL_MLO_LINK);
5905 
5906 	if (tid != IEEE80211_NONQOS_TID) {
5907 		struct ieee80211_tx_ampdu *tap;
5908 
5909 		tap = &ni->ni_tx_ampdu[tid];
5910 		if (ieee80211_is_data_qos(hdr->frame_control) &&
5911 		    !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
5912 		    !is_multicast_ether_addr(hdr->addr1) &&
5913 		    IEEE80211_AMPDU_RUNNING(tap))
5914 			info->flags |= IEEE80211_TX_CTL_AMPDU;
5915 	}
5916 
5917 	/* XXX-BZ info->control.rates */
5918 #ifdef __notyet__
5919 #ifdef LKPI_80211_HT
5920 	info->control.rts_cts_rate_idx=
5921 	info->control.use_rts= /* RTS */
5922 	info->control.use_cts_prot= /* RTS/CTS*/
5923 #endif
5924 #endif
5925 
5926 	sta = LSTA_TO_STA(lsta);
5927 #ifdef LKPI_80211_HW_CRYPTO
5928 	if (lkpi_hwcrypto && keyix != IEEE80211_KEYIX_NONE) {
5929 		int error;
5930 
5931 		error = lkpi_hw_crypto_prepare(lsta, k, skb);
5932 		if (error != 0) {
5933 			/*
5934 			 * We only have to free the skb which will free the
5935 			 * mbuf and release the reference on the ni.
5936 			 */
5937 			dev_kfree_skb(skb);
5938 			return;
5939 		}
5940 		/* Reset header as data might have moved. */
5941 		hdr = (void *)skb->data;
5942 	}
5943 #endif
5944 
5945 	IMPROVE();
5946 
5947 	ltxq = NULL;
5948 	if (!ieee80211_is_data_present(hdr->frame_control)) {
5949 		if (vif->type == NL80211_IFTYPE_STATION &&
5950 		    lsta->added_to_drv &&
5951 		    sta->txq[IEEE80211_NUM_TIDS] != NULL)
5952 			ltxq = TXQ_TO_LTXQ(sta->txq[IEEE80211_NUM_TIDS]);
5953 	} else if (lsta->added_to_drv &&
5954 	    sta->txq[skb->priority] != NULL) {
5955 		ltxq = TXQ_TO_LTXQ(sta->txq[skb->priority]);
5956 	}
5957 	if (ltxq == NULL)
5958 		goto ops_tx;
5959 
5960 	KASSERT(ltxq != NULL, ("%s: lsta %p sta %p m %p skb %p "
5961 	    "ltxq %p != NULL\n", __func__, lsta, sta, m, skb, ltxq));
5962 
5963 	LKPI_80211_LTXQ_LOCK(ltxq);
5964 	skb_queue_tail(&ltxq->skbq, skb);
5965 	ltxq->frms_enqueued++;
5966 #ifdef LINUXKPI_DEBUG_80211
5967 	if (linuxkpi_debug_80211 & D80211_TRACE_TX)
5968 		printf("%s:%d mo_wake_tx_queue :: %d %lu lsta %p sta %p "
5969 		    "ni %p %6D skb %p lxtq %p { qlen %u, ac %d tid %u } "
5970 		    "WAKE_TX_Q ac %d prio %u qmap %u\n",
5971 		    __func__, __LINE__,
5972 		    curthread->td_tid, jiffies,
5973 		    lsta, sta, ni, ni->ni_macaddr, ":", skb, ltxq,
5974 		    skb_queue_len(&ltxq->skbq), ltxq->txq.ac,
5975 		    ltxq->txq.tid, ac, skb->priority, skb->qmap);
5976 #endif
5977 	LKPI_80211_LTXQ_UNLOCK(ltxq);
5978 	wiphy_lock(hw->wiphy);
5979 	lkpi_80211_mo_wake_tx_queue(hw, &ltxq->txq, true);
5980 	wiphy_unlock(hw->wiphy);
5981 	return;
5982 
5983 ops_tx:
5984 #ifdef LINUXKPI_DEBUG_80211
5985 	if (linuxkpi_debug_80211 & D80211_TRACE_TX)
5986 		printf("%s:%d mo_tx :: lsta %p sta %p ni %p %6D skb %p "
5987 		    "TX ac %d prio %u qmap %u\n",
5988 		    __func__, __LINE__, lsta, sta, ni, ni->ni_macaddr, ":",
5989 		    skb, ac, skb->priority, skb->qmap);
5990 #endif
5991 	memset(&control, 0, sizeof(control));
5992 	control.sta = sta;
5993 	wiphy_lock(hw->wiphy);
5994 	lkpi_80211_mo_tx(hw, &control, skb);
5995 	lsta->frms_tx++;
5996 	wiphy_unlock(hw->wiphy);
5997 }
5998 
5999 static void
6000 lkpi_80211_txq_task(void *ctx, int pending)
6001 {
6002 	struct lkpi_sta *lsta;
6003 	struct mbufq mq;
6004 	struct mbuf *m;
6005 	bool shall_tx;
6006 
6007 	lsta = ctx;
6008 
6009 #ifdef LINUXKPI_DEBUG_80211
6010 	if (linuxkpi_debug_80211 & D80211_TRACE_TX)
6011 		printf("%s:%d lsta %p ni %p %6D pending %d mbuf_qlen %d\n",
6012 		    __func__, __LINE__, lsta, lsta->ni, lsta->ni->ni_macaddr, ":",
6013 		    pending, mbufq_len(&lsta->txq));
6014 #endif
6015 
6016 	mbufq_init(&mq, IFQ_MAXLEN);
6017 
6018 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
6019 	/*
6020 	 * Do not re-check lsta->txq_ready here; we may have a pending
6021 	 * disassoc/deauth frame still.  On the contrary if txq_ready is
6022 	 * false we do not have a valid sta anymore in the firmware so no
6023 	 * point to try to TX.
6024 	 * We also use txq_ready as a semaphore and will drain the txq manually
6025 	 * if needed on our way towards SCAN/INIT in the state machine.
6026 	 */
6027 #if 0
6028 	shall_tx = lsta->added_to_drv && lsta->txq_ready;
6029 #else
6030 	/*
6031 	 * Backout this part of 886653492945f which breaks rtw88 or
6032 	 * in general drivers without (*sta_state)() but only the
6033 	 * legacy fallback to (*sta_add)().
6034 	 */
6035 	shall_tx = lsta->txq_ready;
6036 #endif
6037 	if (__predict_true(shall_tx))
6038 		mbufq_concat(&mq, &lsta->txq);
6039 	/*
6040 	 * else a state change will push the packets out manually or
6041 	 * lkpi_lsta_free() will drain the lsta->txq and free the mbufs.
6042 	 */
6043 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
6044 
6045 	m = mbufq_dequeue(&mq);
6046 	while (m != NULL) {
6047 		lkpi_80211_txq_tx_one(lsta, m);
6048 		m = mbufq_dequeue(&mq);
6049 	}
6050 }
6051 
6052 static int
6053 lkpi_ic_transmit(struct ieee80211com *ic, struct mbuf *m)
6054 {
6055 
6056 	/* XXX TODO */
6057 	IMPROVE();
6058 
6059 	/* Quick and dirty cheating hack. */
6060 	struct ieee80211_node *ni;
6061 
6062 	ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
6063 	return (lkpi_xmit(ni, m, NULL, false));
6064 }
6065 
6066 #ifdef LKPI_80211_HT
6067 static int
6068 lkpi_ic_recv_action(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
6069     const uint8_t *frm, const uint8_t *efrm)
6070 {
6071 	struct ieee80211com *ic;
6072 	struct lkpi_hw *lhw;
6073 
6074 	ic = ni->ni_ic;
6075 	lhw = ic->ic_softc;
6076 
6077 	TRACEOK("recv_action called");
6078 
6079 	return (lhw->ic_recv_action(ni, wh, frm, efrm));
6080 }
6081 
6082 static int
6083 lkpi_ic_send_action(struct ieee80211_node *ni, int category, int action, void *sa)
6084 {
6085 	struct ieee80211com *ic;
6086 	struct lkpi_hw *lhw;
6087 
6088 	ic = ni->ni_ic;
6089 	lhw = ic->ic_softc;
6090 
6091 	TRACEOK("send_action with action %d called", action);
6092 
6093 	return (lhw->ic_send_action(ni, category, action, sa));
6094 }
6095 
6096 
6097 static int
6098 lkpi_ic_ampdu_enable(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
6099 {
6100 	struct ieee80211com *ic;
6101 	struct lkpi_hw *lhw;
6102 
6103 	ic = ni->ni_ic;
6104 	lhw = ic->ic_softc;
6105 
6106 	TRACEOK("ieee80211_ampdu_enable called");
6107 
6108 	return (lhw->ic_ampdu_enable(ni, tap));
6109 }
6110 
6111 /*
6112  * (*ic_addba_request)() is called by ieee80211_ampdu_request() before
6113  * calling send_action(CAT_BA, BA_ADDBA_REQUEST).
6114  *
6115  * NB: returns 0 on ERROR!
6116  */
6117 static int
6118 lkpi_ic_addba_request(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap,
6119     int dialogtoken, int baparamset, int batimeout)
6120 {
6121 	struct ieee80211com *ic;
6122 	struct lkpi_hw *lhw;
6123 	struct ieee80211_hw *hw;
6124 	struct ieee80211vap *vap;
6125 	struct lkpi_vif *lvif;
6126 	struct ieee80211_vif *vif;
6127 	struct lkpi_sta *lsta;
6128 	struct ieee80211_sta *sta;
6129 	struct ieee80211_ampdu_params params = { };
6130 	int error;
6131 
6132 	ic = ni->ni_ic;
6133 	lhw = ic->ic_softc;
6134 	hw = LHW_TO_HW(lhw);
6135 	vap = ni->ni_vap;
6136 	lvif = VAP_TO_LVIF(vap);
6137 	vif = LVIF_TO_VIF(lvif);
6138 	lsta = ni->ni_drv_data;
6139 	sta = LSTA_TO_STA(lsta);
6140 
6141 	TRACEOK("ADDBA REQ tid %u", tap->txa_tid);
6142 
6143 	if (!lsta->added_to_drv) {
6144 		ic_printf(ic, "%s: lsta %p ni %p, sta %p not added to firmware\n",
6145 		    __func__, lsta, ni, sta);
6146 		return (0);
6147 	}
6148 
6149 	params.sta = sta;
6150 	params.action = IEEE80211_AMPDU_TX_START;
6151 	/* Keep 0 here! */
6152 	params.buf_size = 0;
6153 	params.timeout = 0;
6154 	params.ssn = tap->txa_start & (IEEE80211_SEQ_RANGE-1);
6155 	params.tid = tap->txa_tid;
6156 	params.amsdu = false;
6157 
6158 	/* We get called from if_transmit all the way up unlocked in net80211. */
6159 	IEEE80211_UNLOCK_ASSERT(ic);
6160 	wiphy_lock(hw->wiphy);
6161 	error = lkpi_80211_mo_ampdu_action(hw, vif, &params);
6162 	wiphy_unlock(hw->wiphy);
6163 	if (error == IEEE80211_AMPDU_TX_START_IMMEDIATE) {
6164 		ic_printf(ic, "%s: mo_ampdu_action returned AMPDU_TX_START_IMMEDIATE. "
6165 		    "ni %p tap %p\n", __func__, ni, tap);
6166 	} else if (error != 0) {
6167 		ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p tap %p\n",
6168 		    __func__, error, ni, tap);
6169 		return (0);
6170 	}
6171 
6172 	if (sta->txq[tap->txa_tid] != NULL) {
6173 		struct lkpi_txq *ltxq;
6174 
6175 		ltxq = TXQ_TO_LTXQ(sta->txq[tap->txa_tid]);
6176 		TRACEOK("ADDBA REQ ltxq tid %u flags %b qlen %d", tap->txa_tid,
6177 		    ltxq->flags, LKPI_TXQ_FLAGS_BITS, skb_queue_len(&ltxq->skbq));
6178 		ltxq->flags |= LKPI_TXQ_STOPPED_BA;
6179 	}
6180 
6181 	return (lhw->ic_addba_request(ni, tap, dialogtoken, baparamset, batimeout));
6182 }
6183 
6184 /*
6185  * (*ic_addba_response)() is called from ht_recv_action_ba_addba_response()
6186  * and calls the default ieee80211_addba_response() which always returns 1.
6187  *
6188  * NB: No error checking in net80211!
6189  * Staying with 0 is an error.
6190  */
6191 static int
6192 lkpi_ic_addba_response(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap,
6193     int status, int baparamset, int batimeout)
6194 {
6195 	struct ieee80211com *ic;
6196 	struct lkpi_hw *lhw;
6197 	struct ieee80211_hw *hw;
6198 	struct ieee80211vap *vap;
6199 	struct lkpi_vif *lvif;
6200 	struct ieee80211_vif *vif;
6201 	struct lkpi_sta *lsta;
6202 	struct ieee80211_sta *sta;
6203 	struct ieee80211_ampdu_params params = { };
6204 	int error;
6205 
6206 	ic = ni->ni_ic;
6207 	lhw = ic->ic_softc;
6208 	hw = LHW_TO_HW(lhw);
6209 	vap = ni->ni_vap;
6210 	lvif = VAP_TO_LVIF(vap);
6211 	vif = LVIF_TO_VIF(lvif);
6212 	lsta = ni->ni_drv_data;
6213 	sta = LSTA_TO_STA(lsta);
6214 
6215 	TRACEOK("ADDBA RESP status %d (0 == SUCCESS) tid %u", status, tap->txa_tid);
6216 
6217 	if (!lsta->added_to_drv) {
6218 		ic_printf(ic, "%s: lsta %p ni %p, sta %p not added to firmware\n",
6219 		    __func__, lsta, ni, sta);
6220 		return (0);
6221 	}
6222 
6223 	if (status == IEEE80211_STATUS_SUCCESS) {
6224 		params.sta = sta;
6225 		params.action = IEEE80211_AMPDU_TX_OPERATIONAL;
6226 		params.buf_size = tap->txa_wnd;
6227 		params.timeout = 0;
6228 		params.ssn = 0;
6229 		params.tid = tap->txa_tid;
6230 		if ((tap->txa_flags & IEEE80211_AGGR_AMSDU) != 0)
6231 			params.amsdu = true;
6232 		else
6233 			params.amsdu = false;
6234 	} else {
6235 		/* We need to free the allocated resources. */
6236 		params.sta = sta;
6237 		switch (status) {
6238 			/* params.action = FLUSH, FLUSH_CONT */
6239 		default:
6240 			params.action = IEEE80211_AMPDU_TX_STOP_CONT;
6241 			break;
6242 		}
6243 		params.buf_size = 0;
6244 		params.timeout = 0;
6245 		params.ssn = 0;
6246 		params.tid = tap->txa_tid;
6247 		params.amsdu = false;
6248 	}
6249 
6250 	/* We are called all they way up from ieee80211_input* without lock. */
6251 	wiphy_lock(hw->wiphy);
6252 	error = lkpi_80211_mo_ampdu_action(hw, vif, &params);
6253 	wiphy_unlock(hw->wiphy);
6254 	if (error != 0) {
6255 		ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p tap %p\n",
6256 		    __func__, error, ni, tap);
6257 		return (0);
6258 	}
6259 
6260 	if (sta->txq[tap->txa_tid] != NULL) {
6261 		struct lkpi_txq *ltxq;
6262 
6263 		ltxq = TXQ_TO_LTXQ(sta->txq[tap->txa_tid]);
6264 		TRACEOK("ADDBA RESP ltxq tid %u flags %b qlen %d", tap->txa_tid,
6265 		    ltxq->flags, LKPI_TXQ_FLAGS_BITS, skb_queue_len(&ltxq->skbq));
6266 		ltxq->flags &= ~LKPI_TXQ_STOPPED_BA;
6267 
6268 		lkpi_80211_mo_wake_tx_queue(hw, sta->txq[tap->txa_tid], true);
6269 	}
6270 
6271 	IMPROVE_HT("who unleashes the TXQ? and when?, do we need to ni->ni_txseqs[tid] = tap->txa_start & 0xfff;");
6272 
6273 	return (lhw->ic_addba_response(ni, tap, status, baparamset, batimeout));
6274 }
6275 
6276 /*
6277  * (*ic_addba_stop)() is called from ampdu_tx_stop(), ht_recv_action_ba_delba(),
6278  * and ieee80211_ampdu_stop() and calls the default ieee80211_addba_stop().
6279  */
6280 static void
6281 lkpi_ic_addba_stop(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
6282 {
6283 	struct ieee80211com *ic;
6284 	struct lkpi_hw *lhw;
6285 	struct ieee80211_hw *hw;
6286 	struct ieee80211vap *vap;
6287 	struct lkpi_vif *lvif;
6288 	struct ieee80211_vif *vif;
6289 	struct lkpi_sta *lsta;
6290 	struct ieee80211_sta *sta;
6291 	struct ieee80211_ampdu_params params = { };
6292 	int error;
6293 
6294 	ic = ni->ni_ic;
6295 	lhw = ic->ic_softc;
6296 	hw = LHW_TO_HW(lhw);
6297 	vap = ni->ni_vap;
6298 	lvif = VAP_TO_LVIF(vap);
6299 	vif = LVIF_TO_VIF(lvif);
6300 	lsta = ni->ni_drv_data;
6301 	sta = LSTA_TO_STA(lsta);
6302 
6303 	if (!lsta->added_to_drv) {
6304 		ic_printf(ic, "%s: lsta %p ni %p, sta %p not added to firmware\n",
6305 		    __func__, lsta, ni, sta);
6306 		goto n80211;
6307 	}
6308 
6309 	/* We need to free the allocated resources. */
6310 	params.sta = sta;
6311 	IMPROVE("net80211 does not provide a reason to us");
6312 	params.action = IEEE80211_AMPDU_TX_STOP_CONT; /* params.action = FLUSH, FLUSH_CONT */
6313 	params.buf_size = 0;
6314 	params.timeout = 0;
6315 	params.ssn = 0;
6316 	params.tid = tap->txa_tid;
6317 	params.amsdu = false;
6318 
6319 	IEEE80211_UNLOCK(ic);
6320 	wiphy_lock(hw->wiphy);
6321 	error = lkpi_80211_mo_ampdu_action(hw, vif, &params);
6322 	wiphy_unlock(hw->wiphy);
6323 	IEEE80211_LOCK(ic);
6324 	if (error != 0) {
6325 		ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p tap %p\n",
6326 		    __func__, error, ni, tap);
6327 		goto n80211;
6328 	}
6329 
6330 	IMPROVE_HT("anyting else?");
6331 
6332 n80211:
6333 	lhw->ic_addba_stop(ni, tap);
6334 }
6335 
6336 static void
6337 lkpi_ic_addba_response_timeout(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
6338 {
6339 	struct ieee80211com *ic;
6340 	struct lkpi_hw *lhw;
6341 	struct lkpi_sta *lsta;
6342 	struct ieee80211_sta *sta;
6343 
6344 	ic = ni->ni_ic;
6345 	lhw = ic->ic_softc;
6346 	lsta = ni->ni_drv_data;
6347 	sta = LSTA_TO_STA(lsta);
6348 
6349 	TRACEOK("ADDBA RESP TIMEO tid %u", tap->txa_tid);
6350 
6351 	IMPROVE_HT();
6352 
6353 	if (!lsta->added_to_drv) {
6354 		ic_printf(ic, "%s: lsta %p ni %p, sta %p not added to firmware\n",
6355 		    __func__, lsta, ni, sta);
6356 		goto n80211;
6357 	}
6358 
6359 	/* We need to re-enable the txq and get packets out. */
6360 	if (sta->txq[tap->txa_tid] != NULL) {
6361 		struct lkpi_txq *ltxq;
6362 		struct ieee80211_hw *hw;
6363 
6364 		ltxq = TXQ_TO_LTXQ(sta->txq[tap->txa_tid]);
6365 		TRACEOK("ADDBA RESP TIMEO ltxq tid %u flags %b qlen %d",
6366 		    tap->txa_tid, ltxq->flags, LKPI_TXQ_FLAGS_BITS,
6367 		    skb_queue_len(&ltxq->skbq));
6368 		ltxq->flags &= ~LKPI_TXQ_STOPPED_BA;
6369 
6370 		hw = LHW_TO_HW(lhw);
6371 		lkpi_80211_mo_wake_tx_queue(hw, sta->txq[tap->txa_tid], true);
6372 	}
6373 
6374 n80211:
6375 	lhw->ic_addba_response_timeout(ni, tap);
6376 }
6377 
6378 static void
6379 lkpi_ic_bar_response(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap,
6380     int status)
6381 {
6382 	struct ieee80211com *ic;
6383 	struct lkpi_hw *lhw;
6384 
6385 	ic = ni->ni_ic;
6386 	lhw = ic->ic_softc;
6387 
6388 	IMPROVE_HT();
6389 
6390 	lhw->ic_bar_response(ni, tap, status);
6391 }
6392 
6393 static int
6394 lkpi_ic_ampdu_rx_start(struct ieee80211_node *ni, struct ieee80211_rx_ampdu *rap,
6395     int baparamset, int batimeout, int baseqctl)
6396 {
6397 	struct ieee80211com *ic;
6398 	struct lkpi_hw *lhw;
6399 	struct ieee80211_hw *hw;
6400 	struct ieee80211vap *vap;
6401 	struct lkpi_vif *lvif;
6402 	struct ieee80211_vif *vif;
6403 	struct lkpi_sta *lsta;
6404 	struct ieee80211_sta *sta;
6405 	struct ieee80211_ampdu_params params = { };
6406 	int error;
6407 
6408 	ic = ni->ni_ic;
6409 	lhw = ic->ic_softc;
6410 	hw = LHW_TO_HW(lhw);
6411 	vap = ni->ni_vap;
6412 	lvif = VAP_TO_LVIF(vap);
6413 	vif = LVIF_TO_VIF(lvif);
6414 	lsta = ni->ni_drv_data;
6415 	sta = LSTA_TO_STA(lsta);
6416 
6417 	IEEE80211_UNLOCK_ASSERT(ic);
6418 
6419 	if (!lsta->added_to_drv) {
6420 		ic_printf(ic, "%s: lsta %p ni %p vap %p, sta %p not added to firmware\n",
6421 		    __func__, lsta, ni, vap, sta);
6422 		return (-ENXIO);
6423 	}
6424 
6425 	if (lsta->state != IEEE80211_STA_AUTHORIZED) {
6426 		ic_printf(ic, "%s: lsta %p ni %p vap %p, sta %p state %d not AUTHORIZED\n",
6427 		    __func__, lsta, ni, vap, sta, lsta->state);
6428 		return (-ENXIO);
6429 	}
6430 
6431 	params.sta = sta;
6432 	params.action = IEEE80211_AMPDU_RX_START;
6433 	params.buf_size = _IEEE80211_MASKSHIFT(le16toh(baparamset), IEEE80211_BAPS_BUFSIZ);
6434 	if (params.buf_size == 0)
6435 		params.buf_size = IEEE80211_MAX_AMPDU_BUF_HT;
6436 	else
6437 		params.buf_size = min(params.buf_size, IEEE80211_MAX_AMPDU_BUF_HT);
6438 	if (hw->max_rx_aggregation_subframes > 0 &&
6439 	    params.buf_size > hw->max_rx_aggregation_subframes)
6440 		params.buf_size = hw->max_rx_aggregation_subframes;
6441 	params.timeout = le16toh(batimeout);
6442 	params.ssn = _IEEE80211_MASKSHIFT(le16toh(baseqctl), IEEE80211_BASEQ_START);
6443 	params.tid = _IEEE80211_MASKSHIFT(le16toh(baparamset), IEEE80211_BAPS_TID);
6444 
6445 	/* Based on net80211::ampdu_rx_start(). */
6446 	if ((vap->iv_htcaps & IEEE80211_HTC_RX_AMSDU_AMPDU) &&
6447 	    (_IEEE80211_MASKSHIFT(baparamset, IEEE80211_BAPS_AMSDU)))
6448 		params.amsdu = true;
6449 	else
6450 		params.amsdu = false;
6451 
6452 	wiphy_lock(hw->wiphy);
6453 	error = lkpi_80211_mo_ampdu_action(hw, vif, &params);
6454 	wiphy_unlock(hw->wiphy);
6455 	if (error != 0) {
6456 		ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p rap %p\n",
6457 		    __func__, error, ni, rap);
6458 		return (error);
6459 	}
6460 
6461 	if (!ieee80211_hw_check(hw, SUPPORTS_REORDERING_BUFFER)) {
6462 		IMPROVE("%s: TODO: SUPPORTS_REORDERING_BUFFER not set; check net80211\n", __func__);
6463 	}
6464 
6465 	IMPROVE_HT("net80211 is missing the error check on return and assumes success");
6466 
6467 	error = lhw->ic_ampdu_rx_start(ni, rap, baparamset, batimeout, baseqctl);
6468 	return (error);
6469 }
6470 
6471 static void
6472 lkpi_ic_ampdu_rx_stop(struct ieee80211_node *ni, struct ieee80211_rx_ampdu *rap)
6473 {
6474 	struct ieee80211com *ic;
6475 	struct lkpi_hw *lhw;
6476 	struct ieee80211_hw *hw;
6477 	struct ieee80211vap *vap;
6478 	struct lkpi_vif *lvif;
6479 	struct ieee80211_vif *vif;
6480 	struct lkpi_sta *lsta;
6481 	struct ieee80211_sta *sta;
6482 	struct ieee80211_ampdu_params params = { };
6483 	int error;
6484 	uint8_t tid;
6485 	bool ic_locked;
6486 
6487 	ic = ni->ni_ic;
6488 	lhw = ic->ic_softc;
6489 
6490 	/*
6491 	 * We should not (cannot) call into mac80211 ops with AMPDU_RX_STOP if
6492 	 * we did not START.  Some drivers pass it down to firmware which will
6493 	 * simply barf and net80211 calls ieee80211_ht_node_cleanup() from
6494 	 * ieee80211_ht_node_init() amongst others which will iterate over all
6495 	 * tid and call ic_ampdu_rx_stop() unconditionally.
6496 	 * XXX net80211 should probably be more "gentle" in these cases and
6497 	 * track some state itself.
6498 	 */
6499 	if ((rap->rxa_flags & IEEE80211_AGGR_RUNNING) == 0)
6500 		goto net80211_only;
6501 
6502 	hw = LHW_TO_HW(lhw);
6503 	vap = ni->ni_vap;
6504 	lvif = VAP_TO_LVIF(vap);
6505 	vif = LVIF_TO_VIF(lvif);
6506 	lsta = ni->ni_drv_data;
6507 	if (lsta == NULL) {
6508 		ic_printf(ic, "%s: lsta %p ni %p vap %p, lsta is NULL\n",
6509 		    __func__, lsta, ni, vap);
6510 		goto net80211_only;
6511 	}
6512 	sta = LSTA_TO_STA(lsta);
6513 
6514 	if (!lsta->added_to_drv) {
6515 		ic_printf(ic, "%s: lsta %p ni %p vap %p, sta %p not added to firmware\n",
6516 		    __func__, lsta, ni, vap, sta);
6517 		goto net80211_only;
6518 	}
6519 
6520 	if (lsta->state != IEEE80211_STA_AUTHORIZED) {
6521 		ic_printf(ic, "%s: lsta %p ni %p vap %p, sta %p state %d not AUTHORIZED\n",
6522 		    __func__, lsta, ni, vap, sta, lsta->state);
6523 		goto net80211_only;
6524 	}
6525 
6526 	IMPROVE_HT("This really should be passed from ht_recv_action_ba_delba.");
6527 	for (tid = 0; tid < WME_NUM_TID; tid++) {
6528 		if (&ni->ni_rx_ampdu[tid] == rap)
6529 			break;
6530 	}
6531 	if (tid == WME_NUM_TID) {
6532 		ic_printf(ic, "%s: lsta %p ni %p vap %p, sta %p TID not found\n",
6533 		    __func__, lsta, ni, vap, sta);
6534 		goto net80211_only;
6535 	}
6536 
6537 	params.sta = sta;
6538 	params.action = IEEE80211_AMPDU_RX_STOP;
6539 	params.buf_size = 0;
6540 	params.timeout = 0;
6541 	params.ssn = 0;
6542 	params.tid = tid;
6543 	params.amsdu = false;
6544 
6545 	ic_locked = IEEE80211_IS_LOCKED(ic);
6546 	if (ic_locked)
6547 		IEEE80211_UNLOCK(ic);
6548 	wiphy_lock(hw->wiphy);
6549 	error = lkpi_80211_mo_ampdu_action(hw, vif, &params);
6550 	wiphy_unlock(hw->wiphy);
6551 	if (ic_locked)
6552 		IEEE80211_LOCK(ic);
6553 	if (error != 0)
6554 		ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p rap %p\n",
6555 		    __func__, error, ni, rap);
6556 
6557 net80211_only:
6558 	lhw->ic_ampdu_rx_stop(ni, rap);
6559 }
6560 #endif
6561 
6562 int
6563 linuxkpi_ieee80211_start_tx_ba_session(struct ieee80211_sta *sta, uint8_t tid,
6564     int timeout)
6565 {
6566 	struct lkpi_sta *lsta;
6567 	struct ieee80211_hw *hw;
6568 	struct lkpi_hw *lhw;
6569 	struct ieee80211_tx_ampdu *tap;
6570 	int worked;
6571 
6572 	lsta = STA_TO_LSTA(sta);
6573 
6574 	/* If tid is out of range, fail gracefully. */
6575 	/* XXX-BZ are we limited to 8? */
6576 	if (tid >= IEEE80211_NUM_TIDS) {
6577 		net80211_vap_printf(lsta->ni->ni_vap, "%s: tid %u out of range "
6578 		    ">= %u\n", __func__, tid, IEEE80211_NUM_TIDS);
6579 		return (-EINVAL);
6580 	}
6581 
6582 	hw = lsta->hw;
6583 	lhw = HW_TO_LHW(hw);
6584 
6585 	/* No ampdu_action support, just error. */
6586 	if (lhw->ops->ampdu_action == NULL) {
6587 		net80211_vap_printf(lsta->ni->ni_vap, "%s: (*ampdu_action) "
6588 		    "not supported\n", __func__);
6589 		return (-ENOTSUPP);
6590 	}
6591 
6592 	/* Does HW allow us to set this up? */
6593 	if (!ieee80211_hw_check(hw, AMPDU_AGGREGATION)) {
6594 		net80211_vap_printf(lsta->ni->ni_vap, "%s: !AMPDU_AGGREGATION\n",
6595 		    __func__);
6596 		return (-ENOTSUPP);
6597 	}
6598 	if (ieee80211_hw_check(hw, TX_AMPDU_SETUP_IN_HW)) {
6599 		net80211_vap_printf(lsta->ni->ni_vap, "%s: TX_AMPDU_SETUP_IN_HW\n",
6600 		    __func__);
6601 		return (-EPERM);
6602 	}
6603 
6604 	/* We need at least HT or higher support enabled. */
6605 	if (!sta->deflink.ht_cap.ht_supported &&
6606 	    !sta->deflink.vht_cap.vht_supported &&
6607 	    !sta->deflink.he_cap.has_he &&
6608 	    !sta->deflink.eht_cap.has_eht) {
6609 		net80211_vap_printf(lsta->ni->ni_vap, "%s: HT or later not "
6610 		    "supported\n", __func__);
6611 		return (-ENOTSUPP);
6612 	}
6613 
6614 #ifdef __notyet__
6615 	/*
6616 	 * We need some rate limiting/disabling in case we try too hard and
6617 	 * get NACKed over and over.
6618 	 * XXX-BZ This check should likely go to addba_req along with a counter.
6619 	 */
6620 	if (lsta->block_ba)
6621 		return (-EACCESS);
6622 #endif
6623 
6624 	/* XXX-BZ locking? */
6625 
6626 	/* Do we have a running session already? */
6627 	tap = &lsta->ni->ni_tx_ampdu[tid];
6628 	if (IEEE80211_AMPDU_REQUESTED(tap)) {
6629 		net80211_vap_printf(lsta->ni->ni_vap, "%s: "
6630 		    "AMPDU requested/running\n", __func__);
6631 		return (-EINPROGRESS);
6632 	}
6633 
6634 	/* Tell net80211 to setup an aggr sessions. */
6635 	/* XXX-BZ we have no way to carry the timeout forward easily. */
6636 	worked = ieee80211_ampdu_tx_request_ext(lsta->ni, tid);
6637 	TRACEOK("ieee80211_ampdu_tx_request_ext %d", worked);
6638 
6639 	if (worked != 1) {
6640 		net80211_vap_printf(lsta->ni->ni_vap, "%s: "
6641 		    "ieee80211_ampdu_tx_request_ext returned %d != 1\n",
6642 		    __func__, worked);
6643 		return (-EINVAL);
6644 	}
6645 
6646 	/*
6647 	 * How do we make sure the EAPOL handshake has completed?
6648 	 * Let ieee80211_output do it.
6649 	 */
6650 	if (1) {
6651 		/* Immediately trigger the setup and output of the action frame. */
6652 		worked = ieee80211_ampdu_request(lsta->ni, tap);
6653 		if (worked != 1) {
6654 			net80211_vap_printf(lsta->ni->ni_vap, "%s: "
6655 			    "ieee80211_ampdu_request returned %d != 1\n",
6656 			    __func__, worked);
6657 			return (-EAGAIN);
6658 		}
6659 	}
6660 
6661 	return (0);
6662 }
6663 
6664 static void
6665 lkpi_ic_getradiocaps_ht(struct ieee80211com *ic, struct ieee80211_hw *hw,
6666     uint8_t *bands, int *chan_flags, enum nl80211_band band)
6667 {
6668 #ifdef LKPI_80211_HT
6669 	struct ieee80211_sta_ht_cap *ht_cap;
6670 
6671 	ht_cap = &hw->wiphy->bands[band]->ht_cap;
6672 	if (!ht_cap->ht_supported)
6673 		return;
6674 
6675 	switch (band) {
6676 	case NL80211_BAND_2GHZ:
6677 		setbit(bands, IEEE80211_MODE_11NG);
6678 		break;
6679 	case NL80211_BAND_5GHZ:
6680 		setbit(bands, IEEE80211_MODE_11NA);
6681 		break;
6682 	default:
6683 		IMPROVE("Unsupported band %d", band);
6684 		return;
6685 	}
6686 
6687 	ic->ic_htcaps = IEEE80211_HTC_HT;	/* HT operation */
6688 
6689 	/*
6690 	 * Rather than manually checking each flag and
6691 	 * translating IEEE80211_HT_CAP_ to IEEE80211_HTCAP_,
6692 	 * simply copy the 16bits.
6693 	 */
6694 	ic->ic_htcaps |= ht_cap->cap;
6695 
6696 	/* Then deal with the other flags. */
6697 	if (ieee80211_hw_check(hw, AMPDU_AGGREGATION))
6698 		ic->ic_htcaps |= IEEE80211_HTC_AMPDU;
6699 #ifdef __notyet__
6700 	if (ieee80211_hw_check(hw, TX_AMSDU))
6701 		ic->ic_htcaps |= IEEE80211_HTC_AMSDU;
6702 	if (ieee80211_hw_check(hw, SUPPORTS_AMSDU_IN_AMPDU))
6703 		ic->ic_htcaps |= (IEEE80211_HTC_RX_AMSDU_AMPDU |
6704 		    IEEE80211_HTC_TX_AMSDU_AMPDU);
6705 #endif
6706 
6707 	IMPROVE("PS, ampdu_*, ht_cap.mcs.tx_params, ...");
6708 
6709 	/* Only add HT40 channels if supported. */
6710 	if ((ic->ic_htcaps & IEEE80211_HTCAP_CHWIDTH40) != 0 &&
6711 	    chan_flags != NULL)
6712 		*chan_flags |= NET80211_CBW_FLAG_HT40;
6713 #endif
6714 }
6715 
6716 static void
6717 lkpi_ic_getradiocaps(struct ieee80211com *ic, int maxchan,
6718     int *n, struct ieee80211_channel *c)
6719 {
6720 	struct lkpi_hw *lhw;
6721 	struct ieee80211_hw *hw;
6722 	struct linuxkpi_ieee80211_channel *channels;
6723 	uint8_t bands[IEEE80211_MODE_BYTES];
6724 	int chan_flags, error, i, nchans;
6725 
6726 	/* Channels */
6727 	lhw = ic->ic_softc;
6728 	hw = LHW_TO_HW(lhw);
6729 
6730 	/* NL80211_BAND_2GHZ */
6731 	nchans = 0;
6732 	if (hw->wiphy->bands[NL80211_BAND_2GHZ] != NULL)
6733 		nchans = hw->wiphy->bands[NL80211_BAND_2GHZ]->n_channels;
6734 	if (nchans > 0) {
6735 		memset(bands, 0, sizeof(bands));
6736 		chan_flags = 0;
6737 		setbit(bands, IEEE80211_MODE_11B);
6738 		/* XXX-BZ unclear how to check for 11g. */
6739 
6740 		IMPROVE("the bitrates may have flags?");
6741 		setbit(bands, IEEE80211_MODE_11G);
6742 
6743 		lkpi_ic_getradiocaps_ht(ic, hw, bands, &chan_flags,
6744 		    NL80211_BAND_2GHZ);
6745 
6746 		channels = hw->wiphy->bands[NL80211_BAND_2GHZ]->channels;
6747 		for (i = 0; i < nchans && *n < maxchan; i++) {
6748 			uint32_t nflags = 0;
6749 			int cflags = chan_flags;
6750 
6751 			if (channels[i].flags & IEEE80211_CHAN_DISABLED) {
6752 				ic_printf(ic, "%s: Skipping disabled chan "
6753 				    "[%u/%u/%#x]\n", __func__,
6754 				    channels[i].hw_value,
6755 				    channels[i].center_freq, channels[i].flags);
6756 				continue;
6757 			}
6758 			if (channels[i].flags & IEEE80211_CHAN_NO_IR)
6759 				nflags |= (IEEE80211_CHAN_NOADHOC|IEEE80211_CHAN_PASSIVE);
6760 			if (channels[i].flags & IEEE80211_CHAN_RADAR)
6761 				nflags |= IEEE80211_CHAN_DFS;
6762 			if (channels[i].flags & IEEE80211_CHAN_NO_160MHZ)
6763 				cflags &= ~(NET80211_CBW_FLAG_VHT160|NET80211_CBW_FLAG_VHT80P80);
6764 			if (channels[i].flags & IEEE80211_CHAN_NO_80MHZ)
6765 				cflags &= ~NET80211_CBW_FLAG_VHT80;
6766 			/* XXX how to map the remaining enum ieee80211_channel_flags? */
6767 			if (channels[i].flags & IEEE80211_CHAN_NO_HT40)
6768 				cflags &= ~NET80211_CBW_FLAG_HT40;
6769 
6770 			error = ieee80211_add_channel_cbw(c, maxchan, n,
6771 			    ieee80211_mhz2ieee(channels[i].center_freq,
6772 				lkpi_nl80211_band_to_net80211_band(channels[i].band)),
6773 			    channels[i].center_freq, channels[i].max_power,
6774 			    nflags, bands, cflags);
6775 			/* net80211::ENOBUFS: *n >= maxchans */
6776 			if (error != 0 && error != ENOBUFS)
6777 				ic_printf(ic, "%s: Adding chan %u/%u/%#x/%#x/%#x/%#x "
6778 				    "returned error %d\n",
6779 				    __func__, channels[i].hw_value,
6780 				    channels[i].center_freq, channels[i].flags,
6781 				    nflags, chan_flags, cflags, error);
6782 			if (error != 0)
6783 				break;
6784 		}
6785 	}
6786 
6787 	/* NL80211_BAND_5GHZ */
6788 	nchans = 0;
6789 	if (hw->wiphy->bands[NL80211_BAND_5GHZ] != NULL)
6790 		nchans = hw->wiphy->bands[NL80211_BAND_5GHZ]->n_channels;
6791 	if (nchans > 0) {
6792 		memset(bands, 0, sizeof(bands));
6793 		chan_flags = 0;
6794 		setbit(bands, IEEE80211_MODE_11A);
6795 
6796 		lkpi_ic_getradiocaps_ht(ic, hw, bands, &chan_flags,
6797 		    NL80211_BAND_5GHZ);
6798 
6799 #ifdef LKPI_80211_VHT
6800 		if (hw->wiphy->bands[NL80211_BAND_5GHZ]->vht_cap.vht_supported) {
6801 
6802 			ic->ic_flags_ext |= IEEE80211_FEXT_VHT;
6803 			ic->ic_vht_cap.vht_cap_info =
6804 			    hw->wiphy->bands[NL80211_BAND_5GHZ]->vht_cap.cap;
6805 			ic->ic_vht_cap.supp_mcs =
6806 			    hw->wiphy->bands[NL80211_BAND_5GHZ]->vht_cap.vht_mcs;
6807 
6808 			setbit(bands, IEEE80211_MODE_VHT_5GHZ);
6809 			chan_flags |= NET80211_CBW_FLAG_VHT80;
6810 			if (IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_IS_160MHZ(
6811 			    ic->ic_vht_cap.vht_cap_info))
6812 				chan_flags |= NET80211_CBW_FLAG_VHT160;
6813 			if (IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_IS_160_80P80MHZ(
6814 			    ic->ic_vht_cap.vht_cap_info))
6815 				chan_flags |= NET80211_CBW_FLAG_VHT80P80;
6816 		}
6817 #endif
6818 
6819 		channels = hw->wiphy->bands[NL80211_BAND_5GHZ]->channels;
6820 		for (i = 0; i < nchans && *n < maxchan; i++) {
6821 			uint32_t nflags = 0;
6822 			int cflags = chan_flags;
6823 
6824 			if (channels[i].flags & IEEE80211_CHAN_DISABLED) {
6825 				ic_printf(ic, "%s: Skipping disabled chan "
6826 				    "[%u/%u/%#x]\n", __func__,
6827 				    channels[i].hw_value,
6828 				    channels[i].center_freq, channels[i].flags);
6829 				continue;
6830 			}
6831 			if (channels[i].flags & IEEE80211_CHAN_NO_IR)
6832 				nflags |= (IEEE80211_CHAN_NOADHOC|IEEE80211_CHAN_PASSIVE);
6833 			if (channels[i].flags & IEEE80211_CHAN_RADAR)
6834 				nflags |= IEEE80211_CHAN_DFS;
6835 			if (channels[i].flags & IEEE80211_CHAN_NO_160MHZ)
6836 				cflags &= ~(NET80211_CBW_FLAG_VHT160|NET80211_CBW_FLAG_VHT80P80);
6837 			if (channels[i].flags & IEEE80211_CHAN_NO_80MHZ)
6838 				cflags &= ~NET80211_CBW_FLAG_VHT80;
6839 			/* XXX hwo to map the remaining enum ieee80211_channel_flags? */
6840 			if (channels[i].flags & IEEE80211_CHAN_NO_HT40)
6841 				cflags &= ~NET80211_CBW_FLAG_HT40;
6842 
6843 			error = ieee80211_add_channel_cbw(c, maxchan, n,
6844 			    ieee80211_mhz2ieee(channels[i].center_freq,
6845 				lkpi_nl80211_band_to_net80211_band(channels[i].band)),
6846 			    channels[i].center_freq, channels[i].max_power,
6847 			    nflags, bands, cflags);
6848 			/* net80211::ENOBUFS: *n >= maxchans */
6849 			if (error != 0 && error != ENOBUFS)
6850 				ic_printf(ic, "%s: Adding chan %u/%u/%#x/%#x/%#x/%#x "
6851 				    "returned error %d\n",
6852 				    __func__, channels[i].hw_value,
6853 				    channels[i].center_freq, channels[i].flags,
6854 				    nflags, chan_flags, cflags, error);
6855 			if (error != 0)
6856 				break;
6857 		}
6858 	}
6859 }
6860 
6861 static void *
6862 lkpi_ieee80211_ifalloc(void)
6863 {
6864 	struct ieee80211com *ic;
6865 
6866 	ic = malloc(sizeof(*ic), M_LKPI80211, M_WAITOK | M_ZERO);
6867 
6868 	/* Setting these happens later when we have device information. */
6869 	ic->ic_softc = NULL;
6870 	ic->ic_name = "linuxkpi";
6871 
6872 	return (ic);
6873 }
6874 
6875 struct ieee80211_hw *
6876 linuxkpi_ieee80211_alloc_hw(size_t priv_len, const struct ieee80211_ops *ops)
6877 {
6878 	struct ieee80211_hw *hw;
6879 	struct lkpi_hw *lhw;
6880 	struct wiphy *wiphy;
6881 	int ac;
6882 	bool emuchanctx;
6883 
6884 	/*
6885 	 * Do certain checks before starting to allocate resources.
6886 	 * Store results in temporary variables.
6887 	 */
6888 
6889 	/* ac1d519c01ca introduced emulating chanctx changes. */
6890 	emuchanctx = false;
6891 	if (ops->add_chanctx == ieee80211_emulate_add_chanctx &&
6892 	    ops->change_chanctx == ieee80211_emulate_change_chanctx &&
6893 	    ops->remove_chanctx == ieee80211_emulate_remove_chanctx) {
6894 		/*
6895 		 * If we emulate the chanctx ops, we must not have
6896 		 * assign_vif_chanctx and unassign_vif_chanctx.
6897 		 */
6898 		if (ops->assign_vif_chanctx != NULL ||
6899 		    ops->unassign_vif_chanctx != NULL) {
6900 			/* Fail gracefully. */
6901 			printf("%s: emulate_chanctx but "
6902 			    "assign_vif_chanctx %p != NULL || "
6903 			    "unassign_vif_chanctx %p != NULL\n", __func__,
6904 			    ops->assign_vif_chanctx, ops->unassign_vif_chanctx);
6905 			return (NULL);
6906 		}
6907 		emuchanctx = true;
6908 	}
6909 	if (!emuchanctx && (ops->add_chanctx == ieee80211_emulate_add_chanctx ||
6910 	    ops->change_chanctx == ieee80211_emulate_change_chanctx ||
6911 	    ops->remove_chanctx == ieee80211_emulate_remove_chanctx)) {
6912 		printf("%s: not emulating chanctx changes but emulating "
6913 		    "function set: %d/%d/%d\n", __func__,
6914 		    ops->add_chanctx == ieee80211_emulate_add_chanctx,
6915 		    ops->change_chanctx == ieee80211_emulate_change_chanctx,
6916 		    ops->remove_chanctx == ieee80211_emulate_remove_chanctx);
6917 		return (NULL);
6918 	}
6919 	if (!emuchanctx && (ops->add_chanctx == NULL || ops->change_chanctx == NULL ||
6920 	    ops->remove_chanctx == NULL || ops->assign_vif_chanctx == NULL ||
6921 	    ops->unassign_vif_chanctx == NULL)) {
6922 		printf("%s: not all functions set for chanctx operations "
6923 		    "(emulating chanctx %d): %p/%p/%p %p/%p\n",
6924 		    __func__, emuchanctx,
6925 		    ops->add_chanctx, ops->change_chanctx, ops->remove_chanctx,
6926 		    ops->assign_vif_chanctx, ops->unassign_vif_chanctx);
6927 		return (NULL);
6928 	}
6929 
6930 	/* Get us and the driver data also allocated. */
6931 	wiphy = wiphy_new(&linuxkpi_mac80211cfgops, sizeof(*lhw) + priv_len);
6932 	if (wiphy == NULL)
6933 		return (NULL);
6934 
6935 	lhw = wiphy_priv(wiphy);
6936 	lhw->ops = ops;
6937 
6938 	LKPI_80211_LHW_SCAN_LOCK_INIT(lhw);
6939 	LKPI_80211_LHW_TXQ_LOCK_INIT(lhw);
6940 	spin_lock_init(&lhw->txq_lock);
6941 	sx_init_flags(&lhw->lvif_sx, "lhw-lvif", SX_RECURSE | SX_DUPOK);
6942 	LKPI_80211_LHW_MC_LOCK_INIT(lhw);
6943 	TAILQ_INIT(&lhw->lvif_head);
6944 	__hw_addr_init(&lhw->mc_list);
6945 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
6946 		spin_lock_init(&lhw->txq_scheduled_lock[ac]);
6947 		lhw->txq_generation[ac] = 1;
6948 		TAILQ_INIT(&lhw->txq_scheduled[ac]);
6949 	}
6950 
6951 	/* Chanctx_conf */
6952 	INIT_LIST_HEAD(&lhw->lchanctx_list);
6953 	INIT_LIST_HEAD(&lhw->lchanctx_list_reserved);
6954 	lhw->emulate_chanctx = emuchanctx;
6955 
6956 	/* Deferred RX path. */
6957 	LKPI_80211_LHW_RXQ_LOCK_INIT(lhw);
6958 	TASK_INIT(&lhw->rxq_task, 0, lkpi_80211_lhw_rxq_task, lhw);
6959 	mbufq_init(&lhw->rxq, 32 * NAPI_POLL_WEIGHT);
6960 	lhw->rxq_stopped = false;
6961 
6962 	/*
6963 	 * XXX-BZ TODO make sure there is a "_null" function to all ops
6964 	 * not initialized.
6965 	 */
6966 	hw = LHW_TO_HW(lhw);
6967 	hw->wiphy = wiphy;
6968 	hw->conf.flags |= IEEE80211_CONF_IDLE;
6969 	hw->priv = (void *)(lhw + 1);
6970 
6971 	/* BSD Specific. */
6972 	lhw->ic = lkpi_ieee80211_ifalloc();
6973 
6974 	if (lhw->emulate_chanctx)
6975 		ic_printf(lhw->ic, "Using chanctx emulation.\n");
6976 	IMPROVE();
6977 
6978 	return (hw);
6979 }
6980 
6981 void
6982 linuxkpi_ieee80211_iffree(struct ieee80211_hw *hw)
6983 {
6984 	struct lkpi_hw *lhw;
6985 	struct mbuf *m;
6986 	int ac;
6987 
6988 	lhw = HW_TO_LHW(hw);
6989 	free(lhw->ic, M_LKPI80211);
6990 	lhw->ic = NULL;
6991 
6992 	/*
6993 	 * Drain the deferred RX path.
6994 	 */
6995 	LKPI_80211_LHW_RXQ_LOCK(lhw);
6996 	lhw->rxq_stopped = true;
6997 	LKPI_80211_LHW_RXQ_UNLOCK(lhw);
6998 
6999 	/* Drain taskq, won't be restarted due to rxq_stopped being set. */
7000 	while (taskqueue_cancel(taskqueue_thread, &lhw->rxq_task, NULL) != 0)
7001 		taskqueue_drain(taskqueue_thread, &lhw->rxq_task);
7002 
7003 	/* Flush mbufq (make sure to release ni refs!). */
7004 	m = mbufq_dequeue(&lhw->rxq);
7005 	while (m != NULL) {
7006 #ifdef LKPI_80211_USE_MTAG
7007 		struct m_tag *mtag;
7008 
7009 		mtag = m_tag_locate(m, MTAG_ABI_LKPI80211, LKPI80211_TAG_RXNI, NULL);
7010 		if (mtag != NULL) {
7011 			struct lkpi_80211_tag_rxni *rxni;
7012 
7013 			rxni = (struct lkpi_80211_tag_rxni *)(mtag + 1);
7014 			ieee80211_free_node(rxni->ni);
7015 		}
7016 #else
7017 		if (m->m_pkthdr.PH_loc.ptr != NULL) {
7018 			struct ieee80211_node *ni;
7019 
7020 			ni = m->m_pkthdr.PH_loc.ptr;
7021 			ieee80211_free_node(ni);
7022 		}
7023 #endif
7024 		m_freem(m);
7025 		m = mbufq_dequeue(&lhw->rxq);
7026 	}
7027 	KASSERT(mbufq_empty(&lhw->rxq), ("%s: lhw %p has rxq len %d != 0\n",
7028 	    __func__, lhw, mbufq_len(&lhw->rxq)));
7029 	LKPI_80211_LHW_RXQ_LOCK_DESTROY(lhw);
7030 
7031 	wiphy_lock(hw->wiphy);
7032 	/* Chanctx_conf. */
7033 	if (!list_empty_careful(&lhw->lchanctx_list)) {
7034 		struct lkpi_chanctx *lchanctx, *next;
7035 		struct ieee80211_chanctx_conf *chanctx_conf;
7036 
7037 		list_for_each_entry_safe(lchanctx, next, &lhw->lchanctx_list, entry) {
7038 			if (lchanctx->added_to_drv) {
7039 				/* In reality we should panic? */
7040 				chanctx_conf = &lchanctx->chanctx_conf;
7041 				lkpi_80211_mo_remove_chanctx(hw, chanctx_conf);
7042 			}
7043 			list_del(&lchanctx->entry);
7044 			/* No need to reset the lchanctx here as we will free it below. */
7045 			list_add_rcu(&lchanctx->entry, &lhw->lchanctx_list_reserved);
7046 		}
7047 	}
7048 	if (!list_empty_careful(&lhw->lchanctx_list_reserved)) {
7049 		struct lkpi_chanctx *lchanctx, *next;
7050 
7051 		list_for_each_entry_safe(lchanctx, next, &lhw->lchanctx_list_reserved, entry) {
7052 			list_del(&lchanctx->entry);
7053 			if (lchanctx->added_to_drv)
7054 				panic("%s: lchanctx %p on reserved list still added_to_drv\n",
7055 				    __func__, lchanctx);
7056 			free(lchanctx, M_LKPI80211);
7057 		}
7058 	}
7059 	wiphy_unlock(hw->wiphy);
7060 
7061 	LKPI_80211_LHW_MC_LOCK(lhw);
7062 	lkpi_cleanup_mcast_list_locked(lhw);
7063 	LKPI_80211_LHW_MC_UNLOCK(lhw);
7064 
7065 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
7066 		spin_lock_destroy(&lhw->txq_scheduled_lock[ac]);
7067 
7068 	/* Cleanup more of lhw here or in wiphy_free()? */
7069 	spin_lock_destroy(&lhw->txq_lock);
7070 	LKPI_80211_LHW_TXQ_LOCK_DESTROY(lhw);
7071 	LKPI_80211_LHW_SCAN_LOCK_DESTROY(lhw);
7072 	sx_destroy(&lhw->lvif_sx);
7073 	LKPI_80211_LHW_MC_LOCK_DESTROY(lhw)
7074 	IMPROVE();
7075 }
7076 
7077 void
7078 linuxkpi_set_ieee80211_dev(struct ieee80211_hw *hw)
7079 {
7080 	struct lkpi_hw *lhw;
7081 	struct ieee80211com *ic;
7082 	struct device *dev;
7083 
7084 	lhw = HW_TO_LHW(hw);
7085 	ic = lhw->ic;
7086 
7087 	/* Save the backpointer from net80211 to LinuxKPI. */
7088 	ic->ic_softc = lhw;
7089 
7090 	/*
7091 	 * Set a proper name before ieee80211_ifattach() if dev is set.
7092 	 * ath1xk also unset the dev so we need to check.
7093 	 * Also we will (ab)use this opportunity to register the
7094 	 * power management sub-children if thay exist (for suspend/resume).
7095 	 */
7096 	dev = wiphy_dev(hw->wiphy);
7097 	if (dev != NULL) {
7098 		ic->ic_name = dev_name(dev);
7099 		if (dev->bsddev != NULL) {
7100 			bus_identify_children(dev->bsddev);
7101 			bus_enumerate_hinted_children(dev->bsddev);
7102 			bus_topo_lock();
7103 			bus_attach_children(dev->bsddev);
7104 			bus_topo_unlock();
7105 		}
7106 	} else {
7107 		TODO("adjust arguments to still have the old dev or go through "
7108 		    "the hoops of getting the bsddev from hw and detach; "
7109 		    "or do in XXX; check ath1kx drivers");
7110 	}
7111 
7112 	/* XXX-BZ do we also need to set wiphy name? */
7113 }
7114 
7115 struct ieee80211_hw *
7116 linuxkpi_wiphy_to_ieee80211_hw(struct wiphy *wiphy)
7117 {
7118 	struct lkpi_hw *lhw;
7119 
7120 	lhw = wiphy_priv(wiphy);
7121 	return (LHW_TO_HW(lhw));
7122 }
7123 
7124 static void
7125 lkpi_radiotap_attach(struct lkpi_hw *lhw)
7126 {
7127 	struct ieee80211com *ic;
7128 
7129 	ic = lhw->ic;
7130 	ieee80211_radiotap_attach(ic,
7131 	    &lhw->rtap_tx.wt_ihdr, sizeof(lhw->rtap_tx),
7132 	    LKPI_RTAP_TX_FLAGS_PRESENT,
7133 	    &lhw->rtap_rx.wr_ihdr, sizeof(lhw->rtap_rx),
7134 	    LKPI_RTAP_RX_FLAGS_PRESENT);
7135 }
7136 
7137 int
7138 linuxkpi_ieee80211_ifattach(struct ieee80211_hw *hw)
7139 {
7140 	struct ieee80211com *ic;
7141 	struct lkpi_hw *lhw;
7142 	int band, i;
7143 
7144 	lhw = HW_TO_LHW(hw);
7145 	ic = lhw->ic;
7146 
7147 	/* We do it this late as wiphy->dev should be set for the name. */
7148 	lhw->workq = alloc_ordered_workqueue(wiphy_name(hw->wiphy), 0);
7149 	if (lhw->workq == NULL)
7150 		return (-EAGAIN);
7151 
7152 	/* XXX-BZ figure this out how they count his... */
7153 	if (!is_zero_ether_addr(hw->wiphy->perm_addr)) {
7154 		IEEE80211_ADDR_COPY(ic->ic_macaddr,
7155 		    hw->wiphy->perm_addr);
7156 	} else if (hw->wiphy->n_addresses > 0) {
7157 		/* We take the first one. */
7158 		IEEE80211_ADDR_COPY(ic->ic_macaddr,
7159 		    hw->wiphy->addresses[0].addr);
7160 	} else {
7161 		ic_printf(ic, "%s: warning, no hardware address!\n", __func__);
7162 	}
7163 
7164 #ifdef __not_yet__
7165 	/* See comment in lkpi_80211_txq_tx_one(). */
7166 	ic->ic_headroom = hw->extra_tx_headroom;
7167 #endif
7168 
7169 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
7170 	ic->ic_opmode = IEEE80211_M_STA;
7171 
7172 	/* Set device capabilities. */
7173 	/* XXX-BZ we need to get these from linux80211/drivers and convert. */
7174 	ic->ic_caps =
7175 	    IEEE80211_C_STA |
7176 	    IEEE80211_C_MONITOR |
7177 	    IEEE80211_C_WPA |		/* WPA/RSN */
7178 #ifdef LKPI_80211_WME
7179 	    IEEE80211_C_WME |
7180 #endif
7181 #if 0
7182 	    IEEE80211_C_PMGT |
7183 #endif
7184 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
7185 	    IEEE80211_C_SHPREAMBLE	/* short preamble supported */
7186 	    ;
7187 
7188 #ifdef LKPI_80211_BGSCAN
7189 	if (lhw->ops->hw_scan)
7190 		ic->ic_caps |= IEEE80211_C_BGSCAN;
7191 #endif
7192 
7193 	lkpi_enable_hw_scan(lhw);
7194 
7195 	/* Does the driver/firmware handle rate countrol? */
7196 	/* Currently only older iwlwifi mvm devices are in this category. */
7197 	if (bootverbose && !ieee80211_hw_check(hw, HAS_RATE_CONTROL))
7198 		ic_printf(ic, "NOTE: rate control not supported by LinuxKPI; "
7199 		    "expect low rates only\n");
7200 
7201 	/* Does HW support Fragmentation offload? */
7202 	if (ieee80211_hw_check(hw, SUPPORTS_TX_FRAG))
7203 		ic->ic_flags_ext |= IEEE80211_FEXT_FRAG_OFFLOAD;
7204 
7205 	/* Does HW support full AMPDU[-TX] offload? */
7206 	if (ieee80211_hw_check(hw, AMPDU_AGGREGATION))
7207 		ic->ic_flags_ext |= IEEE80211_FEXT_AMPDU_OFFLOAD;
7208 #ifdef __notyet__
7209 	if (ieee80211_hw_check(hw, TX_AMSDU))
7210 	if (ieee80211_hw_check(hw, SUPPORTS_AMSDU_IN_AMPDU))
7211 #endif
7212 
7213 	/*
7214 	 * The wiphy variables report bitmasks of avail antennas.
7215 	 * (*get_antenna) get the current bitmask sets which can be
7216 	 * altered by (*set_antenna) for some drivers.
7217 	 * XXX-BZ will the count alone do us much good long-term in net80211?
7218 	 */
7219 	if (hw->wiphy->available_antennas_rx ||
7220 	    hw->wiphy->available_antennas_tx) {
7221 		uint32_t rxs, txs;
7222 
7223 		if (lkpi_80211_mo_get_antenna(hw, &txs, &rxs) == 0) {
7224 			ic->ic_rxstream = bitcount32(rxs);
7225 			ic->ic_txstream = bitcount32(txs);
7226 		}
7227 	}
7228 
7229 	ic->ic_cryptocaps = 0;
7230 #ifdef LKPI_80211_HW_CRYPTO
7231 	if (lkpi_hwcrypto && hw->wiphy->n_cipher_suites > 0) {
7232 		uint32_t hwciphers;
7233 
7234 		hwciphers = 0;
7235 		for (i = 0; i < hw->wiphy->n_cipher_suites; i++) {
7236 			uint32_t cs;
7237 
7238 			cs = lkpi_l80211_to_net80211_cyphers(
7239 			    ic, hw->wiphy->cipher_suites[i]);
7240 			if (cs == IEEE80211_CRYPTO_TKIP) {
7241 				/*
7242 				 * We do set this here.  We will only find out
7243 				 * when doing a SET_KEY operation depending on
7244 				 * what the driver returns.
7245 				 * net80211::ieee80211_crypto_newkey()
7246 				 * checks this so we will have to do flags
7247 				 * surgery later.
7248 				 */
7249 				cs |= IEEE80211_CRYPTO_TKIPMIC;
7250 			}
7251 			hwciphers |= cs;
7252 		}
7253 		/*
7254 		 * (20250415) nothing anywhere in the path checks we actually
7255 		 * support all these in net80211.
7256 		 * net80211 supports _256 variants but the ioctl does not.
7257 		 */
7258 		IMPROVE("as net80211 grows more support, enable them");
7259 		hwciphers &= (IEEE80211_CRYPTO_WEP |
7260 		    IEEE80211_CRYPTO_TKIP | IEEE80211_CRYPTO_TKIPMIC |
7261 		    IEEE80211_CRYPTO_AES_CCM | IEEE80211_CRYPTO_AES_GCM_128);
7262 		/*
7263 		 * We only support CCMP here, so further filter.
7264 		 * Also permit TKIP if turned on.
7265 		 */
7266 		hwciphers &= (IEEE80211_CRYPTO_AES_CCM |
7267 		    IEEE80211_CRYPTO_AES_GCM_128 |
7268 		    (lkpi_hwcrypto_tkip ? (IEEE80211_CRYPTO_TKIP |
7269 		    IEEE80211_CRYPTO_TKIPMIC) : 0));
7270 		ieee80211_set_hardware_ciphers(ic, hwciphers);
7271 	}
7272 #endif
7273 
7274 	lkpi_ic_getradiocaps(ic, IEEE80211_CHAN_MAX, &ic->ic_nchans,
7275 	    ic->ic_channels);
7276 
7277 	ieee80211_ifattach(ic);
7278 
7279 	ic->ic_update_mcast = lkpi_ic_update_mcast;
7280 	ic->ic_update_promisc = lkpi_ic_update_promisc;
7281 	ic->ic_update_chw = lkpi_ic_update_chw;
7282 	ic->ic_parent = lkpi_ic_parent;
7283 	ic->ic_scan_start = lkpi_ic_scan_start;
7284 	ic->ic_scan_end = lkpi_ic_scan_end;
7285 	ic->ic_set_channel = lkpi_ic_set_channel;
7286 	ic->ic_transmit = lkpi_ic_transmit;
7287 	ic->ic_raw_xmit = lkpi_ic_raw_xmit;
7288 	ic->ic_vap_create = lkpi_ic_vap_create;
7289 	ic->ic_vap_delete = lkpi_ic_vap_delete;
7290 	ic->ic_getradiocaps = lkpi_ic_getradiocaps;
7291 	ic->ic_wme.wme_update = lkpi_ic_wme_update;
7292 
7293 	lhw->ic_scan_curchan = ic->ic_scan_curchan;
7294 	ic->ic_scan_curchan = lkpi_ic_scan_curchan;
7295 	lhw->ic_scan_mindwell = ic->ic_scan_mindwell;
7296 	ic->ic_scan_mindwell = lkpi_ic_scan_mindwell;
7297 
7298 	lhw->ic_node_alloc = ic->ic_node_alloc;
7299 	ic->ic_node_alloc = lkpi_ic_node_alloc;
7300 	lhw->ic_node_init = ic->ic_node_init;
7301 	ic->ic_node_init = lkpi_ic_node_init;
7302 	lhw->ic_node_cleanup = ic->ic_node_cleanup;
7303 	ic->ic_node_cleanup = lkpi_ic_node_cleanup;
7304 	lhw->ic_node_free = ic->ic_node_free;
7305 	ic->ic_node_free = lkpi_ic_node_free;
7306 
7307 #ifdef LKPI_80211_HT
7308 	/*
7309 	 * Only attach if the driver/firmware supports (*ampdu_action)().
7310 	 * Otherwise it is in the hands of net80211.
7311 	 */
7312 	if (lhw->ops->ampdu_action != NULL) {
7313 		lhw->ic_recv_action = ic->ic_recv_action;
7314 		ic->ic_recv_action = lkpi_ic_recv_action;
7315 		lhw->ic_send_action = ic->ic_send_action;
7316 		ic->ic_send_action = lkpi_ic_send_action;
7317 
7318 		lhw->ic_ampdu_enable = ic->ic_ampdu_enable;
7319 		ic->ic_ampdu_enable = lkpi_ic_ampdu_enable;
7320 
7321 		lhw->ic_addba_request = ic->ic_addba_request;
7322 		ic->ic_addba_request = lkpi_ic_addba_request;
7323 		lhw->ic_addba_response = ic->ic_addba_response;
7324 		ic->ic_addba_response = lkpi_ic_addba_response;
7325 		lhw->ic_addba_stop = ic->ic_addba_stop;
7326 		ic->ic_addba_stop = lkpi_ic_addba_stop;
7327 		lhw->ic_addba_response_timeout = ic->ic_addba_response_timeout;
7328 		ic->ic_addba_response_timeout = lkpi_ic_addba_response_timeout;
7329 
7330 		lhw->ic_bar_response = ic->ic_bar_response;
7331 		ic->ic_bar_response = lkpi_ic_bar_response;
7332 
7333 		lhw->ic_ampdu_rx_start = ic->ic_ampdu_rx_start;
7334 		ic->ic_ampdu_rx_start = lkpi_ic_ampdu_rx_start;
7335 		lhw->ic_ampdu_rx_stop = ic->ic_ampdu_rx_stop;
7336 		ic->ic_ampdu_rx_stop = lkpi_ic_ampdu_rx_stop;
7337 	}
7338 #endif
7339 
7340 	lkpi_radiotap_attach(lhw);
7341 
7342 	/*
7343 	 * Assign the first possible channel for now;  seems Realtek drivers
7344 	 * expect one.
7345 	 * Also remember the amount of bands we support and the most rates
7346 	 * in any band so we can scale [(ext) sup rates] IE(s) accordingly.
7347 	 */
7348 	lhw->supbands = lhw->max_rates = 0;
7349 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
7350 		struct ieee80211_supported_band *supband;
7351 		struct linuxkpi_ieee80211_channel *channels;
7352 
7353 		supband = hw->wiphy->bands[band];
7354 		if (supband == NULL || supband->n_channels == 0)
7355 			continue;
7356 
7357 		lhw->supbands++;
7358 		lhw->max_rates = max(lhw->max_rates, supband->n_bitrates);
7359 
7360 		/* If we have a channel, we need to keep counting supbands. */
7361 		if (hw->conf.chandef.chan != NULL)
7362 			continue;
7363 
7364 		channels = supband->channels;
7365 		for (i = 0; i < supband->n_channels; i++) {
7366 
7367 			if (channels[i].flags & IEEE80211_CHAN_DISABLED)
7368 				continue;
7369 
7370 			cfg80211_chandef_create(&hw->conf.chandef, &channels[i],
7371 #ifdef LKPI_80211_HT
7372 			    (ic->ic_flags_ht & IEEE80211_FHT_HT) ? NL80211_CHAN_HT20 :
7373 #endif
7374 			    NL80211_CHAN_NO_HT);
7375 			lhw->dflt_chandef = hw->conf.chandef;
7376 #ifdef LINUXKPI_DEBUG_80211
7377 			if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
7378 				ic_printf(ic, "%s:%d: initialized "
7379 				    "hw->conf.chandef and dflt_chandef to %p\n",
7380 				    __func__, __LINE__, &lhw->dflt_chandef);
7381 #endif
7382 			break;
7383 		}
7384 	}
7385 
7386 	IMPROVE("see net80211::ieee80211_chan_init vs. wiphy->bands[].bitrates possibly in lkpi_ic_getradiocaps?");
7387 
7388 	/* Make sure we do not support more than net80211 is willing to take. */
7389 	if (lhw->max_rates > IEEE80211_RATE_MAXSIZE) {
7390 		ic_printf(ic, "%s: limiting max_rates %d to %d!\n", __func__,
7391 		    lhw->max_rates, IEEE80211_RATE_MAXSIZE);
7392 		lhw->max_rates = IEEE80211_RATE_MAXSIZE;
7393 	}
7394 
7395 	/*
7396 	 * The maximum supported bitrates on any band + size for
7397 	 * DSSS Parameter Set give our per-band IE size.
7398 	 * SSID is the responsibility of the driver and goes on the side.
7399 	 * The user specified bits coming from the vap go into the
7400 	 * "common ies" fields.
7401 	 */
7402 	lhw->scan_ie_len = 2 + IEEE80211_RATE_SIZE;
7403 	if (lhw->max_rates > IEEE80211_RATE_SIZE)
7404 		lhw->scan_ie_len += 2 + (lhw->max_rates - IEEE80211_RATE_SIZE);
7405 
7406 	if (hw->wiphy->features & NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) {
7407 		/*
7408 		 * net80211 does not seem to support the DSSS Parameter Set but
7409 		 * some of the drivers insert it so calculate the extra fixed
7410 		 * space in.
7411 		 */
7412 		lhw->scan_ie_len += 2 + 1;
7413 	}
7414 
7415 #if defined(LKPI_80211_HT)
7416 	if ((ic->ic_htcaps & IEEE80211_HTC_HT) != 0)
7417 		lhw->scan_ie_len += sizeof(struct ieee80211_ie_htcap);
7418 #endif
7419 #if defined(LKPI_80211_VHT)
7420 	if (IEEE80211_CONF_VHT(ic))
7421 		lhw->scan_ie_len += 2 + sizeof(struct ieee80211_vht_cap);
7422 #endif
7423 
7424 	/* Reduce the max_scan_ie_len "left" by the amount we consume already. */
7425 	if (hw->wiphy->max_scan_ie_len > 0) {
7426 		if (lhw->scan_ie_len > hw->wiphy->max_scan_ie_len)
7427 			goto err;
7428 		hw->wiphy->max_scan_ie_len -= lhw->scan_ie_len;
7429 	}
7430 
7431 	if (bootverbose) {
7432 		if (hw->netdev_features != 0)
7433 			ic_printf(ic, "netdev_features %b\n",
7434 			    hw->netdev_features, NETIF_F_BITS);
7435 		ieee80211_announce(ic);
7436 	}
7437 
7438 	return (0);
7439 err:
7440 	IMPROVE("TODO FIXME CLEANUP");
7441 	return (-EAGAIN);
7442 }
7443 
7444 void
7445 linuxkpi_ieee80211_ifdetach(struct ieee80211_hw *hw)
7446 {
7447 	struct lkpi_hw *lhw;
7448 	struct ieee80211com *ic;
7449 
7450 	lhw = HW_TO_LHW(hw);
7451 	ic = lhw->ic;
7452 	ieee80211_ifdetach(ic);
7453 }
7454 
7455 void
7456 linuxkpi_ieee80211_iterate_interfaces(struct ieee80211_hw *hw,
7457     enum ieee80211_iface_iter flags,
7458     void(*iterfunc)(void *, uint8_t *, struct ieee80211_vif *),
7459     void *arg)
7460 {
7461 	struct lkpi_hw *lhw;
7462 	struct lkpi_vif *lvif;
7463 	struct ieee80211_vif *vif;
7464 	bool active, atomic, nin_drv;
7465 
7466 	lhw = HW_TO_LHW(hw);
7467 
7468 	if (flags & ~(IEEE80211_IFACE_ITER_NORMAL|
7469 	    IEEE80211_IFACE_ITER_RESUME_ALL|
7470 	    IEEE80211_IFACE_SKIP_SDATA_NOT_IN_DRIVER|
7471 	    IEEE80211_IFACE_ITER_ACTIVE|IEEE80211_IFACE_ITER__ATOMIC|
7472 	    IEEE80211_IFACE_ITER__MTX)) {
7473 		ic_printf(lhw->ic, "XXX TODO %s flags(%#x) not yet supported.\n",
7474 		    __func__, flags);
7475 	}
7476 
7477 	if ((flags & IEEE80211_IFACE_ITER__MTX) != 0)
7478 		lockdep_assert_wiphy(hw->wiphy);
7479 
7480 	active = (flags & IEEE80211_IFACE_ITER_ACTIVE) != 0;
7481 	atomic = (flags & IEEE80211_IFACE_ITER__ATOMIC) != 0;
7482 	nin_drv = (flags & IEEE80211_IFACE_SKIP_SDATA_NOT_IN_DRIVER) != 0;
7483 
7484 	if (atomic) {
7485 		IMPROVE("LKPI_80211_LHW_LVIF_LOCK atomic assume to be rcu?");
7486 		LKPI_80211_LHW_LVIF_LOCK(lhw);
7487 	}
7488 	TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
7489 		struct ieee80211vap *vap;
7490 
7491 		vif = LVIF_TO_VIF(lvif);
7492 
7493 		/*
7494 		 * If we want "active" interfaces, we need to distinguish on
7495 		 * whether the driver knows about them or not to be able to
7496 		 * handle the "resume" case correctly.  Skip the ones the
7497 		 * driver does not know about.
7498 		 */
7499 		if (active && !lvif->added_to_drv &&
7500 		    (flags & IEEE80211_IFACE_ITER_RESUME_ALL) != 0)
7501 			continue;
7502 
7503 		/*
7504 		 * If we shall skip interfaces not added to the driver do so
7505 		 * if we haven't yet.
7506 		 */
7507 		if (nin_drv && !lvif->added_to_drv)
7508 			continue;
7509 
7510 		/*
7511 		 * Run the iterator function if we are either not asking
7512 		 * asking for active only or if the VAP is "running".
7513 		 */
7514 		/* XXX-BZ probably should have state in the lvif as well. */
7515 		vap = LVIF_TO_VAP(lvif);
7516 		if (!active || (vap->iv_state != IEEE80211_S_INIT))
7517 			iterfunc(arg, vif->addr, vif);
7518 	}
7519 	if (atomic)
7520 		LKPI_80211_LHW_LVIF_UNLOCK(lhw);
7521 }
7522 
7523 static void
7524 lkpi_ieee80211_iterate_keys(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
7525     ieee80211_keyix keyix, struct lkpi_sta *lsta,
7526     void(*iterfunc)(struct ieee80211_hw *, struct ieee80211_vif *,
7527 	struct ieee80211_sta *, struct ieee80211_key_conf *, void *),
7528     void *arg)
7529 {
7530 #ifdef LINUXKPI_DEBUG_80211
7531 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
7532 		net80211_vap_printf(LVIF_TO_VAP(VIF_TO_LVIF(vif)),
7533 		    "%s:%d: lsta %6D added_to_drv %d kc[keyix %u] %p\n",
7534 		    __func__, __LINE__, LSTA_TO_STA(lsta)->addr, ":",
7535 		    lsta->added_to_drv, keyix, lsta->kc[keyix]);
7536 #endif
7537 
7538 	if (!lsta->added_to_drv)
7539 		return;
7540 
7541 	if (lsta->kc[keyix] == NULL)
7542 		return;
7543 
7544 	iterfunc(hw, vif, LSTA_TO_STA(lsta), lsta->kc[keyix], arg);
7545 }
7546 
7547 void
7548 linuxkpi_ieee80211_iterate_keys(struct ieee80211_hw *hw,
7549     struct ieee80211_vif *vif,
7550     void(*iterfunc)(struct ieee80211_hw *, struct ieee80211_vif *,
7551         struct ieee80211_sta *, struct ieee80211_key_conf *, void *),
7552     void *arg, bool rcu)
7553 {
7554 	struct lkpi_sta *lsta;
7555 	struct lkpi_vif *lvif;
7556 
7557 	lvif = VIF_TO_LVIF(vif);
7558 
7559 	if (rcu) {
7560 		rcu_read_lock_held();		/* XXX-BZ is this correct? */
7561 
7562 		if (vif == NULL) {
7563 			TODO();
7564 		} else {
7565 			list_for_each_entry_rcu(lsta, &lvif->lsta_list, lsta_list) {
7566 				for (ieee80211_keyix keyix = 0; keyix < nitems(lsta->kc);
7567 				    keyix++)
7568 					lkpi_ieee80211_iterate_keys(hw, vif,
7569 					    keyix, lsta, iterfunc, arg);
7570 			}
7571 		}
7572 	} else {
7573 		TODO("Used by suspend/resume; order of keys as installed to "
7574 		"firmware is important; we'll need to rewrite some code for that");
7575 		lockdep_assert_wiphy(hw->wiphy);
7576 
7577 		if (vif == NULL) {
7578 			TODO();
7579 		} else {
7580 			list_for_each_entry(lsta, &lvif->lsta_list, lsta_list) {
7581 				for (ieee80211_keyix keyix = 0; keyix < nitems(lsta->kc);
7582 				    keyix++)
7583 					lkpi_ieee80211_iterate_keys(hw, vif,
7584 					    keyix, lsta, iterfunc, arg);
7585 			}
7586 		}
7587 	}
7588 }
7589 
7590 void
7591 linuxkpi_ieee80211_iterate_chan_contexts(struct ieee80211_hw *hw,
7592     void(*iterfunc)(struct ieee80211_hw *, struct ieee80211_chanctx_conf *,
7593 	void *),
7594     void *arg)
7595 {
7596 	struct lkpi_hw *lhw;
7597 	struct lkpi_chanctx *lchanctx;
7598 
7599 	KASSERT(hw != NULL && iterfunc != NULL,
7600 	    ("%s: hw %p iterfunc %p arg %p\n", __func__, hw, iterfunc, arg));
7601 
7602 	lhw = HW_TO_LHW(hw);
7603 
7604 	rcu_read_lock();
7605 	list_for_each_entry_rcu(lchanctx, &lhw->lchanctx_list, entry) {
7606 		if (!lchanctx->added_to_drv)
7607 			continue;
7608 		iterfunc(hw, &lchanctx->chanctx_conf, arg);
7609 	}
7610 	rcu_read_unlock();
7611 }
7612 
7613 void
7614 linuxkpi_ieee80211_iterate_stations_atomic(struct ieee80211_hw *hw,
7615    void (*iterfunc)(void *, struct ieee80211_sta *), void *arg)
7616 {
7617 	struct lkpi_hw *lhw;
7618 	struct lkpi_vif *lvif;
7619 	struct lkpi_sta *lsta;
7620 	struct ieee80211_sta *sta;
7621 
7622 	KASSERT(hw != NULL && iterfunc != NULL,
7623 	    ("%s: hw %p iterfunc %p arg %p\n", __func__, hw, iterfunc, arg));
7624 
7625 	lhw = HW_TO_LHW(hw);
7626 
7627 	LKPI_80211_LHW_LVIF_LOCK(lhw);
7628 	TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
7629 
7630 		rcu_read_lock();
7631 		list_for_each_entry_rcu(lsta, &lvif->lsta_list, lsta_list) {
7632 			if (!lsta->added_to_drv)
7633 				continue;
7634 			sta = LSTA_TO_STA(lsta);
7635 			iterfunc(arg, sta);
7636 		}
7637 		rcu_read_unlock();
7638 	}
7639 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
7640 }
7641 
7642 struct linuxkpi_ieee80211_regdomain *
7643 lkpi_get_linuxkpi_ieee80211_regdomain(size_t n)
7644 {
7645 	struct linuxkpi_ieee80211_regdomain *regd;
7646 
7647 	regd = kzalloc(sizeof(*regd) + n * sizeof(struct ieee80211_reg_rule),
7648 	    GFP_KERNEL);
7649 	return (regd);
7650 }
7651 
7652 int
7653 linuxkpi_regulatory_set_wiphy_regd_sync(struct wiphy *wiphy,
7654     struct linuxkpi_ieee80211_regdomain *regd)
7655 {
7656 	struct lkpi_hw *lhw;
7657 	struct ieee80211com *ic;
7658 	struct ieee80211_regdomain *rd;
7659 
7660 	lhw = wiphy_priv(wiphy);
7661 	ic = lhw->ic;
7662 
7663 	rd = &ic->ic_regdomain;
7664 	if (rd->isocc[0] == '\0') {
7665 		rd->isocc[0] = regd->alpha2[0];
7666 		rd->isocc[1] = regd->alpha2[1];
7667 	}
7668 
7669 	TODO();
7670 	/* XXX-BZ finish the rest. */
7671 
7672 	return (0);
7673 }
7674 
7675 void
7676 linuxkpi_ieee80211_scan_completed(struct ieee80211_hw *hw,
7677     struct cfg80211_scan_info *info)
7678 {
7679 	struct lkpi_hw *lhw;
7680 	struct ieee80211com *ic;
7681 	struct ieee80211_scan_state *ss;
7682 
7683 	lhw = wiphy_priv(hw->wiphy);
7684 	ic = lhw->ic;
7685 	ss = ic->ic_scan;
7686 
7687 	TRACE_SCAN(ic, "scan_flags %b info { %ju, %6D, aborted %d }",
7688 	    lhw->scan_flags, LKPI_LHW_SCAN_BITS,
7689 	    (uintmax_t)info->scan_start_tsf, info->tsf_bssid, ":",
7690 	    info->aborted);
7691 
7692 	ieee80211_scan_done(ss->ss_vap);
7693 
7694 	LKPI_80211_LHW_SCAN_LOCK(lhw);
7695 	free(lhw->hw_req, M_LKPI80211);
7696 	lhw->hw_req = NULL;
7697 	lhw->scan_flags &= ~LKPI_LHW_SCAN_RUNNING;
7698 	/* The wakeup(lhw) will be called from lkpi_ic_scan_end(). */
7699 	/* wakeup(lhw); */
7700 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
7701 
7702 	return;
7703 }
7704 
7705 static void
7706 lkpi_80211_lhw_rxq_rx_one(struct lkpi_hw *lhw, struct mbuf *m)
7707 {
7708 	struct ieee80211_node *ni;
7709 #ifdef LKPI_80211_USE_MTAG
7710 	struct m_tag *mtag;
7711 #endif
7712 	int ok;
7713 
7714 	ni = NULL;
7715 #ifdef LKPI_80211_USE_MTAG
7716         mtag = m_tag_locate(m, MTAG_ABI_LKPI80211, LKPI80211_TAG_RXNI, NULL);
7717 	if (mtag != NULL) {
7718 		struct lkpi_80211_tag_rxni *rxni;
7719 
7720 		rxni = (struct lkpi_80211_tag_rxni *)(mtag + 1);
7721 		ni = rxni->ni;
7722 	}
7723 #else
7724 	if (m->m_pkthdr.PH_loc.ptr != NULL) {
7725 		ni = m->m_pkthdr.PH_loc.ptr;
7726 		m->m_pkthdr.PH_loc.ptr = NULL;
7727 	}
7728 #endif
7729 
7730 	if (ni != NULL) {
7731 		ok = ieee80211_input_mimo(ni, m);
7732 		ieee80211_free_node(ni);		/* Release the reference. */
7733 		if (ok < 0)
7734 			m_freem(m);
7735 	} else {
7736 		ok = ieee80211_input_mimo_all(lhw->ic, m);
7737 		/* mbuf got consumed. */
7738 	}
7739 
7740 #ifdef LINUXKPI_DEBUG_80211
7741 	if (linuxkpi_debug_80211 & D80211_TRACE_RX)
7742 		printf("TRACE-RX: %s: handled frame type %#0x\n", __func__, ok);
7743 #endif
7744 }
7745 
7746 static void
7747 lkpi_80211_lhw_rxq_task(void *ctx, int pending)
7748 {
7749 	struct lkpi_hw *lhw;
7750 	struct mbufq mq;
7751 	struct mbuf *m;
7752 
7753 	lhw = ctx;
7754 
7755 #ifdef LINUXKPI_DEBUG_80211
7756 	if (linuxkpi_debug_80211 & D80211_TRACE_RX)
7757 		printf("TRACE-RX: %s: lhw %p pending %d mbuf_qlen %d\n",
7758 		    __func__, lhw, pending, mbufq_len(&lhw->rxq));
7759 #endif
7760 
7761 	mbufq_init(&mq, IFQ_MAXLEN);
7762 
7763 	LKPI_80211_LHW_RXQ_LOCK(lhw);
7764 	mbufq_concat(&mq, &lhw->rxq);
7765 	LKPI_80211_LHW_RXQ_UNLOCK(lhw);
7766 
7767 	m = mbufq_dequeue(&mq);
7768 	while (m != NULL) {
7769 		lkpi_80211_lhw_rxq_rx_one(lhw, m);
7770 		m = mbufq_dequeue(&mq);
7771 	}
7772 }
7773 
7774 static void
7775 lkpi_convert_rx_status(struct ieee80211_hw *hw, struct lkpi_sta *lsta,
7776     struct ieee80211_rx_status *rx_status,
7777     struct ieee80211_rx_stats *rx_stats,
7778     uint8_t *rssip)
7779 {
7780 	struct ieee80211_supported_band *supband;
7781 	struct rate_info rxrate;
7782 	int i;
7783 	uint8_t rssi;
7784 
7785 	memset(&rxrate, 0, sizeof(rxrate));
7786 	memset(rx_stats, 0, sizeof(*rx_stats));
7787 	rx_stats->r_flags = IEEE80211_R_NF | IEEE80211_R_RSSI;
7788 	/* XXX-BZ correct hardcoded noise floor, survey data? */
7789 	rx_stats->c_nf = -96;
7790 	if (ieee80211_hw_check(hw, SIGNAL_DBM) &&
7791 	    !(rx_status->flag & RX_FLAG_NO_SIGNAL_VAL))
7792 		rssi = rx_status->signal;
7793 	else
7794 		rssi = rx_stats->c_nf;
7795 	/*
7796 	 * net80211 signal strength data are in .5 dBm units relative to
7797 	 * the current noise floor (see comment in ieee80211_node.h).
7798 	 */
7799 	rssi -= rx_stats->c_nf;
7800 	if (rssip != NULL)
7801 		*rssip = rssi;
7802 	rx_stats->c_rssi = rssi * 2;
7803 	rx_stats->r_flags |= IEEE80211_R_BAND;
7804 	rx_stats->c_band =
7805 	    lkpi_nl80211_band_to_net80211_band(rx_status->band);
7806 	rx_stats->r_flags |= IEEE80211_R_FREQ | IEEE80211_R_IEEE;
7807 	rx_stats->c_freq = rx_status->freq;
7808 	rx_stats->c_ieee = ieee80211_mhz2ieee(rx_stats->c_freq, rx_stats->c_band);
7809 
7810 	rx_stats->c_rx_tsf = rx_status->mactime;
7811 
7812 	/* XXX RX_FLAG_MACTIME_IS_RTAP_TS64 ? */
7813 	if ((rx_status->flag & RX_FLAG_MACTIME) ==
7814 	    (RX_FLAG_MACTIME_START|RX_FLAG_MACTIME_END)) {
7815 		rx_stats->r_flags |= IEEE80211_R_TSF64;
7816 		/* XXX RX_FLAG_MACTIME_PLCP_START ? */
7817 		if ((rx_status->flag & RX_FLAG_MACTIME) == RX_FLAG_MACTIME_START)
7818 			rx_stats->r_flags |= IEEE80211_R_TSF_START;
7819 		if ((rx_status->flag & RX_FLAG_MACTIME) == RX_FLAG_MACTIME_END)
7820 			rx_stats->r_flags |= IEEE80211_R_TSF_END;
7821 		/* XXX-BZ if TSF_END will net80211 do the unwind of time? */
7822 	}
7823 
7824 	if (rx_status->chains != 0) {
7825 		int cc;
7826 		int8_t crssi;
7827 
7828 		rx_stats->c_chain = rx_status->chains;
7829 		rx_stats->r_flags |= IEEE80211_R_C_CHAIN;
7830 
7831 		cc = 0;
7832 		for (i = 0; i < nitems(rx_status->chain_signal); i++) {
7833 			if (!(rx_status->chains & BIT(i)))
7834 				continue;
7835 			crssi = rx_status->chain_signal[i];
7836 			crssi -= rx_stats->c_nf;
7837 			rx_stats->c_rssi_ctl[i] = crssi * 2;
7838 			rx_stats->c_rssi_ext[i] = crssi * 2;	/* XXX _ext ??? ATH thing? */
7839 			/* We currently only have the global noise floor value. */
7840 			rx_stats->c_nf_ctl[i] = rx_stats->c_nf;
7841 			rx_stats->c_nf_ext[i] = rx_stats->c_nf;
7842 			cc++;
7843 		}
7844 		if (cc > 0)
7845 			 rx_stats->r_flags |= (IEEE80211_R_C_NF | IEEE80211_R_C_RSSI);
7846 	}
7847 
7848 	/* XXX-NET80211 We are not going to populate c_phytype! */
7849 
7850 	switch (rx_status->encoding) {
7851 	case RX_ENC_LEGACY:
7852 	{
7853 		uint32_t legacy = 0;
7854 
7855 		supband = hw->wiphy->bands[rx_status->band];
7856 		if (supband != NULL)
7857 			legacy = supband->bitrates[rx_status->rate_idx].bitrate;
7858 		rx_stats->c_rate = legacy;
7859 		rxrate.legacy = legacy;
7860 		/* Is there a LinuxKPI way of reporting IEEE80211_RX_F_CCK / _OFDM? */
7861 		break;
7862 	}
7863 	case RX_ENC_HT:
7864 		rx_stats->c_pktflags |= IEEE80211_RX_F_HT;
7865 		rx_stats->c_rate = rx_status->rate_idx;		/* mcs */
7866 		rxrate.flags |= RATE_INFO_FLAGS_MCS;
7867 		rxrate.mcs = rx_status->rate_idx;
7868 		if ((rx_status->enc_flags & RX_ENC_FLAG_SHORT_GI) != 0) {
7869 			rx_stats->c_pktflags |= IEEE80211_RX_F_SHORTGI;
7870 			rxrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
7871 		}
7872 		break;
7873 	case RX_ENC_VHT:
7874 		rx_stats->c_pktflags |= IEEE80211_RX_F_VHT;
7875 		rx_stats->c_rate = rx_status->rate_idx;		/* mcs */
7876 		rx_stats->c_vhtnss = rx_status->nss;
7877 		rxrate.flags |= RATE_INFO_FLAGS_VHT_MCS;
7878 		rxrate.mcs = rx_status->rate_idx;
7879 		rxrate.nss = rx_status->nss;
7880 		if ((rx_status->enc_flags & RX_ENC_FLAG_SHORT_GI) != 0) {
7881 			rx_stats->c_pktflags |= IEEE80211_RX_F_SHORTGI;
7882 			rxrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
7883 		}
7884 		break;
7885 	case RX_ENC_HE:
7886 		rxrate.flags |= RATE_INFO_FLAGS_HE_MCS;
7887 		rxrate.mcs = rx_status->rate_idx;
7888 		rxrate.nss = rx_status->nss;
7889 		/* XXX TODO */
7890 		TODO("net80211 has not matching encoding for %u", rx_status->encoding);
7891 		break;
7892 	case RX_ENC_EHT:
7893 		rxrate.flags |= RATE_INFO_FLAGS_EHT_MCS;
7894 		rxrate.mcs = rx_status->rate_idx;
7895 		rxrate.nss = rx_status->nss;
7896 		/* XXX TODO */
7897 		TODO("net80211 has not matching encoding for %u", rx_status->encoding);
7898 		break;
7899 	}
7900 
7901 	rxrate.bw = rx_status->bw;
7902 	switch (rx_status->bw) {
7903 	case RATE_INFO_BW_20:
7904 		rx_stats->c_width = IEEE80211_RX_FW_20MHZ;
7905 		break;
7906 	case RATE_INFO_BW_40:
7907 		rx_stats->c_width = IEEE80211_RX_FW_40MHZ;
7908 		break;
7909 	case RATE_INFO_BW_80:
7910 		rx_stats->c_width = IEEE80211_RX_FW_80MHZ;
7911 		break;
7912 	case RATE_INFO_BW_160:
7913 		rx_stats->c_width = IEEE80211_RX_FW_160MHZ;
7914 		break;
7915 	case RATE_INFO_BW_320:
7916 	case RATE_INFO_BW_HE_RU:
7917 	case RATE_INFO_BW_EHT_RU:
7918 	case RATE_INFO_BW_5:
7919 	case RATE_INFO_BW_10:
7920 		TODO("net80211 has not matching bandwidth for %u", rx_status->bw);
7921 		break;
7922 	}
7923 
7924 	if ((rx_status->enc_flags & RX_ENC_FLAG_LDPC) != 0)
7925 		rx_stats->c_pktflags |= IEEE80211_RX_F_LDPC;
7926 	if ((rx_status->enc_flags & RX_ENC_FLAG_STBC_MASK) != 0)
7927 		 rx_stats->c_pktflags |= IEEE80211_RX_F_STBC;
7928 
7929 	/*
7930 	 * We only need these for LKPI_80211_HW_CRYPTO in theory but in
7931 	 * case the hardware does something we do not expect always leave
7932 	 * these enabled.  Leaving this commant as documentation for the || 1.
7933 	 */
7934 #if defined(LKPI_80211_HW_CRYPTO) || 1
7935 	if (rx_status->flag & RX_FLAG_DECRYPTED) {
7936 		rx_stats->c_pktflags |= IEEE80211_RX_F_DECRYPTED;
7937 		/* Only valid if decrypted is set. */
7938 		if (rx_status->flag & RX_FLAG_PN_VALIDATED)
7939 			rx_stats->c_pktflags |= IEEE80211_RX_F_PN_VALIDATED;
7940 	}
7941 	if (rx_status->flag & RX_FLAG_IV_STRIPPED)
7942 		rx_stats->c_pktflags |= IEEE80211_RX_F_IV_STRIP;
7943 	if (rx_status->flag & RX_FLAG_ICV_STRIPPED)
7944 		rx_stats->c_pktflags |= IEEE80211_RX_F_ICV_STRIP;
7945 	if (rx_status->flag & RX_FLAG_MIC_STRIPPED)
7946 		rx_stats->c_pktflags |= IEEE80211_RX_F_MIC_STRIP;
7947 	if (rx_status->flag & RX_FLAG_MMIC_STRIPPED)
7948 		rx_stats->c_pktflags |= IEEE80211_RX_F_MMIC_STRIP;
7949 	if (rx_status->flag & RX_FLAG_MMIC_ERROR)
7950 		rx_stats->c_pktflags |= IEEE80211_RX_F_FAIL_MMIC;
7951 	if (rx_status->flag & RX_FLAG_FAILED_FCS_CRC)
7952 		rx_stats->c_pktflags |= IEEE80211_RX_F_FAIL_FCSCRC;
7953 #endif
7954 
7955 	/* Fill in some sinfo bits to fill gaps not reported byt the driver. */
7956 	if (lsta != NULL) {
7957 		memcpy(&lsta->sinfo.rxrate, &rxrate, sizeof(rxrate));
7958 		lsta->sinfo.filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
7959 
7960 		if (rx_status->chains != 0) {
7961 			lsta->sinfo.chains = rx_status->chains;
7962 			memcpy(lsta->sinfo.chain_signal, rx_status->chain_signal,
7963 			    sizeof(lsta->sinfo.chain_signal));
7964 			lsta->sinfo.filled |= BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL);
7965 		}
7966 	}
7967 }
7968 
7969 #ifdef LINUXKPI_DEBUG_80211
7970 static void
7971 lkpi_rx_log_beacon(struct mbuf *m, struct lkpi_hw *lhw,
7972     struct ieee80211_rx_status *rx_status)
7973 {
7974 	struct ieee80211_mgmt *f;
7975 	uint8_t *e;
7976 	char ssid[IEEE80211_NWID_LEN * 4 + 1];
7977 
7978 	memset(ssid, '\0', sizeof(ssid));
7979 
7980 	f = mtod(m, struct ieee80211_mgmt *);
7981 	e = f->u.beacon.variable;
7982 	/*
7983 	 * Usually SSID is right after the fixed part and for debugging we will
7984 	 * be fine should we miss it if it is not.
7985 	 */
7986 	while ((e - (uint8_t *)f) < m->m_len) {
7987 		if (*e == IEEE80211_ELEMID_SSID)
7988 			break;
7989 		e += (2 + *(e + 1));
7990 	}
7991 	if (*e == IEEE80211_ELEMID_SSID) {
7992 		int i, len;
7993 		char *p;
7994 
7995 		p = ssid;
7996 		len = m->m_len - ((e + 2) - (uint8_t *)f);
7997 		if (len > *(e + 1))
7998 			len = *(e + 1);
7999 		e += 2;
8000 		for (i = 0; i < len; i++) {
8001 			/* Printable character? */
8002 			if (*e >= 0x20 && *e < 0x7f) {
8003 				*p++ = *e++;
8004 			} else {
8005 				snprintf(p, 5, "%#04x", *e++);
8006 				p += 4;
8007 			}
8008 		}
8009 		*p = '\0';
8010 	}
8011 
8012 	/* We print skb, skb->data, m as we are seeing 'ghost beacons'. */
8013 	TRACE_SCAN_BEACON(lhw->ic, "Beacon: scan_flags %b, band %s freq %u chan %-4d "
8014 	    "len %d { %#06x %#06x %6D %6D %6D %#06x %ju %u %#06x SSID '%s' }",
8015 	    lhw->scan_flags, LKPI_LHW_SCAN_BITS,
8016 	    lkpi_nl80211_band_name(rx_status->band), rx_status->freq,
8017 	    linuxkpi_ieee80211_frequency_to_channel(rx_status->freq, 0),
8018 	    m->m_pkthdr.len, f->frame_control, f->duration_id,
8019 	    f->da, ":", f->sa, ":", f->bssid, ":", f->seq_ctrl,
8020 	    (uintmax_t)le64_to_cpu(f->u.beacon.timestamp),
8021 	    le16_to_cpu(f->u.beacon.beacon_int),
8022 	    le16_to_cpu(f->u.beacon.capab_info), ssid);
8023 }
8024 #endif
8025 
8026 /* For %list see comment towards the end of the function. */
8027 void
8028 linuxkpi_ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
8029     struct ieee80211_sta *sta, struct napi_struct *napi __unused,
8030     struct list_head *list __unused)
8031 {
8032 	struct lkpi_hw *lhw;
8033 	struct ieee80211com *ic;
8034 	struct mbuf *m;
8035 	struct skb_shared_info *shinfo;
8036 	struct ieee80211_rx_status *rx_status;
8037 	struct ieee80211_rx_stats rx_stats;
8038 	struct ieee80211_node *ni;
8039 	struct ieee80211vap *vap;
8040 	struct ieee80211_hdr *hdr;
8041 	struct lkpi_sta *lsta;
8042 	int i, offset, ok, error;
8043 	uint8_t rssi;
8044 	bool is_beacon;
8045 
8046 	lhw = HW_TO_LHW(hw);
8047 	ic = lhw->ic;
8048 
8049 	if (skb->len < 2) {
8050 		/* Need 80211 stats here. */
8051 		counter_u64_add(ic->ic_ierrors, 1);
8052 		IMPROVE();
8053 		goto err;
8054 	}
8055 
8056 	/*
8057 	 * For now do the data copy; we can later improve things. Might even
8058 	 * have an mbuf backing the skb data then?
8059 	 */
8060 	m = m_get3(skb->len, M_NOWAIT, MT_DATA, M_PKTHDR);
8061 	if (m == NULL) {
8062 		counter_u64_add(ic->ic_ierrors, 1);
8063 		goto err;
8064 	}
8065 	m_copyback(m, 0, skb->tail - skb->data, skb->data);
8066 
8067 	shinfo = skb_shinfo(skb);
8068 	offset = m->m_len;
8069 	for (i = 0; i < shinfo->nr_frags; i++) {
8070 		m_copyback(m, offset, shinfo->frags[i].size,
8071 		    (uint8_t *)linux_page_address(shinfo->frags[i].page) +
8072 		    shinfo->frags[i].offset);
8073 		offset += shinfo->frags[i].size;
8074 	}
8075 
8076 	rx_status = IEEE80211_SKB_RXCB(skb);
8077 
8078 	hdr = (void *)skb->data;
8079 	is_beacon = ieee80211_is_beacon(hdr->frame_control);
8080 
8081 #ifdef LINUXKPI_DEBUG_80211
8082 	/*
8083 	 * We use the mbuf here as otherwise the variable part might
8084 	 * be in skb frags.
8085 	 */
8086 	if (is_beacon && ((linuxkpi_debug_80211 & D80211_SCAN_BEACON) != 0))
8087 		lkpi_rx_log_beacon(m, lhw, rx_status);
8088 
8089 	if (is_beacon && (linuxkpi_debug_80211 & D80211_TRACE_RX_BEACONS) == 0 &&
8090 	   (linuxkpi_debug_80211 & D80211_SCAN_BEACON) == 0)
8091 		goto no_trace_beacons;
8092 
8093 	if (linuxkpi_debug_80211 & D80211_TRACE_RX)
8094 		printf("TRACE-RX: %s: skb %p l/d/t-len (%u/%u/%u) "
8095 		    "h %p d %p t %p e %p sh %p (%u) m %p plen %u len %u%s\n",
8096 		    __func__, skb, skb->len, skb->data_len,
8097 		    skb->truesize, skb->head, skb->data, skb->tail, skb->end,
8098 		    shinfo, shinfo->nr_frags,
8099 		    m, m->m_pkthdr.len, m->m_len, is_beacon ? " beacon" : "");
8100 
8101 	if (linuxkpi_debug_80211 & D80211_TRACE_RX_DUMP)
8102 		hexdump(mtod(m, const void *), m->m_len, "RX (raw) ", 0);
8103 
8104 	/* Implement a dump_rxcb() !!! */
8105 	if ((linuxkpi_debug_80211 & D80211_TRACE_RX) != 0 ||
8106 	    (linuxkpi_debug_80211 & D80211_SCAN_BEACON) != 0)
8107 		printf("TRACE-RX: %s: RXCB: %ju %ju %u, %b, %u, %#0x, %#0x, "
8108 		    "%u band %u, %u { %d %d %d %d }, %d, %#x %#x %#x %#x %u %u %u\n",
8109 			__func__,
8110 			(uintmax_t)rx_status->boottime_ns,
8111 			(uintmax_t)rx_status->mactime,
8112 			rx_status->device_timestamp,
8113 			rx_status->flag, IEEE80211_RX_STATUS_FLAGS_BITS,
8114 			rx_status->freq,
8115 			rx_status->bw,
8116 			rx_status->encoding,
8117 			rx_status->ampdu_reference,
8118 			rx_status->band,
8119 			rx_status->chains,
8120 			rx_status->chain_signal[0],
8121 			rx_status->chain_signal[1],
8122 			rx_status->chain_signal[2],
8123 			rx_status->chain_signal[3],
8124 			rx_status->signal,
8125 			rx_status->enc_flags,
8126 			rx_status->he_dcm,
8127 			rx_status->he_gi,
8128 			rx_status->he_ru,
8129 			rx_status->zero_length_psdu_type,
8130 			rx_status->nss,
8131 			rx_status->rate_idx);
8132 no_trace_beacons:
8133 #endif
8134 
8135 	lsta = NULL;
8136 	if (sta != NULL) {
8137 		lsta = STA_TO_LSTA(sta);
8138 		ni = ieee80211_ref_node(lsta->ni);
8139 	} else {
8140 		struct ieee80211_frame_min *wh;
8141 
8142 		wh = mtod(m, struct ieee80211_frame_min *);
8143 		ni = ieee80211_find_rxnode(ic, wh);
8144 		if (ni != NULL)
8145 			lsta = ni->ni_drv_data;
8146 	}
8147 
8148 	rssi = 0;
8149 	lkpi_convert_rx_status(hw, lsta, rx_status, &rx_stats, &rssi);
8150 
8151 	ok = ieee80211_add_rx_params(m, &rx_stats);
8152 	if (ok == 0) {
8153 		m_freem(m);
8154 		counter_u64_add(ic->ic_ierrors, 1);
8155 		goto err;
8156 	}
8157 
8158 	if (ni != NULL)
8159 		vap = ni->ni_vap;
8160 	else
8161 		/*
8162 		 * XXX-BZ can we improve this by looking at the frame hdr
8163 		 * or other meta-data passed up?
8164 		 */
8165 		vap = TAILQ_FIRST(&ic->ic_vaps);
8166 
8167 #ifdef LINUXKPI_DEBUG_80211
8168 	if (linuxkpi_debug_80211 & D80211_TRACE_RX)
8169 		printf("TRACE-RX: %s: sta %p lsta %p state %d ni %p vap %p%s\n",
8170 		    __func__, sta, lsta, (lsta != NULL) ? lsta->state : -1,
8171 		    ni, vap, is_beacon ? " beacon" : "");
8172 #endif
8173 
8174 	if (ni != NULL && vap != NULL && is_beacon &&
8175 	    rx_status->device_timestamp > 0 &&
8176 	    m->m_pkthdr.len >= sizeof(struct ieee80211_frame)) {
8177 		struct lkpi_vif *lvif;
8178 		struct ieee80211_vif *vif;
8179 		struct ieee80211_frame *wh;
8180 
8181 		lvif = VAP_TO_LVIF(vap);
8182 		vif = LVIF_TO_VIF(lvif);
8183 
8184 		wh = mtod(m, struct ieee80211_frame *);
8185 		if (!IEEE80211_ADDR_EQ(wh->i_addr2, vif->cfg.ap_addr))
8186 			goto skip_device_ts;
8187 
8188 		IMPROVE("TIMING_BEACON_ONLY?");
8189 		/* mac80211 specific (not net80211) so keep it here. */
8190 		vif->bss_conf.sync_device_ts = rx_status->device_timestamp;
8191 		/*
8192 		 * net80211 should take care of the other information (sync_tsf,
8193 		 * sync_dtim_count) as otherwise we need to parse the beacon.
8194 		 */
8195 skip_device_ts:
8196 		;
8197 	}
8198 
8199 	if (vap != NULL && vap->iv_state > IEEE80211_S_INIT &&
8200 	    ieee80211_radiotap_active_vap(vap)) {
8201 		struct lkpi_radiotap_rx_hdr *rtap;
8202 
8203 		rtap = &lhw->rtap_rx;
8204 		rtap->wr_tsft = rx_status->device_timestamp;
8205 		rtap->wr_flags = 0;
8206 		if (rx_status->enc_flags & RX_ENC_FLAG_SHORTPRE)
8207 			rtap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
8208 		if (rx_status->enc_flags & RX_ENC_FLAG_SHORT_GI)
8209 			rtap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTGI;
8210 #if 0	/* .. or it does not given we strip it below. */
8211 		if (ieee80211_hw_check(hw, RX_INCLUDES_FCS))
8212 			rtap->wr_flags |= IEEE80211_RADIOTAP_F_FCS;
8213 #endif
8214 		if (rx_status->flag & RX_FLAG_FAILED_FCS_CRC)
8215 			rtap->wr_flags |= IEEE80211_RADIOTAP_F_BADFCS;
8216 		rtap->wr_rate = 0;
8217 		IMPROVE();
8218 		/* XXX TODO status->encoding / rate_index / bw */
8219 		rtap->wr_chan_freq = htole16(rx_stats.c_freq);
8220 		if (ic->ic_curchan->ic_ieee == rx_stats.c_ieee)
8221 			rtap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
8222 		rtap->wr_dbm_antsignal = rssi;
8223 		rtap->wr_dbm_antnoise = rx_stats.c_nf;
8224 	}
8225 
8226 	if (ieee80211_hw_check(hw, RX_INCLUDES_FCS))
8227 		m_adj(m, -IEEE80211_CRC_LEN);
8228 
8229 #if 0
8230 	if (list != NULL) {
8231 		/*
8232 		* Normally this would be queued up and delivered by
8233 		* netif_receive_skb_list(), napi_gro_receive(), or the like.
8234 		* See mt76::mac80211.c as only current possible consumer.
8235 		*/
8236 		IMPROVE("we simply pass the packet to net80211 to deal with.");
8237 	}
8238 #endif
8239 
8240 	/* Attach meta-information to the mbuf for the deferred RX path. */
8241 	if (ni != NULL) {
8242 #ifdef LKPI_80211_USE_MTAG
8243 		struct m_tag *mtag;
8244 		struct lkpi_80211_tag_rxni *rxni;
8245 
8246 		mtag = m_tag_alloc(MTAG_ABI_LKPI80211, LKPI80211_TAG_RXNI,
8247 		    sizeof(*rxni), IEEE80211_M_NOWAIT);
8248 		if (mtag == NULL) {
8249 			m_freem(m);
8250 			counter_u64_add(ic->ic_ierrors, 1);
8251 			goto err;
8252 		}
8253 		rxni = (struct lkpi_80211_tag_rxni *)(mtag + 1);
8254 		rxni->ni = ni;		/* We hold a reference. */
8255 		m_tag_prepend(m, mtag);
8256 #else
8257 		m->m_pkthdr.PH_loc.ptr = ni;	/* We hold a reference. */
8258 #endif
8259 	}
8260 
8261 	LKPI_80211_LHW_RXQ_LOCK(lhw);
8262 	if (lhw->rxq_stopped) {
8263 		LKPI_80211_LHW_RXQ_UNLOCK(lhw);
8264 		m_freem(m);
8265 		counter_u64_add(ic->ic_ierrors, 1);
8266 		goto err;
8267 	}
8268 
8269 	error = mbufq_enqueue(&lhw->rxq, m);
8270 	if (error != 0) {
8271 		LKPI_80211_LHW_RXQ_UNLOCK(lhw);
8272 		m_freem(m);
8273 		counter_u64_add(ic->ic_ierrors, 1);
8274 #ifdef LINUXKPI_DEBUG_80211
8275 		if (linuxkpi_debug_80211 & D80211_TRACE_RX)
8276 			ic_printf(ni->ni_ic, "%s: mbufq_enqueue failed: %d\n",
8277 			    __func__, error);
8278 #endif
8279 		goto err;
8280 	}
8281 	taskqueue_enqueue(taskqueue_thread, &lhw->rxq_task);
8282 	LKPI_80211_LHW_RXQ_UNLOCK(lhw);
8283 
8284 	IMPROVE();
8285 
8286 err:
8287 	/* The skb is ours so we can free it :-) */
8288 	kfree_skb(skb);
8289 }
8290 
8291 uint8_t
8292 linuxkpi_ieee80211_get_tid(struct ieee80211_hdr *hdr, bool nonqos_ok)
8293 {
8294 	const struct ieee80211_frame *wh;
8295 	uint8_t tid;
8296 
8297 	/* Linux seems to assume this is a QOS-Data-Frame */
8298 	KASSERT(nonqos_ok || ieee80211_is_data_qos(hdr->frame_control),
8299 	   ("%s: hdr %p fc %#06x not qos_data\n", __func__, hdr,
8300 	   hdr->frame_control));
8301 
8302 	wh = (const struct ieee80211_frame *)hdr;
8303 	tid = ieee80211_gettid(wh);
8304 	KASSERT(nonqos_ok || tid == (tid & IEEE80211_QOS_TID), ("%s: tid %u "
8305 	   "not expected (%u?)\n", __func__, tid, IEEE80211_NONQOS_TID));
8306 
8307 	return (tid);
8308 }
8309 
8310 /* -------------------------------------------------------------------------- */
8311 
8312 static void
8313 lkpi_wiphy_work(struct work_struct *work)
8314 {
8315 	struct lkpi_wiphy *lwiphy;
8316 	struct wiphy *wiphy;
8317 	struct wiphy_work *wk;
8318 
8319 	lwiphy = container_of(work, struct lkpi_wiphy, wwk);
8320 	wiphy = LWIPHY_TO_WIPHY(lwiphy);
8321 
8322 	wiphy_lock(wiphy);
8323 
8324 	LKPI_80211_LWIPHY_WORK_LOCK(lwiphy);
8325 	wk = list_first_entry_or_null(&lwiphy->wwk_list, struct wiphy_work, entry);
8326 	/* If there is nothing we do nothing. */
8327 	if (wk == NULL) {
8328 		LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8329 		wiphy_unlock(wiphy);
8330 		return;
8331 	}
8332 	list_del_init(&wk->entry);
8333 
8334 	/* More work to do? */
8335 	if (!list_empty(&lwiphy->wwk_list))
8336 		schedule_work(work);
8337 	LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8338 
8339 	/* Finally call the (*wiphy_work_fn)() function. */
8340 	wk->fn(wiphy, wk);
8341 
8342 	wiphy_unlock(wiphy);
8343 }
8344 
8345 void
8346 linuxkpi_wiphy_work_queue(struct wiphy *wiphy, struct wiphy_work *wwk)
8347 {
8348 	struct lkpi_wiphy *lwiphy;
8349 
8350 	lwiphy = WIPHY_TO_LWIPHY(wiphy);
8351 
8352 	LKPI_80211_LWIPHY_WORK_LOCK(lwiphy);
8353 	/* Do not double-queue. */
8354 	if (list_empty(&wwk->entry))
8355 		list_add_tail(&wwk->entry, &lwiphy->wwk_list);
8356 	LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8357 
8358 	/*
8359 	 * See how ieee80211_queue_work() work continues in Linux or if things
8360 	 * migrate here over time?
8361 	 * Use a system queue from linux/workqueue.h for now.
8362 	 */
8363 	queue_work(system_wq, &lwiphy->wwk);
8364 }
8365 
8366 void
8367 linuxkpi_wiphy_work_cancel(struct wiphy *wiphy, struct wiphy_work *wwk)
8368 {
8369 	struct lkpi_wiphy *lwiphy;
8370 
8371 	lwiphy = WIPHY_TO_LWIPHY(wiphy);
8372 
8373 	LKPI_80211_LWIPHY_WORK_LOCK(lwiphy);
8374 	/* Only cancel if queued. */
8375 	if (!list_empty(&wwk->entry))
8376 		list_del_init(&wwk->entry);
8377 	LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8378 }
8379 
8380 void
8381 linuxkpi_wiphy_work_flush(struct wiphy *wiphy, struct wiphy_work *wwk)
8382 {
8383 	struct lkpi_wiphy *lwiphy;
8384 	struct wiphy_work *wk;
8385 
8386 	lwiphy = WIPHY_TO_LWIPHY(wiphy);
8387 	LKPI_80211_LWIPHY_WORK_LOCK(lwiphy);
8388 	/* If wwk is unset, flush everything; called when wiphy is shut down. */
8389 	if (wwk != NULL && list_empty(&wwk->entry)) {
8390 		LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8391 		return;
8392 	}
8393 
8394 	while (!list_empty(&lwiphy->wwk_list)) {
8395 
8396 		wk = list_first_entry(&lwiphy->wwk_list, struct wiphy_work,
8397 		    entry);
8398 		list_del_init(&wk->entry);
8399 		LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8400 		wk->fn(wiphy, wk);
8401 		LKPI_80211_LWIPHY_WORK_LOCK(lwiphy);
8402 		if (wk == wwk)
8403 			break;
8404 	}
8405 	LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8406 }
8407 
8408 void
8409 lkpi_wiphy_delayed_work_timer(struct timer_list *tl)
8410 {
8411 	struct wiphy_delayed_work *wdwk;
8412 
8413 	wdwk = timer_container_of(wdwk, tl, timer);
8414 	wiphy_work_queue(wdwk->wiphy, &wdwk->work);
8415 }
8416 
8417 void
8418 linuxkpi_wiphy_delayed_work_queue(struct wiphy *wiphy,
8419     struct wiphy_delayed_work *wdwk, unsigned long delay)
8420 {
8421 	if (delay == 0) {
8422 		/* Run right away. */
8423 		del_timer(&wdwk->timer);
8424 		wiphy_work_queue(wiphy, &wdwk->work);
8425 	} else {
8426 		wdwk->wiphy = wiphy;
8427 		mod_timer(&wdwk->timer, jiffies + delay);
8428 	}
8429 }
8430 
8431 void
8432 linuxkpi_wiphy_delayed_work_cancel(struct wiphy *wiphy,
8433     struct wiphy_delayed_work *wdwk)
8434 {
8435 	del_timer_sync(&wdwk->timer);
8436 	wiphy_work_cancel(wiphy, &wdwk->work);
8437 }
8438 
8439 void
8440 linuxkpi_wiphy_delayed_work_flush(struct wiphy *wiphy,
8441     struct wiphy_delayed_work *wdwk)
8442 {
8443 	lockdep_assert_held(&wiphy->mtx);
8444 
8445 	del_timer_sync(&wdwk->timer);
8446 	wiphy_work_flush(wiphy, &wdwk->work);
8447 }
8448 
8449 /* -------------------------------------------------------------------------- */
8450 
8451 struct wiphy *
8452 linuxkpi_wiphy_new(const struct cfg80211_ops *ops, size_t priv_len)
8453 {
8454 	struct lkpi_wiphy *lwiphy;
8455 	struct wiphy *wiphy;
8456 
8457 	lwiphy = kzalloc(sizeof(*lwiphy) + priv_len, GFP_KERNEL);
8458 	if (lwiphy == NULL)
8459 		return (NULL);
8460 	lwiphy->ops = ops;
8461 
8462 	LKPI_80211_LWIPHY_WORK_LOCK_INIT(lwiphy);
8463 	INIT_LIST_HEAD(&lwiphy->wwk_list);
8464 	INIT_WORK(&lwiphy->wwk, lkpi_wiphy_work);
8465 
8466 	wiphy = LWIPHY_TO_WIPHY(lwiphy);
8467 
8468 	mutex_init(&wiphy->mtx);
8469 	TODO();
8470 
8471 	return (wiphy);
8472 }
8473 
8474 void
8475 linuxkpi_wiphy_free(struct wiphy *wiphy)
8476 {
8477 	struct lkpi_wiphy *lwiphy;
8478 
8479 	if (wiphy == NULL)
8480 		return;
8481 
8482 	linuxkpi_wiphy_work_flush(wiphy, NULL);
8483 	mutex_destroy(&wiphy->mtx);
8484 
8485 	lwiphy = WIPHY_TO_LWIPHY(wiphy);
8486 	LKPI_80211_LWIPHY_WORK_LOCK_DESTROY(lwiphy);
8487 
8488 	kfree(lwiphy);
8489 }
8490 
8491 static void
8492 lkpi_wiphy_band_annotate(struct wiphy *wiphy)
8493 {
8494 	int band;
8495 
8496 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
8497 		struct ieee80211_supported_band *supband;
8498 		int i;
8499 
8500 		supband = wiphy->bands[band];
8501 		if (supband == NULL)
8502 			continue;
8503 
8504 		switch (band) {
8505 		case NL80211_BAND_2GHZ:
8506 		case NL80211_BAND_5GHZ:
8507 			break;
8508 		default:
8509 #ifdef LINUXKPI_DEBUG_80211
8510 			IMPROVE("band %d(%s) not yet supported",
8511 			    band, lkpi_nl80211_band_name(band));
8512 			/* For bands added here, also check lkpi_lsta_alloc(). */
8513 #endif
8514 			continue;
8515 		}
8516 
8517 		for (i = 0; i < supband->n_bitrates; i++) {
8518 			switch (band) {
8519 			case NL80211_BAND_2GHZ:
8520 				switch (supband->bitrates[i].bitrate) {
8521 				case 110:
8522 				case 55:
8523 				case 20:
8524 				case 10:
8525 					supband->bitrates[i].flags |=
8526 					    IEEE80211_RATE_MANDATORY_B;
8527 					/* FALLTHROUGH */
8528 				/* 11g only */
8529 				case 240:
8530 				case 120:
8531 				case 60:
8532 					supband->bitrates[i].flags |=
8533 					    IEEE80211_RATE_MANDATORY_G;
8534 					break;
8535 				}
8536 				break;
8537 			case NL80211_BAND_5GHZ:
8538 				switch (supband->bitrates[i].bitrate) {
8539 				case 240:
8540 				case 120:
8541 				case 60:
8542 					supband->bitrates[i].flags |=
8543 					    IEEE80211_RATE_MANDATORY_A;
8544 					break;
8545 				}
8546 				break;
8547 			}
8548 		}
8549 	}
8550 }
8551 
8552 int
8553 linuxkpi_80211_wiphy_register(struct wiphy *wiphy)
8554 {
8555 	TODO("Lots of checks and initialization");
8556 
8557 	lkpi_wiphy_band_annotate(wiphy);
8558 
8559 	return (0);
8560 }
8561 
8562 static uint32_t
8563 lkpi_cfg80211_calculate_bitrate_ht(struct rate_info *rate)
8564 {
8565 	TODO("cfg80211_calculate_bitrate_ht");
8566 	return (rate->legacy);
8567 }
8568 
8569 static uint32_t
8570 lkpi_cfg80211_calculate_bitrate_vht(struct rate_info *rate)
8571 {
8572 	TODO("cfg80211_calculate_bitrate_vht");
8573 	return (rate->legacy);
8574 }
8575 
8576 uint32_t
8577 linuxkpi_cfg80211_calculate_bitrate(struct rate_info *rate)
8578 {
8579 
8580 	/* Beware: order! */
8581 	if (rate->flags & RATE_INFO_FLAGS_MCS)
8582 		return (lkpi_cfg80211_calculate_bitrate_ht(rate));
8583 
8584 	if (rate->flags & RATE_INFO_FLAGS_VHT_MCS)
8585 		return (lkpi_cfg80211_calculate_bitrate_vht(rate));
8586 
8587 	IMPROVE("HE/EHT/...");
8588 
8589 	return (rate->legacy);
8590 }
8591 
8592 uint32_t
8593 linuxkpi_ieee80211_channel_to_frequency(uint32_t channel,
8594     enum nl80211_band band)
8595 {
8596 
8597 	switch (band) {
8598 	case NL80211_BAND_2GHZ:
8599 		return (ieee80211_ieee2mhz(channel, IEEE80211_CHAN_2GHZ));
8600 		break;
8601 	case NL80211_BAND_5GHZ:
8602 		return (ieee80211_ieee2mhz(channel, IEEE80211_CHAN_5GHZ));
8603 		break;
8604 	default:
8605 		/* XXX abort, retry, error, panic? */
8606 		break;
8607 	}
8608 
8609 	return (0);
8610 }
8611 
8612 uint32_t
8613 linuxkpi_ieee80211_frequency_to_channel(uint32_t freq, uint32_t flags __unused)
8614 {
8615 
8616 	return (ieee80211_mhz2ieee(freq, 0));
8617 }
8618 
8619 #if 0
8620 static struct lkpi_sta *
8621 lkpi_find_lsta_by_ni(struct lkpi_vif *lvif, struct ieee80211_node *ni)
8622 {
8623 	struct lkpi_sta *lsta, *temp;
8624 
8625 	rcu_read_lock();
8626 	list_for_each_entry_rcu(lsta, &lvif->lsta_list, lsta_list) {
8627 		if (lsta->ni == ni) {
8628 			rcu_read_unlock();
8629 			return (lsta);
8630 		}
8631 	}
8632 	rcu_read_unlock();
8633 
8634 	return (NULL);
8635 }
8636 #endif
8637 
8638 struct ieee80211_sta *
8639 linuxkpi_ieee80211_find_sta(struct ieee80211_vif *vif, const u8 *peer)
8640 {
8641 	struct lkpi_vif *lvif;
8642 	struct lkpi_sta *lsta;
8643 	struct ieee80211_sta *sta;
8644 
8645 	lvif = VIF_TO_LVIF(vif);
8646 
8647 	rcu_read_lock();
8648 	list_for_each_entry_rcu(lsta, &lvif->lsta_list, lsta_list) {
8649 		sta = LSTA_TO_STA(lsta);
8650 		if (IEEE80211_ADDR_EQ(sta->addr, peer)) {
8651 			rcu_read_unlock();
8652 			return (sta);
8653 		}
8654 	}
8655 	rcu_read_unlock();
8656 	return (NULL);
8657 }
8658 
8659 struct ieee80211_sta *
8660 linuxkpi_ieee80211_find_sta_by_ifaddr(struct ieee80211_hw *hw,
8661     const uint8_t *addr, const uint8_t *ourvifaddr)
8662 {
8663 	struct lkpi_hw *lhw;
8664 	struct lkpi_vif *lvif;
8665 	struct lkpi_sta *lsta;
8666 	struct ieee80211_vif *vif;
8667 	struct ieee80211_sta *sta;
8668 
8669 	lhw = wiphy_priv(hw->wiphy);
8670 	sta = NULL;
8671 
8672 	LKPI_80211_LHW_LVIF_LOCK(lhw);
8673 	TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
8674 
8675 		/* XXX-BZ check our address from the vif. */
8676 
8677 		vif = LVIF_TO_VIF(lvif);
8678 		if (ourvifaddr != NULL &&
8679 		    !IEEE80211_ADDR_EQ(vif->addr, ourvifaddr))
8680 			continue;
8681 		sta = linuxkpi_ieee80211_find_sta(vif, addr);
8682 		if (sta != NULL)
8683 			break;
8684 	}
8685 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
8686 
8687 	if (sta != NULL) {
8688 		lsta = STA_TO_LSTA(sta);
8689 		if (!lsta->added_to_drv)
8690 			return (NULL);
8691 	}
8692 
8693 	return (sta);
8694 }
8695 
8696 struct sk_buff *
8697 linuxkpi_ieee80211_tx_dequeue(struct ieee80211_hw *hw,
8698     struct ieee80211_txq *txq)
8699 {
8700 	struct lkpi_txq *ltxq;
8701 	struct lkpi_vif *lvif;
8702 	struct sk_buff *skb;
8703 
8704 	IMPROVE("wiphy_lock? or assert?");
8705 	skb = NULL;
8706 	ltxq = TXQ_TO_LTXQ(txq);
8707 	ltxq->flags |= LKPI_TXQ_SEEN_DEQUEUE;
8708 
8709 	if ((ltxq->flags & (LKPI_TXQ_STOPPED|LKPI_TXQ_STOPPED_BA)) != 0)
8710 		goto stopped;
8711 
8712 	lvif = VIF_TO_LVIF(ltxq->txq.vif);
8713 	if (lvif->hw_queue_stopped[ltxq->txq.ac]) {
8714 		ltxq->flags |= LKPI_TXQ_STOPPED;
8715 		goto stopped;
8716 	}
8717 
8718 	IMPROVE("hw(TX_FRAG_LIST)");
8719 
8720 	LKPI_80211_LTXQ_LOCK(ltxq);
8721 	skb = skb_dequeue(&ltxq->skbq);
8722 	if (skb != NULL)
8723 		ltxq->frms_dequeued++;
8724 	LKPI_80211_LTXQ_UNLOCK(ltxq);
8725 
8726 stopped:
8727 	return (skb);
8728 }
8729 
8730 void
8731 linuxkpi_ieee80211_txq_get_depth(struct ieee80211_txq *txq,
8732     unsigned long *frame_cnt, unsigned long *byte_cnt)
8733 {
8734 	struct lkpi_txq *ltxq;
8735 	struct sk_buff *skb;
8736 	unsigned long fc, bc;
8737 
8738 	ltxq = TXQ_TO_LTXQ(txq);
8739 
8740 	fc = bc = 0;
8741 	LKPI_80211_LTXQ_LOCK(ltxq);
8742 	skb_queue_walk(&ltxq->skbq, skb) {
8743 		fc++;
8744 		bc += skb->len;
8745 	}
8746 	LKPI_80211_LTXQ_UNLOCK(ltxq);
8747 	if (frame_cnt)
8748 		*frame_cnt = fc;
8749 	if (byte_cnt)
8750 		*byte_cnt = bc;
8751 
8752 	/* Validate that this is doing the correct thing. */
8753 	/* Should we keep track on en/dequeue? */
8754 	IMPROVE();
8755 }
8756 
8757 /*
8758  * We are called from ieee80211_free_txskb() or ieee80211_tx_status().
8759  * The latter tries to derive the success status from the info flags
8760  * passed back from the driver.  rawx_mit() saves the ni on the m and the
8761  * m on the skb for us to be able to give feedback to net80211.
8762  */
8763 static void
8764 _lkpi_ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb,
8765     int status)
8766 {
8767 	struct ieee80211_node *ni;
8768 	struct mbuf *m;
8769 
8770 	if (skb == NULL)
8771 		return;
8772 
8773 	m = skb->m;
8774 	skb->m = NULL;
8775 
8776 	if (m != NULL) {
8777 		ni = m->m_pkthdr.PH_loc.ptr;
8778 		/* Status: 0 is ok, != 0 is error. */
8779 		ieee80211_tx_complete(ni, m, status);
8780 		/* ni & mbuf were consumed. */
8781 	}
8782 }
8783 
8784 void
8785 linuxkpi_ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb,
8786     int status)
8787 {
8788 
8789 	_lkpi_ieee80211_free_txskb(hw, skb, status);
8790 	kfree_skb(skb);
8791 }
8792 
8793 void
8794 linuxkpi_ieee80211_tx_status_ext(struct ieee80211_hw *hw,
8795     struct ieee80211_tx_status *txstat)
8796 {
8797 	struct sk_buff *skb;
8798 	struct ieee80211_tx_info *info, _info = { };
8799 	struct ieee80211_ratectl_tx_status txs;
8800 	struct ieee80211_node *ni;
8801 	int status;
8802 
8803 	skb = txstat->skb;
8804 	if (skb != NULL && skb->m != NULL) {
8805 		struct mbuf *m;
8806 
8807 		m = skb->m;
8808 		ni = m->m_pkthdr.PH_loc.ptr;
8809 		memset(&txs, 0, sizeof(txs));
8810 	} else {
8811 		ni = NULL;
8812 	}
8813 
8814 	/*
8815 	 * If we have no info information on tx, set info to an all-zero struct
8816 	 * to make the code (and debug output) simpler.
8817 	 */
8818 	info = txstat->info;
8819 	if (info == NULL)
8820 		info = &_info;
8821 	if (info->flags & IEEE80211_TX_STAT_ACK) {
8822 		status = 0;	/* No error. */
8823 		txs.status = IEEE80211_RATECTL_TX_SUCCESS;
8824 	} else {
8825 		status = 1;
8826 		txs.status = IEEE80211_RATECTL_TX_FAIL_UNSPECIFIED;
8827 	}
8828 
8829 	if (ni != NULL) {
8830 		txs.pktlen = skb->len;
8831 		txs.flags |= IEEE80211_RATECTL_STATUS_PKTLEN;
8832 		if (info->status.rates[0].count > 1) {
8833 			txs.long_retries = info->status.rates[0].count - 1;	/* 1 + retries in drivers. */
8834 			txs.flags |= IEEE80211_RATECTL_STATUS_LONG_RETRY;
8835 		}
8836 #if 0		/* Unused in net80211 currently. */
8837 		/* XXX-BZ convert check .flags for MCS/VHT/.. */
8838 		txs.final_rate = info->status.rates[0].idx;
8839 		txs.flags |= IEEE80211_RATECTL_STATUS_FINAL_RATE;
8840 #endif
8841 		if (info->status.flags & IEEE80211_TX_STATUS_ACK_SIGNAL_VALID) {
8842 			txs.rssi = info->status.ack_signal;		/* XXX-BZ CONVERT? */
8843 			txs.flags |= IEEE80211_RATECTL_STATUS_RSSI;
8844 		}
8845 
8846 		IMPROVE("only update rate if needed but that requires us to get a proper rate from mo_sta_statistics");
8847 		ieee80211_ratectl_tx_complete(ni, &txs);
8848 		ieee80211_ratectl_rate(ni->ni_vap->iv_bss, NULL, 0);
8849 
8850 #ifdef LINUXKPI_DEBUG_80211
8851 		if (linuxkpi_debug_80211 & D80211_TRACE_TX) {
8852 			printf("TX-RATE: %s: long_retries %d\n", __func__,
8853 			    txs.long_retries);
8854 		}
8855 #endif
8856 	}
8857 
8858 #ifdef LINUXKPI_DEBUG_80211
8859 	if (linuxkpi_debug_80211 & D80211_TRACE_TX)
8860 		printf("TX-STATUS: %s: hw %p skb %p status %d : flags %b "
8861 		    "band %u hw_queue %u tx_time_est %d : "
8862 		    "rates [ %u %u %#x, %u %u %#x, %u %u %#x, %u %u %#x ] "
8863 		    "ack_signal %u ampdu_ack_len %u ampdu_len %u antenna %u "
8864 		    "tx_time %u flags %b "
8865 		    "status_driver_data [ %p %p ]\n",
8866 		    __func__, hw, skb, status, info->flags, IEEE80211_TX_INFO_FLAGS,
8867 		    info->band, info->hw_queue, info->tx_time_est,
8868 		    info->status.rates[0].idx, info->status.rates[0].count,
8869 		    info->status.rates[0].flags,
8870 		    info->status.rates[1].idx, info->status.rates[1].count,
8871 		    info->status.rates[1].flags,
8872 		    info->status.rates[2].idx, info->status.rates[2].count,
8873 		    info->status.rates[2].flags,
8874 		    info->status.rates[3].idx, info->status.rates[3].count,
8875 		    info->status.rates[3].flags,
8876 		    info->status.ack_signal, info->status.ampdu_ack_len,
8877 		    info->status.ampdu_len, info->status.antenna,
8878 		    info->status.tx_time, info->status.flags, IEEE80211_TX_STATUS_FLAGS,
8879 		    info->status.status_driver_data[0],
8880 		    info->status.status_driver_data[1]);
8881 #endif
8882 
8883 	if (txstat->free_list) {
8884 		_lkpi_ieee80211_free_txskb(hw, skb, status);
8885 		if (skb != NULL)
8886 			list_add_tail(&skb->list, txstat->free_list);
8887 	} else {
8888 		linuxkpi_ieee80211_free_txskb(hw, skb, status);
8889 	}
8890 }
8891 
8892 void
8893 linuxkpi_ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
8894 {
8895 	struct ieee80211_tx_status status;
8896 
8897 	memset(&status, 0, sizeof(status));
8898 	status.info = IEEE80211_SKB_CB(skb);
8899 	status.skb = skb;
8900 	/* sta, n_rates, rates, free_list? */
8901 
8902 	ieee80211_tx_status_ext(hw, &status);
8903 }
8904 
8905 /*
8906  * This is an internal bandaid for the moment for the way we glue
8907  * skbs and mbufs together for TX.  Once we have skbs backed by
8908  * mbufs this should go away.
8909  * This is a public function but kept on the private KPI (lkpi_)
8910  * and is not exposed by a header file.
8911  */
8912 static void
8913 lkpi_ieee80211_free_skb_mbuf(void *p)
8914 {
8915 	struct ieee80211_node *ni;
8916 	struct mbuf *m;
8917 
8918 	if (p == NULL)
8919 		return;
8920 
8921 	m = (struct mbuf *)p;
8922 	M_ASSERTPKTHDR(m);
8923 
8924 	ni = m->m_pkthdr.PH_loc.ptr;
8925 	m->m_pkthdr.PH_loc.ptr = NULL;
8926 	if (ni != NULL)
8927 		ieee80211_free_node(ni);
8928 	m_freem(m);
8929 }
8930 
8931 void
8932 linuxkpi_ieee80211_queue_delayed_work(struct ieee80211_hw *hw,
8933     struct delayed_work *w, int delay)
8934 {
8935 	struct lkpi_hw *lhw;
8936 
8937 	/* Need to make sure hw is in a stable (non-suspended) state. */
8938 	IMPROVE();
8939 
8940 	lhw = HW_TO_LHW(hw);
8941 	queue_delayed_work(lhw->workq, w, delay);
8942 }
8943 
8944 void
8945 linuxkpi_ieee80211_queue_work(struct ieee80211_hw *hw,
8946     struct work_struct *w)
8947 {
8948 	struct lkpi_hw *lhw;
8949 
8950 	/* Need to make sure hw is in a stable (non-suspended) state. */
8951 	IMPROVE();
8952 
8953 	lhw = HW_TO_LHW(hw);
8954 	queue_work(lhw->workq, w);
8955 }
8956 
8957 struct sk_buff *
8958 linuxkpi_ieee80211_probereq_get(struct ieee80211_hw *hw, const uint8_t *addr,
8959     const uint8_t *ssid, size_t ssid_len, size_t tailroom)
8960 {
8961 	struct sk_buff *skb;
8962 	struct ieee80211_frame *wh;
8963 	uint8_t *p;
8964 	size_t len;
8965 
8966 	len = sizeof(*wh);
8967 	len += 2 + ssid_len;
8968 
8969 	skb = dev_alloc_skb(hw->extra_tx_headroom + len + tailroom);
8970 	if (skb == NULL)
8971 		return (NULL);
8972 
8973 	skb_reserve(skb, hw->extra_tx_headroom);
8974 
8975 	wh = skb_put_zero(skb, sizeof(*wh));
8976 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0;
8977 	wh->i_fc[0] |= IEEE80211_FC0_SUBTYPE_PROBE_REQ | IEEE80211_FC0_TYPE_MGT;
8978 	IEEE80211_ADDR_COPY(wh->i_addr1, ieee80211broadcastaddr);
8979 	IEEE80211_ADDR_COPY(wh->i_addr2, addr);
8980 	IEEE80211_ADDR_COPY(wh->i_addr3, ieee80211broadcastaddr);
8981 
8982 	p = skb_put(skb, 2 + ssid_len);
8983 	*p++ = IEEE80211_ELEMID_SSID;
8984 	*p++ = ssid_len;
8985 	if (ssid_len > 0)
8986 		memcpy(p, ssid, ssid_len);
8987 
8988 	return (skb);
8989 }
8990 
8991 struct sk_buff *
8992 linuxkpi_ieee80211_pspoll_get(struct ieee80211_hw *hw,
8993     struct ieee80211_vif *vif)
8994 {
8995 	struct lkpi_vif *lvif;
8996 	struct ieee80211vap *vap;
8997 	struct sk_buff *skb;
8998 	struct ieee80211_frame_pspoll *psp;
8999 	uint16_t v;
9000 
9001 	skb = dev_alloc_skb(hw->extra_tx_headroom + sizeof(*psp));
9002 	if (skb == NULL)
9003 		return (NULL);
9004 
9005 	skb_reserve(skb, hw->extra_tx_headroom);
9006 
9007 	lvif = VIF_TO_LVIF(vif);
9008 	vap = LVIF_TO_VAP(lvif);
9009 
9010 	psp = skb_put_zero(skb, sizeof(*psp));
9011 	psp->i_fc[0] = IEEE80211_FC0_VERSION_0;
9012 	psp->i_fc[0] |= IEEE80211_FC0_SUBTYPE_PS_POLL | IEEE80211_FC0_TYPE_CTL;
9013 	v = htole16(vif->cfg.aid | 1<<15 | 1<<16);
9014 	memcpy(&psp->i_aid, &v, sizeof(v));
9015 	IEEE80211_ADDR_COPY(psp->i_bssid, vap->iv_bss->ni_macaddr);
9016 	IEEE80211_ADDR_COPY(psp->i_ta, vif->addr);
9017 
9018 	return (skb);
9019 }
9020 
9021 struct sk_buff *
9022 linuxkpi_ieee80211_nullfunc_get(struct ieee80211_hw *hw,
9023     struct ieee80211_vif *vif, int linkid, bool qos)
9024 {
9025 	struct sk_buff *skb;
9026 	struct ieee80211_frame *nullf;
9027 
9028 	IMPROVE("linkid");
9029 
9030 	skb = dev_alloc_skb(hw->extra_tx_headroom + sizeof(*nullf));
9031 	if (skb == NULL)
9032 		return (NULL);
9033 
9034 	skb_reserve(skb, hw->extra_tx_headroom);
9035 
9036 	nullf = skb_put_zero(skb, sizeof(*nullf));
9037 	nullf->i_fc[0] = IEEE80211_FC0_VERSION_0;
9038 	nullf->i_fc[0] |= IEEE80211_FC0_SUBTYPE_NODATA | IEEE80211_FC0_TYPE_DATA;
9039 	nullf->i_fc[1] = IEEE80211_FC1_DIR_TODS;
9040 
9041 	/* XXX-BZ if link is given, this is different. */
9042 	IEEE80211_ADDR_COPY(nullf->i_addr1, vif->cfg.ap_addr);
9043 	IEEE80211_ADDR_COPY(nullf->i_addr2, vif->addr);
9044 	IEEE80211_ADDR_COPY(nullf->i_addr3, vif->cfg.ap_addr);
9045 
9046 	return (skb);
9047 }
9048 
9049 struct wireless_dev *
9050 linuxkpi_ieee80211_vif_to_wdev(struct ieee80211_vif *vif)
9051 {
9052 	struct lkpi_vif *lvif;
9053 
9054 	lvif = VIF_TO_LVIF(vif);
9055 	return (&lvif->wdev);
9056 }
9057 
9058 void
9059 linuxkpi_ieee80211_connection_loss(struct ieee80211_vif *vif)
9060 {
9061 	struct lkpi_vif *lvif;
9062 	struct ieee80211vap *vap;
9063 	enum ieee80211_state nstate;
9064 	int arg;
9065 
9066 	lvif = VIF_TO_LVIF(vif);
9067 	vap = LVIF_TO_VAP(lvif);
9068 
9069 	/*
9070 	 * Go to init; otherwise we need to elaborately check state and
9071 	 * handle accordingly, e.g., if in RUN we could call iv_bmiss.
9072 	 * Let the statemachine handle all neccessary changes.
9073 	 */
9074 	nstate = IEEE80211_S_INIT;
9075 	arg = 0;	/* Not a valid reason. */
9076 
9077 	ic_printf(vap->iv_ic, "%s: vif %p vap %p state %s (synched %d, assoc %d "
9078 	    "beacons %d dtim_period %d)\n", __func__, vif, vap,
9079 	    ieee80211_state_name[vap->iv_state],
9080 	    lvif->lvif_bss_synched, vif->cfg.assoc, lvif->beacons,
9081 	    vif->bss_conf.dtim_period);
9082 	ieee80211_new_state(vap, nstate, arg);
9083 }
9084 
9085 void
9086 linuxkpi_ieee80211_beacon_loss(struct ieee80211_vif *vif)
9087 {
9088 	struct lkpi_vif *lvif;
9089 	struct ieee80211vap *vap;
9090 
9091 	lvif = VIF_TO_LVIF(vif);
9092 	vap = LVIF_TO_VAP(lvif);
9093 
9094 	ic_printf(vap->iv_ic, "%s: vif %p vap %p state %s (synched %d, assoc %d "
9095 	    "beacons %d dtim_period %d)\n", __func__, vif, vap,
9096 	    ieee80211_state_name[vap->iv_state],
9097 	    lvif->lvif_bss_synched, vif->cfg.assoc, lvif->beacons,
9098 	    vif->bss_conf.dtim_period);
9099 	ieee80211_beacon_miss(vap->iv_ic);
9100 }
9101 
9102 /* -------------------------------------------------------------------------- */
9103 
9104 void
9105 linuxkpi_ieee80211_stop_queue(struct ieee80211_hw *hw, int qnum)
9106 {
9107 	struct lkpi_hw *lhw;
9108 	struct lkpi_vif *lvif;
9109 	struct ieee80211_vif *vif;
9110 	int ac_count, ac;
9111 
9112 	KASSERT(qnum < hw->queues, ("%s: qnum %d >= hw->queues %d, hw %p\n",
9113 	    __func__, qnum, hw->queues, hw));
9114 
9115 	lhw = wiphy_priv(hw->wiphy);
9116 
9117 	/* See lkpi_ic_vap_create(). */
9118 	if (hw->queues >= IEEE80211_NUM_ACS)
9119 		ac_count = IEEE80211_NUM_ACS;
9120 	else
9121 		ac_count = 1;
9122 
9123 	LKPI_80211_LHW_LVIF_LOCK(lhw);
9124 	TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
9125 
9126 		vif = LVIF_TO_VIF(lvif);
9127 		for (ac = 0; ac < ac_count; ac++) {
9128 			IMPROVE_TXQ("LOCKING");
9129 			if (qnum == vif->hw_queue[ac]) {
9130 #ifdef LINUXKPI_DEBUG_80211
9131 				/*
9132 				 * For now log this to better understand
9133 				 * how this is supposed to work.
9134 				 */
9135 				if (lvif->hw_queue_stopped[ac] &&
9136 				    (linuxkpi_debug_80211 & D80211_IMPROVE_TXQ) != 0)
9137 					ic_printf(lhw->ic, "%s:%d: lhw %p hw %p "
9138 					    "lvif %p vif %p ac %d qnum %d already "
9139 					    "stopped\n", __func__, __LINE__,
9140 					    lhw, hw, lvif, vif, ac, qnum);
9141 #endif
9142 				lvif->hw_queue_stopped[ac] = true;
9143 			}
9144 		}
9145 	}
9146 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
9147 }
9148 
9149 void
9150 linuxkpi_ieee80211_stop_queues(struct ieee80211_hw *hw)
9151 {
9152 	int i;
9153 
9154 	IMPROVE_TXQ("Locking; do we need further info?");
9155 	for (i = 0; i < hw->queues; i++)
9156 		linuxkpi_ieee80211_stop_queue(hw, i);
9157 }
9158 
9159 
9160 static void
9161 lkpi_ieee80211_wake_queues(struct ieee80211_hw *hw, int hwq)
9162 {
9163 	struct lkpi_hw *lhw;
9164 	struct lkpi_vif *lvif;
9165 	struct lkpi_sta *lsta;
9166 	int ac_count, ac, tid;
9167 
9168 	/* See lkpi_ic_vap_create(). */
9169 	if (hw->queues >= IEEE80211_NUM_ACS)
9170 		ac_count = IEEE80211_NUM_ACS;
9171 	else
9172 		ac_count = 1;
9173 
9174 	lhw = wiphy_priv(hw->wiphy);
9175 
9176 	IMPROVE_TXQ("Locking");
9177 	LKPI_80211_LHW_LVIF_LOCK(lhw);
9178 	TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
9179 		struct ieee80211_vif *vif;
9180 
9181 		vif = LVIF_TO_VIF(lvif);
9182 		for (ac = 0; ac < ac_count; ac++) {
9183 
9184 			if (hwq == vif->hw_queue[ac]) {
9185 
9186 				/* XXX-BZ what about software scan? */
9187 
9188 #ifdef LINUXKPI_DEBUG_80211
9189 				/*
9190 				 * For now log this to better understand
9191 				 * how this is supposed to work.
9192 				 */
9193 				if (!lvif->hw_queue_stopped[ac] &&
9194 				    (linuxkpi_debug_80211 & D80211_IMPROVE_TXQ) != 0)
9195 					ic_printf(lhw->ic, "%s:%d: lhw %p hw %p "
9196 					    "lvif %p vif %p ac %d hw_q not stopped\n",
9197 					    __func__, __LINE__,
9198 					    lhw, hw, lvif, vif, ac);
9199 #endif
9200 				lvif->hw_queue_stopped[ac] = false;
9201 
9202 				rcu_read_lock();
9203 				list_for_each_entry_rcu(lsta, &lvif->lsta_list, lsta_list) {
9204 					struct ieee80211_sta *sta;
9205 
9206 					sta = LSTA_TO_STA(lsta);
9207 					for (tid = 0; tid < nitems(sta->txq); tid++) {
9208 						struct lkpi_txq *ltxq;
9209 
9210 						if (sta->txq[tid] == NULL)
9211 							continue;
9212 
9213 						if (sta->txq[tid]->ac != ac)
9214 							continue;
9215 
9216 						ltxq = TXQ_TO_LTXQ(sta->txq[tid]);
9217 						if ((ltxq->flags & LKPI_TXQ_STOPPED) == 0)
9218 							continue;
9219 
9220 						ltxq->flags &= ~LKPI_TXQ_STOPPED;
9221 
9222 						if (!skb_queue_empty(&ltxq->skbq))
9223 							lkpi_80211_mo_wake_tx_queue(hw, sta->txq[tid], false);
9224 					}
9225 				}
9226 				rcu_read_unlock();
9227 			}
9228 		}
9229 	}
9230 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
9231 }
9232 
9233 static void
9234 lkpi_ieee80211_wake_queues_locked(struct ieee80211_hw *hw)
9235 {
9236 	int i;
9237 
9238 	IMPROVE_TXQ("Is this all/enough here?");
9239 	for (i = 0; i < hw->queues; i++)
9240 		lkpi_ieee80211_wake_queues(hw, i);
9241 }
9242 
9243 void
9244 linuxkpi_ieee80211_wake_queues(struct ieee80211_hw *hw)
9245 {
9246 	struct lkpi_hw *lhw;
9247 	unsigned long flags;
9248 
9249 	lhw = HW_TO_LHW(hw);
9250 
9251 	spin_lock_irqsave(&lhw->txq_lock, flags);
9252 	lkpi_ieee80211_wake_queues_locked(hw);
9253 	spin_unlock_irqrestore(&lhw->txq_lock, flags);
9254 }
9255 
9256 void
9257 linuxkpi_ieee80211_wake_queue(struct ieee80211_hw *hw, int qnum)
9258 {
9259 	struct lkpi_hw *lhw;
9260 	unsigned long flags;
9261 
9262 	KASSERT(qnum < hw->queues, ("%s: qnum %d >= hw->queues %d, hw %p\n",
9263 	    __func__, qnum, hw->queues, hw));
9264 
9265 	lhw = HW_TO_LHW(hw);
9266 
9267 	spin_lock_irqsave(&lhw->txq_lock, flags);
9268 	lkpi_ieee80211_wake_queues(hw, qnum);
9269 	spin_unlock_irqrestore(&lhw->txq_lock, flags);
9270 }
9271 
9272 void
9273 linuxkpi_ieee80211_handle_wake_tx_queue(struct ieee80211_hw *hw,
9274     struct ieee80211_txq *txq)
9275 {
9276 	struct lkpi_hw *lhw;
9277 
9278 	lhw = HW_TO_LHW(hw);
9279 
9280 	LKPI_80211_LHW_TXQ_LOCK(lhw);
9281 	ieee80211_txq_schedule_start(hw, txq->ac);
9282 	do {
9283 		struct lkpi_txq *ltxq;
9284 		struct ieee80211_txq *ntxq;
9285 		struct ieee80211_tx_control control;
9286 		struct sk_buff *skb;
9287 
9288 		ntxq = ieee80211_next_txq(hw, txq->ac);
9289 		if (ntxq == NULL)
9290 			break;
9291 		ltxq = TXQ_TO_LTXQ(ntxq);
9292 
9293 		memset(&control, 0, sizeof(control));
9294 		control.sta = ntxq->sta;
9295 		do {
9296 			skb = linuxkpi_ieee80211_tx_dequeue(hw, ntxq);
9297 			if (skb == NULL)
9298 				break;
9299 			ltxq->frms_tx++;
9300 			lkpi_80211_mo_tx(hw, &control, skb);
9301 		} while(1);
9302 
9303 		ieee80211_return_txq(hw, ntxq, false);
9304 	} while (1);
9305 	ieee80211_txq_schedule_end(hw, txq->ac);
9306 	LKPI_80211_LHW_TXQ_UNLOCK(lhw);
9307 }
9308 
9309 /* -------------------------------------------------------------------------- */
9310 
9311 /* This is just hardware queues. */
9312 /*
9313  * Being called from the driver thus use _bh() locking.
9314  */
9315 void
9316 linuxkpi_ieee80211_txq_schedule_start(struct ieee80211_hw *hw, uint8_t ac)
9317 {
9318 	struct lkpi_hw *lhw;
9319 
9320 	lhw = HW_TO_LHW(hw);
9321 
9322 	if (ac >= IEEE80211_NUM_ACS) {
9323 		ic_printf(lhw->ic, "%s: ac %u out of bounds.\n", __func__, ac);
9324 		return;
9325 	}
9326 
9327 	spin_lock_bh(&lhw->txq_scheduled_lock[ac]);
9328 	IMPROVE("check AIRTIME_FAIRNESS");
9329 	if (++lhw->txq_generation[ac] == 0)
9330 		lhw->txq_generation[ac]++;
9331 	spin_unlock_bh(&lhw->txq_scheduled_lock[ac]);
9332 }
9333 
9334 struct ieee80211_txq *
9335 linuxkpi_ieee80211_next_txq(struct ieee80211_hw *hw, uint8_t ac)
9336 {
9337 	struct lkpi_hw *lhw;
9338 	struct ieee80211_txq *txq;
9339 	struct lkpi_txq *ltxq;
9340 
9341 	lhw = HW_TO_LHW(hw);
9342 	txq = NULL;
9343 
9344 	if (ac >= IEEE80211_NUM_ACS) {
9345 		ic_printf(lhw->ic, "%s: ac %u out of bounds.\n", __func__, ac);
9346 		return (NULL);
9347 	}
9348 
9349 	spin_lock_bh(&lhw->txq_scheduled_lock[ac]);
9350 
9351 	/* Check that we are scheduled. */
9352 	if (lhw->txq_generation[ac] == 0)
9353 		goto out;
9354 
9355 	ltxq = TAILQ_FIRST(&lhw->txq_scheduled[ac]);
9356 	if (ltxq == NULL)
9357 		goto out;
9358 	if (ltxq->txq_generation == lhw->txq_generation[ac])
9359 		goto out;
9360 	if ((ltxq->flags & (LKPI_TXQ_STOPPED|LKPI_TXQ_STOPPED_BA)) != 0)
9361 		goto out;
9362 
9363 	IMPROVE("check AIRTIME_FAIRNESS");
9364 
9365 	TAILQ_REMOVE(&lhw->txq_scheduled[ac], ltxq, txq_entry);
9366 	ltxq->txq_generation = lhw->txq_generation[ac];
9367 	txq = &ltxq->txq;
9368 	TAILQ_ELEM_INIT(ltxq, txq_entry);
9369 
9370 out:
9371 	spin_unlock_bh(&lhw->txq_scheduled_lock[ac]);
9372 
9373 	return (txq);
9374 }
9375 
9376 void linuxkpi_ieee80211_schedule_txq(struct ieee80211_hw *hw,
9377     struct ieee80211_txq *txq, bool withoutpkts)
9378 {
9379 	struct lkpi_hw *lhw;
9380 	struct lkpi_txq *ltxq;
9381 	bool ltxq_empty;
9382 
9383 	ltxq = TXQ_TO_LTXQ(txq);
9384 
9385 	/* Only schedule if work to do or asked to anyway. */
9386 	LKPI_80211_LTXQ_LOCK(ltxq);
9387 	ltxq_empty = skb_queue_empty(&ltxq->skbq);
9388 	LKPI_80211_LTXQ_UNLOCK(ltxq);
9389 	if (!withoutpkts && ltxq_empty)
9390 		goto out;
9391 
9392 	lhw = HW_TO_LHW(hw);
9393 	spin_lock_bh(&lhw->txq_scheduled_lock[txq->ac]);
9394 	/*
9395 	 * Make sure we do not double-schedule. We do this by checking tqe_prev,
9396 	 * the previous entry in our tailq. tqe_prev is always valid if this entry
9397 	 * is queued, tqe_next may be NULL if this is the only element in the list.
9398 	 */
9399 	if (ltxq->txq_entry.tqe_prev != NULL)
9400 		goto unlock;
9401 
9402 	TAILQ_INSERT_TAIL(&lhw->txq_scheduled[txq->ac], ltxq, txq_entry);
9403 unlock:
9404 	spin_unlock_bh(&lhw->txq_scheduled_lock[txq->ac]);
9405 
9406 out:
9407 	return;
9408 }
9409 
9410 /* -------------------------------------------------------------------------- */
9411 
9412 struct lkpi_cfg80211_bss {
9413 	u_int refcnt;
9414 	struct cfg80211_bss bss;
9415 };
9416 
9417 struct lkpi_cfg80211_get_bss_iter_lookup {
9418 	struct wiphy *wiphy;
9419 	struct linuxkpi_ieee80211_channel *chan;
9420 	const uint8_t *bssid;
9421 	const uint8_t *ssid;
9422 	size_t ssid_len;
9423 	enum ieee80211_bss_type bss_type;
9424 	enum ieee80211_privacy privacy;
9425 
9426 	/*
9427 	 * Something to store a copy of the result as the net80211 scan cache
9428 	 * is not refoucnted so a scan entry might go away any time.
9429 	 */
9430 	bool match;
9431 	struct cfg80211_bss *bss;
9432 };
9433 
9434 static void
9435 lkpi_cfg80211_get_bss_iterf(void *arg, const struct ieee80211_scan_entry *se)
9436 {
9437 	struct lkpi_cfg80211_get_bss_iter_lookup *lookup;
9438 	size_t ielen;
9439 
9440 	lookup = arg;
9441 
9442 	/* Do not try to find another match. */
9443 	if (lookup->match)
9444 		return;
9445 
9446 	/* Nothing to store result. */
9447 	if (lookup->bss == NULL)
9448 		return;
9449 
9450 	if (lookup->privacy != IEEE80211_PRIVACY_ANY) {
9451 		/* if (se->se_capinfo & IEEE80211_CAPINFO_PRIVACY) */
9452 		/* We have no idea what to compare to as the drivers only request ANY */
9453 		return;
9454 	}
9455 
9456 	if (lookup->bss_type != IEEE80211_BSS_TYPE_ANY) {
9457 		/* if (se->se_capinfo & (IEEE80211_CAPINFO_IBSS|IEEE80211_CAPINFO_ESS)) */
9458 		/* We have no idea what to compare to as the drivers only request ANY */
9459 		return;
9460 	}
9461 
9462 	if (lookup->chan != NULL) {
9463 		struct linuxkpi_ieee80211_channel *chan;
9464 
9465 		chan = linuxkpi_ieee80211_get_channel(lookup->wiphy,
9466 		    se->se_chan->ic_freq);
9467 		if (chan == NULL || chan != lookup->chan)
9468 			return;
9469 	}
9470 
9471 	if (lookup->bssid && !IEEE80211_ADDR_EQ(lookup->bssid, se->se_bssid))
9472 		return;
9473 
9474 	if (lookup->ssid) {
9475 		if (lookup->ssid_len != se->se_ssid[1] ||
9476 		    se->se_ssid[1] == 0)
9477 			return;
9478 		if (memcmp(lookup->ssid, se->se_ssid+2, lookup->ssid_len) != 0)
9479 			return;
9480 	}
9481 
9482 	ielen = se->se_ies.len;
9483 
9484 	lookup->bss->ies = malloc(sizeof(*lookup->bss->ies) + ielen,
9485 	    M_LKPI80211, M_NOWAIT | M_ZERO);
9486 	if (lookup->bss->ies == NULL)
9487 		return;
9488 
9489 	lookup->bss->ies->data = (uint8_t *)lookup->bss->ies + sizeof(*lookup->bss->ies);
9490 	lookup->bss->ies->len = ielen;
9491 	if (ielen)
9492 		memcpy(lookup->bss->ies->data, se->se_ies.data, ielen);
9493 
9494 	lookup->match = true;
9495 }
9496 
9497 struct cfg80211_bss *
9498 linuxkpi_cfg80211_get_bss(struct wiphy *wiphy, struct linuxkpi_ieee80211_channel *chan,
9499     const uint8_t *bssid, const uint8_t *ssid, size_t ssid_len,
9500     enum ieee80211_bss_type bss_type, enum ieee80211_privacy privacy)
9501 {
9502 	struct lkpi_cfg80211_bss *lbss;
9503 	struct lkpi_cfg80211_get_bss_iter_lookup lookup;
9504 	struct lkpi_hw *lhw;
9505 	struct ieee80211vap *vap;
9506 
9507 	lhw = wiphy_priv(wiphy);
9508 
9509 	/* Let's hope we can alloc. */
9510 	lbss = malloc(sizeof(*lbss), M_LKPI80211, M_NOWAIT | M_ZERO);
9511 	if (lbss == NULL) {
9512 		ic_printf(lhw->ic, "%s: alloc failed.\n", __func__);
9513 		return (NULL);
9514 	}
9515 
9516 	lookup.wiphy = wiphy;
9517 	lookup.chan = chan;
9518 	lookup.bssid = bssid;
9519 	lookup.ssid = ssid;
9520 	lookup.ssid_len = ssid_len;
9521 	lookup.bss_type = bss_type;
9522 	lookup.privacy = privacy;
9523 	lookup.match = false;
9524 	lookup.bss = &lbss->bss;
9525 
9526 	IMPROVE("Iterate over all VAPs comparing perm_addr and addresses?");
9527 	vap = TAILQ_FIRST(&lhw->ic->ic_vaps);
9528 	ieee80211_scan_iterate(vap, lkpi_cfg80211_get_bss_iterf, &lookup);
9529 	if (!lookup.match) {
9530 		free(lbss, M_LKPI80211);
9531 		return (NULL);
9532 	}
9533 
9534 	refcount_init(&lbss->refcnt, 1);
9535 	return (&lbss->bss);
9536 }
9537 
9538 void
9539 linuxkpi_cfg80211_put_bss(struct wiphy *wiphy, struct cfg80211_bss *bss)
9540 {
9541 	struct lkpi_cfg80211_bss *lbss;
9542 
9543 	lbss = container_of(bss, struct lkpi_cfg80211_bss, bss);
9544 
9545 	/* Free everything again on refcount ... */
9546 	if (refcount_release(&lbss->refcnt)) {
9547 		free(lbss->bss.ies, M_LKPI80211);
9548 		free(lbss, M_LKPI80211);
9549 	}
9550 }
9551 
9552 void
9553 linuxkpi_cfg80211_bss_flush(struct wiphy *wiphy)
9554 {
9555 	struct lkpi_hw *lhw;
9556 	struct ieee80211com *ic;
9557 	struct ieee80211vap *vap;
9558 
9559 	lhw = wiphy_priv(wiphy);
9560 	ic = lhw->ic;
9561 
9562 	/*
9563 	 * If we haven't called ieee80211_ifattach() yet
9564 	 * or there is no VAP, there are no scans to flush.
9565 	 */
9566 	if (ic == NULL ||
9567 	    (lhw->sc_flags & LKPI_MAC80211_DRV_STARTED) == 0)
9568 		return;
9569 
9570 	/* Should only happen on the current one? Not seen it late enough. */
9571 	IEEE80211_LOCK(ic);
9572 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
9573 		ieee80211_scan_flush(vap);
9574 	IEEE80211_UNLOCK(ic);
9575 }
9576 
9577 /* -------------------------------------------------------------------------- */
9578 
9579 static bool
9580 cfg80211_chan_def_are_same(struct cfg80211_chan_def *cd1,
9581     struct cfg80211_chan_def *cd2)
9582 {
9583 
9584 	if (cd1 == cd2)
9585 		return (true);
9586 
9587 	if (cd1 == NULL || cd2 == NULL)
9588 		return (false);
9589 
9590 	if (cd1->chan != cd2->chan)
9591 		return (false);
9592 
9593 	if (cd1->width != cd2->width)
9594 		return (false);
9595 
9596 	if (cd1->center_freq1 != cd2->center_freq1)
9597 		return (false);
9598 
9599 	if (cd1->center_freq2 != cd2->center_freq2)
9600 		return (false);
9601 
9602 	if (cd1->punctured != cd2->punctured)
9603 		return (false);
9604 
9605 	return (true);
9606 }
9607 
9608 /*
9609  * hw->conf get initialized/set in various places for us:
9610  * - linuxkpi_ieee80211_alloc_hw(): flags
9611  * - linuxkpi_ieee80211_ifattach(): chandef
9612  * - lkpi_ic_vap_create(): listen_interval
9613  * - lkpi_ic_set_channel(): chandef, flags
9614  */
9615 
9616 static int
9617 lkpi_80211_update_chandef(struct ieee80211_hw *hw,
9618     struct ieee80211_chanctx_conf *new)
9619 {
9620 	struct lkpi_hw *lhw;
9621 	struct cfg80211_chan_def *cd;
9622 	uint32_t changed;
9623 	int error;
9624 	bool same;
9625 
9626 	lockdep_assert_wiphy(hw->wiphy);
9627 
9628 	lhw = HW_TO_LHW(hw);
9629 	if (!lhw->emulate_chanctx)
9630 		return (0);
9631 
9632 	if (new == NULL || new->def.chan == NULL) {
9633 		/*
9634 		 * In case of remove "new" is NULL, we need to get us to some
9635 		 * basic channel width but we'd also need to set the channel
9636 		 * accordingly somewhere.
9637 		 * The same is true if we are scanning in which case the
9638 		 * scan_chandef should have a channel set.
9639 		 */
9640 		if (lhw->scan_chandef.chan != NULL) {
9641 #ifdef LINUXKPI_DEBUG_80211
9642 			if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
9643 				ic_printf(lhw->ic, "%s:%d: using scan_chandef %p\n",
9644 				    __func__, __LINE__, &lhw->scan_chandef);
9645 #endif
9646 			cd = &lhw->scan_chandef;
9647 		} else {
9648 #ifdef LINUXKPI_DEBUG_80211
9649 			if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
9650 				ic_printf(lhw->ic, "%s:%d: using dflt_chandef %p\n",
9651 				    __func__, __LINE__, &lhw->dflt_chandef);
9652 #endif
9653 			cd = &lhw->dflt_chandef;
9654 		}
9655 	} else {
9656 #ifdef LINUXKPI_DEBUG_80211
9657 		if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
9658 			ic_printf(lhw->ic, "%s:%d: using chanctx %p chandef %p\n",
9659 			    __func__, __LINE__, new, &new->def);
9660 #endif
9661 		cd = &new->def;
9662 	}
9663 
9664 	changed = 0;
9665 	same = cfg80211_chan_def_are_same(cd, &hw->conf.chandef);
9666 	if (!same) {
9667 		/* Copy; the chan pointer is fine and will stay valid. */
9668 		hw->conf.chandef = *cd;
9669 		changed |= IEEE80211_CONF_CHANGE_CHANNEL;
9670 	}
9671 	IMPROVE("IEEE80211_CONF_CHANGE_PS, IEEE80211_CONF_CHANGE_POWER");
9672 
9673 #ifdef LINUXKPI_DEBUG_80211
9674 	if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
9675 		ic_printf(lhw->ic, "%s:%d: chanctx %p { %u } cd %p { %u } "
9676 		    "hw->conf.chandef %p { %u %d %u %u %u }, "
9677 		    "changed %#04x same %d\n",
9678 		    __func__, __LINE__,
9679 		    new, (new != NULL && new->def.chan != NULL) ?
9680 			new->def.chan->center_freq : 0,
9681 		    cd, cd->chan->center_freq,
9682 		    &hw->conf.chandef, hw->conf.chandef.chan->center_freq,
9683 		    hw->conf.chandef.width,
9684 		    hw->conf.chandef.center_freq1,
9685 		    hw->conf.chandef.center_freq2,
9686 		    hw->conf.chandef.punctured,
9687 		    changed, same);
9688 #endif
9689 
9690 	if (changed == 0)
9691 		return (0);
9692 
9693 	error = lkpi_80211_mo_config(hw, changed);
9694 	return (error);
9695 }
9696 
9697 int
9698 ieee80211_emulate_add_chanctx(struct ieee80211_hw *hw,
9699     struct ieee80211_chanctx_conf *chanctx_conf)
9700 {
9701 	int error;
9702 
9703 	lockdep_assert_wiphy(hw->wiphy);
9704 
9705 #ifdef LINUXKPI_DEBUG_80211
9706 	if ((linuxkpi_debug_80211 & D80211_TRACE) != 0) {
9707 		struct lkpi_hw *lhw;
9708 
9709 		lhw = HW_TO_LHW(hw);
9710 		ic_printf(lhw->ic, "%s:%d: chanctx_conf %p\n",
9711 		    __func__, __LINE__, chanctx_conf);
9712 	}
9713 #endif
9714 
9715 	hw->conf.radar_enabled = chanctx_conf->radar_enabled;
9716 	error = lkpi_80211_update_chandef(hw, chanctx_conf);
9717 	return (error);
9718 }
9719 
9720 void
9721 ieee80211_emulate_remove_chanctx(struct ieee80211_hw *hw,
9722     struct ieee80211_chanctx_conf *chanctx_conf __unused)
9723 {
9724 
9725 	lockdep_assert_wiphy(hw->wiphy);
9726 
9727 #ifdef LINUXKPI_DEBUG_80211
9728 	if ((linuxkpi_debug_80211 & D80211_TRACE) != 0) {
9729 		struct lkpi_hw *lhw;
9730 
9731 		lhw = HW_TO_LHW(hw);
9732 		ic_printf(lhw->ic, "%s:%d: chanctx_conf %p\n",
9733 		    __func__, __LINE__, chanctx_conf);
9734 	}
9735 #endif
9736 
9737 	hw->conf.radar_enabled = false;
9738 	lkpi_80211_update_chandef(hw, NULL);
9739 }
9740 
9741 void
9742 ieee80211_emulate_change_chanctx(struct ieee80211_hw *hw,
9743     struct ieee80211_chanctx_conf *chanctx_conf, uint32_t changed __unused)
9744 {
9745 
9746 	lockdep_assert_wiphy(hw->wiphy);
9747 
9748 #ifdef LINUXKPI_DEBUG_80211
9749 	if ((linuxkpi_debug_80211 & D80211_TRACE) != 0) {
9750 		struct lkpi_hw *lhw;
9751 
9752 		lhw = HW_TO_LHW(hw);
9753 		ic_printf(lhw->ic, "%s:%d: chanctx_conf %p\n",
9754 		    __func__, __LINE__, chanctx_conf);
9755 	}
9756 #endif
9757 
9758 	hw->conf.radar_enabled = chanctx_conf->radar_enabled;
9759 	lkpi_80211_update_chandef(hw, chanctx_conf);
9760 }
9761 
9762 int
9763 ieee80211_emulate_switch_vif_chanctx(struct ieee80211_hw *hw,
9764     struct ieee80211_vif_chanctx_switch *vifs, int n_vifs,
9765     enum ieee80211_chanctx_switch_mode mode __unused)
9766 {
9767 	struct ieee80211_chanctx_conf *chanctx_conf;
9768 	int error;
9769 
9770 	lockdep_assert_wiphy(hw->wiphy);
9771 
9772 	/* Sanity check. */
9773 	if (n_vifs <= 0)
9774 		return (-EINVAL);
9775 	if (vifs == NULL || vifs[0].new_ctx == NULL)
9776 		return (-EINVAL);
9777 
9778 	/*
9779 	 * What to do if n_vifs > 1?
9780 	 * Does that make sense for drivers not supporting chanctx?
9781 	 */
9782 	hw->conf.radar_enabled = vifs[0].new_ctx->radar_enabled;
9783 	chanctx_conf = vifs[0].new_ctx;
9784 	error = lkpi_80211_update_chandef(hw, chanctx_conf);
9785 	return (error);
9786 }
9787 
9788 /* -------------------------------------------------------------------------- */
9789 /* LinuxKPI 802.11 PM. */
9790 int
9791 lkpi_80211_suspend(struct ieee80211com *ic, pm_message_t state)
9792 {
9793 	struct lkpi_hw *lhw;
9794 	struct ieee80211_hw *hw;
9795 	int error;
9796 
9797 	lhw = ic->ic_softc;
9798 	hw = LHW_TO_HW(lhw);
9799 	error = 0;
9800 
9801 	/* Check:
9802 	 * - device_set_wakeup_capable() / device_can_wakeup()
9803 	 * - hw->wiphy->wowlan to be non-NULL, if so contents.
9804 	 * - hw->wiphy->max_sched_scan_ssids (rtw88)
9805 	 */
9806 	if ((lkpi_suspend_type & 0x2) != 0) {
9807 		struct cfg80211_wowlan wowlan;
9808 
9809 		IMPROVE("various options for WoWLAN");
9810 		memset(&wowlan, 0, sizeof(wowlan));
9811 		wiphy_lock(hw->wiphy);
9812 		error = lkpi_80211_mo_suspend(hw, &wowlan);
9813 		wiphy_unlock(hw->wiphy);
9814 		if (error == EOPNOTSUPP)
9815 			error = 0;
9816 	}
9817 	if ((lkpi_suspend_type & 0x1) != 0) {
9818 		struct lkpi_vif *lvif;
9819 
9820 		ieee80211_suspend_all(ic);
9821 
9822 		wiphy_lock(hw->wiphy);
9823 		/*
9824 		 * At the end of this net80211 will run a task to call
9825 		 * (*ic_parent)() which is entirely unhelpful as we do not
9826 		 * know when it will happen.  So deal with it here.
9827 		 */
9828 		TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
9829 			lkpi_80211_mo_remove_interface(hw, LVIF_TO_VIF(lvif));
9830 		}
9831 
9832 		if ((lhw->sc_flags & LKPI_MAC80211_DRV_STARTED) != 0)
9833 			lkpi_80211_mo_stop(hw, true);
9834 		wiphy_unlock(hw->wiphy);
9835 	}
9836 
9837 	if (error < 0)
9838 		error = -error;
9839 
9840 	if (error != 0)
9841 		ic_printf(ic, "%s: SUSPEND FAILED: %d\n", __func__, error);
9842 
9843 	return (error);
9844 }
9845 
9846 int
9847 lkpi_80211_resume(struct ieee80211com *ic)
9848 {
9849 	struct lkpi_hw *lhw;
9850 	struct ieee80211_hw *hw;
9851 	int error;
9852 	bool hw_scan_running;
9853 
9854 	lhw = ic->ic_softc;
9855 	hw = LHW_TO_HW(lhw);
9856 	error = 0;
9857 
9858 	/*
9859 	 * Ongoing HW scans during suspend are a problem on resume.
9860 	 * Be verbose about that.
9861 	 */
9862 	LKPI_80211_LHW_SCAN_LOCK(lhw);
9863 	hw_scan_running = (lhw->scan_flags & (LKPI_LHW_SCAN_RUNNING|LKPI_LHW_SCAN_HW)) != 0;
9864 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
9865 	if (hw_scan_running)
9866 		ic_printf(ic, "%s: WARNING: ongoing hw scan on resume!\n", __func__);
9867 
9868 	if ((lkpi_suspend_type & 0x1) != 0) {
9869 		struct lkpi_vif *lvif;
9870 
9871 		wiphy_lock(hw->wiphy);
9872 		error = lkpi_80211_mo_start(hw);
9873 		if (error != 0 && error != EEXIST) {
9874 			ic_printf(ic, "%s: mo_start failed: %d\n",
9875 			    __func__, error);
9876 			wiphy_unlock(hw->wiphy);
9877 			goto err;
9878 		}
9879 
9880 		TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
9881 			error = lkpi_80211_mo_add_interface(hw, LVIF_TO_VIF(lvif));
9882 			if (error != 0) {
9883 				struct ieee80211vap *vap;
9884 
9885 				vap = LVIF_TO_VAP(lvif);
9886 				ic_printf(ic, "%s: mo_add_interface %s failed: %d\n",
9887 				    __func__, if_name(vap->iv_ifp), error);
9888 				wiphy_unlock(hw->wiphy);
9889 				goto err;
9890 			}
9891 		}
9892 		wiphy_unlock(hw->wiphy);
9893 
9894 		ieee80211_resume_all(ic);
9895 	}
9896 
9897 	if ((lkpi_suspend_type & 0x2) != 0) {
9898 		wiphy_lock(hw->wiphy);
9899 		error = lkpi_80211_mo_resume(hw);
9900 		wiphy_unlock(hw->wiphy);
9901 		if (error == EOPNOTSUPP)
9902 			error = 0;
9903 	}
9904 
9905 err:
9906 	if (error < 0)
9907 		error = -error;
9908 
9909 	return (error);
9910 }
9911 
9912 /* -------------------------------------------------------------------------- */
9913 MODULE_VERSION(linuxkpi_wlan, 1);
9914 MODULE_DEPEND(linuxkpi_wlan, linuxkpi, 1, 1, 1);
9915 MODULE_DEPEND(linuxkpi_wlan, wlan, 1, 1, 1);
9916