xref: /freebsd/sys/compat/linuxkpi/common/src/linux_80211.c (revision d15f2551b25f79ddcbe289faa95e655100b952da)
1 /*-
2  * Copyright (c) 2020-2026 The FreeBSD Foundation
3  * Copyright (c) 2020-2025 Bjoern A. Zeeb
4  *
5  * This software was developed by Björn Zeeb under sponsorship from
6  * the FreeBSD Foundation.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  */
29 
30 /*
31  * Public functions are called linuxkpi_*().
32  * Internal (static) functions are called lkpi_*().
33  *
34  * The internal structures holding metadata over public structures are also
35  * called lkpi_xxx (usually with a member at the end called xxx).
36  * Note: we do not replicate the structure names but the general variable names
37  * for these (e.g., struct hw -> struct lkpi_hw, struct sta -> struct lkpi_sta).
38  * There are macros to access one from the other.
39  * We call the internal versions lxxx (e.g., hw -> lhw, sta -> lsta).
40  */
41 
42 /*
43  * TODO:
44  * - lots :)
45  * - HW_CRYPTO: we need a "keystore" and an ordered list for suspend/resume.
46  */
47 
48 #include <sys/param.h>
49 #include <sys/types.h>
50 #include <sys/kernel.h>
51 #include <sys/errno.h>
52 #include <sys/malloc.h>
53 #include <sys/module.h>
54 #include <sys/mutex.h>
55 #include <sys/sbuf.h>
56 #include <sys/socket.h>
57 #include <sys/sysctl.h>
58 #include <sys/queue.h>
59 #include <sys/taskqueue.h>
60 #include <sys/libkern.h>
61 
62 #include <net/if.h>
63 #include <net/if_var.h>
64 #include <net/if_media.h>
65 #include <net/ethernet.h>
66 
67 #include <net80211/ieee80211_var.h>
68 #include <net80211/ieee80211_proto.h>
69 #include <net80211/ieee80211_ratectl.h>
70 #include <net80211/ieee80211_radiotap.h>
71 #include <net80211/ieee80211_vht.h>
72 
73 #define	LINUXKPI_NET80211
74 #include <net/mac80211.h>
75 
76 #include <linux/workqueue.h>
77 #include <linux/rculist.h>
78 #include "linux_80211.h"
79 
80 /* #define	LKPI_80211_USE_SCANLIST */
81 /* #define	LKPI_80211_BGSCAN */
82 #define	LKPI_80211_WME
83 #define	LKPI_80211_HW_CRYPTO
84 #define	LKPI_80211_HT
85 #define	LKPI_80211_VHT
86 
87 #if defined(LKPI_80211_VHT) && !defined(LKPI_80211_HT)
88 #define	LKPI_80211_HT
89 #endif
90 #if defined(LKPI_80211_HT) && !defined(LKPI_80211_HW_CRYPTO)
91 #define	LKPI_80211_HW_CRYPTO
92 #endif
93 
94 static MALLOC_DEFINE(M_LKPI80211, "lkpi80211", "LinuxKPI 80211 compat");
95 
96 /* XXX-BZ really want this and others in queue.h */
97 #define	TAILQ_ELEM_INIT(elm, field) do {				\
98 	(elm)->field.tqe_next = NULL;					\
99 	(elm)->field.tqe_prev = NULL;					\
100 } while (0)
101 
102 /* -------------------------------------------------------------------------- */
103 
104 SYSCTL_DECL(_compat_linuxkpi);
105 SYSCTL_NODE(_compat_linuxkpi, OID_AUTO, 80211, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
106     "LinuxKPI 802.11 compatibility layer");
107 
108 static int lkpi_suspend_type = 1;
109 SYSCTL_INT(_compat_linuxkpi_80211, OID_AUTO, suspend_type, CTLFLAG_RW,
110     &lkpi_suspend_type, 0,
111     "LinuxKPI 802.11 suspend type bitmask (0=off, 1=net80211, 2=wowlan");
112 
113 static bool lkpi_order_scanlist = false;
114 SYSCTL_BOOL(_compat_linuxkpi_80211, OID_AUTO, order_scanlist, CTLFLAG_RW,
115     &lkpi_order_scanlist, 0, "Enable LinuxKPI 802.11 scan list shuffeling");
116 
117 #if defined(LKPI_80211_HW_CRYPTO)
118 static bool lkpi_hwcrypto = false;
119 SYSCTL_BOOL(_compat_linuxkpi_80211, OID_AUTO, hw_crypto, CTLFLAG_RDTUN,
120     &lkpi_hwcrypto, 0, "Enable LinuxKPI 802.11 hardware crypto offload");
121 
122 static bool lkpi_hwcrypto_tkip = false;
123 SYSCTL_BOOL(_compat_linuxkpi_80211, OID_AUTO, tkip, CTLFLAG_RDTUN,
124     &lkpi_hwcrypto_tkip, 0, "Enable LinuxKPI 802.11 TKIP crypto offload");
125 #endif
126 
127 /* Keep public for as long as header files are using it too. */
128 int linuxkpi_debug_80211;
129 
130 #ifdef LINUXKPI_DEBUG_80211
131 SYSCTL_INT(_compat_linuxkpi_80211, OID_AUTO, debug, CTLFLAG_RWTUN,
132     &linuxkpi_debug_80211, 0, "LinuxKPI 802.11 debug level");
133 
134 #define	UNIMPLEMENTED		if (linuxkpi_debug_80211 & D80211_TODO)		\
135     printf("XXX-TODO %s:%d: UNIMPLEMENTED\n", __func__, __LINE__)
136 #define	TRACEOK(_fmt, ...)	if (linuxkpi_debug_80211 & D80211_TRACEOK)	\
137     printf("%s:%d: TRACEPOINT " _fmt "\n", __func__, __LINE__, ##__VA_ARGS__)
138 #else
139 #define	UNIMPLEMENTED		do { } while (0)
140 #define	TRACEOK(...)		do { } while (0)
141 #endif
142 
143 /* #define	PREP_TX_INFO_DURATION	(IEEE80211_TRANS_WAIT * 1000) */
144 #ifndef PREP_TX_INFO_DURATION
145 #define	PREP_TX_INFO_DURATION	0 /* Let the driver do its thing. */
146 #endif
147 
148 /* This is DSAP | SSAP | CTRL | ProtoID/OrgCode{3}. */
149 const uint8_t rfc1042_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
150 
151 /* IEEE 802.11-05/0257r1 */
152 const uint8_t bridge_tunnel_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
153 
154 /* IEEE 802.11e Table 20i-UP-to-AC mappings. */
155 static const uint8_t ieee80211e_up_to_ac[] = {
156 	IEEE80211_AC_BE,
157 	IEEE80211_AC_BK,
158 	IEEE80211_AC_BK,
159 	IEEE80211_AC_BE,
160 	IEEE80211_AC_VI,
161 	IEEE80211_AC_VI,
162 	IEEE80211_AC_VO,
163 	IEEE80211_AC_VO,
164 #if 0
165 	IEEE80211_AC_VO, /* We treat MGMT as TID 8, which is set as AC_VO */
166 #endif
167 };
168 
169 const struct cfg80211_ops linuxkpi_mac80211cfgops = {
170 	/*
171 	 * XXX TODO need a "glue layer" to link cfg80211 ops to
172 	 * mac80211 and to the driver or net80211.
173 	 * Can we pass some on 1:1? Need to compare the (*f)().
174 	 */
175 };
176 
177 #if 0
178 static struct lkpi_sta *lkpi_find_lsta_by_ni(struct lkpi_vif *,
179     struct ieee80211_node *);
180 #endif
181 static void lkpi_sw_scan_task(void *, int);
182 static void lkpi_80211_txq_tx_one(struct lkpi_sta *, struct mbuf *);
183 static void lkpi_80211_txq_task(void *, int);
184 static void lkpi_80211_lhw_rxq_task(void *, int);
185 static void lkpi_ieee80211_free_skb_mbuf(void *);
186 #ifdef LKPI_80211_WME
187 static int lkpi_wme_update(struct lkpi_hw *, struct ieee80211vap *, bool);
188 #endif
189 static int lkpi_80211_update_chandef(struct ieee80211_hw *,
190     struct ieee80211_chanctx_conf *);
191 static void lkpi_ieee80211_wake_queues_locked(struct ieee80211_hw *);
192 
193 static const char *
194 lkpi_rate_info_bw_to_str(enum rate_info_bw bw)
195 {
196 
197 	switch (bw) {
198 
199         case RATE_INFO_BW_20:
200 		return ("20");
201 		break;
202         case RATE_INFO_BW_5:
203 		return ("5");
204 		break;
205         case RATE_INFO_BW_10:
206 		return ("10");
207 		break;
208         case RATE_INFO_BW_40:
209 		return ("40");
210 		break;
211         case RATE_INFO_BW_80:
212 		return ("80");
213 		break;
214         case RATE_INFO_BW_160:
215 		return ("160");
216 		break;
217         case RATE_INFO_BW_HE_RU:
218 		IMPROVE("nl80211_he_ru_alloc");
219 		return ("HE_RU");
220 		break;
221         case RATE_INFO_BW_320:
222 		return ("320");
223 		break;
224         case RATE_INFO_BW_EHT_RU:
225 		IMPROVE("nl80211_eht_ru_alloc");
226 		return ("EHT_RU");
227 		break;
228 	default:
229 		return ("?");
230 		break;
231 	}
232 }
233 
234 static void
235 lkpi_nl80211_sta_info_to_str(struct sbuf *s, const char *prefix,
236     const uint64_t flags)
237 {
238 	int bit, i;
239 
240 	sbuf_printf(s, "%s %#010jx", prefix, flags);
241 
242 	i = 0;
243 	for (bit = 0; bit < BITS_PER_TYPE(flags); bit++) {
244 
245 		if ((flags & BIT_ULL(bit)) == 0)
246 			continue;
247 
248 #define	EXPAND_CASE(_flag)						\
249 	case NL80211_STA_INFO_ ## _flag:				\
250 		sbuf_printf(s, "%c%s", (i == 0) ? '<' : ',', #_flag);	\
251 		i++;							\
252 		break;
253 
254 		switch (bit) {
255 		EXPAND_CASE(BEACON_RX)
256 		EXPAND_CASE(BEACON_SIGNAL_AVG)
257 		EXPAND_CASE(BSS_PARAM)
258 		EXPAND_CASE(CHAIN_SIGNAL)
259 		EXPAND_CASE(CHAIN_SIGNAL_AVG)
260 		EXPAND_CASE(CONNECTED_TIME)
261 		EXPAND_CASE(INACTIVE_TIME)
262 		EXPAND_CASE(SIGNAL)
263 		EXPAND_CASE(SIGNAL_AVG)
264 		EXPAND_CASE(STA_FLAGS)
265 		EXPAND_CASE(RX_BITRATE)
266 		EXPAND_CASE(RX_PACKETS)
267 		EXPAND_CASE(RX_BYTES)
268 		EXPAND_CASE(RX_DROP_MISC)
269 		EXPAND_CASE(TX_BITRATE)
270 		EXPAND_CASE(TX_PACKETS)
271 		EXPAND_CASE(TX_BYTES)
272 		EXPAND_CASE(TX_BYTES64)
273 		EXPAND_CASE(RX_BYTES64)
274 		EXPAND_CASE(TX_FAILED)
275 		EXPAND_CASE(TX_RETRIES)
276 		EXPAND_CASE(RX_DURATION)
277 		EXPAND_CASE(TX_DURATION)
278 		EXPAND_CASE(ACK_SIGNAL)
279 		EXPAND_CASE(ACK_SIGNAL_AVG)
280 		default:
281 			sbuf_printf(s, "%c?%d", (i == 0) ? '<' : ',', bit);
282 			break;
283 		}
284 	}
285 #undef	EXPAND_CASE
286 	if (i > 0)
287 		sbuf_printf(s, ">");
288 	sbuf_printf(s, "\n");
289 }
290 
291 static void
292 lkpi_80211_dump_lvif_stas(struct lkpi_vif *lvif, struct sbuf *s, bool dump_queues)
293 {
294 	struct lkpi_hw *lhw;
295 	struct ieee80211_hw *hw;
296 	struct ieee80211vap *vap;
297 	struct ieee80211_vif *vif;
298 	struct lkpi_sta *lsta;
299 	struct ieee80211_sta *sta;
300 	struct station_info sinfo;
301 	int error;
302 	uint8_t tid;
303 
304 	vif = LVIF_TO_VIF(lvif);
305 	vap = LVIF_TO_VAP(lvif);
306 	lhw = vap->iv_ic->ic_softc;
307 	hw = LHW_TO_HW(lhw);
308 
309 	wiphy_lock(hw->wiphy);
310 	list_for_each_entry(lsta, &lvif->lsta_list, lsta_list) {
311 		sta = LSTA_TO_STA(lsta);
312 
313 		sbuf_putc(s, '\n');
314 		sbuf_printf(s, "lsta %p sta %p added_to_drv %d\n", lsta, sta, lsta->added_to_drv);
315 
316 		memset(&sinfo, 0, sizeof(sinfo));
317 		error = lkpi_80211_mo_sta_statistics(hw, vif, sta, &sinfo);
318 		if (error == EEXIST)	/* Not added to driver. */
319 			continue;
320 		if (error == ENOTSUPP) {
321 			sbuf_printf(s, " sta_statistics not supported\n");
322 			continue;
323 		}
324 		if (error != 0) {
325 			sbuf_printf(s, " sta_statistics failed: %d\n", error);
326 			continue;
327 		}
328 
329 		/* If no RX_BITRATE is reported, try to fill it in from the lsta sinfo. */
330 		if ((sinfo.filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) == 0 &&
331 		    (lsta->sinfo.filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) != 0) {
332 			memcpy(&sinfo.rxrate, &lsta->sinfo.rxrate, sizeof(sinfo.rxrate));
333 			sinfo.filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
334 		}
335 		/* If no CHAIN_SIGNAL is reported,  try to fill it in from the lsta sinfo. */
336 		if ((sinfo.filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) == 0 &&
337 		    (lsta->sinfo.filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) != 0) {
338 			sinfo.chains = lsta->sinfo.chains;
339 			memcpy(sinfo.chain_signal, lsta->sinfo.chain_signal,
340 			    sizeof(sinfo.chain_signal));
341 			sinfo.filled |= BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL);
342 		}
343 
344 		lkpi_nl80211_sta_info_to_str(s, " nl80211_sta_info (valid fields)", sinfo.filled);
345 		sbuf_printf(s, " connected_time %u inactive_time %u\n",
346 		    sinfo.connected_time, sinfo.inactive_time);
347 		sbuf_printf(s, " rx_bytes %ju rx_packets %u rx_dropped_misc %u\n",
348 		    (uintmax_t)sinfo.rx_bytes, sinfo.rx_packets, sinfo.rx_dropped_misc);
349 		sbuf_printf(s, " rx_duration %ju rx_beacon %u rx_beacon_signal_avg %d\n",
350 		    (uintmax_t)sinfo.rx_duration, sinfo.rx_beacon, (int8_t)sinfo.rx_beacon_signal_avg);
351 
352 		sbuf_printf(s, " tx_bytes %ju tx_packets %u tx_failed %u\n",
353 		    (uintmax_t)sinfo.tx_bytes, sinfo.tx_packets, sinfo.tx_failed);
354 		sbuf_printf(s, " tx_duration %ju tx_retries %u\n",
355 		    (uintmax_t)sinfo.tx_duration, sinfo.tx_retries);
356 
357 		sbuf_printf(s, " signal %d signal_avg %d ack_signal %d avg_ack_signal %d\n",
358 		    sinfo.signal, sinfo.signal_avg, sinfo.ack_signal, sinfo.avg_ack_signal);
359 		sbuf_printf(s, " generation %d assoc_req_ies_len %zu chains %#04x\n",
360 		    sinfo.generation, sinfo.assoc_req_ies_len, sinfo.chains);
361 
362 		for (int i = 0; i < nitems(sinfo.chain_signal) && i < IEEE80211_MAX_CHAINS; i++) {
363 			if (!(sinfo.chains & BIT(i)))
364 				continue;
365 			sbuf_printf(s, "  chain[%d] signal %d signal_avg %d\n",
366 			    i, (int8_t)sinfo.chain_signal[i], (int8_t)sinfo.chain_signal_avg[i]);
367 		}
368 
369 		/* assoc_req_ies, bss_param, sta_flags */
370 
371 		sbuf_printf(s, " rxrate: flags %b bw %u(%s) legacy %u kbit/s mcs %u nss %u\n",
372 		    sinfo.rxrate.flags, CFG80211_RATE_INFO_FLAGS_BITS,
373 		    sinfo.rxrate.bw, lkpi_rate_info_bw_to_str(sinfo.rxrate.bw),
374 		    sinfo.rxrate.legacy * 100,
375 		    sinfo.rxrate.mcs, sinfo.rxrate.nss);
376 		sbuf_printf(s, "         he_dcm %u he_gi %u he_ru_alloc %u eht_gi %u\n",
377 		    sinfo.rxrate.he_dcm, sinfo.rxrate.he_gi, sinfo.rxrate.he_ru_alloc,
378 		    sinfo.rxrate.eht_gi);
379 		sbuf_printf(s, " txrate: flags %b bw %u(%s) legacy %u kbit/s mcs %u nss %u\n",
380 		    sinfo.txrate.flags, CFG80211_RATE_INFO_FLAGS_BITS,
381 		    sinfo.txrate.bw, lkpi_rate_info_bw_to_str(sinfo.txrate.bw),
382 		    sinfo.txrate.legacy * 100,
383 		    sinfo.txrate.mcs, sinfo.txrate.nss);
384 		sbuf_printf(s, "         he_dcm %u he_gi %u he_ru_alloc %u eht_gi %u\n",
385 		    sinfo.txrate.he_dcm, sinfo.txrate.he_gi, sinfo.txrate.he_ru_alloc,
386 		    sinfo.txrate.eht_gi);
387 
388 		if (!dump_queues)
389 			continue;
390 
391 		/* Dump queue information. */
392 		sbuf_printf(s, " Queue information:\n");
393 		sbuf_printf(s, "  frms direct tx %ju\n", lsta->frms_tx);
394 		for (tid = 0; tid <= IEEE80211_NUM_TIDS; tid++) {
395 			struct lkpi_txq *ltxq;
396 
397 			if (sta->txq[tid] == NULL) {
398 				sbuf_printf(s, "  tid %-2u NOQ\n", tid);
399 				continue;
400 			}
401 
402 			ltxq = TXQ_TO_LTXQ(sta->txq[tid]);
403 #ifdef __notyet__
404 			sbuf_printf(s, "  tid %-2u flags: %b "
405 			    "txq_generation %u skbq len %d\n",
406 			    tid, ltxq->flags, LKPI_TXQ_FLAGS_BITS,
407 			    ltxq->txq_generation,
408 			    skb_queue_len_lockless(&ltxq->skbq));
409 #else
410 			sbuf_printf(s, "  tid %-2u "
411 			    "txq_generation %u skbq len %d\n",
412 			    tid,
413 			    ltxq->txq_generation,
414 			    skb_queue_len_lockless(&ltxq->skbq));
415 #endif
416 			sbuf_printf(s, "         frms_enqueued %ju frms_dequeued %ju "
417 			    "frms_tx %ju\n",
418 			    ltxq->frms_enqueued, ltxq->frms_dequeued, ltxq->frms_tx);
419 		}
420 	}
421 	wiphy_unlock(hw->wiphy);
422 }
423 
424 static int
425 lkpi_80211_dump_stas(SYSCTL_HANDLER_ARGS)
426 {
427 	struct lkpi_vif *lvif;
428 	struct sbuf s;
429 
430 	if (req->newptr)
431 		return (EPERM);
432 
433 	lvif = (struct lkpi_vif *)arg1;
434 
435 	sbuf_new_for_sysctl(&s, NULL, 1024, req);
436 
437 	lkpi_80211_dump_lvif_stas(lvif, &s, false);
438 
439 	sbuf_finish(&s);
440 	sbuf_delete(&s);
441 
442 	return (0);
443 }
444 
445 static int
446 lkpi_80211_dump_sta_queues(SYSCTL_HANDLER_ARGS)
447 {
448 	struct lkpi_vif *lvif;
449 	struct sbuf s;
450 
451 	if (req->newptr)
452 		return (EPERM);
453 
454 	lvif = (struct lkpi_vif *)arg1;
455 
456 	sbuf_new_for_sysctl(&s, NULL, 1024, req);
457 
458 	lkpi_80211_dump_lvif_stas(lvif, &s, true);
459 
460 	sbuf_finish(&s);
461 	sbuf_delete(&s);
462 
463 	return (0);
464 }
465 
466 static enum ieee80211_sta_rx_bandwidth
467 lkpi_cw_to_rx_bw(enum nl80211_chan_width cw)
468 {
469 	switch (cw) {
470 	case NL80211_CHAN_WIDTH_320:
471 		return (IEEE80211_STA_RX_BW_320);
472 	case NL80211_CHAN_WIDTH_160:
473 	case NL80211_CHAN_WIDTH_80P80:
474 		return (IEEE80211_STA_RX_BW_160);
475 	case NL80211_CHAN_WIDTH_80:
476 		return (IEEE80211_STA_RX_BW_80);
477 	case NL80211_CHAN_WIDTH_40:
478 		return (IEEE80211_STA_RX_BW_40);
479 	case NL80211_CHAN_WIDTH_20:
480 	case NL80211_CHAN_WIDTH_20_NOHT:
481 		return (IEEE80211_STA_RX_BW_20);
482 	case NL80211_CHAN_WIDTH_5:
483 	case NL80211_CHAN_WIDTH_10:
484 		/* Unsupported input. */
485 		return (IEEE80211_STA_RX_BW_20);
486 	}
487 }
488 
489 static enum nl80211_chan_width
490 lkpi_rx_bw_to_cw(enum ieee80211_sta_rx_bandwidth rx_bw)
491 {
492 	switch (rx_bw) {
493 	case IEEE80211_STA_RX_BW_20:
494 		return (NL80211_CHAN_WIDTH_20);	/* _NOHT */
495 	case IEEE80211_STA_RX_BW_40:
496 		return (NL80211_CHAN_WIDTH_40);
497 	case IEEE80211_STA_RX_BW_80:
498 		return (NL80211_CHAN_WIDTH_80);
499 	case IEEE80211_STA_RX_BW_160:
500 		return (NL80211_CHAN_WIDTH_160); /* 80P80 */
501 	case IEEE80211_STA_RX_BW_320:
502 		return (NL80211_CHAN_WIDTH_320);
503 	}
504 }
505 
506 static enum ieee80211_bss_changed
507 lkpi_sta_supp_rates(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
508     struct ieee80211_node *ni,
509     enum ieee80211_rate_control_changed_flags *rc_changed)
510 {
511 	struct lkpi_vif *lvif;
512 	struct lkpi_sta *lsta;
513 	struct ieee80211_sta *sta;
514 	enum ieee80211_bss_changed bss_changed;
515 	struct ieee80211_supported_band *supband;
516 	uint32_t supp_rates, basic_rates;
517 	int band, i, n;
518 
519 	bss_changed = 0;
520 
521 	band = vif->bss_conf.chanreq.oper.chan->band;
522 	supband = hw->wiphy->bands[band];
523 	if (supband == NULL)
524 		return (bss_changed);
525 
526 	lvif = VIF_TO_LVIF(vif);
527 	lsta = ni->ni_drv_data;
528 	sta = LSTA_TO_STA(lsta);
529 
530 	supp_rates = 0;
531 	basic_rates = 0;
532 
533 	for (n = 0; n < ni->ni_rates.rs_nrates; n++) {
534 		uint8_t supp_rate;
535 		uint16_t bitr;
536 		bool basic;
537 
538 		/* Note: net80211 rates are in 0.5Mbit/s, e.g., 108 is 54Mbit/s. */
539 		supp_rate = ni->ni_rates.rs_rates[n] & (~IEEE80211_RATE_BASIC);
540 		basic = (ni->ni_rates.rs_rates[n] & IEEE80211_RATE_BASIC) != 0;
541 
542 		for (i = 0; i < supband->n_bitrates; i++) {
543 			/* Band bitrates are * 10 so, e.g., 55 is 5.5Mbit/s. */
544 			/* To match net80211 rates we need to do a DIV5. */
545 			bitr = howmany(supband->bitrates[i].bitrate, 5);
546 			if (supp_rate == bitr) {
547 				supp_rates |= BIT(i);
548 				if (basic)
549 					basic_rates |= BIT(i);
550 			}
551 			/*
552 			 * We are not checking if we are doing 11b or 11g and
553 			 * if the rate is fine for each.
554 			 */
555 		}
556 		TRACE_RATES("supp_rate %u basic %d supp_rates %#010x basic_rates %#010x",
557 		    supp_rate, basic, supp_rates, basic_rates);
558 	}
559 	if (basic_rates != 0 &&
560 	    vif->bss_conf.basic_rates != basic_rates) {
561 		TRACE_RATES("vif bss_conf basic_rates %#010x update to %#010x",
562 		    vif->bss_conf.basic_rates, basic_rates);
563 		vif->bss_conf.basic_rates = basic_rates;
564 		bss_changed |= BSS_CHANGED_BASIC_RATES;
565 	}
566 	/* Guard against net80211 not having any rates set when we get here. */
567 	if (supp_rates == 0)
568 		supp_rates = vif->bss_conf.basic_rates;
569 	if (sta->deflink.supp_rates[band] != supp_rates) {
570 		TRACE_RATES("band %d supp_rates %#010x update to %#010x",
571 		    band, sta->deflink.supp_rates[band], supp_rates);
572 		sta->deflink.supp_rates[band] = supp_rates;
573 		if (rc_changed != NULL)
574 			*rc_changed |= IEEE80211_RC_SUPP_RATES_CHANGED;
575 	}
576 
577 	/*
578 	 * br_mask got initialized in lkpi_ic_vap_create().
579 	 * Do a basic rates check against it for the current band if we are
580 	 * in a state to have all the above information.
581 	 */
582 	TRACE_RATES("band %d br_mask legacy %#010x & basic_rates %#010x != 0?",
583 	    band, lvif->br_mask.control[band].legacy, vif->bss_conf.basic_rates);
584 	if (band == vif->bss_conf.chanreq.oper.chan->band &&
585 	    (lvif->br_mask.control[band].legacy & vif->bss_conf.basic_rates) == 0) {
586 		/* In our setup this should never happen. */
587 		printf("%s: WARNING: no acceptable basic rate %#010x & %#010x\n",
588 		     __func__, lvif->br_mask.control[band].legacy, vif->bss_conf.basic_rates);
589 	}
590 
591 	/*
592 	 * XXX-BZ we should track changes here as well and call or let the
593 	 * caller call lkpi_80211_mo_set_bitrate_mask() if needed.
594 	 * Note: the call in lkpi_sta_scan_to_auth() still have to
595 	 * happen unconditionally for the initial setting.
596 	 */
597 #if defined(LKPI_80211_HT)
598 	if (supband->ht_cap.ht_supported) {
599 		memcpy(lvif->br_mask.control[band].ht_mcs,
600 		    supband->ht_cap.mcs.rx_mask,
601 		    sizeof(lvif->br_mask.control[band].ht_mcs));
602 #if defined(LINUXKPI_DEBUG_80211)
603 		for (int i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
604 			TRACE_RATES("band %d ht_mcs[%d] %#010x",
605 			    band, i, lvif->br_mask.control[band].ht_mcs[i]);
606 		}
607 #endif
608 	}
609 #endif /* LKPI_80211_HT */
610 #if defined(LKPI_80211_VHT)
611 	if (supband->vht_cap.vht_supported) {
612 		uint16_t mcs_map, val;
613 		uint8_t nss;
614 
615 		mcs_map = supband->vht_cap.vht_mcs.tx_mcs_map;
616 		for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
617 			TRACE_RATES("band %d nss %d vht_mcs.tx_mcs_map %#06x mcs_map %#06x & 0x3 = %#06x",
618 			    band, nss, supband->vht_cap.vht_mcs.tx_mcs_map, mcs_map, mcs_map & 0x3);
619 			switch (mcs_map & 0x3) {
620 			case IEEE80211_VHT_MCS_SUPPORT_0_7:
621 				val = 0x00ff;
622 				break;
623 			case IEEE80211_VHT_MCS_SUPPORT_0_8:
624 				val = 0x01ff;
625 				break;
626 			case IEEE80211_VHT_MCS_SUPPORT_0_9:
627 				val = 0x03ff;
628 				break;
629 			case IEEE80211_VHT_MCS_NOT_SUPPORTED:
630 				val = 0;
631 				break;
632 			}
633 			lvif->br_mask.control[band].vht_mcs[nss] = val;
634 			TRACE_RATES("band %d nss %d vht_mcs %#06x",
635 			    band, nss, lvif->br_mask.control[band].vht_mcs[nss]);
636 			mcs_map >>= 2;
637 		}
638 	}
639 #endif /* LKPI_80211_VHT */
640 
641 	return (bss_changed);
642 }
643 
644 static void
645 lkpi_sync_chanctx_cw_from_rx_bw(struct ieee80211_hw *hw,
646     struct ieee80211_vif *vif, struct ieee80211_sta *sta)
647 {
648 	struct lkpi_hw *lhw;
649 	struct ieee80211_chanctx_conf *chanctx_conf;
650 	enum ieee80211_sta_rx_bandwidth old_bw;
651 	uint32_t changed;
652 
653 	lockdep_assert_wiphy(hw->wiphy);
654 
655 	chanctx_conf = rcu_dereference_protected(vif->bss_conf.chanctx_conf,
656 	    lockdep_is_held(&hw->wiphy->mtx));
657 	if (chanctx_conf == NULL)
658 		return;
659 
660 	old_bw = lkpi_cw_to_rx_bw(chanctx_conf->def.width);
661 	TRACE_RATES("old_bw %d sta->deflink.bandwidth %d hw->conf.chandef.width %d",
662 	    old_bw, sta->deflink.bandwidth, lkpi_cw_to_rx_bw(hw->conf.chandef.width));
663 
664 	lhw = HW_TO_LHW(hw);
665 	if (old_bw == sta->deflink.bandwidth &&
666 	    (!lhw->emulate_chanctx || old_bw == lkpi_cw_to_rx_bw(hw->conf.chandef.width)))
667 		return;
668 
669 	chanctx_conf->def.width = lkpi_rx_bw_to_cw(sta->deflink.bandwidth);
670 	if (chanctx_conf->def.width == NL80211_CHAN_WIDTH_20 &&
671 	    !sta->deflink.ht_cap.ht_supported)
672 		chanctx_conf->def.width = NL80211_CHAN_WIDTH_20_NOHT;
673 
674 	chanctx_conf->min_def = chanctx_conf->def;
675 
676 	vif->bss_conf.chanreq.oper.width = chanctx_conf->def.width;
677 
678 	TRACE_RATES("chanctx_conf %p def.width %d sta->deflink.bandwidth %d "
679 	    "ht_supported %d vht_supported %d",
680 	    chanctx_conf, chanctx_conf->def.width, sta->deflink.bandwidth,
681 	    sta->deflink.ht_cap.ht_supported, sta->deflink.vht_cap.vht_supported);
682 
683 	changed = IEEE80211_CHANCTX_CHANGE_MIN_WIDTH;
684 	changed |= IEEE80211_CHANCTX_CHANGE_WIDTH;
685 	lkpi_80211_mo_change_chanctx(hw, chanctx_conf, changed);
686 }
687 
688 #if defined(LKPI_80211_HT)
689 static void
690 lkpi_sta_sync_ht_from_ni(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
691     struct ieee80211_sta *sta, struct ieee80211_node *ni)
692 {
693 	struct ieee80211vap *vap;
694 	uint8_t *ie;
695 	struct ieee80211_ht_cap *htcap;
696 	struct ieee80211_sta_ht_cap *ht_cap, *sta_ht_cap;
697 	enum nl80211_band band;
698 	int i, rx_nss;
699 
700 	if ((ni->ni_flags & IEEE80211_NODE_HT) == 0) {
701 		sta->deflink.ht_cap.ht_supported = false;
702 		TRACE_RATES("HT ht_supported %d", sta->deflink.ht_cap.ht_supported);
703 		return;
704 	}
705 
706 	sta->deflink.ht_cap.ht_supported = true;
707 
708 	/* htcap->ampdu_params_info */
709 	vap = ni->ni_vap;
710 	sta->deflink.ht_cap.ampdu_density = _IEEE80211_MASKSHIFT(ni->ni_htparam, IEEE80211_HTCAP_MPDUDENSITY);
711 	if (sta->deflink.ht_cap.ampdu_density > vap->iv_ampdu_density)
712 		sta->deflink.ht_cap.ampdu_density = vap->iv_ampdu_density;
713 	sta->deflink.ht_cap.ampdu_factor = _IEEE80211_MASKSHIFT(ni->ni_htparam, IEEE80211_HTCAP_MAXRXAMPDU);
714 	if (sta->deflink.ht_cap.ampdu_factor > vap->iv_ampdu_rxmax)
715 		sta->deflink.ht_cap.ampdu_factor = vap->iv_ampdu_rxmax;
716 
717 	ie = ni->ni_ies.htcap_ie;
718 	KASSERT(ie != NULL, ("%s: HT but no htcap_ie on ni %p\n", __func__, ni));
719 	if (ie[0] == IEEE80211_ELEMID_VENDOR)
720 		ie += 4;
721 	ie += 2;
722 	htcap = (struct ieee80211_ht_cap *)ie;
723 	sta->deflink.ht_cap.cap = htcap->cap_info;
724 	sta->deflink.ht_cap.mcs = htcap->mcs;
725 
726 	/*
727 	 * 802.11n-2009 20.6 Parameters for HT MCSs gives the mandatory/
728 	 * optional MCS for Nss=1..4.  We need to check the first four
729 	 * MCS sets from the Rx MCS Bitmask; then there is MCS 32 and
730 	 * MCS33.. is UEQM.
731 	 */
732 	band = vif->bss_conf.chanctx_conf->def.chan->band;
733 	ht_cap = &hw->wiphy->bands[band]->ht_cap;
734 	sta_ht_cap = &sta->deflink.ht_cap;
735 	rx_nss = 0;
736 	for (i = 0; i < 4; i++) {
737 		TRACE_RATES("HT rx_mask[%d] sta %#04x & hw %#04x", i,
738 		    sta_ht_cap->mcs.rx_mask[i], ht_cap->mcs.rx_mask[i]);
739 		sta_ht_cap->mcs.rx_mask[i] =
740 			sta_ht_cap->mcs.rx_mask[i] & ht_cap->mcs.rx_mask[i];
741 		/* XXX-BZ masking unequal modulation? */
742 
743 		if (sta_ht_cap->mcs.rx_mask[i] != 0)
744 			rx_nss++;
745 	}
746 	if (rx_nss > 0) {
747 		TRACE_RATES("HT rx_nss = max(%d, %d)", rx_nss, sta->deflink.rx_nss);
748 		sta->deflink.rx_nss = MAX(rx_nss, sta->deflink.rx_nss);
749 	} else {
750 		sta->deflink.ht_cap.ht_supported = false;
751 		TRACE_RATES("HT ht_supported %d", sta->deflink.ht_cap.ht_supported);
752 		return;
753 	}
754 
755 	if ((sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) != 0 &&
756 	    IEEE80211_IS_CHAN_HT40(ni->ni_chan))
757 		sta->deflink.bandwidth = IEEE80211_STA_RX_BW_40;
758 	else
759 		sta->deflink.bandwidth = IEEE80211_STA_RX_BW_20;
760 
761 	IMPROVE("sta->wme");
762 
763 	if (sta->deflink.ht_cap.cap & IEEE80211_HT_CAP_MAX_AMSDU)
764 		sta->deflink.agg.max_amsdu_len = IEEE80211_MAX_MPDU_LEN_HT_7935;
765 	else
766 		sta->deflink.agg.max_amsdu_len = IEEE80211_MAX_MPDU_LEN_HT_3839;
767 	sta->deflink.agg.max_rc_amsdu_len = IEEE80211_MAX_MPDU_LEN_HT_BA;
768 #ifdef __handled_by_driver__	/* iwlwifi only? actually unused? */
769 	for (i = 0; i < nitems(sta.deflink.agg.max_tid_amsdu_len); i++) {
770 		sta->deflink.agg.max_tid_amsdu_len[j] = ;
771 	}
772 #endif
773 	TRACE_RATES("HT ht_supported %d", sta->deflink.ht_cap.ht_supported);
774 }
775 #endif
776 
777 #if defined(LKPI_80211_VHT)
778 static void
779 lkpi_sta_sync_vht_from_ni(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
780     struct ieee80211_sta *sta, struct ieee80211_node *ni)
781 {
782 	struct ieee80211_sta_vht_cap *vht_cap, *sta_vht_cap;;
783 	enum ieee80211_sta_rx_bandwidth bw;
784 	enum nl80211_band band;
785 	uint32_t width;
786 	int rx_nss;
787 	uint16_t rx_map, tx_map;
788 
789 	if ((ni->ni_flags & IEEE80211_NODE_VHT) == 0 ||
790 	    !IEEE80211_IS_CHAN_VHT_5GHZ(ni->ni_chan)) {
791 		sta->deflink.vht_cap.vht_supported = false;
792 		TRACE_RATES("VHT vht_supported %d", sta->deflink.vht_cap.vht_supported);
793 		return;
794 	}
795 
796 	sta->deflink.vht_cap.vht_supported = true;
797 
798 	sta->deflink.vht_cap.cap = ni->ni_vhtcap;
799 	sta->deflink.vht_cap.vht_mcs = ni->ni_vht_mcsinfo;
800 
801 	/*
802 	 * If VHT20/40 are selected do not update the bandwidth
803 	 * from HT but stya on VHT.
804 	 */
805 	if (ni->ni_vht_chanwidth == IEEE80211_VHT_CHANWIDTH_USE_HT)
806 		goto skip_bw;
807 
808 	bw = sta->deflink.bandwidth;
809 	width = (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK);
810 	switch (width) {
811 	/* Deprecated. */
812 	case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ:
813 	case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ:
814 		bw = IEEE80211_STA_RX_BW_160;
815 		break;
816 	default:
817 		/* Check if we do support 160Mhz somehow after all. */
818 		if ((sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_EXT_NSS_BW_MASK) != 0)
819 			bw = IEEE80211_STA_RX_BW_160;
820 		else
821 			bw = IEEE80211_STA_RX_BW_80;
822 	}
823 	/*
824 	 * While we can set what is possibly supported we also need to be
825 	 * on a channel which supports that bandwidth; e.g., we can support
826 	 * VHT160 but the AP only does VHT80.
827 	 * Further ni_chan will also have filtered out what we disabled
828 	 * by configuration.
829 	 * Once net80211 channel selection is fixed for 802.11-2020 and
830 	 * VHT160 we can possibly spare ourselves the above.
831 	 */
832 	if (bw == IEEE80211_STA_RX_BW_160 &&
833 	    !IEEE80211_IS_CHAN_VHT160(ni->ni_chan) &&
834 	    !IEEE80211_IS_CHAN_VHT80P80(ni->ni_chan))
835 		bw = IEEE80211_STA_RX_BW_80;
836 	if (bw == IEEE80211_STA_RX_BW_80 &&
837 	    !IEEE80211_IS_CHAN_VHT80(ni->ni_chan))
838 		bw = sta->deflink.bandwidth;
839 	sta->deflink.bandwidth = bw;
840 skip_bw:
841 
842 	band = vif->bss_conf.chanctx_conf->def.chan->band;
843 	vht_cap = &hw->wiphy->bands[band]->vht_cap;
844 	sta_vht_cap = &sta->deflink.vht_cap;
845 
846 	rx_nss = 0;
847 	rx_map = tx_map = 0;
848 	for (int i = 7; i >= 0; i--) {
849 		uint8_t card, sta;
850 
851 		card = (vht_cap->vht_mcs.rx_mcs_map >> (2 * i)) & 0x3;
852 		sta  = (sta_vht_cap->vht_mcs.rx_mcs_map >> (2 * i)) & 0x3;
853 		if (sta != IEEE80211_VHT_MCS_NOT_SUPPORTED) {
854 			if (card == IEEE80211_VHT_MCS_NOT_SUPPORTED)
855 				sta = IEEE80211_VHT_MCS_NOT_SUPPORTED;
856 			else {
857 				sta = MIN(sta, card);
858 				if (rx_nss == 0)
859 					rx_nss = i + 1;
860 			}
861 		}
862 		rx_map |= (sta << (2 * i));
863 
864 		card = (vht_cap->vht_mcs.tx_mcs_map >> (2 * i)) & 0x3;
865 		sta  = (sta_vht_cap->vht_mcs.tx_mcs_map >> (2 * i)) & 0x3;
866 		if (sta != IEEE80211_VHT_MCS_NOT_SUPPORTED) {
867 			if (card == IEEE80211_VHT_MCS_NOT_SUPPORTED)
868 				sta = IEEE80211_VHT_MCS_NOT_SUPPORTED;
869 			else
870 				sta = MIN(sta, card);
871 		}
872 		tx_map |= (sta << (2 * i));
873 	}
874 	TRACE_RATES("VHT rx_mcs_map %#010x->%#010x, tx_mcs_map %#010x->%#010x, rx_nss = %d",
875 	    sta_vht_cap->vht_mcs.rx_mcs_map, rx_map,
876 	    sta_vht_cap->vht_mcs.tx_mcs_map, tx_map, rx_nss);
877 	sta_vht_cap->vht_mcs.rx_mcs_map = rx_map;
878 	sta_vht_cap->vht_mcs.tx_mcs_map = tx_map;
879 	if (rx_nss > 0) {
880 		TRACE_RATES("VHT rx_nss = max(%d, %d)", rx_nss, sta->deflink.rx_nss);
881 		sta->deflink.rx_nss = MAX(rx_nss, sta->deflink.rx_nss);
882 	} else {
883 		sta->deflink.vht_cap.vht_supported = false;
884 		TRACE_RATES("VHT vht_supported %d", sta->deflink.vht_cap.vht_supported);
885 		return;
886 	}
887 
888 	switch (sta->deflink.vht_cap.cap & IEEE80211_VHT_CAP_MAX_MPDU_MASK) {
889 	case IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454:
890 		sta->deflink.agg.max_amsdu_len = IEEE80211_MAX_MPDU_LEN_VHT_11454;
891 		break;
892 	case IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991:
893 		sta->deflink.agg.max_amsdu_len = IEEE80211_MAX_MPDU_LEN_VHT_7991;
894 		break;
895 	case IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895:
896 	default:
897 		sta->deflink.agg.max_amsdu_len = IEEE80211_MAX_MPDU_LEN_VHT_3895;
898 		break;
899 	}
900 
901 	TRACE_RATES("VHT vht_supported %d", sta->deflink.vht_cap.vht_supported);
902 }
903 #endif
904 
905 static enum ieee80211_bss_changed
906 lkpi_sta_sync_from_ni(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
907     struct ieee80211_sta *sta, struct ieee80211_node *ni, bool updchnctx)
908 {
909 	enum ieee80211_bss_changed bss_changed;
910 	enum ieee80211_rate_control_changed_flags rc_changed;
911 	enum ieee80211_sta_rx_bandwidth bandwidth;
912 	uint8_t rx_nss;
913 
914 	if (updchnctx)
915 		lockdep_assert_wiphy(hw->wiphy);
916 
917 	bss_changed = 0;
918 	rc_changed = 0;
919 
920 	bandwidth = sta->deflink.bandwidth;
921 	rx_nss = sta->deflink.rx_nss;
922 
923 	TRACE_RATES("updchnctx %d bandwidth %d rx_nss %u",
924 	    updchnctx, bandwidth, rx_nss);
925 
926 	/*
927 	 * Ensure rx_nss is at least 1 as otherwise drivers run into
928 	 * unexpected problems.
929 	 */
930 	sta->deflink.rx_nss = 1;
931 
932 #if defined(LKPI_80211_HT)
933 	lkpi_sta_sync_ht_from_ni(hw, vif, sta, ni);
934 #endif
935 #if defined(LKPI_80211_VHT)
936 	lkpi_sta_sync_vht_from_ni(hw, vif, sta, ni);
937 #endif
938 
939 	/*
940 	 * We are also called from node allocation which net80211
941 	 * can do even on `ifconfig down`; in that case the chanctx
942 	 * may still be valid and we get a discrepancy between
943 	 * sta and chanctx.  Thus do not try to update the chanctx
944 	 * when called from lkpi_lsta_alloc().
945 	 */
946 	if (updchnctx)
947 		lkpi_sync_chanctx_cw_from_rx_bw(hw, vif, sta);
948 
949 	bss_changed |= lkpi_sta_supp_rates(hw, vif, ni, &rc_changed);
950 
951 	if (sta->deflink.bandwidth != bandwidth)
952 		rc_changed |= IEEE80211_RC_BW_CHANGED;
953 	if (sta->deflink.rx_nss != rx_nss)
954 		rc_changed |= IEEE80211_RC_NSS_CHANGED;
955 
956 	TRACE_RATES("updchnctx %d rc_change %#010x bss_changed %#010jx "
957 	    "bandwidth %d rx_nss %u",
958 	    updchnctx, rc_changed, (uintmax_t)bss_changed,
959 	    sta->deflink.bandwidth, sta->deflink.rx_nss);
960 
961 	if (rc_changed != 0)
962 		lkpi_80211_mo_link_sta_rc_update(hw, vif, &sta->deflink, rc_changed);
963 
964 	return (bss_changed);
965 }
966 
967 #if 0
968 static uint8_t
969 lkpi_get_max_rx_chains(struct ieee80211_node *ni)
970 {
971 	uint8_t chains;
972 #if defined(LKPI_80211_HT) || defined(LKPI_80211_VHT)
973 	struct lkpi_sta *lsta;
974 	struct ieee80211_sta *sta;
975 
976 	lsta = ni->ni_drv_data;
977 	sta = LSTA_TO_STA(lsta);
978 #endif
979 
980 	chains = 1;
981 #if defined(LKPI_80211_HT)
982 	IMPROVE("We should factor counting MCS/NSS out for sync and here");
983 	if (sta->deflink.ht_cap.ht_supported)
984 		chains = MAX(chains, sta->deflink.rx_nss);
985 #endif
986 
987 #if defined(LKPI_80211_VHT)
988 	if (sta->deflink.vht_cap.vht_supported)
989 		chains = MAX(chains, sta->deflink.rx_nss);
990 #endif
991 
992 	return (chains);
993 }
994 #endif
995 
996 static void
997 lkpi_lsta_dump(struct lkpi_sta *lsta, struct ieee80211_node *ni,
998     const char *_f, int _l)
999 {
1000 
1001 #ifdef LINUXKPI_DEBUG_80211
1002 	if ((linuxkpi_debug_80211 & D80211_TRACE_STA) == 0)
1003 		return;
1004 	if (lsta == NULL)
1005 		return;
1006 
1007 	printf("%s:%d lsta %p ni %p sta %p\n",
1008 	    _f, _l, lsta, ni, &lsta->sta);
1009 	if (ni != NULL)
1010 		ieee80211_dump_node(NULL, ni);
1011 	printf("\ttxq_task txq len %d mtx\n", mbufq_len(&lsta->txq));
1012 	printf("\tkc %p state %d added_to_drv %d in_mgd %d\n",
1013 		&lsta->kc[0], lsta->state, lsta->added_to_drv, lsta->in_mgd);
1014 #endif
1015 }
1016 
1017 static void
1018 lkpi_lsta_remove(struct lkpi_sta *lsta, struct lkpi_vif *lvif)
1019 {
1020 
1021 	lockdep_assert_wiphy(lsta->hw->wiphy);
1022 
1023 	KASSERT(!list_empty(&lsta->lsta_list),
1024 	    ("%s: lsta %p ni %p\n", __func__, lsta, lsta->ni));
1025 	list_del_init(&lsta->lsta_list);
1026 }
1027 
1028 static struct lkpi_sta *
1029 lkpi_lsta_alloc(struct ieee80211vap *vap, const uint8_t mac[IEEE80211_ADDR_LEN],
1030     struct ieee80211_hw *hw, struct ieee80211_node *ni)
1031 {
1032 	struct lkpi_sta *lsta;
1033 	struct lkpi_vif *lvif;
1034 	struct ieee80211_vif *vif;
1035 	struct ieee80211_sta *sta;
1036 	int band, i, tid;
1037 
1038 	lsta = malloc(sizeof(*lsta) + hw->sta_data_size, M_LKPI80211,
1039 	    M_NOWAIT | M_ZERO);
1040 	if (lsta == NULL)
1041 		return (NULL);
1042 
1043 	lsta->hw = hw;
1044 	lsta->added_to_drv = false;
1045 	lsta->state = IEEE80211_STA_NOTEXIST;
1046 	/*
1047 	 * Link the ni to the lsta here without taking a reference.
1048 	 * For one we would have to take the reference in node_init()
1049 	 * as ieee80211_alloc_node() will initialise the refcount after us.
1050 	 * For the other a ni and an lsta are 1:1 mapped and always together
1051 	 * from [ic_]node_alloc() to [ic_]node_free() so we are essentally
1052 	 * using the ni references for the lsta as well despite it being
1053 	 * two separate allocations.
1054 	 */
1055 	lsta->ni = ni;
1056 	/* The back-pointer "drv_data" to net80211_node let's us get lsta. */
1057 	ni->ni_drv_data = lsta;
1058 
1059 	lvif = VAP_TO_LVIF(vap);
1060 	vif = LVIF_TO_VIF(lvif);
1061 	sta = LSTA_TO_STA(lsta);
1062 
1063 	IEEE80211_ADDR_COPY(sta->addr, mac);
1064 
1065 	/* TXQ */
1066 	for (tid = 0; tid < nitems(sta->txq); tid++) {
1067 		struct lkpi_txq *ltxq;
1068 
1069 		/* We are not limiting ourselves to hw.queues here. */
1070 		ltxq = malloc(sizeof(*ltxq) + hw->txq_data_size,
1071 		    M_LKPI80211, M_NOWAIT | M_ZERO);
1072 		if (ltxq == NULL)
1073 			goto cleanup;
1074 		/* iwlwifi//mvm/sta.c::tid_to_mac80211_ac[] */
1075 		if (tid == IEEE80211_NUM_TIDS) {
1076 			if (!ieee80211_hw_check(hw, STA_MMPDU_TXQ)) {
1077 				free(ltxq, M_LKPI80211);
1078 				continue;
1079 			}
1080 			IMPROVE("AP/if we support non-STA here too");
1081 			ltxq->txq.ac = IEEE80211_AC_VO;
1082 		} else {
1083 			ltxq->txq.ac = ieee80211e_up_to_ac[tid & 7];
1084 		}
1085 		ltxq->flags = 0;
1086 		ltxq->txq.vif = vif;
1087 		ltxq->txq.tid = tid;
1088 		ltxq->txq.sta = sta;
1089 		TAILQ_ELEM_INIT(ltxq, txq_entry);
1090 		skb_queue_head_init(&ltxq->skbq);
1091 		LKPI_80211_LTXQ_LOCK_INIT(ltxq);
1092 		sta->txq[tid] = &ltxq->txq;
1093 	}
1094 
1095 	/* Deflink information. */
1096 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
1097 		struct ieee80211_supported_band *supband;
1098 		uint32_t rate_mandatory;;
1099 
1100 		supband = hw->wiphy->bands[band];
1101 		if (supband == NULL)
1102 			continue;
1103 
1104 		switch (band) {
1105 		case NL80211_BAND_2GHZ:
1106 			/* We have to assume 11g support here. */
1107 			rate_mandatory = IEEE80211_RATE_MANDATORY_G |
1108 			    IEEE80211_RATE_MANDATORY_B;
1109 			break;
1110 		case NL80211_BAND_5GHZ:
1111 			rate_mandatory = IEEE80211_RATE_MANDATORY_A;
1112 			break;
1113 		default:
1114 			continue;
1115 		}
1116 
1117 		for (i = 0; i < supband->n_bitrates; i++) {
1118 			if ((supband->bitrates[i].flags & rate_mandatory) != 0)
1119 				sta->deflink.supp_rates[band] |= BIT(i);
1120 		}
1121 	}
1122 
1123 	sta->deflink.smps_mode = IEEE80211_SMPS_OFF;
1124 	sta->deflink.bandwidth = IEEE80211_STA_RX_BW_20;
1125 	sta->deflink.agg.max_rc_amsdu_len = IEEE80211_MAX_MPDU_LEN_HT_BA;
1126 	sta->deflink.rx_nss = 1;
1127 	sta->deflink.sta = sta;
1128 
1129 	(void)lkpi_sta_sync_from_ni(hw, vif, sta, ni, false);
1130 
1131 	IMPROVE("he, eht, bw_320, ... smps_mode, ..");
1132 
1133 	/* Link configuration. */
1134 	IEEE80211_ADDR_COPY(sta->deflink.addr, sta->addr);
1135 	sta->link[0] = &sta->deflink;
1136 	for (i = 1; i < nitems(sta->link); i++) {
1137 		IMPROVE("more links; only link[0] = deflink currently.");
1138 	}
1139 	IMPROVE("11be");
1140 	sta->mlo = false;
1141 
1142 	/* Deferred TX path. */
1143 	LKPI_80211_LSTA_TXQ_LOCK_INIT(lsta);
1144 	TASK_INIT(&lsta->txq_task, 0, lkpi_80211_txq_task, lsta);
1145 	mbufq_init(&lsta->txq, 32 * NAPI_POLL_WEIGHT);
1146 	lsta->txq_ready = true;
1147 
1148 	return (lsta);
1149 
1150 cleanup:
1151 	for (; tid >= 0; tid--) {
1152 		struct lkpi_txq *ltxq;
1153 
1154 		ltxq = TXQ_TO_LTXQ(sta->txq[tid]);
1155 		LKPI_80211_LTXQ_LOCK_DESTROY(ltxq);
1156 		free(sta->txq[tid], M_LKPI80211);
1157 	}
1158 	free(lsta, M_LKPI80211);
1159 	return (NULL);
1160 }
1161 
1162 static void
1163 lkpi_lsta_free(struct lkpi_sta *lsta, struct ieee80211_node *ni)
1164 {
1165 	struct mbuf *m;
1166 
1167 	if (lsta->added_to_drv)
1168 		panic("%s: Trying to free an lsta still known to firmware: "
1169 		    "lsta %p ni %p added_to_drv %d\n",
1170 		    __func__, lsta, ni, lsta->added_to_drv);
1171 
1172 	/* XXX-BZ free resources, ... */
1173 	IMPROVE();
1174 
1175 	/* Drain sta->txq[] */
1176 
1177 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
1178 	lsta->txq_ready = false;
1179 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
1180 
1181 	/* Drain taskq, won't be restarted until added_to_drv is set again. */
1182 	while (taskqueue_cancel(taskqueue_thread, &lsta->txq_task, NULL) != 0)
1183 		taskqueue_drain(taskqueue_thread, &lsta->txq_task);
1184 
1185 	/* Flush mbufq (make sure to release ni refs!). */
1186 	m = mbufq_dequeue(&lsta->txq);
1187 	while (m != NULL) {
1188 		struct ieee80211_node *nim;
1189 
1190 		nim = (struct ieee80211_node *)m->m_pkthdr.rcvif;
1191 		if (nim != NULL)
1192 			ieee80211_free_node(nim);
1193 		m_freem(m);
1194 		m = mbufq_dequeue(&lsta->txq);
1195 	}
1196 	KASSERT(mbufq_empty(&lsta->txq), ("%s: lsta %p has txq len %d != 0\n",
1197 	    __func__, lsta, mbufq_len(&lsta->txq)));
1198 	LKPI_80211_LSTA_TXQ_LOCK_DESTROY(lsta);
1199 
1200 	/* Remove lsta from vif; that is done by the state machine.  Should assert it? */
1201 
1202 	IMPROVE("Make sure everything is cleaned up.");
1203 
1204 	/* Free lsta. */
1205 	lsta->ni = NULL;
1206 	ni->ni_drv_data = NULL;
1207 	free(lsta, M_LKPI80211);
1208 }
1209 
1210 
1211 static enum nl80211_band
1212 lkpi_net80211_chan_to_nl80211_band(struct ieee80211_channel *c)
1213 {
1214 
1215 	if (IEEE80211_IS_CHAN_2GHZ(c))
1216 		return (NL80211_BAND_2GHZ);
1217 	else if (IEEE80211_IS_CHAN_5GHZ(c))
1218 		return (NL80211_BAND_5GHZ);
1219 #ifdef __notyet__
1220 	else if ()
1221 		return (NL80211_BAND_6GHZ);
1222 	else if ()
1223 		return (NL80211_BAND_60GHZ);
1224 	else if (IEEE80211_IS_CHAN_GSM(c))
1225 		return (NL80211_BAND_XXX);
1226 #endif
1227 	else
1228 		panic("%s: unsupported band. c %p flags %#x\n",
1229 		    __func__, c, c->ic_flags);
1230 }
1231 
1232 static uint32_t
1233 lkpi_nl80211_band_to_net80211_band(enum nl80211_band band)
1234 {
1235 
1236 	/* XXX-BZ this is just silly; net80211 is too convoluted. */
1237 	/* IEEE80211_CHAN_A / _G / .. doesn't really work either. */
1238 	switch (band) {
1239 	case NL80211_BAND_2GHZ:
1240 		return (IEEE80211_CHAN_2GHZ);
1241 		break;
1242 	case NL80211_BAND_5GHZ:
1243 		return (IEEE80211_CHAN_5GHZ);
1244 		break;
1245 	case NL80211_BAND_60GHZ:
1246 		break;
1247 	case NL80211_BAND_6GHZ:
1248 		break;
1249 	default:
1250 		panic("%s: unsupported band %u\n", __func__, band);
1251 		break;
1252 	}
1253 
1254 	IMPROVE();
1255 	return (0x00);
1256 }
1257 
1258 #ifdef LINUXKPI_DEBUG_80211
1259 static const char *
1260 lkpi_nl80211_band_name(enum nl80211_band band)
1261 {
1262 	switch (band) {
1263 	case NL80211_BAND_2GHZ:
1264 		return "2Ghz";
1265 		break;
1266 	case NL80211_BAND_5GHZ:
1267 		return "5Ghz";
1268 		break;
1269 	case NL80211_BAND_60GHZ:
1270 		return "60Ghz";
1271 		break;
1272 	case NL80211_BAND_6GHZ:
1273 		return "6Ghz";
1274 		break;
1275 	default:
1276 		panic("%s: unsupported band %u\n", __func__, band);
1277 		break;
1278 	}
1279 }
1280 #endif
1281 
1282 #if 0
1283 static enum ieee80211_ac_numbers
1284 lkpi_ac_net_to_l80211(int ac)
1285 {
1286 
1287 	switch (ac) {
1288 	case WME_AC_VO:
1289 		return (IEEE80211_AC_VO);
1290 	case WME_AC_VI:
1291 		return (IEEE80211_AC_VI);
1292 	case WME_AC_BE:
1293 		return (IEEE80211_AC_BE);
1294 	case WME_AC_BK:
1295 		return (IEEE80211_AC_BK);
1296 	default:
1297 		printf("%s: invalid WME_AC_* input: ac = %d\n", __func__, ac);
1298 		return (IEEE80211_AC_BE);
1299 	}
1300 }
1301 #endif
1302 
1303 static enum nl80211_iftype
1304 lkpi_opmode_to_vif_type(enum ieee80211_opmode opmode)
1305 {
1306 
1307 	switch (opmode) {
1308 	case IEEE80211_M_IBSS:
1309 		return (NL80211_IFTYPE_ADHOC);
1310 		break;
1311 	case IEEE80211_M_STA:
1312 		return (NL80211_IFTYPE_STATION);
1313 		break;
1314 	case IEEE80211_M_WDS:
1315 		return (NL80211_IFTYPE_WDS);
1316 		break;
1317 	case IEEE80211_M_HOSTAP:
1318 		return (NL80211_IFTYPE_AP);
1319 		break;
1320 	case IEEE80211_M_MONITOR:
1321 		return (NL80211_IFTYPE_MONITOR);
1322 		break;
1323 	case IEEE80211_M_MBSS:
1324 		return (NL80211_IFTYPE_MESH_POINT);
1325 		break;
1326 	case IEEE80211_M_AHDEMO:
1327 		/* FALLTHROUGH */
1328 	default:
1329 		printf("ERROR: %s: unsupported opmode %d\n", __func__, opmode);
1330 		/* FALLTHROUGH */
1331 	}
1332 	return (NL80211_IFTYPE_UNSPECIFIED);
1333 }
1334 
1335 #ifdef LKPI_80211_HW_CRYPTO
1336 static const char *
1337 lkpi_cipher_suite_to_name(uint32_t wlan_cipher_suite)
1338 {
1339 	switch (wlan_cipher_suite) {
1340 	case WLAN_CIPHER_SUITE_WEP40:
1341 		return ("WEP40");
1342 	case WLAN_CIPHER_SUITE_WEP104:
1343 		return ("WEP104");
1344 	case WLAN_CIPHER_SUITE_TKIP:
1345 		return ("TKIP");
1346 	case WLAN_CIPHER_SUITE_CCMP:
1347 		return ("CCMP");
1348 	case WLAN_CIPHER_SUITE_CCMP_256:
1349 		return ("CCMP_256");
1350 	case WLAN_CIPHER_SUITE_GCMP:
1351 		return ("GCMP");
1352 	case WLAN_CIPHER_SUITE_GCMP_256:
1353 		return ("GCMP_256");
1354 	case WLAN_CIPHER_SUITE_AES_CMAC:
1355 		return ("AES_CMAC");
1356 	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
1357 		return ("BIP_CMAC_256");
1358 	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
1359 		return ("BIP_GMAC_128");
1360 	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
1361 		return ("BIP_GMAC_256");
1362 	default:
1363 		return ("??");
1364 	}
1365 }
1366 
1367 static uint32_t
1368 lkpi_l80211_to_net80211_cyphers(struct ieee80211com *ic,
1369     uint32_t wlan_cipher_suite)
1370 {
1371 	switch (wlan_cipher_suite) {
1372 	case WLAN_CIPHER_SUITE_WEP40:
1373 		return (IEEE80211_CRYPTO_WEP);
1374 	case WLAN_CIPHER_SUITE_WEP104:
1375 		return (IEEE80211_CRYPTO_WEP);
1376 	case WLAN_CIPHER_SUITE_TKIP:
1377 		return (IEEE80211_CRYPTO_TKIP);
1378 	case WLAN_CIPHER_SUITE_CCMP:
1379 		return (IEEE80211_CRYPTO_AES_CCM);
1380 	case WLAN_CIPHER_SUITE_CCMP_256:
1381 		return (IEEE80211_CRYPTO_AES_CCM_256);
1382 	case WLAN_CIPHER_SUITE_GCMP:
1383 		return (IEEE80211_CRYPTO_AES_GCM_128);
1384 	case WLAN_CIPHER_SUITE_GCMP_256:
1385 		return (IEEE80211_CRYPTO_AES_GCM_256);
1386 	case WLAN_CIPHER_SUITE_AES_CMAC:
1387 		return (IEEE80211_CRYPTO_BIP_CMAC_128);
1388 	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
1389 		return (IEEE80211_CRYPTO_BIP_CMAC_256);
1390 	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
1391 		return (IEEE80211_CRYPTO_BIP_GMAC_128);
1392 	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
1393 		return (IEEE80211_CRYPTO_BIP_GMAC_256);
1394 	default:
1395 		ic_printf(ic, "%s: unknown WLAN Cipher Suite %#08x | %u (%s)\n",
1396 		    __func__,
1397 		    wlan_cipher_suite >> 8, wlan_cipher_suite & 0xff,
1398 		    lkpi_cipher_suite_to_name(wlan_cipher_suite));
1399 		return (0);
1400 	}
1401 }
1402 
1403 static uint32_t
1404 lkpi_net80211_to_l80211_cipher_suite(uint32_t cipher, uint8_t keylen)
1405 {
1406 
1407 	switch (cipher) {
1408 	case IEEE80211_CIPHER_WEP:
1409 		if (keylen == (40/NBBY))
1410 			return (WLAN_CIPHER_SUITE_WEP40);
1411 		else if (keylen == (104/NBBY))
1412 			return (WLAN_CIPHER_SUITE_WEP104);
1413 		else {
1414 			printf("%s: WEP with unsupported keylen %d\n",
1415 			    __func__, keylen * NBBY);
1416 			return (0);
1417 		}
1418 		break;
1419 	case IEEE80211_CIPHER_TKIP:
1420 		return (WLAN_CIPHER_SUITE_TKIP);
1421 	case IEEE80211_CIPHER_AES_CCM:
1422 		return (WLAN_CIPHER_SUITE_CCMP);
1423 	case IEEE80211_CIPHER_AES_CCM_256:
1424 		return (WLAN_CIPHER_SUITE_CCMP_256);
1425 	case IEEE80211_CIPHER_AES_GCM_128:
1426 		return (WLAN_CIPHER_SUITE_GCMP);
1427 	case IEEE80211_CIPHER_AES_GCM_256:
1428 		return (WLAN_CIPHER_SUITE_GCMP_256);
1429 	case IEEE80211_CIPHER_BIP_CMAC_128:
1430 		return (WLAN_CIPHER_SUITE_AES_CMAC);
1431 	case IEEE80211_CIPHER_BIP_CMAC_256:
1432 		return (WLAN_CIPHER_SUITE_BIP_CMAC_256);
1433 	case IEEE80211_CIPHER_BIP_GMAC_128:
1434 		return (WLAN_CIPHER_SUITE_BIP_GMAC_128);
1435 	case IEEE80211_CIPHER_BIP_GMAC_256:
1436 		return (WLAN_CIPHER_SUITE_BIP_GMAC_256);
1437 
1438 	case IEEE80211_CIPHER_AES_OCB:
1439 	case IEEE80211_CIPHER_TKIPMIC:
1440 		/*
1441 		 * TKIP w/ hw MIC support
1442 		 * (gone wrong; should really be a crypto flag in net80211).
1443 		 */
1444 	case IEEE80211_CIPHER_CKIP:
1445 	case IEEE80211_CIPHER_NONE:
1446 		printf("%s: unsupported cipher %#010x\n", __func__, cipher);
1447 		break;
1448 	default:
1449 		printf("%s: unknown cipher %#010x\n", __func__, cipher);
1450 	};
1451 	return (0);
1452 }
1453 #endif
1454 
1455 #ifdef __notyet__
1456 static enum ieee80211_sta_state
1457 lkpi_net80211_state_to_sta_state(enum ieee80211_state state)
1458 {
1459 
1460 	/*
1461 	 * XXX-BZ The net80211 states are "try to ..", the lkpi8011 states are
1462 	 * "done".  Also ASSOC/AUTHORIZED are both "RUN" then?
1463 	 */
1464 	switch (state) {
1465 	case IEEE80211_S_INIT:
1466 		return (IEEE80211_STA_NOTEXIST);
1467 	case IEEE80211_S_SCAN:
1468 		return (IEEE80211_STA_NONE);
1469 	case IEEE80211_S_AUTH:
1470 		return (IEEE80211_STA_AUTH);
1471 	case IEEE80211_S_ASSOC:
1472 		return (IEEE80211_STA_ASSOC);
1473 	case IEEE80211_S_RUN:
1474 		return (IEEE80211_STA_AUTHORIZED);
1475 	case IEEE80211_S_CAC:
1476 	case IEEE80211_S_CSA:
1477 	case IEEE80211_S_SLEEP:
1478 	default:
1479 		UNIMPLEMENTED;
1480 	};
1481 
1482 	return (IEEE80211_STA_NOTEXIST);
1483 }
1484 #endif
1485 
1486 static struct linuxkpi_ieee80211_channel *
1487 lkpi_find_lkpi80211_chan(struct lkpi_hw *lhw,
1488     struct ieee80211_channel *c)
1489 {
1490 	struct ieee80211_hw *hw;
1491 	struct linuxkpi_ieee80211_channel *channels;
1492 	enum nl80211_band band;
1493 	int i, nchans;
1494 
1495 	hw = LHW_TO_HW(lhw);
1496 	band = lkpi_net80211_chan_to_nl80211_band(c);
1497 	if (hw->wiphy->bands[band] == NULL)
1498 		return (NULL);
1499 
1500 	nchans = hw->wiphy->bands[band]->n_channels;
1501 	if (nchans <= 0)
1502 		return (NULL);
1503 
1504 	channels = hw->wiphy->bands[band]->channels;
1505 	for (i = 0; i < nchans; i++) {
1506 		if (channels[i].center_freq == c->ic_freq)
1507 			return (&channels[i]);
1508 	}
1509 
1510 	return (NULL);
1511 }
1512 
1513 #if 0
1514 static struct linuxkpi_ieee80211_channel *
1515 lkpi_get_lkpi80211_chan(struct ieee80211com *ic, struct ieee80211_node *ni)
1516 {
1517 	struct linuxkpi_ieee80211_channel *chan;
1518 	struct ieee80211_channel *c;
1519 	struct lkpi_hw *lhw;
1520 
1521 	chan = NULL;
1522 	if (ni != NULL && ni->ni_chan != IEEE80211_CHAN_ANYC)
1523 		c = ni->ni_chan;
1524 	else if (ic->ic_bsschan != IEEE80211_CHAN_ANYC)
1525 		c = ic->ic_bsschan;
1526 	else if (ic->ic_curchan != IEEE80211_CHAN_ANYC)
1527 		c = ic->ic_curchan;
1528 	else
1529 		c = NULL;
1530 
1531 	if (c != NULL && c != IEEE80211_CHAN_ANYC) {
1532 		lhw = ic->ic_softc;
1533 		chan = lkpi_find_lkpi80211_chan(lhw, c);
1534 	}
1535 
1536 	return (chan);
1537 }
1538 #endif
1539 
1540 struct linuxkpi_ieee80211_channel *
1541 linuxkpi_ieee80211_get_channel(struct wiphy *wiphy, uint32_t freq)
1542 {
1543 	enum nl80211_band band;
1544 
1545 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
1546 		struct ieee80211_supported_band *supband;
1547 		struct linuxkpi_ieee80211_channel *channels;
1548 		int i;
1549 
1550 		supband = wiphy->bands[band];
1551 		if (supband == NULL || supband->n_channels == 0)
1552 			continue;
1553 
1554 		channels = supband->channels;
1555 		for (i = 0; i < supband->n_channels; i++) {
1556 			if (channels[i].center_freq == freq)
1557 				return (&channels[i]);
1558 		}
1559 	}
1560 
1561 	return (NULL);
1562 }
1563 
1564 #ifdef LKPI_80211_HW_CRYPTO
1565 static int
1566 lkpi_sta_del_keys(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
1567     struct lkpi_sta *lsta)
1568 {
1569 	int error;
1570 
1571 	if (!lkpi_hwcrypto)
1572 		return (0);
1573 
1574 	lockdep_assert_wiphy(hw->wiphy);
1575 
1576 	if (vif->cfg.assoc && lsta->state == IEEE80211_STA_AUTHORIZED) {
1577 		if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1578 			ic_printf(lsta->ni->ni_ic,
1579 			    "%d %lu %s: vif still assoc; not deleting keys\n",
1580 			    curthread->td_tid, jiffies, __func__);
1581 		return (0);
1582 	}
1583 
1584 	ieee80211_ref_node(lsta->ni);
1585 
1586 	error = 0;
1587 	for (ieee80211_keyix keyix = 0; keyix < nitems(lsta->kc); keyix++) {
1588 		struct ieee80211_key_conf *kc;
1589 		int err;
1590 
1591 		if (lsta->kc[keyix] == NULL)
1592 			continue;
1593 		kc = lsta->kc[keyix];
1594 
1595 #ifdef LINUXKPI_DEBUG_80211
1596 		if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1597 			ic_printf(lsta->ni->ni_ic, "%d %lu %s: running set_key cmd %d(%s) for "
1598 			    "sta %6D: keyidx %u hw_key_idx %u flags %b\n",
1599 			    curthread->td_tid, jiffies, __func__,
1600 			    DISABLE_KEY, "DISABLE", lsta->sta.addr, ":",
1601 			    kc->keyidx, kc->hw_key_idx, kc->flags, IEEE80211_KEY_FLAG_BITS);
1602 #endif
1603 
1604 		err = lkpi_80211_mo_set_key(hw, DISABLE_KEY, vif,
1605 		    LSTA_TO_STA(lsta), kc);
1606 		if (err != 0) {
1607 			ic_printf(lsta->ni->ni_ic, "%d %lu %s: set_key cmd %d(%s) for "
1608 			    "sta %6D failed: %d\n", curthread->td_tid, jiffies, __func__,
1609 			    DISABLE_KEY, "DISABLE", lsta->sta.addr, ":", err);
1610 			error++;
1611 
1612 			/*
1613 			 * If we free the key here we will never be able to get it
1614 			 * removed from the driver/fw which will likely make us
1615 			 * crash (firmware).
1616 			 */
1617 			continue;
1618 		}
1619 #ifdef LINUXKPI_DEBUG_80211
1620 		if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1621 			ic_printf(lsta->ni->ni_ic, "%d %lu %s: set_key cmd %d(%s) for "
1622 			    "sta %6D succeeded: keyidx %u hw_key_idx %u flags %b\n",
1623 			    curthread->td_tid, jiffies, __func__,
1624 			    DISABLE_KEY, "DISABLE", lsta->sta.addr, ":",
1625 			    kc->keyidx, kc->hw_key_idx, kc->flags, IEEE80211_KEY_FLAG_BITS);
1626 #endif
1627 
1628 		lsta->kc[keyix] = NULL;
1629 		free(kc, M_LKPI80211);
1630 	}
1631 	ieee80211_free_node(lsta->ni);
1632 	return (error);
1633 }
1634 
1635 /* XXX-BZ one day we should replace this iterating over VIFs, or node list? */
1636 /* See also lkpi_sta_del_keys() these days. */
1637 static int
1638 lkpi_iv_key_delete(struct ieee80211vap *vap, const struct ieee80211_key *k)
1639 {
1640 	struct ieee80211com *ic;
1641 	struct lkpi_hw *lhw;
1642 	struct ieee80211_hw *hw;
1643 	struct lkpi_vif *lvif;
1644 	struct lkpi_sta *lsta;
1645 	struct ieee80211_vif *vif;
1646 	struct ieee80211_sta *sta;
1647 	struct ieee80211_node *ni;
1648 	struct ieee80211_key_conf *kc;
1649 	int error;
1650 
1651 	ic = vap->iv_ic;
1652 	lhw = ic->ic_softc;
1653 	hw = LHW_TO_HW(lhw);
1654 	lvif = VAP_TO_LVIF(vap);
1655 	vif = LVIF_TO_VIF(lvif);
1656 
1657 	/*
1658 	 * Make sure we do not make it here without going through
1659 	 * lkpi_iv_key_update_begin() first.
1660 	 */
1661 	lockdep_assert_wiphy(hw->wiphy);
1662 
1663 	ni = ieee80211_ref_node(vap->iv_bss);
1664 	lsta = ni->ni_drv_data;
1665 	if (lsta == NULL) {
1666 		ic_printf(ic, "%s: ni %p (%6D) with lsta NULL\n",
1667 		    __func__, ni, ni->ni_bssid, ":");
1668 		ieee80211_free_node(ni);
1669 		return (0);
1670 	}
1671 
1672 	/*
1673 	 * While we are assoc we may still send packets.  We cannot delete the
1674 	 * keys as otherwise packets could go out unencrypted.  Some firmware
1675 	 * does not like this and will fire an assert.
1676 	 * net80211 needs to drive this better but given we want the disassoc
1677 	 * frame out and have to unlock we are open to a race currently.
1678 	 * This check should prevent problems.
1679 	 * How to test: run 800Mbit/s UDP traffic and during that restart your
1680 	 * supplicant.  You want to survive that.
1681 	 */
1682 	if (vif->cfg.assoc && lsta->state == IEEE80211_STA_AUTHORIZED) {
1683 		if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1684 			ic_printf(ic, "%d %lu %s: vif still assoc; not deleting keys\n",
1685 			    curthread->td_tid, jiffies, __func__);
1686 		ieee80211_free_node(ni);
1687 		return (0);
1688 	}
1689 
1690 	if (IEEE80211_KEY_UNDEFINED(k)) {
1691 		ic_printf(ic, "%s: vap %p key %p is undefined: %p %u\n",
1692 		    __func__, vap, k, k->wk_cipher, k->wk_keyix);
1693 		ieee80211_free_node(ni);
1694 		return (0);
1695 	}
1696 
1697 	if (vap->iv_bss == NULL) {
1698 		ic_printf(ic, "%s: iv_bss %p for vap %p is NULL\n",
1699 		    __func__, vap->iv_bss, vap);
1700 		ieee80211_free_node(ni);
1701 		return (0);
1702 	}
1703 	sta = LSTA_TO_STA(lsta);
1704 
1705 	if (lsta->kc[k->wk_keyix] == NULL) {
1706 #ifdef LINUXKPI_DEBUG_80211
1707 		if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1708 			ic_printf(ic, "%d %lu %s: sta %6D and no key information, "
1709 			    "keyidx %u wk_macaddr %6D; returning success\n",
1710 			    curthread->td_tid, jiffies, __func__, sta->addr, ":",
1711 			    k->wk_keyix, k->wk_macaddr, ":");
1712 #endif
1713 		ieee80211_free_node(ni);
1714 		return (1);
1715 	}
1716 	kc = lsta->kc[k->wk_keyix];
1717 
1718 #ifdef LINUXKPI_DEBUG_80211
1719 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1720 		ic_printf(ic, "%d %lu %s: running set_key cmd %d(%s) for sta %6D: "
1721 		    "keyidx %u hw_key_idx %u flags %b\n",
1722 		    curthread->td_tid, jiffies, __func__,
1723 		    DISABLE_KEY, "DISABLE", sta->addr, ":",
1724 		    kc->keyidx, kc->hw_key_idx, kc->flags, IEEE80211_KEY_FLAG_BITS);
1725 #endif
1726 
1727 	error = lkpi_80211_mo_set_key(hw, DISABLE_KEY, vif, sta, kc);
1728 	if (error != 0) {
1729 		ic_printf(ic, "%d %lu %s: set_key cmd %d(%s) for sta %6D failed: %d\n",
1730 		    curthread->td_tid, jiffies, __func__,
1731 		    DISABLE_KEY, "DISABLE", sta->addr, ":", error);
1732 		error = 0;
1733 		goto out;
1734 	}
1735 
1736 #ifdef LINUXKPI_DEBUG_80211
1737 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1738 		ic_printf(ic, "%d %lu %s: set_key cmd %d(%s) for sta %6D succeeded: "
1739 		    "keyidx %u hw_key_idx %u flags %b\n",
1740 		    curthread->td_tid, jiffies, __func__,
1741 		    DISABLE_KEY, "DISABLE", sta->addr, ":",
1742 		    kc->keyidx, kc->hw_key_idx, kc->flags, IEEE80211_KEY_FLAG_BITS);
1743 #endif
1744 	lsta->kc[k->wk_keyix] = NULL;
1745 	free(kc, M_LKPI80211);
1746 	error = 1;
1747 out:
1748 	ieee80211_free_node(ni);
1749 	return (error);
1750 }
1751 
1752 static int
1753 lkpi_iv_key_set(struct ieee80211vap *vap, const struct ieee80211_key *k)
1754 {
1755 	struct ieee80211com *ic;
1756 	struct lkpi_hw *lhw;
1757 	struct ieee80211_hw *hw;
1758 	struct lkpi_vif *lvif;
1759 	struct lkpi_sta *lsta;
1760 	struct ieee80211_vif *vif;
1761 	struct ieee80211_sta *sta;
1762 	struct ieee80211_node *ni;
1763 	struct ieee80211_key_conf *kc;
1764 	struct ieee80211_key *wk;
1765 	uint32_t lcipher;
1766 	uint16_t exp_flags;
1767 	uint8_t keylen;
1768 	int error;
1769 
1770 	ic = vap->iv_ic;
1771 	lhw = ic->ic_softc;
1772 	hw = LHW_TO_HW(lhw);
1773 
1774 	/*
1775 	 * Make sure we do not make it here without going through
1776 	 * lkpi_iv_key_update_begin() first.
1777 	 */
1778 	lockdep_assert_wiphy(hw->wiphy);
1779 
1780 	if (IEEE80211_KEY_UNDEFINED(k)) {
1781 		ic_printf(ic, "%s: vap %p key %p is undefined: %p %u\n",
1782 		    __func__, vap, k, k->wk_cipher, k->wk_keyix);
1783 		return (0);
1784 	}
1785 
1786 	if (vap->iv_bss == NULL) {
1787 		ic_printf(ic, "%s: iv_bss %p for vap %p is NULL\n",
1788 		    __func__, vap->iv_bss, vap);
1789 		return (0);
1790 	}
1791 	ni = ieee80211_ref_node(vap->iv_bss);
1792 	lsta = ni->ni_drv_data;
1793 	if (lsta == NULL) {
1794 		ic_printf(ic, "%s: ni %p (%6D) with lsta NULL\n",
1795 		    __func__, ni, ni->ni_bssid, ":");
1796 		ieee80211_free_node(ni);
1797 		return (0);
1798 	}
1799 	sta = LSTA_TO_STA(lsta);
1800 
1801 	keylen = ieee80211_crypto_get_key_len(k);
1802 	lcipher = lkpi_net80211_to_l80211_cipher_suite(
1803 	    k->wk_cipher->ic_cipher, ieee80211_crypto_get_key_len(k));
1804 	switch (lcipher) {
1805 	case WLAN_CIPHER_SUITE_TKIP:
1806 		keylen += ieee80211_crypto_get_key_txmic_len(k);
1807 		keylen += ieee80211_crypto_get_key_rxmic_len(k);
1808 		break;
1809 	case WLAN_CIPHER_SUITE_CCMP:
1810 	case WLAN_CIPHER_SUITE_GCMP:
1811 		break;
1812 	default:
1813 		ic_printf(ic, "%s: CIPHER SUITE %#x (%s) not supported\n",
1814 		    __func__, lcipher, lkpi_cipher_suite_to_name(lcipher));
1815 		IMPROVE();
1816 		ieee80211_free_node(ni);
1817 		return (0);
1818 	}
1819 
1820 	if (lsta->kc[k->wk_keyix] != NULL) {
1821 		IMPROVE("Still in firmware? Del first. Can we assert this cannot happen?");
1822 		ic_printf(ic, "%s: sta %6D found with key information\n",
1823 		    __func__, sta->addr, ":");
1824 		kc = lsta->kc[k->wk_keyix];
1825 		lsta->kc[k->wk_keyix] = NULL;
1826 		free(kc, M_LKPI80211);
1827 		kc = NULL;	/* safeguard */
1828 	}
1829 
1830 	kc = malloc(sizeof(*kc) + keylen, M_LKPI80211, M_WAITOK | M_ZERO);
1831 	kc->_k = k;		/* Save the pointer to net80211. */
1832 	kc->cipher = lcipher;
1833 	kc->keyidx = k->wk_keyix;
1834 #if 0
1835 	kc->hw_key_idx = /* set by hw and needs to be passed for TX */;
1836 #endif
1837 	atomic64_set(&kc->tx_pn, k->wk_keytsc);
1838 	kc->keylen = ieee80211_crypto_get_key_len(k);
1839 	memcpy(kc->key, ieee80211_crypto_get_key_data(k),
1840 	    ieee80211_crypto_get_key_len(k));
1841 
1842 	if (k->wk_flags & (IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV))
1843 		kc->flags |= IEEE80211_KEY_FLAG_PAIRWISE;
1844 	if (k->wk_flags & IEEE80211_KEY_GROUP)
1845 		kc->flags &= ~IEEE80211_KEY_FLAG_PAIRWISE;
1846 
1847 	kc->iv_len = k->wk_cipher->ic_header;
1848 	kc->icv_len = k->wk_cipher->ic_trailer;
1849 
1850 	switch (kc->cipher) {
1851 	case WLAN_CIPHER_SUITE_TKIP:
1852 		memcpy(kc->key + NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY,
1853 		    ieee80211_crypto_get_key_txmic_data(k),
1854 		    ieee80211_crypto_get_key_txmic_len(k));
1855 		memcpy(kc->key + NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY,
1856 		    ieee80211_crypto_get_key_rxmic_data(k),
1857 		    ieee80211_crypto_get_key_rxmic_len(k));
1858 		break;
1859 	case WLAN_CIPHER_SUITE_CCMP:
1860 	case WLAN_CIPHER_SUITE_GCMP:
1861 		break;
1862 	default:
1863 		/* currently UNREACH */
1864 		IMPROVE();
1865 		break;
1866 	};
1867 	lsta->kc[k->wk_keyix] = kc;
1868 
1869 #ifdef LINUXKPI_DEBUG_80211
1870 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1871 		ic_printf(ic, "%d %lu %s: running set_key cmd %d(%s) for sta %6D: "
1872 		    "kc %p keyidx %u hw_key_idx %u keylen %u flags %b\n",
1873 		    curthread->td_tid, jiffies, __func__,
1874 		    SET_KEY, "SET", sta->addr, ":", kc, kc->keyidx, kc->hw_key_idx,
1875 		    kc->keylen, kc->flags, IEEE80211_KEY_FLAG_BITS);
1876 #endif
1877 
1878 	lvif = VAP_TO_LVIF(vap);
1879 	vif = LVIF_TO_VIF(lvif);
1880 	error = lkpi_80211_mo_set_key(hw, SET_KEY, vif, sta, kc);
1881 	if (error != 0) {
1882 		ic_printf(ic, "%d %lu %s: set_key cmd %d(%s) for sta %6D failed: %d\n",
1883 		    curthread->td_tid, jiffies, __func__,
1884 		    SET_KEY, "SET", sta->addr, ":", error);
1885 		lsta->kc[k->wk_keyix] = NULL;
1886 		free(kc, M_LKPI80211);
1887 		ieee80211_free_node(ni);
1888 		return (0);
1889 	}
1890 
1891 #ifdef LINUXKPI_DEBUG_80211
1892 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1893 		ic_printf(ic, "%d %lu %s: set_key cmd %d(%s) for sta %6D succeeded: "
1894 		    "kc %p keyidx %u hw_key_idx %u flags %b\n",
1895 		    curthread->td_tid, jiffies, __func__,
1896 		    SET_KEY, "SET", sta->addr, ":",
1897 		    kc, kc->keyidx, kc->hw_key_idx, kc->flags, IEEE80211_KEY_FLAG_BITS);
1898 #endif
1899 
1900 	/*
1901 	 * Getting here means we support HW crypto offload.
1902 	 * Some drivers do not set the wiphy [n_]cipher_suites and thus we
1903 	 * never populate ic_cryptocaps. which means SWCRYPT will be set and we
1904 	 * should disable this now (before possibly setting other SW flags
1905 	 * again for when we need partial SW support).
1906 	 */
1907 	wk = __DECONST(struct ieee80211_key *, k);
1908 	wk->wk_flags &= ~IEEE80211_KEY_SWCRYPT;
1909 
1910 	exp_flags = 0;
1911 	switch (kc->cipher) {
1912 	case WLAN_CIPHER_SUITE_TKIP:
1913 		exp_flags = (IEEE80211_KEY_FLAG_PAIRWISE |
1914 			IEEE80211_KEY_FLAG_PUT_IV_SPACE |
1915 			IEEE80211_KEY_FLAG_GENERATE_MMIC |
1916 			IEEE80211_KEY_FLAG_PUT_MIC_SPACE);
1917 #define	TKIP_INVAL_COMBINATION						\
1918      (IEEE80211_KEY_FLAG_PUT_MIC_SPACE|IEEE80211_KEY_FLAG_GENERATE_MMIC)
1919 		if ((kc->flags & TKIP_INVAL_COMBINATION) == TKIP_INVAL_COMBINATION) {
1920 			ic_printf(ic, "%s: SET_KEY for %s returned invalid "
1921 			    "combination %b\n", __func__,
1922 			    lkpi_cipher_suite_to_name(kc->cipher),
1923 			    kc->flags, IEEE80211_KEY_FLAG_BITS);
1924 		}
1925 #undef	TKIP_INVAL_COMBINATION
1926 #ifdef __notyet__
1927 		/* Do flags surgery; special see linuxkpi_ieee80211_ifattach(). */
1928 		if ((kc->flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) != 0) {
1929 			wk->wk_flags &= ~(IEEE80211_KEY_NOMICMGT|IEEE80211_KEY_NOMIC);
1930 			wk->wk_flags |= IEEE80211_KEY_SWMIC;
1931 			ic->ic_cryptocaps &= ~IEEE80211_CRYPTO_TKIPMIC
1932 		}
1933 #endif
1934 		break;
1935 	case WLAN_CIPHER_SUITE_CCMP:
1936 	case WLAN_CIPHER_SUITE_GCMP:
1937 		exp_flags = (IEEE80211_KEY_FLAG_PAIRWISE |
1938 		    IEEE80211_KEY_FLAG_PUT_IV_SPACE |
1939 		    IEEE80211_KEY_FLAG_GENERATE_IV |
1940 		    IEEE80211_KEY_FLAG_GENERATE_IV_MGMT |	/* Only needs IV geeration for MGMT frames. */
1941 		    IEEE80211_KEY_FLAG_SW_MGMT_TX);		/* MFP in software */
1942 		break;
1943 	}
1944 	if ((kc->flags & ~exp_flags) != 0)
1945 		ic_printf(ic, "%s: SET_KEY for %s returned unexpected key flags: "
1946 		    " %#06x & ~%#06x = %b\n", __func__,
1947 		    lkpi_cipher_suite_to_name(kc->cipher), kc->flags, exp_flags,
1948 		    (kc->flags & ~exp_flags), IEEE80211_KEY_FLAG_BITS);
1949 
1950 #ifdef __notyet__
1951 	/* Do flags surgery. */
1952 	if ((kc->flags & IEEE80211_KEY_FLAG_GENERATE_IV_MGMT) == 0)
1953 		wk->wk_flags |= IEEE80211_KEY_NOIVMGT;
1954 	if ((kc->flags & IEEE80211_KEY_FLAG_GENERATE_IV) == 0)
1955 		wk->wk_flags |= IEEE80211_KEY_NOIV;
1956 #endif
1957 
1958 	ieee80211_free_node(ni);
1959 	return (1);
1960 }
1961 
1962 static void
1963 lkpi_iv_key_update_begin(struct ieee80211vap *vap)
1964 {
1965 	struct ieee80211_node_table *nt;
1966 	struct ieee80211com *ic;
1967 	struct lkpi_hw *lhw;
1968 	struct ieee80211_hw *hw;
1969 	struct lkpi_vif *lvif;
1970 	struct ieee80211_node *ni;
1971 	bool icislocked, ntislocked;
1972 
1973 	ic = vap->iv_ic;
1974 	lhw = ic->ic_softc;
1975 	hw = LHW_TO_HW(lhw);
1976 	lvif = VAP_TO_LVIF(vap);
1977 	nt = &ic->ic_sta;
1978 
1979 	icislocked = IEEE80211_IS_LOCKED(ic);
1980 	ntislocked = IEEE80211_NODE_IS_LOCKED(nt);
1981 
1982 #ifdef LINUXKPI_DEBUG_80211
1983 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
1984 		ic_printf(ic, "%d %lu %s: vap %p ic %p %slocked nt %p %slocked "
1985 		    "lvif ic_unlocked %d nt_unlocked %d\n",
1986 		    curthread->td_tid, jiffies, __func__, vap,
1987 		    ic, icislocked ? "" : "un", nt, ntislocked ? "" : "un",
1988 		    lvif->ic_unlocked, lvif->nt_unlocked);
1989 #endif
1990 
1991 	/*
1992 	 * This is inconsistent net80211 locking to be fixed one day.
1993 	 */
1994 	/* Try to make sure the node does not go away while possibly unlocked. */
1995 	ni = NULL;
1996 	if (icislocked || ntislocked) {
1997 		if (vap->iv_bss != NULL)
1998 			ni = ieee80211_ref_node(vap->iv_bss);
1999 	}
2000 
2001 	if (icislocked)
2002 		IEEE80211_UNLOCK(ic);
2003 	if (ntislocked)
2004 		IEEE80211_NODE_UNLOCK(nt);
2005 
2006 	wiphy_lock(hw->wiphy);
2007 
2008 	KASSERT(lvif->key_update_iv_bss == NULL, ("%s: key_update_iv_bss not NULL %p",
2009 	    __func__, lvif->key_update_iv_bss));
2010 	lvif->key_update_iv_bss = ni;
2011 
2012 	/*
2013 	 * ic/nt_unlocked could be a bool given we are under the lock and there
2014 	 * must only be a single thread.
2015 	 * In case anything in the future disturbs the order the refcnt will
2016 	 * help us catching problems a lot easier.
2017 	 */
2018 	if (icislocked)
2019 		refcount_acquire(&lvif->ic_unlocked);
2020 	if (ntislocked)
2021 		refcount_acquire(&lvif->nt_unlocked);
2022 
2023 	/*
2024 	 * Stop the queues while doing key updates.
2025 	 */
2026 	ieee80211_stop_queues(hw);
2027 }
2028 
2029 static void
2030 lkpi_iv_key_update_end(struct ieee80211vap *vap)
2031 {
2032 	struct ieee80211_node_table *nt;
2033 	struct ieee80211com *ic;
2034 	struct lkpi_hw *lhw;
2035 	struct ieee80211_hw *hw;
2036 	struct lkpi_vif *lvif;
2037 	bool icislocked, ntislocked;
2038 
2039 	ic = vap->iv_ic;
2040 	lhw = ic->ic_softc;
2041 	hw = LHW_TO_HW(lhw);
2042 	lvif = VAP_TO_LVIF(vap);
2043 	nt = &ic->ic_sta;
2044 
2045 	/*
2046 	 * Re-enabled the queues after the key update.
2047 	 */
2048 	lkpi_ieee80211_wake_queues_locked(hw);
2049 
2050 	icislocked = IEEE80211_IS_LOCKED(ic);
2051 	MPASS(!icislocked);
2052 	ntislocked = IEEE80211_NODE_IS_LOCKED(nt);
2053 	MPASS(!ntislocked);
2054 
2055 #ifdef LINUXKPI_DEBUG_80211
2056 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
2057 		ic_printf(ic, "%d %lu %s: vap %p ic %p %slocked nt %p %slocked "
2058 		    "lvif ic_unlocked %d nt_unlocked %d\n",
2059 		    curthread->td_tid, jiffies, __func__, vap,
2060 		    ic, icislocked ? "" : "un", nt, ntislocked ? "" : "un",
2061 		    lvif->ic_unlocked, lvif->nt_unlocked);
2062 #endif
2063 
2064 	/*
2065 	 * Check under lock; see comment in lkpi_iv_key_update_begin().
2066 	 * In case the refcnt gets out of sync locking in net80211 will
2067 	 * quickly barf as well (trying to unlock a lock not held).
2068 	 */
2069 	icislocked = refcount_release_if_last(&lvif->ic_unlocked);
2070 	ntislocked = refcount_release_if_last(&lvif->nt_unlocked);
2071 
2072 	if (lvif->key_update_iv_bss != NULL) {
2073 		ieee80211_free_node(lvif->key_update_iv_bss);
2074 		lvif->key_update_iv_bss = NULL;
2075 	}
2076 
2077 	wiphy_unlock(hw->wiphy);
2078 
2079 	/*
2080 	 * This is inconsistent net80211 locking to be fixed one day.
2081 	 * ic before nt to avoid a LOR.
2082 	 */
2083 	if (icislocked)
2084 		IEEE80211_LOCK(ic);
2085 	if (ntislocked)
2086 		IEEE80211_NODE_LOCK(nt);
2087 }
2088 #endif
2089 
2090 static void
2091 lkpi_cleanup_mcast_list_locked(struct lkpi_hw *lhw)
2092 {
2093 	struct list_head *le, *next;
2094 	struct netdev_hw_addr *addr;
2095 
2096 	if (lhw->mc_list.count != 0) {
2097 		list_for_each_safe(le, next, &lhw->mc_list.addr_list) {
2098 			addr = list_entry(le, struct netdev_hw_addr, addr_list);
2099 			list_del(le);
2100 			lhw->mc_list.count--;
2101 			free(addr, M_LKPI80211);
2102 		}
2103 	}
2104 	KASSERT(lhw->mc_list.count == 0, ("%s: mc_list %p count %d != 0\n",
2105 	    __func__, &lhw->mc_list, lhw->mc_list.count));
2106 }
2107 
2108 static u_int
2109 lkpi_ic_update_mcast_copy(void *arg, struct sockaddr_dl *sdl, u_int cnt)
2110 {
2111 	struct netdev_hw_addr_list *mc_list;
2112 	struct netdev_hw_addr *addr;
2113 
2114 	KASSERT(arg != NULL && sdl != NULL, ("%s: arg %p sdl %p cnt %u\n",
2115 	    __func__, arg, sdl, cnt));
2116 
2117 	mc_list = arg;
2118 	/* If it is on the list already skip it. */
2119 	netdev_hw_addr_list_for_each(addr, mc_list) {
2120 		if (!memcmp(addr->addr, LLADDR(sdl), sdl->sdl_alen))
2121 			return (0);
2122 	}
2123 
2124 	addr = malloc(sizeof(*addr), M_LKPI80211, M_NOWAIT | M_ZERO);
2125 	if (addr == NULL)
2126 		return (0);
2127 
2128 	INIT_LIST_HEAD(&addr->addr_list);
2129 	memcpy(addr->addr, LLADDR(sdl), sdl->sdl_alen);
2130 	/* XXX this should be a netdev function? */
2131 	list_add(&addr->addr_list, &mc_list->addr_list);
2132 	mc_list->count++;
2133 
2134 #ifdef LINUXKPI_DEBUG_80211
2135 	if (linuxkpi_debug_80211 & D80211_TRACE)
2136 		printf("%s:%d: mc_list count %d: added %6D\n",
2137 		    __func__, __LINE__, mc_list->count, addr->addr, ":");
2138 #endif
2139 
2140 	return (1);
2141 }
2142 
2143 static void
2144 lkpi_update_mcast_filter_locked(struct ieee80211com *ic)
2145 {
2146 	struct lkpi_hw *lhw;
2147 	struct ieee80211_hw *hw;
2148 	u64 mc;
2149 	unsigned int changed_flags, flags;
2150 	bool scanning;
2151 
2152 	lhw = ic->ic_softc;
2153 	hw = LHW_TO_HW(lhw);
2154 
2155 	lockdep_assert_wiphy(hw->wiphy);
2156 
2157 	LKPI_80211_LHW_SCAN_LOCK(lhw);
2158 	scanning = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
2159 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
2160 
2161 	LKPI_80211_LHW_MC_LOCK(lhw);
2162 
2163 	flags = 0;
2164 	if (scanning)
2165 		flags |= FIF_BCN_PRBRESP_PROMISC;
2166 	/* The latter condition may not be as expected but seems wise. */
2167 	if (lhw->mc_all_multi || lhw->ops->prepare_multicast == NULL)
2168 		flags |= FIF_ALLMULTI;
2169 
2170 	mc = lkpi_80211_mo_prepare_multicast(hw, &lhw->mc_list);
2171 
2172 	changed_flags = (lhw->mc_flags ^ flags) & FIF_FLAGS_MASK;
2173 	lkpi_80211_mo_configure_filter(hw, changed_flags, &flags, mc);
2174 	lhw->mc_flags = flags;
2175 
2176 #ifdef LINUXKPI_DEBUG_80211
2177 	if (linuxkpi_debug_80211 & D80211_TRACE)
2178 		printf("%s: changed_flags %#06x count %d mc_flags %#010x\n",
2179 		    __func__, changed_flags, lhw->mc_list.count, lhw->mc_flags);
2180 #endif
2181 
2182 	LKPI_80211_LHW_MC_UNLOCK(lhw);
2183 }
2184 
2185 static void
2186 lkpi_update_mcast_filter(struct ieee80211com *ic)
2187 {
2188 	struct lkpi_hw *lhw;
2189 	struct ieee80211_hw *hw;
2190 
2191 	lhw = ic->ic_softc;
2192 	hw = LHW_TO_HW(lhw);
2193 
2194 	wiphy_lock(hw->wiphy);
2195 	lkpi_update_mcast_filter_locked(ic);
2196 	wiphy_unlock(hw->wiphy);
2197 }
2198 
2199 static enum ieee80211_bss_changed
2200 lkpi_update_dtim_tsf(struct ieee80211_vif *vif, struct ieee80211_node *ni,
2201     struct ieee80211vap *vap, const char *_f, int _l)
2202 {
2203 	enum ieee80211_bss_changed bss_changed;
2204 
2205 	bss_changed = 0;
2206 
2207 #ifdef LINUXKPI_DEBUG_80211
2208 	if (linuxkpi_debug_80211 & D80211_TRACE)
2209 		printf("%s:%d [%s:%d] assoc %d aid %d beacon_int %u "
2210 		    "dtim_period %u sync_dtim_count %u sync_tsf %ju "
2211 		    "sync_device_ts %u bss_changed %#010jx\n",
2212 			__func__, __LINE__, _f, _l,
2213 			vif->cfg.assoc, vif->cfg.aid,
2214 			vif->bss_conf.beacon_int, vif->bss_conf.dtim_period,
2215 			vif->bss_conf.sync_dtim_count,
2216 			(uintmax_t)vif->bss_conf.sync_tsf,
2217 			vif->bss_conf.sync_device_ts,
2218 			(uintmax_t)bss_changed);
2219 #endif
2220 
2221 	if (vif->bss_conf.beacon_int != ni->ni_intval) {
2222 		vif->bss_conf.beacon_int = ni->ni_intval;
2223 		/* iwlwifi FW bug workaround; iwl_mvm_mac_sta_state. */
2224 		if (vif->bss_conf.beacon_int < 16)
2225 			vif->bss_conf.beacon_int = 16;
2226 		bss_changed |= BSS_CHANGED_BEACON_INT;
2227 	}
2228 
2229 	/*
2230 	 * lkpi_iv_sta_recv_mgmt() will directly call into this function.
2231 	 * iwlwifi(4) in iwl_mvm_bss_info_changed_station_common() will
2232 	 * stop seesion protection the moment it sees
2233 	 * BSS_CHANGED_BEACON_INFO (with the expectations that it was
2234 	 * "a beacon from the associated AP"). It will also update
2235 	 * the beacon filter in that case.  This is the only place
2236 	 * we set the BSS_CHANGED_BEACON_INFO on the non-teardown
2237 	 * path so make sure we only do run this check once we are
2238 	 * assoc. (*iv_recv_mgmt)() will be called before we enter
2239 	 * here so the ni will be updated with information from the
2240 	 * beacon via net80211::sta_recv_mgmt().  We also need to
2241 	 * make sure we do not do it on every beacon we still may
2242 	 * get so only do if something changed.  vif->bss_conf.dtim_period
2243 	 * should be 0 as we start up (we also reset it on teardown).
2244 	 *
2245 	 * If we are assoc we need to make sure dtim_period is non-0.
2246 	 * 0 is a reserved value and drivers assume they can DIV by it.
2247 	 * In theory this means we need to wait for the first beacon
2248 	 * before we finalize the vif being assoc.  In practise that
2249 	 * is harder until net80211 learns how to.  Work around like
2250 	 * this for the moment.
2251 	 */
2252 	if (vif->cfg.assoc) {
2253 		if (vif->bss_conf.dtim_period != ni->ni_dtim_period &&
2254 	            ni->ni_dtim_period > 0) {
2255 			vif->bss_conf.dtim_period = ni->ni_dtim_period;
2256 			bss_changed |= BSS_CHANGED_BEACON_INFO;
2257 		} else if (vif->bss_conf.dtim_period == 0) {
2258 			vif->bss_conf.dtim_period = 1;
2259 			bss_changed |= BSS_CHANGED_BEACON_INFO;
2260 		}
2261 	}
2262 
2263 	vif->bss_conf.sync_dtim_count = ni->ni_dtim_count;
2264 	vif->bss_conf.sync_tsf = le64toh(ni->ni_tstamp.tsf);
2265 	/* vif->bss_conf.sync_device_ts = set in linuxkpi_ieee80211_rx. */
2266 
2267 #ifdef LINUXKPI_DEBUG_80211
2268 	if (linuxkpi_debug_80211 & D80211_TRACE)
2269 		printf("%s:%d [%s:%d] assoc %d aid %d beacon_int %u "
2270 		    "dtim_period %u sync_dtim_count %u sync_tsf %ju "
2271 		    "sync_device_ts %u bss_changed %#010jx\n",
2272 			__func__, __LINE__, _f, _l,
2273 			vif->cfg.assoc, vif->cfg.aid,
2274 			vif->bss_conf.beacon_int, vif->bss_conf.dtim_period,
2275 			vif->bss_conf.sync_dtim_count,
2276 			(uintmax_t)vif->bss_conf.sync_tsf,
2277 			vif->bss_conf.sync_device_ts,
2278 			(uintmax_t)bss_changed);
2279 #endif
2280 
2281 	return (bss_changed);
2282 }
2283 
2284 static void
2285 lkpi_stop_hw_scan(struct lkpi_hw *lhw, struct ieee80211_vif *vif)
2286 {
2287 	struct ieee80211_hw *hw;
2288 	int error;
2289 	bool cancel;
2290 
2291 	TRACE_SCAN(lhw->ic, "scan_flags %b", lhw->scan_flags, LKPI_LHW_SCAN_BITS);
2292 
2293 	LKPI_80211_LHW_SCAN_LOCK(lhw);
2294 	cancel = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
2295 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
2296 	if (!cancel)
2297 		return;
2298 
2299 	hw = LHW_TO_HW(lhw);
2300 
2301 	IEEE80211_UNLOCK(lhw->ic);
2302 	wiphy_lock(hw->wiphy);
2303 	/* Need to cancel the scan. */
2304 	lkpi_80211_mo_cancel_hw_scan(hw, vif);
2305 	wiphy_unlock(hw->wiphy);
2306 
2307 	/* Need to make sure we see ieee80211_scan_completed. */
2308 	LKPI_80211_LHW_SCAN_LOCK(lhw);
2309 	if ((lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0)
2310 		error = msleep(lhw, &lhw->scan_mtx, 0, "lhwscanstop", hz/2);
2311 	cancel = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
2312 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
2313 
2314 	IEEE80211_LOCK(lhw->ic);
2315 
2316 	if (cancel)
2317 		ic_printf(lhw->ic, "%s: failed to cancel scan: %d (%p, %p)\n",
2318 		    __func__, error, lhw, vif);
2319 }
2320 
2321 static void
2322 lkpi_hw_conf_idle(struct ieee80211_hw *hw, bool new)
2323 {
2324 	struct lkpi_hw *lhw;
2325 	int error;
2326 	bool old;
2327 
2328 	lockdep_assert_wiphy(hw->wiphy);
2329 
2330 	old = hw->conf.flags & IEEE80211_CONF_IDLE;
2331 	if (old == new)
2332 		return;
2333 
2334 	hw->conf.flags ^= IEEE80211_CONF_IDLE;
2335 	error = lkpi_80211_mo_config(hw, IEEE80211_CONF_CHANGE_IDLE);
2336 	if (error != 0 && error != EOPNOTSUPP) {
2337 		lhw = HW_TO_LHW(hw);
2338 		ic_printf(lhw->ic, "ERROR: %s: config %#0x returned %d\n",
2339 		    __func__, IEEE80211_CONF_CHANGE_IDLE, error);
2340 	}
2341 }
2342 
2343 static enum ieee80211_bss_changed
2344 lkpi_disassoc(struct ieee80211_sta *sta, struct ieee80211_vif *vif,
2345     struct lkpi_hw *lhw)
2346 {
2347 	struct ieee80211_hw *hw;
2348 	struct lkpi_vif *lvif;
2349 	enum ieee80211_bss_changed changed;
2350 
2351 	hw = LHW_TO_HW(lhw);
2352 	lockdep_assert_wiphy(hw->wiphy);
2353 
2354 	changed = 0;
2355 	sta->aid = 0;
2356 	if (vif->cfg.assoc) {
2357 
2358 		vif->cfg.assoc = false;
2359 		vif->cfg.aid = 0;
2360 		changed |= BSS_CHANGED_ASSOC;
2361 		IMPROVE();
2362 
2363 		lkpi_update_mcast_filter_locked(lhw->ic);
2364 
2365 		/*
2366 		 * Executing the bss_info_changed(BSS_CHANGED_ASSOC) with
2367 		 * assoc = false right away here will remove the sta from
2368 		 * firmware for iwlwifi.
2369 		 * We no longer do this but only return the BSS_CHNAGED value.
2370 		 * The caller is responsible for removing the sta gong to
2371 		 * IEEE80211_STA_NOTEXIST and then executing the
2372 		 * bss_info_changed() update.
2373 		 * See DOWN4 for more detailed comment.
2374 		 */
2375 
2376 		lvif = VIF_TO_LVIF(vif);
2377 		lvif->beacons = 0;
2378 	}
2379 
2380 	return (changed);
2381 }
2382 
2383 static void
2384 lkpi_wake_tx_queues(struct ieee80211_hw *hw, struct ieee80211_sta *sta,
2385     bool dequeue_seen, bool no_emptyq)
2386 {
2387 	struct lkpi_txq *ltxq;
2388 	int tid;
2389 	bool ltxq_empty;
2390 
2391 	/* Wake up all queues to know they are allocated in the driver. */
2392 	for (tid = 0; tid < nitems(sta->txq); tid++) {
2393 
2394 		if (tid == IEEE80211_NUM_TIDS) {
2395 			IMPROVE("station specific?");
2396 			if (!ieee80211_hw_check(hw, STA_MMPDU_TXQ))
2397 				continue;
2398 		} else if (tid >= hw->queues)
2399 			continue;
2400 
2401 		if (sta->txq[tid] == NULL)
2402 			continue;
2403 
2404 		ltxq = TXQ_TO_LTXQ(sta->txq[tid]);
2405 		if (dequeue_seen && (ltxq->flags & LKPI_TXQ_SEEN_DEQUEUE) == 0)
2406 			continue;
2407 
2408 		LKPI_80211_LTXQ_LOCK(ltxq);
2409 		ltxq_empty = skb_queue_empty(&ltxq->skbq);
2410 		LKPI_80211_LTXQ_UNLOCK(ltxq);
2411 		if (no_emptyq && ltxq_empty)
2412 			continue;
2413 
2414 		lkpi_80211_mo_wake_tx_queue(hw, sta->txq[tid], false);
2415 	}
2416 }
2417 
2418 /*
2419  * On the way down from RUN -> ASSOC -> AUTH we may send a DISASSOC or DEAUTH
2420  * packet.  The problem is that the state machine functions tend to hold the
2421  * LHW lock which will prevent lkpi_80211_txq_tx_one() from sending the packet.
2422  * We call this after dropping the ic lock and before acquiring the LHW lock.
2423  * we make sure no further packets are queued and if they are queued the task
2424  * will finish or be cancelled.  At the end if a packet is left we manually
2425  * send it.  scan_to_auth() would re-enable sending if the lsta would be
2426  * re-used.
2427  */
2428 static void
2429 lkpi_80211_flush_tx(struct lkpi_hw *lhw, struct lkpi_sta *lsta)
2430 {
2431 	struct ieee80211_hw *hw;
2432 	struct mbufq mq;
2433 	struct mbuf *m;
2434 	int len;
2435 
2436 	/* There is no lockdep_assert_not_held_wiphy(). */
2437 	hw = LHW_TO_HW(lhw);
2438 	lockdep_assert_not_held(&hw->wiphy->mtx);
2439 
2440 	/* Do not accept any new packets until scan_to_auth or lsta_free(). */
2441 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
2442 	lsta->txq_ready = false;
2443 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
2444 
2445 	while (taskqueue_cancel(taskqueue_thread, &lsta->txq_task, NULL) != 0)
2446 		taskqueue_drain(taskqueue_thread, &lsta->txq_task);
2447 
2448 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
2449 	len = mbufq_len(&lsta->txq);
2450 	if (len <= 0) {
2451 		LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
2452 		return;
2453 	}
2454 
2455 	mbufq_init(&mq, IFQ_MAXLEN);
2456 	mbufq_concat(&mq, &lsta->txq);
2457 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
2458 
2459 	m = mbufq_dequeue(&mq);
2460 	while (m != NULL) {
2461 		lkpi_80211_txq_tx_one(lsta, m);
2462 		m = mbufq_dequeue(&mq);
2463 	}
2464 }
2465 
2466 static void
2467 lkpi_init_chandef(struct ieee80211com *ic __unused,
2468     struct cfg80211_chan_def *chandef,
2469     struct linuxkpi_ieee80211_channel *chan, struct ieee80211_channel *c,
2470     bool can_ht)
2471 {
2472 
2473 	cfg80211_chandef_create(chandef, chan,
2474 	    (can_ht) ? NL80211_CHAN_HT20 : NL80211_CHAN_NO_HT);
2475 	chandef->center_freq1 = ieee80211_get_channel_center_freq1(c);
2476 	chandef->center_freq2 = ieee80211_get_channel_center_freq2(c);
2477 
2478 	IMPROVE("Check ht/vht_cap from band not just chan? See lkpi_sta_sync_from_ni...");
2479 #ifdef LKPI_80211_HT
2480 	if (IEEE80211_IS_CHAN_HT(c)) {
2481 		if (IEEE80211_IS_CHAN_HT40(c))
2482 			chandef->width = NL80211_CHAN_WIDTH_40;
2483 		else
2484 			chandef->width = NL80211_CHAN_WIDTH_20;
2485 	}
2486 #endif
2487 #ifdef LKPI_80211_VHT
2488 	if (IEEE80211_IS_CHAN_VHT_5GHZ(c)) {
2489 		if (IEEE80211_IS_CHAN_VHT80P80(c))
2490 			chandef->width = NL80211_CHAN_WIDTH_80P80;
2491 		else if (IEEE80211_IS_CHAN_VHT160(c))
2492 			chandef->width = NL80211_CHAN_WIDTH_160;
2493 		else if (IEEE80211_IS_CHAN_VHT80(c))
2494 			chandef->width = NL80211_CHAN_WIDTH_80;
2495 	}
2496 #endif
2497 
2498 #ifdef LINUXKPI_DEBUG_80211
2499 	if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
2500 		ic_printf(ic, "%s:%d: chandef %p { chan %p { %u }, "
2501 		    "width %d cfreq1 %u cfreq2 %u punctured %u }\n",
2502 		    __func__, __LINE__, chandef,
2503 		    chandef->chan, chandef->chan->center_freq,
2504 		    chandef->width,
2505 		    chandef->center_freq1, chandef->center_freq2,
2506 		    chandef->punctured);
2507 #endif
2508 }
2509 
2510 static uint32_t
2511 lkpi_init_chanctx_conf(struct ieee80211_hw *hw,
2512     struct cfg80211_chan_def *chandef,
2513     struct ieee80211_chanctx_conf *chanctx_conf)
2514 {
2515 	uint32_t changed;
2516 
2517 	lockdep_assert_wiphy(hw->wiphy);
2518 
2519 	changed = 0;
2520 
2521 	chanctx_conf->rx_chains_static = 1;
2522 	chanctx_conf->rx_chains_dynamic = 1;
2523 	changed |= IEEE80211_CHANCTX_CHANGE_RX_CHAINS;
2524 
2525 	if (chanctx_conf->radar_enabled != hw->conf.radar_enabled) {
2526 		chanctx_conf->radar_enabled = hw->conf.radar_enabled;
2527 		changed |= IEEE80211_CHANCTX_CHANGE_RADAR;
2528 	}
2529 
2530 	chanctx_conf->def = *chandef;
2531 	changed |= IEEE80211_CHANCTX_CHANGE_WIDTH;
2532 
2533 	/* One day we should figure this out; is for iwlwifi-only. */
2534 	chanctx_conf->min_def = chanctx_conf->def;
2535 	changed |= IEEE80211_CHANCTX_CHANGE_MIN_WIDTH;
2536 
2537 	/* chanctx_conf->ap = */
2538 
2539 	return (changed);
2540 }
2541 
2542 static struct lkpi_chanctx *
2543 lkpi_alloc_lchanctx(struct ieee80211_hw *hw, struct lkpi_vif *lvif)
2544 {
2545 	struct lkpi_chanctx *lchanctx;
2546 
2547 	lchanctx = malloc(sizeof(*lchanctx) + hw->chanctx_data_size,
2548 	    M_LKPI80211, M_WAITOK | M_ZERO);
2549 	lchanctx->lvif = lvif;
2550 
2551 	return (lchanctx);
2552 }
2553 
2554 static struct lkpi_chanctx *
2555 lkpi_find_lchanctx_reserved(struct ieee80211_hw *hw, struct lkpi_vif *lvif)
2556 {
2557 	struct lkpi_hw *lhw;
2558 	struct lkpi_chanctx *lchanctx;
2559 	bool found;
2560 
2561 	lhw = HW_TO_LHW(hw);
2562 
2563 	found = false;
2564 	rcu_read_lock();
2565 	list_for_each_entry_rcu(lchanctx, &lhw->lchanctx_list_reserved, entry) {
2566 		if (lchanctx->lvif == lvif) {
2567 			found = true;
2568 			break;
2569 		}
2570 	}
2571 	rcu_read_unlock();
2572 
2573 	if (!found) {
2574 		lchanctx = lkpi_alloc_lchanctx(hw, lvif);
2575 		list_add_rcu(&lchanctx->entry, &lhw->lchanctx_list_reserved);
2576 	}
2577 
2578 	return (lchanctx);
2579 }
2580 
2581 static struct ieee80211_chanctx_conf *
2582 lkpi_get_chanctx_conf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
2583 {
2584 	struct ieee80211_chanctx_conf *chanctx_conf;
2585 
2586 	chanctx_conf = rcu_dereference_protected(vif->bss_conf.chanctx_conf,
2587 	    lockdep_is_held(&hw->wiphy->mtx));
2588 	if (chanctx_conf == NULL) {
2589 		struct lkpi_chanctx *lchanctx;
2590 		struct lkpi_vif *lvif;
2591 
2592 		lvif = VIF_TO_LVIF(vif);
2593 		lchanctx = lkpi_find_lchanctx_reserved(hw, lvif);
2594 		KASSERT(lchanctx != NULL, ("%s: hw %p, vif %p no lchanctx\n",
2595 		    __func__, hw, vif));
2596 		list_del(&lchanctx->entry);
2597 		chanctx_conf = &lchanctx->chanctx_conf;
2598 	}
2599 	/* else { IMPROVE("diff changes for changed, working on live copy, rcu"); } */
2600 
2601 	return (chanctx_conf);
2602 }
2603 
2604 static int
2605 lkpi_set_chanctx_conf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
2606     struct ieee80211_chanctx_conf *chanctx_conf,
2607     uint32_t changed, bool changed_set)
2608 {
2609 	struct lkpi_hw *lhw;
2610 	struct lkpi_chanctx *lchanctx;
2611 	int error;
2612 
2613 	lockdep_assert_wiphy(hw->wiphy);
2614 
2615 	if (vif->bss_conf.chanctx_conf == chanctx_conf) {
2616 		if (!changed_set) {
2617 			IMPROVE("OBSOLETE?");
2618 			changed = IEEE80211_CHANCTX_CHANGE_MIN_WIDTH;
2619 			changed |= IEEE80211_CHANCTX_CHANGE_RADAR;
2620 			changed |= IEEE80211_CHANCTX_CHANGE_RX_CHAINS;
2621 			changed |= IEEE80211_CHANCTX_CHANGE_WIDTH;
2622 		}
2623 		lkpi_80211_mo_change_chanctx(hw, chanctx_conf, changed);
2624 
2625 		return (0);
2626 	}
2627 
2628 	lhw = HW_TO_LHW(hw);
2629 
2630 	/* The device is no longer idle. */
2631 	IMPROVE("Once we do multi-vif, only do for 1st chanctx");
2632 	lkpi_hw_conf_idle(hw, false);
2633 
2634 	error = lkpi_80211_mo_add_chanctx(hw, chanctx_conf);
2635 	if (error != 0 && error != EOPNOTSUPP) {
2636 		ic_printf(lhw->ic, "%s:%d: mo_add_chanctx "
2637 		    "failed: %d\n", __func__, __LINE__, error);
2638 		return (error);
2639 	}
2640 
2641 	vif->bss_conf.chanreq.oper.chan = chanctx_conf->def.chan;
2642 	vif->bss_conf.chanreq.oper.width = chanctx_conf->def.width;
2643 	vif->bss_conf.chanreq.oper.center_freq1 =
2644 	    chanctx_conf->def.center_freq1;
2645 	vif->bss_conf.chanreq.oper.center_freq2 =
2646 	    chanctx_conf->def.center_freq2;
2647 
2648 	lchanctx = CHANCTX_CONF_TO_LCHANCTX(chanctx_conf);
2649 	list_add_rcu(&lchanctx->entry, &lhw->lchanctx_list);
2650 	rcu_assign_pointer(vif->bss_conf.chanctx_conf, chanctx_conf);
2651 
2652 	/* Assign vif chanctx. */
2653 	if (error == 0)
2654 		error = lkpi_80211_mo_assign_vif_chanctx(hw, vif,
2655 		    &vif->bss_conf, chanctx_conf);
2656 	if (error == EOPNOTSUPP)
2657 		error = 0;
2658 	if (error != 0) {
2659 		ic_printf(lhw->ic, "%s:%d: mo_assign_vif_chanctx "
2660 		    "failed: %d\n", __func__, __LINE__, error);
2661 		lkpi_80211_mo_remove_chanctx(hw, chanctx_conf);
2662 		rcu_assign_pointer(vif->bss_conf.chanctx_conf, NULL);
2663 		lchanctx = CHANCTX_CONF_TO_LCHANCTX(chanctx_conf);
2664 		list_del(&lchanctx->entry);
2665 		memset(lchanctx, 0, sizeof(*lchanctx));
2666 		lchanctx->lvif = VIF_TO_LVIF(vif);
2667 		list_add_rcu(&lchanctx->entry, &lhw->lchanctx_list_reserved);
2668 	}
2669 
2670 	return (error);
2671 }
2672 
2673 static void
2674 lkpi_remove_chanctx(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
2675 {
2676 	struct lkpi_hw *lhw;
2677 	struct ieee80211_chanctx_conf *chanctx_conf;
2678 	struct lkpi_chanctx *lchanctx;
2679 
2680 	lockdep_assert_wiphy(hw->wiphy);
2681 
2682 	chanctx_conf = rcu_dereference_protected(vif->bss_conf.chanctx_conf,
2683 	    lockdep_is_held(&hw->wiphy->mtx));
2684 
2685 	if (chanctx_conf == NULL)
2686 		return;
2687 
2688 	/* Remove vif context. */
2689 	lkpi_80211_mo_unassign_vif_chanctx(hw, vif, &vif->bss_conf, chanctx_conf);
2690 
2691 	lkpi_hw_conf_idle(hw, true);
2692 
2693 	/* Remove chan ctx. */
2694 	lkpi_80211_mo_remove_chanctx(hw, chanctx_conf);
2695 
2696 	/* Cleanup. */
2697 	rcu_assign_pointer(vif->bss_conf.chanctx_conf, NULL);
2698 	lchanctx = CHANCTX_CONF_TO_LCHANCTX(chanctx_conf);
2699 	list_del(&lchanctx->entry);
2700 	lhw = HW_TO_LHW(hw);
2701 	memset(lchanctx, 0, sizeof(*lchanctx));
2702 	lchanctx->lvif = VIF_TO_LVIF(vif);
2703 	list_add_rcu(&lchanctx->entry, &lhw->lchanctx_list_reserved);
2704 }
2705 
2706 /* -------------------------------------------------------------------------- */
2707 
2708 /* Any other options belong here? Check more drivers. */
2709 #define	BSS_CHANGED_VIF_CFG_BITS					\
2710     (BSS_CHANGED_SSID | BSS_CHANGED_IDLE | BSS_CHANGED_PS | BSS_CHANGED_ASSOC | \
2711     BSS_CHANGED_ARP_FILTER | BSS_CHANGED_MLD_VALID_LINKS | BSS_CHANGED_MLD_TTLM)
2712 
2713 static void
2714 lkpi_bss_info_change(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
2715     enum ieee80211_bss_changed bss_changed)
2716 {
2717 	struct lkpi_vif *lvif;
2718 	enum ieee80211_bss_changed vif_cfg_bits, link_info_bits;
2719 
2720 	if (ieee80211_vif_is_mld(vif)) {
2721 		TODO("This likely needs a subset only; split up into 3 parts.");
2722 	}
2723 
2724 	/* Nothing to do? */
2725 	if (bss_changed == 0)
2726 		return;
2727 
2728 	/*
2729 	 * If the vif is not known to the driver there is nothing to notifiy for.
2730 	 * We MUST NOT check for !lvif_bss_synched here (the reasonable it seems)
2731 	 * as we need to execute the update(s) or we will have follow-up issues.
2732 	 */
2733 	lvif = VIF_TO_LVIF(vif);
2734 	if (!lvif->added_to_drv)
2735 		return;
2736 
2737 	/*
2738 	 * With the advent of MLO bss_conf got split up into vif and link
2739 	 * change notfications, while historically it was one.
2740 	 * We now need to support all possible models.
2741 	 */
2742 	vif_cfg_bits = bss_changed & BSS_CHANGED_VIF_CFG_BITS;
2743 	if (vif_cfg_bits != 0)
2744 		lkpi_80211_mo_vif_cfg_changed(hw, vif, vif_cfg_bits, false);
2745 
2746 	link_info_bits = bss_changed & ~(BSS_CHANGED_VIF_CFG_BITS);
2747 	if (link_info_bits != 0)
2748 		lkpi_80211_mo_link_info_changed(hw, vif, &vif->bss_conf,
2749 		    link_info_bits, 0, false);
2750 
2751 	lkpi_80211_mo_bss_info_changed(hw, vif, &vif->bss_conf, bss_changed);
2752 }
2753 
2754 /* -------------------------------------------------------------------------- */
2755 
2756 static int
2757 lkpi_sta_state_do_nada(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2758 {
2759 	return (0);
2760 }
2761 
2762 /* UP1 */
2763 static int
2764 lkpi_sta_init_to_scan(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2765 {
2766 	return (lkpi_sta_state_do_nada(vap, nstate, arg));
2767 }
2768 
2769 /* UP2 */
2770 static int
2771 lkpi_sta_scan_to_auth(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2772 {
2773 	struct linuxkpi_ieee80211_channel *chan;
2774 	struct cfg80211_chan_def chandef;
2775 	struct ieee80211_chanctx_conf *chanctx_conf;
2776 	struct lkpi_hw *lhw;
2777 	struct ieee80211_hw *hw;
2778 	struct lkpi_vif *lvif;
2779 	struct ieee80211_vif *vif;
2780 	struct ieee80211_node *ni;
2781 	struct lkpi_sta *lsta;
2782 	enum ieee80211_bss_changed bss_changed;
2783 	struct ieee80211_prep_tx_info prep_tx_info;
2784 	uint32_t changed;
2785 	int error;
2786 	bool synched, can_ht;
2787 
2788 	/*
2789 	 * In here we use vap->iv_bss until lvif->lvif_bss is set.
2790 	 * For all later (STATE >= AUTH) functions we need to use the lvif
2791 	 * cache which will be tracked even through (*iv_update_bss)().
2792 	 */
2793 
2794 	if (vap->iv_bss == NULL) {
2795 		ic_printf(vap->iv_ic, "%s: no iv_bss for vap %p\n", __func__, vap);
2796 		return (EINVAL);
2797 	}
2798 	/*
2799 	 * Keep the ni alive locally.  In theory (and practice) iv_bss can change
2800 	 * once we unlock here.  This is due to net80211 allowing state changes
2801 	 * and new join1() despite having an active node as well as due to
2802 	 * the fact that the iv_bss can be swapped under the hood in (*iv_update_bss).
2803 	 */
2804 	ni = ieee80211_ref_node(vap->iv_bss);
2805 	if (ni->ni_chan == NULL || ni->ni_chan == IEEE80211_CHAN_ANYC) {
2806 		ic_printf(vap->iv_ic, "%s: no channel set for iv_bss ni %p "
2807 		    "on vap %p\n", __func__, ni, vap);
2808 		ieee80211_free_node(ni);	/* Error handling for the local ni. */
2809 		return (EINVAL);
2810 	}
2811 
2812 	lhw = vap->iv_ic->ic_softc;
2813 	chan = lkpi_find_lkpi80211_chan(lhw, ni->ni_chan);
2814 	if (chan == NULL) {
2815 		ic_printf(vap->iv_ic, "%s: failed to get LKPI channel from "
2816 		    "iv_bss ni %p on vap %p\n", __func__, ni, vap);
2817 		ieee80211_free_node(ni);	/* Error handling for the local ni. */
2818 		return (ESRCH);
2819 	}
2820 
2821 	hw = LHW_TO_HW(lhw);
2822 	lvif = VAP_TO_LVIF(vap);
2823 	vif = LVIF_TO_VIF(lvif);
2824 
2825 	LKPI_80211_LVIF_LOCK(lvif);
2826 	/* XXX-BZ KASSERT later? */
2827 	if (lvif->lvif_bss_synched || lvif->lvif_bss != NULL) {
2828 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
2829 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
2830 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
2831 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
2832 		    lvif->lvif_bss_synched);
2833 		LKPI_80211_LVIF_UNLOCK(lvif);
2834 		ieee80211_free_node(ni);	/* Error handling for the local ni. */
2835 		return (EBUSY);
2836 	}
2837 	LKPI_80211_LVIF_UNLOCK(lvif);
2838 
2839 	IEEE80211_UNLOCK(vap->iv_ic);
2840 	wiphy_lock(hw->wiphy);
2841 
2842 	/* Add chanctx (or if exists, change it). */
2843 	chanctx_conf = lkpi_get_chanctx_conf(hw, vif);
2844 
2845 	KASSERT(ni->ni_chan != NULL && ni->ni_chan != IEEE80211_CHAN_ANYC,
2846 	   ("%s:%d: ni %p ni_chan %p\n", __func__, __LINE__, ni, ni->ni_chan));
2847 
2848 #ifdef LKPI_80211_HT
2849 	can_ht = (vap->iv_ic->ic_flags_ht & IEEE80211_FHT_HT) != 0;
2850 #else
2851 	can_ht = false;
2852 #endif
2853 	lkpi_init_chandef(vap->iv_ic, &chandef, chan, ni->ni_chan, can_ht);
2854 	hw->conf.radar_enabled =
2855 	    ((chan->flags & IEEE80211_CHAN_RADAR) != 0) ? true : false;
2856 	hw->conf.chandef = chandef;
2857 	vif->bss_conf.chanreq.oper = hw->conf.chandef;
2858 #ifdef LINUXKPI_DEBUG_80211
2859 	if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
2860 		ic_printf(vap->iv_ic, "%s:%d: hw->conf.chandef %p = chandef %p = "
2861 		    "vif->bss_conf.chanreq.oper %p\n", __func__, __LINE__,
2862 		    &hw->conf.chandef, &chandef, &vif->bss_conf.chanreq.oper);
2863 #endif
2864 
2865 	changed = lkpi_init_chanctx_conf(hw, &chandef, chanctx_conf);
2866 
2867 	/* Responder ... */
2868 
2869 	/* Set bss info (bss_info_changed). */
2870 	bss_changed = 0;
2871 	IEEE80211_ADDR_COPY(vif->cfg.ap_addr, ni->ni_bssid);
2872 	vif->bss_conf.bssid = ni->ni_bssid;
2873 	bss_changed |= BSS_CHANGED_BSSID;
2874 	vif->bss_conf.txpower = ni->ni_txpower;
2875 	bss_changed |= BSS_CHANGED_TXPOWER;
2876 	vif->cfg.idle = false;
2877 	bss_changed |= BSS_CHANGED_IDLE;
2878 
2879 	lvif->beacons = 0;
2880 	/* Should almost assert it is this. */
2881 	vif->cfg.assoc = false;
2882 	vif->cfg.aid = 0;
2883 
2884 	bss_changed |= lkpi_update_dtim_tsf(vif, ni, vap, __func__, __LINE__);
2885 
2886 	error = lkpi_set_chanctx_conf(hw, vif, chanctx_conf, changed, true);
2887 	if (error != 0)
2888 		goto out;
2889 
2890 	IMPROVE("update radiotap chan fields too");
2891 
2892 	/* RATES */
2893 	IMPROVE("bss info: not all needs to come now and rates are missing");
2894 	bss_changed |= lkpi_sta_supp_rates(hw, vif, ni, NULL);
2895 	if (ieee80211_hw_check(hw, HAS_RATE_CONTROL))
2896 		lkpi_80211_mo_set_bitrate_mask(hw, vif, &lvif->br_mask);
2897 	TODO("cfg80211_tid_config WHERE?");
2898 
2899 	lkpi_bss_info_change(hw, vif, bss_changed);
2900 
2901 	/*
2902 	 * Given ni and lsta are 1:1 from alloc to free we can assert that
2903 	 * ni always has lsta data attach despite net80211 node swapping
2904 	 * under the hoods.
2905 	 */
2906 	KASSERT(ni->ni_drv_data != NULL, ("%s: ni %p ni_drv_data %p\n",
2907 	    __func__, ni, ni->ni_drv_data));
2908 	lsta = ni->ni_drv_data;
2909 
2910 	/* Insert the [l]sta into the list of known stations. */
2911 	list_add_tail(&lsta->lsta_list, &lvif->lsta_list);
2912 
2913 	/* Add (or adjust) sta and change state (from NOTEXIST) to NONE. */
2914 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
2915 	KASSERT(lsta->state == IEEE80211_STA_NOTEXIST, ("%s: lsta %p state not "
2916 	    "NOTEXIST: %#x\n", __func__, lsta, lsta->state));
2917 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_NONE);
2918 	if (error != 0) {
2919 		IMPROVE("do we need to undo the chan ctx?");
2920 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(NONE) "
2921 		    "failed: %d\n", __func__, __LINE__, error);
2922 		goto out;
2923 	}
2924 #if 0
2925 	lsta->added_to_drv = true;	/* mo manages. */
2926 #endif
2927 
2928 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
2929 
2930 #if 0
2931 	/*
2932 	 * Wakeup all queues now that sta is there so we have as much time to
2933 	 * possibly prepare the queue in the driver to be ready for the 1st
2934 	 * packet;  lkpi_80211_txq_tx_one() still has a workaround as there
2935 	 * is no guarantee or way to check.
2936 	 * XXX-BZ and by now we know that this does not work on all drivers
2937 	 * for all queues.
2938 	 */
2939 	lkpi_wake_tx_queues(hw, LSTA_TO_STA(lsta), false, false);
2940 #endif
2941 
2942 	/* Start mgd_prepare_tx. */
2943 	memset(&prep_tx_info, 0, sizeof(prep_tx_info));
2944 	prep_tx_info.duration = PREP_TX_INFO_DURATION;		/* SAE */
2945 	prep_tx_info.subtype = IEEE80211_STYPE_AUTH;
2946 	prep_tx_info.link_id = 0;
2947 	lkpi_80211_mo_mgd_prepare_tx(hw, vif, &prep_tx_info);
2948 	lsta->in_mgd = true;
2949 
2950 	/*
2951 	 * What is going to happen next:
2952 	 * - <twiddle> .. we should end up in "auth_to_assoc"
2953 	 * - event_callback
2954 	 * - update sta_state (NONE to AUTH)
2955 	 * - mgd_complete_tx
2956 	 * (ideally we'd do that on a callback for something else ...)
2957 	 */
2958 
2959 	wiphy_unlock(hw->wiphy);
2960 	IEEE80211_LOCK(vap->iv_ic);
2961 
2962 	LKPI_80211_LVIF_LOCK(lvif);
2963 	/* Re-check given (*iv_update_bss) could have happened while we were unlocked. */
2964 	if (lvif->lvif_bss_synched || lvif->lvif_bss != NULL ||
2965 	    lsta->ni != vap->iv_bss)
2966 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
2967 		    "lvif_bss->ni %p synched %d, ni %p lsta %p\n", __func__, __LINE__,
2968 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
2969 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
2970 		    lvif->lvif_bss_synched, ni, lsta);
2971 
2972 	/*
2973 	 * Reference the "ni" for caching the lsta/ni in lvif->lvif_bss.
2974 	 * Given we cache lsta we use lsta->ni instead of ni here (even though
2975 	 * lsta->ni == ni) to be distinct from the rest of the code where we do
2976 	 * assume that ni == vap->iv_bss which it may or may not be.
2977 	 * So do NOT use iv_bss here anymore as that may have diverged from our
2978 	 * function local ni already while ic was unlocked and would lead to
2979 	 * inconsistencies.  Go and see if we lost a race and do not update
2980 	 * lvif_bss_synched in that case.
2981 	 */
2982 	ieee80211_ref_node(lsta->ni);
2983 	lvif->lvif_bss = lsta;
2984 	if (lsta->ni == vap->iv_bss) {
2985 		lvif->lvif_bss_synched = synched = true;
2986 	} else {
2987 		/* Set to un-synched no matter what. */
2988 		lvif->lvif_bss_synched = synched = false;
2989 		/*
2990 		 * We do not error as someone has to take us down.
2991 		 * If we are followed by a 2nd, new net80211::join1() going to
2992 		 * AUTH lkpi_sta_a_to_a() will error, lkpi_sta_auth_to_{scan,init}()
2993 		 * will take the lvif->lvif_bss node down eventually.
2994 		 * What happens with the vap->iv_bss node will entirely be up
2995 		 * to net80211 as we never used the node beyond alloc()/free()
2996 		 * and we do not hold an extra reference for that anymore given
2997 		 * ni : lsta == 1:1.
2998 		 * Problem is if we do not error a MGMT/AUTH frame will be
2999 		 * sent from net80211::sta_newstate(); disable lsta queue below.
3000 		 */
3001 	}
3002 	LKPI_80211_LVIF_UNLOCK(lvif);
3003 	/*
3004 	 * Make sure in case the sta did not change and we re-added it,
3005 	 * that we can tx again but only if the vif/iv_bss are in sync.
3006 	 * Otherwise this should prevent the MGMT/AUTH frame from being
3007 	 * sent triggering a warning in iwlwifi.
3008 	 */
3009 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
3010 	lsta->txq_ready = synched;
3011 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
3012 	goto out_relocked;
3013 
3014 out:
3015 	wiphy_unlock(hw->wiphy);
3016 	IEEE80211_LOCK(vap->iv_ic);
3017 out_relocked:
3018 	/*
3019 	 * Release the reference that kept the ni stable locally
3020 	 * during the work of this function.
3021 	 */
3022 	if (ni != NULL)
3023 		ieee80211_free_node(ni);
3024 	return (error);
3025 }
3026 
3027 /* UP3.1 */
3028 static int
3029 lkpi_sta_auth_to_assoc(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3030 {
3031 	struct lkpi_hw *lhw;
3032 	struct ieee80211_hw *hw;
3033 	struct lkpi_vif *lvif;
3034 	struct ieee80211_vif *vif;
3035 	struct lkpi_sta *lsta;
3036 	struct ieee80211_prep_tx_info prep_tx_info;
3037 	int error;
3038 
3039 	lhw = vap->iv_ic->ic_softc;
3040 	hw = LHW_TO_HW(lhw);
3041 	lvif = VAP_TO_LVIF(vap);
3042 	vif = LVIF_TO_VIF(lvif);
3043 
3044 	IEEE80211_UNLOCK(vap->iv_ic);
3045 	wiphy_lock(hw->wiphy);
3046 
3047 	LKPI_80211_LVIF_LOCK(lvif);
3048 	/* XXX-BZ KASSERT later? */
3049 	if (!lvif->lvif_bss_synched || lvif->lvif_bss == NULL) {
3050 #ifdef LINUXKPI_DEBUG_80211
3051 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
3052 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
3053 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
3054 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
3055 		    lvif->lvif_bss_synched);
3056 #endif
3057 		error = ENOTRECOVERABLE;
3058 		LKPI_80211_LVIF_UNLOCK(lvif);
3059 		goto out;
3060 	}
3061 	lsta = lvif->lvif_bss;
3062 	LKPI_80211_LVIF_UNLOCK(lvif);
3063 
3064 	KASSERT(lsta != NULL, ("%s: lsta %p\n", __func__, lsta));
3065 
3066 	/* Finish auth. */
3067 	IMPROVE("event callback");
3068 
3069 	/* Update sta_state (NONE to AUTH). */
3070 	KASSERT(lsta->state == IEEE80211_STA_NONE, ("%s: lsta %p state not "
3071 	    "NONE: %#x\n", __func__, lsta, lsta->state));
3072 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_AUTH);
3073 	if (error != 0) {
3074 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(AUTH) "
3075 		    "failed: %d\n", __func__, __LINE__, error);
3076 		goto out;
3077 	}
3078 
3079 	/* End mgd_complete_tx. */
3080 	if (lsta->in_mgd) {
3081 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3082 		prep_tx_info.subtype = IEEE80211_STYPE_AUTH;
3083 		prep_tx_info.success = true;
3084 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
3085 		lsta->in_mgd = false;
3086 	}
3087 
3088 	/* Now start assoc. unless nstate=RUN (auth_to_run). */
3089 
3090 	/* Start mgd_prepare_tx. */
3091 	if (nstate == IEEE80211_S_ASSOC && !lsta->in_mgd) {
3092 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3093 		prep_tx_info.subtype = IEEE80211_STYPE_ASSOC_REQ;
3094 		prep_tx_info.link_id = 0;
3095 		lkpi_80211_mo_mgd_prepare_tx(hw, vif, &prep_tx_info);
3096 		lsta->in_mgd = true;
3097 	}
3098 
3099 #if 0
3100 	/* We do not yet have a packet to go out. */
3101 	/* Wake tx queue to get packet out. */
3102 	lkpi_wake_tx_queues(hw, LSTA_TO_STA(lsta), false, true);
3103 #endif
3104 
3105 	/*
3106 	 * <twiddle> .. we end up in "assoc_to_run"
3107 	 * - update sta_state (AUTH to ASSOC)
3108 	 * - conf_tx [all]
3109 	 * - bss_info_changed (assoc, aid, ssid, ..)
3110 	 * - change_chanctx (if needed)
3111 	 * - event_callback
3112 	 * - mgd_complete_tx
3113 	 */
3114 
3115 out:
3116 	wiphy_unlock(hw->wiphy);
3117 	IEEE80211_LOCK(vap->iv_ic);
3118 	return (error);
3119 }
3120 
3121 static int lkpi_sta_assoc_to_run(struct ieee80211vap *, enum ieee80211_state, int);
3122 
3123 /* UP3.2 */
3124 static int
3125 lkpi_sta_auth_to_run(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3126 {
3127 	int error;
3128 
3129 	error = lkpi_sta_auth_to_assoc(vap, nstate, arg);
3130 	if (error == 0)
3131 		error = lkpi_sta_assoc_to_run(vap, nstate, arg);
3132 	return (error);
3133 }
3134 
3135 /* UP4 */
3136 static int
3137 lkpi_sta_assoc_to_run(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3138 {
3139 	struct lkpi_hw *lhw;
3140 	struct ieee80211_hw *hw;
3141 	struct lkpi_vif *lvif;
3142 	struct ieee80211_vif *vif;
3143 	struct ieee80211_node *ni;
3144 	struct lkpi_sta *lsta;
3145 	struct ieee80211_sta *sta;
3146 	struct ieee80211_prep_tx_info prep_tx_info;
3147 	enum ieee80211_bss_changed bss_changed;
3148 	int error;
3149 
3150 	lhw = vap->iv_ic->ic_softc;
3151 	hw = LHW_TO_HW(lhw);
3152 	lvif = VAP_TO_LVIF(vap);
3153 	vif = LVIF_TO_VIF(lvif);
3154 
3155 	IEEE80211_UNLOCK(vap->iv_ic);
3156 	wiphy_lock(hw->wiphy);
3157 
3158 	LKPI_80211_LVIF_LOCK(lvif);
3159 	/* XXX-BZ KASSERT later? */
3160 	if (!lvif->lvif_bss_synched || lvif->lvif_bss == NULL) {
3161 #ifdef LINUXKPI_DEBUG_80211
3162 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
3163 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
3164 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
3165 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
3166 		    lvif->lvif_bss_synched);
3167 #endif
3168 		LKPI_80211_LVIF_UNLOCK(lvif);
3169 		error = ENOTRECOVERABLE;
3170 		goto out;
3171 	}
3172 	lsta = lvif->lvif_bss;
3173 	LKPI_80211_LVIF_UNLOCK(lvif);
3174 	KASSERT(lsta != NULL && lsta->ni != NULL, ("%s: lsta %p ni %p "
3175 	    "lvif %p vap %p\n", __func__,
3176 	    lsta, (lsta != NULL) ? lsta->ni : NULL, lvif, vap));
3177 
3178 	ni = lsta->ni;		/* Reference held for lvif_bss. */
3179 
3180 	IMPROVE("ponder some of this moved to ic_newassoc, scan_assoc_success, "
3181 	    "and to lesser extend ieee80211_notify_node_join");
3182 
3183 	/* Finish assoc. */
3184 	/* Update sta_state (AUTH to ASSOC) and set aid. */
3185 	KASSERT(lsta->state == IEEE80211_STA_AUTH, ("%s: lsta %p state not "
3186 	    "AUTH: %#x\n", __func__, lsta, lsta->state));
3187 	sta = LSTA_TO_STA(lsta);
3188 	sta->aid = IEEE80211_NODE_AID(ni);
3189 #ifdef LKPI_80211_WME
3190 	if (vap->iv_flags & IEEE80211_F_WME)
3191 		sta->wme = true;
3192 #endif
3193 	bss_changed = 0;
3194 	/*
3195 	 * This sync needs to happen before the sta_state change to ASSOC.
3196 	 * At least mt7921 (likely all drivers) rely on, e.g., ht_cap, vht_cap,
3197 	 * .. to be set at the point we go to assoc.
3198 	 */
3199 	bss_changed |= lkpi_sta_sync_from_ni(hw, vif, sta, ni, true);
3200 	if (ieee80211_hw_check(hw, HAS_RATE_CONTROL))
3201 		lkpi_80211_mo_set_bitrate_mask(hw, vif, &lvif->br_mask);
3202 
3203 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_ASSOC);
3204 	if (error != 0) {
3205 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(ASSOC) "
3206 		    "failed: %d\n", __func__, __LINE__, error);
3207 		goto out;
3208 	}
3209 
3210 	IMPROVE("wme / conf_tx [all]");
3211 
3212 	/* Update bss info (bss_info_changed) (assoc, aid, ..). */
3213 #ifdef LKPI_80211_WME
3214 	bss_changed |= lkpi_wme_update(lhw, vap, true);
3215 #endif
3216 	if (!vif->cfg.assoc || vif->cfg.aid != IEEE80211_NODE_AID(ni)) {
3217 		lvif->beacons = 0;
3218 		vif->cfg.assoc = true;
3219 		vif->cfg.aid = IEEE80211_NODE_AID(ni);
3220 		bss_changed |= BSS_CHANGED_ASSOC;
3221 	}
3222 	/* We set SSID but this is not BSSID! */
3223 	vif->cfg.ssid_len = ni->ni_esslen;
3224 	memcpy(vif->cfg.ssid, ni->ni_essid, ni->ni_esslen);
3225 	if ((vap->iv_flags & IEEE80211_F_SHPREAMBLE) !=
3226 	    vif->bss_conf.use_short_preamble) {
3227 		vif->bss_conf.use_short_preamble ^= 1;
3228 		/* bss_changed |= BSS_CHANGED_??? */
3229 	}
3230 	if ((vap->iv_flags & IEEE80211_F_SHSLOT) !=
3231 	    vif->bss_conf.use_short_slot) {
3232 		vif->bss_conf.use_short_slot ^= 1;
3233 		/* bss_changed |= BSS_CHANGED_??? */
3234 	}
3235 	if ((ni->ni_flags & IEEE80211_NODE_QOS) !=
3236 	    vif->bss_conf.qos) {
3237 		vif->bss_conf.qos ^= 1;
3238 		bss_changed |= BSS_CHANGED_QOS;
3239 	}
3240 
3241 	bss_changed |= lkpi_update_dtim_tsf(vif, ni, vap, __func__, __LINE__);
3242 	lkpi_bss_info_change(hw, vif, bss_changed);
3243 
3244 	/* - change_chanctx (if needed)
3245 	 * - event_callback
3246 	 */
3247 
3248 	/* End mgd_complete_tx. (we do not have to check ostate == IEEE80211_S_ASSOC). */
3249 	if (lsta->in_mgd) {
3250 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3251 		prep_tx_info.subtype = IEEE80211_STYPE_ASSOC_REQ;
3252 		prep_tx_info.success = true;	/* Needs vif->cfg.assoc set! */
3253 		prep_tx_info.link_id = 0;
3254 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
3255 		lsta->in_mgd = false;
3256 	}
3257 
3258 	/*
3259 	 * And then:
3260 	 * - (more packets)?
3261 	 * - set_key
3262 	 * - set_default_unicast_key
3263 	 * - set_key (?)
3264 	 * - ipv6_addr_change (?)
3265 	 */
3266 
3267 	if (!ieee80211_node_is_authorized(ni)) {
3268 		IMPROVE("net80211 does not consider node authorized");
3269 	}
3270 
3271 	bss_changed = 0;
3272 	IMPROVE("Is this the right spot, has net80211 done all updates already?");
3273 
3274 	/* Update thresholds. */
3275 	hw->wiphy->frag_threshold = vap->iv_fragthreshold;
3276 	lkpi_80211_mo_set_frag_threshold(hw, vap->iv_fragthreshold);
3277 	hw->wiphy->rts_threshold = vap->iv_rtsthreshold;
3278 	lkpi_80211_mo_set_rts_threshold(hw, vap->iv_rtsthreshold);
3279 
3280 	/* Update sta_state (ASSOC to AUTHORIZED). */
3281 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
3282 	KASSERT(lsta->state == IEEE80211_STA_ASSOC, ("%s: lsta %p state not "
3283 	    "ASSOC: %#x\n", __func__, lsta, lsta->state));
3284 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_AUTHORIZED);
3285 	if (error != 0) {
3286 		IMPROVE("undo some changes?");
3287 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(AUTHORIZED) "
3288 		    "failed: %d\n", __func__, __LINE__, error);
3289 		goto out;
3290 	}
3291 
3292 	/* - drv_config (?)
3293 	 * - bss_info_changed
3294 	 * - set_rekey_data (?)
3295 	 *
3296 	 * And now we should be passing packets.
3297 	 */
3298 	IMPROVE("Need that bssid setting, and the keys");
3299 
3300 	bss_changed |= lkpi_update_dtim_tsf(vif, ni, vap, __func__, __LINE__);
3301 	lkpi_bss_info_change(hw, vif, bss_changed);
3302 
3303 	/* Prepare_multicast && configure_filter. */
3304 	lkpi_update_mcast_filter_locked(vap->iv_ic);
3305 
3306 out:
3307 	wiphy_unlock(hw->wiphy);
3308 	IEEE80211_LOCK(vap->iv_ic);
3309 	return (error);
3310 }
3311 
3312 /*
3313  * DOWN1
3314  * "to assoc" means we are going back to State 2 from State 4[/3].
3315  * This means ni still is authenticated, so we keep sta, chanctx, ..
3316  * We will send a (Re)Assoc Request in case net80211 handles roadming.
3317  * Note: this can be called as part of a DEAUTH going to State 1 as well,
3318  * so for RoC prep_tx_info we need to check nstate (see run_to_{auth,scan,init}).
3319  */
3320 static int
3321 lkpi_sta_run_to_assoc(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3322 {
3323 	struct lkpi_hw *lhw;
3324 	struct ieee80211_hw *hw;
3325 	struct lkpi_vif *lvif;
3326 	struct ieee80211_vif *vif;
3327 	struct ieee80211_node *ni;
3328 	struct lkpi_sta *lsta;
3329 	struct ieee80211_sta *sta;
3330 	struct ieee80211_prep_tx_info prep_tx_info;
3331 #if 0
3332 	enum ieee80211_bss_changed bss_changed;
3333 #endif
3334 	struct ieee80211_rx_ampdu *rap;
3335 	int error;
3336 
3337 	lhw = vap->iv_ic->ic_softc;
3338 	hw = LHW_TO_HW(lhw);
3339 	lvif = VAP_TO_LVIF(vap);
3340 	vif = LVIF_TO_VIF(lvif);
3341 
3342 	IEEE80211_UNLOCK(vap->iv_ic);
3343 	wiphy_lock(hw->wiphy);
3344 
3345 	LKPI_80211_LVIF_LOCK(lvif);
3346 #ifdef LINUXKPI_DEBUG_80211
3347 	/* XXX-BZ KASSERT later; state going down so no action. */
3348 	if (lvif->lvif_bss == NULL)
3349 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
3350 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
3351 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
3352 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
3353 		    lvif->lvif_bss_synched);
3354 #endif
3355 	lsta = lvif->lvif_bss;
3356 	LKPI_80211_LVIF_UNLOCK(lvif);
3357 	KASSERT(lsta != NULL && lsta->ni != NULL, ("%s: lsta %p ni %p "
3358 	    "lvif %p vap %p\n", __func__,
3359 	    lsta, (lsta != NULL) ? lsta->ni : NULL, lvif, vap));
3360 
3361 	ni = lsta->ni;		/* Reference held for lvif_bss. */
3362 	sta = LSTA_TO_STA(lsta);
3363 
3364 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3365 
3366 	/* flush, drop. */
3367 	lkpi_80211_mo_flush(hw, vif,  nitems(sta->txq), true);
3368 
3369 	/* We should make this a KASSERT. */
3370 	if (lsta->in_mgd) {
3371 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p lsta %p in_mgd\n",
3372 		    __func__, __LINE__, lvif, vap, lsta);
3373 	}
3374 	/*
3375 	 * Problem is that we should hook into the tx/rx flow and not
3376 	 * try to re-model the state machine parts.  We may miss a SME
3377 	 * triggered frame this way.
3378 	 */
3379 	memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3380 	if (nstate == IEEE80211_S_ASSOC) {
3381 		if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
3382 			if (arg)
3383 				prep_tx_info.subtype = IEEE80211_STYPE_REASSOC_REQ;
3384 			else
3385 				prep_tx_info.subtype = IEEE80211_STYPE_ASSOC_REQ;
3386 		} else {
3387 			/* wpa_supplicant upon RTM_IEEE80211_LEAVE. */
3388 			prep_tx_info.subtype = IEEE80211_STYPE_DISASSOC;
3389 		}
3390 	} else
3391 		prep_tx_info.subtype = IEEE80211_STYPE_DEAUTH;
3392 	prep_tx_info.was_assoc = true;
3393 	prep_tx_info.link_id = 0;
3394 	lkpi_80211_mo_mgd_prepare_tx(hw, vif, &prep_tx_info);
3395 	lsta->in_mgd = true;
3396 
3397 	wiphy_unlock(hw->wiphy);
3398 	IEEE80211_LOCK(vap->iv_ic);
3399 
3400 	/* Call iv_newstate first so we get potential (RE-)ASSOC/DEAUTH? packet out. */
3401 	error = lvif->iv_newstate(vap, nstate, arg);
3402 	if (error != 0) {
3403 		ic_printf(vap->iv_ic, "%s:%d: iv_newstate(%p, %d, %d) "
3404 		    "failed: %d\n", __func__, __LINE__, vap, nstate, arg, error);
3405 		goto outni;
3406 	}
3407 
3408 	/* Stop any BA sessions if still active. */
3409 	for (int rapn = 0; rapn < WME_NUM_TID; rapn++) {
3410 		rap = &ni->ni_rx_ampdu[rapn];
3411 
3412 		if ((rap->rxa_flags & IEEE80211_AGGR_RUNNING) == 0)
3413 			continue;
3414 
3415 		vap->iv_ic->ic_ampdu_rx_stop(ni, rap);
3416 	}
3417 
3418 	IEEE80211_UNLOCK(vap->iv_ic);
3419 
3420 	/* Ensure the packets get out. */
3421 	lkpi_80211_flush_tx(lhw, lsta);
3422 
3423 	wiphy_lock(hw->wiphy);
3424 
3425 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3426 
3427 	/* Wake tx queues to get packet(s) out. */
3428 	lkpi_wake_tx_queues(hw, sta, false, true);
3429 
3430 	/* flush, no drop */
3431 	lkpi_80211_mo_flush(hw, vif,  nitems(sta->txq), false);
3432 
3433 	/* End mgd_complete_tx. */
3434 	/* We should make this a KASSERT. */
3435 	if (!lsta->in_mgd) {
3436 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p lsta %p !in_mgd\n",
3437 		    __func__, __LINE__, lvif, vap, lsta);
3438 	}
3439 	lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
3440 	lsta->in_mgd = false;
3441 
3442 #if 0
3443 	/* sync_rx_queues */
3444 	lkpi_80211_mo_sync_rx_queues(hw);
3445 
3446 	/* sta_pre_rcu_remove */
3447 	lkpi_80211_mo_sta_pre_rcu_remove(hw, vif, sta);
3448 #endif
3449 
3450 	/* Take the station down. */
3451 
3452 	/* Adjust sta and change state (from AUTHORIZED) to ASSOC. */
3453 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
3454 	KASSERT(lsta->state == IEEE80211_STA_AUTHORIZED, ("%s: lsta %p state not "
3455 	    "AUTHORIZED: %#x\n", __func__, lsta, lsta->state));
3456 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_ASSOC);
3457 	if (error != 0) {
3458 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(ASSOC) "
3459 		    "failed: %d\n", __func__, __LINE__, error);
3460 		goto out;
3461 	}
3462 
3463 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3464 
3465 #ifdef LKPI_80211_HW_CRYPTO
3466 	if (lkpi_hwcrypto) {
3467 		error = lkpi_sta_del_keys(hw, vif, lsta);
3468 		if (error != 0) {
3469 			ic_printf(vap->iv_ic, "%s:%d: lkpi_sta_del_keys "
3470 			    "failed: %d\n", __func__, __LINE__, error);
3471 			/*
3472 			 * Either drv/fw will crash or cleanup itself,
3473 			 * otherwise net80211 will delete the keys (at a
3474 			 * less appropriate time).
3475 			 */
3476 			/* goto out; */
3477 		}
3478 	}
3479 #endif
3480 
3481 	/* Update sta_state (ASSOC to AUTH). */
3482 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
3483 	KASSERT(lsta->state == IEEE80211_STA_ASSOC, ("%s: lsta %p state not "
3484 	    "ASSOC: %#x\n", __func__, lsta, lsta->state));
3485 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_AUTH);
3486 	if (error != 0) {
3487 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(AUTH) "
3488 		    "failed: %d\n", __func__, __LINE__, error);
3489 		goto out;
3490 	}
3491 
3492 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3493 
3494 #if 0
3495 	/* Update bss info (bss_info_changed) (assoc, aid, ..). */
3496 	/* See comment in DOWN4. */
3497 	lkpi_disassoc(sta, vif, lhw);
3498 #endif
3499 
3500 	error = EALREADY;
3501 out:
3502 	wiphy_unlock(hw->wiphy);
3503 	IEEE80211_LOCK(vap->iv_ic);
3504 outni:
3505 	return (error);
3506 }
3507 
3508 /*
3509  * DOWN2
3510  * We are in state 2 and go back to state 1 and will try to auth again
3511  * (to IEEE80211_S_AUTH in FreeBSD means "try to auth").  This should be
3512  * like scan_to_auth but that we keep the "ni" and with that chanctx/bssid,
3513  * which essentially makes this "a_to_a" in LinuxKPI.
3514  */
3515 static int
3516 lkpi_sta_assoc_to_auth(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3517 {
3518 	struct lkpi_hw *lhw;
3519 	struct ieee80211_hw *hw;
3520 	struct lkpi_vif *lvif;
3521 	struct ieee80211_vif *vif;
3522 	struct ieee80211_node *ni;
3523 	struct lkpi_sta *lsta;
3524 	struct ieee80211_prep_tx_info prep_tx_info;
3525 	int error;
3526 
3527 	lhw = vap->iv_ic->ic_softc;
3528 	hw = LHW_TO_HW(lhw);
3529 	lvif = VAP_TO_LVIF(vap);
3530 	vif = LVIF_TO_VIF(lvif);
3531 
3532 	IEEE80211_UNLOCK(vap->iv_ic);
3533 	wiphy_lock(hw->wiphy);
3534 
3535 	LKPI_80211_LVIF_LOCK(lvif);
3536 #ifdef LINUXKPI_DEBUG_80211
3537 	/* XXX-BZ KASSERT later; state going down so no action. */
3538 	if (lvif->lvif_bss == NULL)
3539 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
3540 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
3541 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
3542 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
3543 		    lvif->lvif_bss_synched);
3544 #endif
3545 	lsta = lvif->lvif_bss;
3546 	LKPI_80211_LVIF_UNLOCK(lvif);
3547 	KASSERT(lsta != NULL && lsta->ni != NULL, ("%s: lsta %p ni %p "
3548 	    "lvif %p vap %p\n", __func__,
3549 	    lsta, (lsta != NULL) ? lsta->ni : NULL, lvif, vap));
3550 
3551 	ni = lsta->ni;		/* Reference held for lvif_bss. */
3552 
3553 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3554 
3555 	/* End mgd_complete_tx. */
3556 	if (lsta->in_mgd && vap->iv_state == IEEE80211_S_ASSOC) {
3557 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3558 		prep_tx_info.subtype = IEEE80211_STYPE_ASSOC_REQ;
3559 		prep_tx_info.link_id = 0;
3560 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
3561 		lsta->in_mgd = false;
3562 	} else if (lsta->in_mgd) {
3563 		ic_printf(vap->iv_ic, "%s:%d: in_mgd %d (%s) -> %d (%s) %d\n",
3564 		    __func__, __LINE__,
3565 		    vap->iv_state, ieee80211_state_name[vap->iv_state],
3566 		    nstate, ieee80211_state_name[nstate], arg);
3567 	}
3568 
3569 	/* Take the station down. */
3570 	/* Update sta_state (AUTH to NONE). */
3571 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
3572 	KASSERT(lsta->state == IEEE80211_STA_AUTH, ("%s: lsta %p state not "
3573 	    "AUTH: %#x\n", __func__, lsta, lsta->state));
3574 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_NONE);
3575 	if (error != 0) {
3576 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(NONE) "
3577 		    "failed: %d\n", __func__, __LINE__, error);
3578 		goto out;
3579 	}
3580 
3581 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3582 
3583 out:
3584 	wiphy_unlock(hw->wiphy);
3585 	IEEE80211_LOCK(vap->iv_ic);
3586 	return (error);
3587 }
3588 
3589 /*
3590  * DOWN3
3591  * We are in state 1.  Either auth timed out (arg != 0) or we have an internal
3592  * state change forcing us to give up trying to authenticate.
3593  * Cleanup and remove chanctx, sta, ...
3594  */
3595 static int
3596 lkpi_sta_auth_to_scan(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3597 {
3598 	struct lkpi_hw *lhw;
3599 	struct ieee80211_hw *hw;
3600 	struct lkpi_vif *lvif;
3601 	struct ieee80211_vif *vif;
3602 	struct ieee80211_node *ni;
3603 	struct lkpi_sta *lsta;
3604 	struct ieee80211_sta *sta;
3605 	struct ieee80211_prep_tx_info prep_tx_info;
3606 	enum ieee80211_bss_changed bss_changed;
3607 	int error;
3608 
3609 	lhw = vap->iv_ic->ic_softc;
3610 	hw = LHW_TO_HW(lhw);
3611 	lvif = VAP_TO_LVIF(vap);
3612 	vif = LVIF_TO_VIF(lvif);
3613 
3614 	IEEE80211_UNLOCK(vap->iv_ic);
3615 	wiphy_lock(hw->wiphy);
3616 
3617 	LKPI_80211_LVIF_LOCK(lvif);
3618 	/*
3619 	 * XXX-BZ KASSERT later; state going down so no action in theory
3620 	 * but try to avoid a NULL-pointer derref for now and gracefully
3621 	 * fail for non-debug kernels.
3622 	 */
3623 	if (lvif->lvif_bss == NULL) {
3624 		ic_printf(vap->iv_ic, "%s:%d: ERROR: lvif %p vap %p iv_bss %p "
3625 		    "lvif_bss %p lvif_bss->ni %p synched %d; "
3626 		    "expect follow-up problems\n", __func__, __LINE__,
3627 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
3628 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
3629 		    lvif->lvif_bss_synched);
3630 		LKPI_80211_LVIF_UNLOCK(lvif);
3631 		/*
3632 		 * This will likely lead to a firmware crash (if there
3633 		 * was not one before already) and need a
3634 		 * ieee80211_restart_hw() but still better than a panic
3635 		 * for users as they can at least recover.
3636 		 */
3637 		error = ENOTRECOVERABLE;
3638 		goto out;
3639 	}
3640 	lsta = lvif->lvif_bss;
3641 	LKPI_80211_LVIF_UNLOCK(lvif);
3642 	KASSERT(lsta != NULL && lsta->ni != NULL, ("%s: lsta %p ni %p "
3643 	    "lvif %p vap %p\n", __func__,
3644 	    lsta, (lsta != NULL) ? lsta->ni : NULL, lvif, vap));
3645 	ni = lsta->ni;			/* Reference held for lvif_bss. */
3646 	sta = LSTA_TO_STA(lsta);
3647 
3648 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3649 
3650 	/* flush, drop. */
3651 	lkpi_80211_mo_flush(hw, vif,  nitems(sta->txq), true);
3652 
3653 	/* Wake tx queues to get packet(s) out. */
3654 	lkpi_wake_tx_queues(hw, sta, false, true);
3655 
3656 	/* flush, no drop */
3657 	lkpi_80211_mo_flush(hw, vif,  nitems(sta->txq), false);
3658 
3659 	/* End mgd_complete_tx. */
3660 	if (lsta->in_mgd) {
3661 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3662 		prep_tx_info.subtype = IEEE80211_STYPE_AUTH;
3663 		prep_tx_info.link_id = 0;
3664 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
3665 		lsta->in_mgd = false;
3666 	}
3667 
3668 	/* sync_rx_queues */
3669 	lkpi_80211_mo_sync_rx_queues(hw);
3670 
3671 #ifdef LKPI_80211_HW_CRYPTO
3672 	if (lkpi_hwcrypto) {
3673 		error = lkpi_sta_del_keys(hw, vif, lsta);
3674 		if (error != 0) {
3675 			ic_printf(vap->iv_ic, "%s:%d: lkpi_sta_del_keys "
3676 			    "failed: %d\n", __func__, __LINE__, error);
3677 			/*
3678 			 * Either drv/fw will crash or cleanup itself,
3679 			 * otherwise net80211 will delete the keys (at a
3680 			 * less appropriate time).
3681 			 */
3682 			/* goto out; */
3683 		}
3684 	}
3685 #endif
3686 
3687 	/* sta_pre_rcu_remove */
3688         lkpi_80211_mo_sta_pre_rcu_remove(hw, vif, sta);
3689 
3690 	synchronize_net();
3691 
3692 	/* Take the station down. */
3693 
3694 	bss_changed = 0;
3695 	/*
3696 	 * Start updating bss info (*bss_info_changed) (assoc, aid, ..).
3697 	 *
3698 	 * One would expect this to happen when going off AUTHORIZED but
3699 	 * not so.
3700 	 *
3701 	 * Immediately issuing the (*bss_info_changed) used to also remove the
3702 	 * sta from firmware for iwlwifi; or we have problems with the sta
3703 	 * silently not being removed and then crash upon the next sta add.
3704 	 * Neither seems to be the case or a problem still.
3705 	 *
3706 	 * Contrary for BE200 (iwlwifi/mld) if we do not issue the
3707 	 * (*vif_cfg_change) to tell FW that we are no longer assoc
3708 	 * it will crash now upon sta rm.  So the order now is as we once
3709 	 * expected it:
3710 	 *
3711 	 * 1) lkpi_disassoc(): set vif->cfg.assoc = false and .aid=0
3712 	 * 2) add the remaining BSS_CHANGED changes and call (*bss_info_changed)
3713 	 *    (which may be split up into (*vif_cfg_change) and
3714 	 *    (*link_info_changed) for more modern drivers).
3715 	 * 3) call the last sta_state update -> IEEE80211_STA_NOTEXIST
3716 	 *    (removes the sta given assoc is false) and tidy up our lists.
3717 	 * 4) call unassign_vif_chanctx
3718 	 * 5) call lkpi_hw_conf_idle
3719 	 * 6) call remove_chanctx
3720 	 *
3721 	 * Note: vif->driver_flags & IEEE80211_VIF_REMOVE_AP_AFTER_DISASSOC
3722 	 * might change this.
3723 	 */
3724 	bss_changed |= lkpi_disassoc(sta, vif, lhw);
3725 
3726 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3727 
3728 	IMPROVE("Any bss_info changes to announce?");
3729 	vif->bss_conf.qos = false;
3730 	bss_changed |= BSS_CHANGED_QOS;
3731 	vif->cfg.ssid_len = 0;
3732 	memset(vif->cfg.ssid, '\0', sizeof(vif->cfg.ssid));
3733 	IEEE80211_ADDR_COPY(vif->cfg.ap_addr, ieee80211broadcastaddr);
3734 	bss_changed |= BSS_CHANGED_BSSID;
3735 	vif->bss_conf.use_short_preamble = false;
3736 	/* XXX BSS_CHANGED_???? */
3737 	vif->bss_conf.dtim_period = 0; /* go back to 0. */
3738 	bss_changed |= BSS_CHANGED_BEACON_INFO;
3739 	lkpi_bss_info_change(hw, vif, bss_changed);
3740 
3741 	/* Adjust sta and change state (from NONE) to NOTEXIST. */
3742 	KASSERT(lsta != NULL, ("%s: ni %p lsta is NULL\n", __func__, ni));
3743 	KASSERT(lsta->state == IEEE80211_STA_NONE, ("%s: lsta %p state not "
3744 	    "NONE: %#x, nstate %d arg %d\n", __func__, lsta, lsta->state, nstate, arg));
3745 	error = lkpi_80211_mo_sta_state(hw, vif, lsta, IEEE80211_STA_NOTEXIST);
3746 	if (error != 0) {
3747 		IMPROVE("do we need to undo the chan ctx?");
3748 		ic_printf(vap->iv_ic, "%s:%d: mo_sta_state(NOTEXIST) "
3749 		    "failed: %d\n", __func__, __LINE__, error);
3750 		goto out;
3751 	}
3752 
3753 	lkpi_lsta_remove(lsta, lvif);
3754 
3755 	lkpi_lsta_dump(lsta, ni, __func__, __LINE__);
3756 
3757 	LKPI_80211_LVIF_LOCK(lvif);
3758 	/* Remove ni reference for this cache of lsta. */
3759 	lvif->lvif_bss = NULL;
3760 	lvif->lvif_bss_synched = false;
3761 	LKPI_80211_LVIF_UNLOCK(lvif);
3762 
3763 	/* conf_tx */
3764 
3765 	lkpi_remove_chanctx(hw, vif);
3766 
3767 out:
3768 	wiphy_unlock(hw->wiphy);
3769 	IEEE80211_LOCK(vap->iv_ic);
3770 	if (error == 0) {
3771 		/*
3772 		 * We do this outside the wiphy lock as net80211::node_free() may call
3773 		 * into crypto code to delete keys and we have a recursed on
3774 		 * non-recursive sx panic.  Also only do this if we get here w/o error.
3775 		 *
3776 		 * The very last release the reference on the ni for the ni/lsta on
3777 		 * lvif->lvif_bss.  Upon return from this both ni and lsta are invalid
3778 		 * and potentially freed.
3779 		 */
3780 		ieee80211_free_node(ni);
3781 	}
3782 	return (error);
3783 }
3784 
3785 /* DOWN4 */
3786 static int
3787 lkpi_sta_scan_to_init(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3788 {
3789 	/* lkpi_iv_newstate() handles the stop scan case in common code. */
3790 	return (lkpi_sta_state_do_nada(vap, nstate, arg));
3791 }
3792 
3793 /* ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ */
3794 
3795 static int
3796 lkpi_sta_auth_to_init(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3797 {
3798 	int error;
3799 
3800 	error = lkpi_sta_auth_to_scan(vap, nstate, arg);
3801 	if (error == 0)
3802 		error = lkpi_sta_scan_to_init(vap, nstate, arg);
3803 	return (error);
3804 }
3805 
3806 /* auth_to_auth, assoc_to_assoc. */
3807 static int
3808 lkpi_sta_a_to_a(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3809 {
3810 	struct lkpi_hw *lhw;
3811 	struct ieee80211_hw *hw;
3812 	struct lkpi_vif *lvif;
3813 	struct ieee80211_vif *vif;
3814 	struct lkpi_sta *lsta;
3815 	struct ieee80211_prep_tx_info prep_tx_info;
3816 	int error;
3817 
3818 	lhw = vap->iv_ic->ic_softc;
3819 	hw = LHW_TO_HW(lhw);
3820 	lvif = VAP_TO_LVIF(vap);
3821 	vif = LVIF_TO_VIF(lvif);
3822 
3823 	IEEE80211_UNLOCK(vap->iv_ic);
3824 	wiphy_lock(hw->wiphy);
3825 
3826 	LKPI_80211_LVIF_LOCK(lvif);
3827 	/* XXX-BZ KASSERT later? */
3828 	if (!lvif->lvif_bss_synched || lvif->lvif_bss == NULL) {
3829 #ifdef LINUXKPI_DEBUG_80211
3830 		ic_printf(vap->iv_ic, "%s:%d: lvif %p vap %p iv_bss %p lvif_bss %p "
3831 		    "lvif_bss->ni %p synched %d\n", __func__, __LINE__,
3832 		    lvif, vap, vap->iv_bss, lvif->lvif_bss,
3833 		    (lvif->lvif_bss != NULL) ? lvif->lvif_bss->ni : NULL,
3834 		    lvif->lvif_bss_synched);
3835 #endif
3836 		LKPI_80211_LVIF_UNLOCK(lvif);
3837 		error = ENOTRECOVERABLE;
3838 		goto out;
3839 	}
3840 	lsta = lvif->lvif_bss;
3841 	LKPI_80211_LVIF_UNLOCK(lvif);
3842 
3843 	KASSERT(lsta != NULL, ("%s: lsta %p! lvif %p vap %p\n", __func__,
3844 	    lsta, lvif, vap));
3845 
3846 	IMPROVE("event callback?");
3847 
3848 	/* End mgd_complete_tx. */
3849 	if (lsta->in_mgd) {
3850 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3851 		if (vap->iv_state == IEEE80211_S_AUTH)
3852 			prep_tx_info.subtype = IEEE80211_STYPE_AUTH;
3853 		else
3854 			prep_tx_info.subtype = IEEE80211_STYPE_ASSOC_REQ;
3855 		prep_tx_info.link_id = 0;
3856 		lkpi_80211_mo_mgd_complete_tx(hw, vif, &prep_tx_info);
3857 		lsta->in_mgd = false;
3858 	}
3859 
3860 	/* Now start auth/assoc. */
3861 
3862 	/* Start mgd_prepare_tx. */
3863 	if (!lsta->in_mgd) {
3864 		memset(&prep_tx_info, 0, sizeof(prep_tx_info));
3865 		if (nstate == IEEE80211_S_AUTH)
3866 			prep_tx_info.subtype = IEEE80211_STYPE_AUTH;
3867 		else
3868 			prep_tx_info.subtype = IEEE80211_STYPE_ASSOC_REQ;
3869 		prep_tx_info.link_id = 0;
3870 		lkpi_80211_mo_mgd_prepare_tx(hw, vif, &prep_tx_info);
3871 		lsta->in_mgd = true;
3872 	}
3873 
3874 	error = 0;
3875 out:
3876 	wiphy_unlock(hw->wiphy);
3877 	IEEE80211_LOCK(vap->iv_ic);
3878 
3879 	return (error);
3880 }
3881 
3882 static int
3883 lkpi_sta_assoc_to_scan(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3884 {
3885 	int error;
3886 
3887 	error = lkpi_sta_assoc_to_auth(vap, nstate, arg);
3888 	if (error != 0 && error != EALREADY)
3889 		return (error);
3890 
3891 	error = lkpi_sta_auth_to_scan(vap, nstate, arg);
3892 	return (error);
3893 }
3894 
3895 static int
3896 lkpi_sta_assoc_to_init(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3897 {
3898 	int error;
3899 
3900 	error = lkpi_sta_assoc_to_scan(vap, nstate, arg);
3901 	if (error != 0 && error != EALREADY)
3902 		return (error);
3903 
3904 	error = lkpi_sta_scan_to_init(vap, nstate, arg);	/* do_nada */
3905 	return (error);
3906 }
3907 
3908 static int
3909 lkpi_sta_run_to_init(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3910 {
3911 	int error;
3912 
3913 	error = lkpi_sta_run_to_assoc(vap, nstate, arg);
3914 	if (error != 0 && error != EALREADY)
3915 		return (error);
3916 
3917 	error = lkpi_sta_assoc_to_init(vap, nstate, arg);
3918 	return (error);
3919 }
3920 
3921 static int
3922 lkpi_sta_run_to_scan(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3923 {
3924 	int error;
3925 
3926 	error = lkpi_sta_run_to_assoc(vap, nstate, arg);
3927 	if (error != 0 && error != EALREADY)
3928 		return (error);
3929 
3930 	error = lkpi_sta_assoc_to_scan(vap, nstate, arg);
3931 	return (error);
3932 }
3933 
3934 static int
3935 lkpi_sta_run_to_auth(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3936 {
3937 	int error;
3938 
3939 	error = lkpi_sta_run_to_assoc(vap, nstate, arg);
3940 	if (error != 0 && error != EALREADY)
3941 		return (error);
3942 
3943 	error = lkpi_sta_assoc_to_auth(vap, nstate, arg);
3944 	return (error);
3945 }
3946 
3947 /* -------------------------------------------------------------------------- */
3948 
3949 /*
3950  * The matches the documented state changes in net80211::sta_newstate().
3951  * XXX (1) without CSA and SLEEP yet, * XXX (2) not all unhandled cases
3952  * there are "invalid" (so there is a room for failure here).
3953  */
3954 struct fsm_state {
3955 	/* INIT, SCAN, AUTH, ASSOC, CAC, RUN, CSA, SLEEP */
3956 	enum ieee80211_state ostate;
3957 	enum ieee80211_state nstate;
3958 	int (*handler)(struct ieee80211vap *, enum ieee80211_state, int);
3959 } sta_state_fsm[] = {
3960 	{ IEEE80211_S_INIT,	IEEE80211_S_INIT, lkpi_sta_state_do_nada },
3961 	{ IEEE80211_S_SCAN,	IEEE80211_S_INIT, lkpi_sta_state_do_nada },	/* DOWN4 scan_to_init */
3962 	{ IEEE80211_S_AUTH,	IEEE80211_S_INIT, lkpi_sta_auth_to_init },	/* not explicitly in sta_newstate() */
3963 	{ IEEE80211_S_ASSOC,	IEEE80211_S_INIT, lkpi_sta_assoc_to_init },	/* Send DEAUTH. */
3964 	{ IEEE80211_S_RUN,	IEEE80211_S_INIT, lkpi_sta_run_to_init },	/* Send DISASSOC. */
3965 
3966 	{ IEEE80211_S_INIT,	IEEE80211_S_SCAN, lkpi_sta_init_to_scan },	/* UP1 */
3967 	{ IEEE80211_S_SCAN,	IEEE80211_S_SCAN, lkpi_sta_state_do_nada },
3968 	{ IEEE80211_S_AUTH,	IEEE80211_S_SCAN, lkpi_sta_auth_to_scan },	/* DOWN3 */
3969 	{ IEEE80211_S_ASSOC,	IEEE80211_S_SCAN, lkpi_sta_assoc_to_scan },
3970 	{ IEEE80211_S_RUN,	IEEE80211_S_SCAN, lkpi_sta_run_to_scan },	/* Beacon miss. */
3971 
3972 	{ IEEE80211_S_INIT,	IEEE80211_S_AUTH, lkpi_sta_scan_to_auth },	/* Send AUTH. */
3973 	{ IEEE80211_S_SCAN,	IEEE80211_S_AUTH, lkpi_sta_scan_to_auth },	/* UP2 Send AUTH. */
3974 	{ IEEE80211_S_AUTH,	IEEE80211_S_AUTH, lkpi_sta_a_to_a },		/* Send ?AUTH. */
3975 	{ IEEE80211_S_ASSOC,	IEEE80211_S_AUTH, lkpi_sta_assoc_to_auth },	/* DOWN2 Send ?AUTH. */
3976 	{ IEEE80211_S_RUN,	IEEE80211_S_AUTH, lkpi_sta_run_to_auth },	/* Send ?AUTH. */
3977 
3978 	{ IEEE80211_S_AUTH,	IEEE80211_S_ASSOC, lkpi_sta_auth_to_assoc },	/* UP3.1 Send ASSOCREQ. */
3979 	{ IEEE80211_S_ASSOC,	IEEE80211_S_ASSOC, lkpi_sta_a_to_a },		/* Send ASSOCREQ. */
3980 	{ IEEE80211_S_RUN,	IEEE80211_S_ASSOC, lkpi_sta_run_to_assoc },	/* DOWN1 Send ASSOCREQ/REASSOCREQ. */
3981 
3982 	{ IEEE80211_S_AUTH,	IEEE80211_S_RUN, lkpi_sta_auth_to_run },	/* UP3.2 */
3983 	{ IEEE80211_S_ASSOC,	IEEE80211_S_RUN, lkpi_sta_assoc_to_run },	/* UP4 */
3984 	{ IEEE80211_S_RUN,	IEEE80211_S_RUN, lkpi_sta_state_do_nada },
3985 
3986 	/* Dummy at the end without handler. */
3987 	{ IEEE80211_S_INIT,	IEEE80211_S_INIT, NULL },
3988 };
3989 
3990 static int
3991 lkpi_iv_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
3992 {
3993 	struct ieee80211com *ic;
3994 	struct lkpi_hw *lhw;
3995 	struct lkpi_vif *lvif;
3996 	struct ieee80211_vif *vif;
3997 	struct fsm_state *s;
3998 	enum ieee80211_state ostate;
3999 	int error;
4000 
4001 	ic = vap->iv_ic;
4002 	IEEE80211_LOCK_ASSERT(ic);
4003 	ostate = vap->iv_state;
4004 
4005 #ifdef LINUXKPI_DEBUG_80211
4006 	if (linuxkpi_debug_80211 & D80211_TRACE)
4007 		ic_printf(vap->iv_ic, "%s:%d: vap %p nstate %#x arg %#x\n",
4008 		    __func__, __LINE__, vap, nstate, arg);
4009 #endif
4010 
4011 	if (vap->iv_opmode == IEEE80211_M_STA) {
4012 
4013 		lhw = ic->ic_softc;
4014 		lvif = VAP_TO_LVIF(vap);
4015 		vif = LVIF_TO_VIF(lvif);
4016 
4017 		/* No need to replicate this in most state handlers. */
4018 		if (nstate > IEEE80211_S_SCAN)
4019 			lkpi_stop_hw_scan(lhw, vif);
4020 
4021 		s = sta_state_fsm;
4022 
4023 	} else {
4024 		ic_printf(vap->iv_ic, "%s: only station mode currently supported: "
4025 		    "vap %p iv_opmode %d\n", __func__, vap, vap->iv_opmode);
4026 		return (ENOSYS);
4027 	}
4028 
4029 	error = 0;
4030 	for (; s->handler != NULL; s++) {
4031 		if (ostate == s->ostate && nstate == s->nstate) {
4032 #ifdef LINUXKPI_DEBUG_80211
4033 			if (linuxkpi_debug_80211 & D80211_TRACE)
4034 				ic_printf(vap->iv_ic, "%s: new state %d (%s) ->"
4035 				    " %d (%s): arg %d.\n", __func__,
4036 				    ostate, ieee80211_state_name[ostate],
4037 				    nstate, ieee80211_state_name[nstate], arg);
4038 #endif
4039 			error = s->handler(vap, nstate, arg);
4040 			break;
4041 		}
4042 	}
4043 	IEEE80211_LOCK_ASSERT(vap->iv_ic);
4044 
4045 	if (s->handler == NULL) {
4046 		IMPROVE("turn this into a KASSERT\n");
4047 		ic_printf(vap->iv_ic, "%s: unsupported state transition "
4048 		    "%d (%s) -> %d (%s)\n", __func__,
4049 		    ostate, ieee80211_state_name[ostate],
4050 		    nstate, ieee80211_state_name[nstate]);
4051 		return (ENOSYS);
4052 	}
4053 
4054 	if (error == EALREADY) {
4055 #ifdef LINUXKPI_DEBUG_80211
4056 		if (linuxkpi_debug_80211 & D80211_TRACE)
4057 			ic_printf(vap->iv_ic, "%s: state transition %d (%s) -> "
4058 			    "%d (%s): iv_newstate already handled: %d.\n",
4059 			    __func__, ostate, ieee80211_state_name[ostate],
4060 			    nstate, ieee80211_state_name[nstate], error);
4061 #endif
4062 		return (0);
4063 	}
4064 
4065 	if (error != 0) {
4066 		ic_printf(vap->iv_ic, "%s: error %d during state transition "
4067 		    "%d (%s) -> %d (%s)\n", __func__, error,
4068 		    ostate, ieee80211_state_name[ostate],
4069 		    nstate, ieee80211_state_name[nstate]);
4070 		return (error);
4071 	}
4072 
4073 #ifdef LINUXKPI_DEBUG_80211
4074 	if (linuxkpi_debug_80211 & D80211_TRACE)
4075 		ic_printf(vap->iv_ic, "%s:%d: vap %p nstate %#x arg %#x "
4076 		    "calling net80211 parent\n",
4077 		    __func__, __LINE__, vap, nstate, arg);
4078 #endif
4079 
4080 	return (lvif->iv_newstate(vap, nstate, arg));
4081 }
4082 
4083 /* -------------------------------------------------------------------------- */
4084 
4085 /*
4086  * We overload (*iv_update_bss) as otherwise we have cases in, e.g.,
4087  * net80211::ieee80211_sta_join1() where vap->iv_bss gets replaced by a
4088  * new node without us knowing and thus our ni/lsta are out of sync.
4089  */
4090 static struct ieee80211_node *
4091 lkpi_iv_update_bss(struct ieee80211vap *vap, struct ieee80211_node *ni)
4092 {
4093 	struct lkpi_vif *lvif;
4094 	struct ieee80211_node *rni;
4095 
4096 	IEEE80211_LOCK_ASSERT(vap->iv_ic);
4097 
4098 	lvif = VAP_TO_LVIF(vap);
4099 
4100 	LKPI_80211_LVIF_LOCK(lvif);
4101 	lvif->lvif_bss_synched = false;
4102 	LKPI_80211_LVIF_UNLOCK(lvif);
4103 
4104 	rni = lvif->iv_update_bss(vap, ni);
4105 	return (rni);
4106 }
4107 
4108 #ifdef LKPI_80211_WME
4109 static int
4110 lkpi_wme_update(struct lkpi_hw *lhw, struct ieee80211vap *vap, bool planned)
4111 {
4112 	struct ieee80211com *ic;
4113 	struct ieee80211_hw *hw;
4114 	struct lkpi_vif *lvif;
4115 	struct ieee80211_vif *vif;
4116 	struct chanAccParams chp;
4117 	struct wmeParams wmeparr[WME_NUM_AC];
4118 	struct ieee80211_tx_queue_params txqp;
4119 	enum ieee80211_bss_changed bss_changed;
4120 	int error;
4121 	uint16_t ac;
4122 
4123 	hw = LHW_TO_HW(lhw);
4124 	lockdep_assert_wiphy(hw->wiphy);
4125 
4126 	IMPROVE();
4127 	KASSERT(WME_NUM_AC == IEEE80211_NUM_ACS, ("%s: WME_NUM_AC %d != "
4128 	    "IEEE80211_NUM_ACS %d\n", __func__, WME_NUM_AC, IEEE80211_NUM_ACS));
4129 
4130 	if (vap == NULL)
4131 		return (0);
4132 
4133 	if ((vap->iv_flags & IEEE80211_F_WME) == 0)
4134 		return (0);
4135 
4136 	if (lhw->ops->conf_tx == NULL)
4137 		return (0);
4138 
4139 	if (!planned && (vap->iv_state != IEEE80211_S_RUN)) {
4140 		lhw->update_wme = true;
4141 		return (0);
4142 	}
4143 	lhw->update_wme = false;
4144 
4145 	ic = lhw->ic;
4146 	ieee80211_wme_ic_getparams(ic, &chp);
4147 	IEEE80211_LOCK(ic);
4148 	for (ac = 0; ac < WME_NUM_AC; ac++)
4149 		wmeparr[ac] = chp.cap_wmeParams[ac];
4150 	IEEE80211_UNLOCK(ic);
4151 
4152 	lvif = VAP_TO_LVIF(vap);
4153 	vif = LVIF_TO_VIF(lvif);
4154 
4155 	/* Configure tx queues (conf_tx) & send BSS_CHANGED_QOS. */
4156 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
4157 		struct wmeParams *wmep;
4158 
4159 		wmep = &wmeparr[ac];
4160 		bzero(&txqp, sizeof(txqp));
4161 		txqp.cw_min = wmep->wmep_logcwmin;
4162 		txqp.cw_max = wmep->wmep_logcwmax;
4163 		txqp.txop = wmep->wmep_txopLimit;
4164 		txqp.aifs = wmep->wmep_aifsn;
4165 		error = lkpi_80211_mo_conf_tx(hw, vif, /* link_id */0, ac, &txqp);
4166 		if (error != 0)
4167 			ic_printf(ic, "%s: conf_tx ac %u failed %d\n",
4168 			    __func__, ac, error);
4169 	}
4170 	bss_changed = BSS_CHANGED_QOS;
4171 	if (!planned)
4172 		lkpi_bss_info_change(hw, vif, bss_changed);
4173 
4174 	return (bss_changed);
4175 }
4176 #endif
4177 
4178 static int
4179 lkpi_ic_wme_update(struct ieee80211com *ic)
4180 {
4181 #ifdef LKPI_80211_WME
4182 	struct ieee80211vap *vap;
4183 	struct lkpi_hw *lhw;
4184 	struct ieee80211_hw *hw;
4185 
4186 	IMPROVE("Use the per-VAP callback in net80211.");
4187 	vap = TAILQ_FIRST(&ic->ic_vaps);
4188 	if (vap == NULL)
4189 		return (0);
4190 
4191 	lhw = ic->ic_softc;
4192 	hw = LHW_TO_HW(lhw);
4193 
4194 	wiphy_lock(hw->wiphy);
4195 	lkpi_wme_update(lhw, vap, false);
4196 	wiphy_unlock(hw->wiphy);
4197 #endif
4198 	return (0);	/* unused */
4199 }
4200 
4201 static void
4202 lkpi_iv_sta_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0,
4203     int subtype, const struct ieee80211_rx_stats *rxs, int rssi, int nf)
4204 {
4205 	struct lkpi_hw *lhw;
4206 	struct ieee80211_hw *hw;
4207 	struct lkpi_vif *lvif;
4208 	struct ieee80211_vif *vif;
4209 	enum ieee80211_bss_changed bss_changed;
4210 
4211 	lvif = VAP_TO_LVIF(ni->ni_vap);
4212 	vif = LVIF_TO_VIF(lvif);
4213 
4214 	lvif->iv_recv_mgmt(ni, m0, subtype, rxs, rssi, nf);
4215 
4216 	switch (subtype) {
4217 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
4218 		break;
4219 	case IEEE80211_FC0_SUBTYPE_BEACON:
4220 		/*
4221 		 * Only count beacons when assoc. SCAN has its own logging.
4222 		 * This is for connection/beacon loss/session protection almost
4223 		 * over debugging when trying to get into a stable RUN state.
4224 		 */
4225 		if (vif->cfg.assoc)
4226 			lvif->beacons++;
4227 		break;
4228 	default:
4229 		return;
4230 	}
4231 
4232 	lhw = ni->ni_ic->ic_softc;
4233 	hw = LHW_TO_HW(lhw);
4234 
4235 	/*
4236 	 * If this direct call to mo_bss_info_changed will not work due to
4237 	 * locking, see if queue_work() is fast enough.
4238 	 */
4239 	bss_changed = lkpi_update_dtim_tsf(vif, ni, ni->ni_vap, __func__, __LINE__);
4240 	lkpi_bss_info_change(hw, vif, bss_changed);
4241 }
4242 
4243 /*
4244  * Change link-layer address on the vif (if the vap is not started/"UP").
4245  * This can happen if a user changes 'ether' using ifconfig.
4246  * The code is based on net80211/ieee80211_freebsd.c::wlan_iflladdr() but
4247  * we do use a per-[l]vif event handler to be sure we exist as we
4248  * cannot assume that from every vap derives a vif and we have a hard
4249  * time checking based on net80211 information.
4250  * Should this ever become a real problem we could add a callback function
4251  * to wlan_iflladdr() to be set optionally but that would be for a
4252  * single-consumer (or needs a list) -- was just too complicated for an
4253  * otherwise perfect mechanism FreeBSD already provides.
4254  */
4255 static void
4256 lkpi_vif_iflladdr(void *arg, struct ifnet *ifp)
4257 {
4258 	struct epoch_tracker et;
4259 	struct ieee80211_vif *vif;
4260 
4261 	NET_EPOCH_ENTER(et);
4262 	/* NB: identify vap's by if_transmit; left as an extra check. */
4263 	if (if_gettransmitfn(ifp) != ieee80211_vap_transmit ||
4264 	    (if_getflags(ifp) & IFF_UP) != 0) {
4265 		NET_EPOCH_EXIT(et);
4266 		return;
4267 	}
4268 
4269 	vif = arg;
4270 	IEEE80211_ADDR_COPY(vif->bss_conf.addr, if_getlladdr(ifp));
4271 	NET_EPOCH_EXIT(et);
4272 }
4273 
4274 static struct ieee80211vap *
4275 lkpi_ic_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ],
4276     int unit, enum ieee80211_opmode opmode, int flags,
4277     const uint8_t bssid[IEEE80211_ADDR_LEN],
4278     const uint8_t mac[IEEE80211_ADDR_LEN])
4279 {
4280 	struct lkpi_hw *lhw;
4281 	struct ieee80211_hw *hw;
4282 	struct lkpi_vif *lvif;
4283 	struct ieee80211vap *vap;
4284 	struct ieee80211_vif *vif;
4285 	struct ieee80211_tx_queue_params txqp;
4286 	enum ieee80211_bss_changed bss_changed;
4287 	enum nl80211_band band;
4288 	struct sysctl_oid *node;
4289 	size_t len;
4290 	int error, i;
4291 	uint16_t ac;
4292 
4293 	if (!TAILQ_EMPTY(&ic->ic_vaps))	/* 1 so far. Add <n> once this works. */
4294 		return (NULL);
4295 
4296 	lhw = ic->ic_softc;
4297 	hw = LHW_TO_HW(lhw);
4298 
4299 	len = sizeof(*lvif);
4300 	len += hw->vif_data_size;	/* vif->drv_priv */
4301 
4302 	lvif = malloc(len, M_80211_VAP, M_WAITOK | M_ZERO);
4303 	mtx_init(&lvif->mtx, "lvif", NULL, MTX_DEF);
4304 	TASK_INIT(&lvif->sw_scan_task, 0, lkpi_sw_scan_task, lvif);
4305 	INIT_LIST_HEAD(&lvif->lsta_list);
4306 	lvif->lvif_bss = NULL;
4307 	refcount_init(&lvif->nt_unlocked, 0);
4308 	lvif->lvif_bss_synched = false;
4309 	vap = LVIF_TO_VAP(lvif);
4310 	vif = LVIF_TO_VIF(lvif);
4311 
4312 	/*
4313 	 * Setup legacy br_mask here.  We will call (*set_bitrate_mask)
4314 	 * elsewhere to announce it to the driver but it is a static
4315 	 * setup.
4316 	 * Also setup basic_rates with just the mandatory rates for the
4317 	 * current band (if avail).
4318 	 */
4319 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
4320 		struct ieee80211_supported_band *supband;
4321 		uint32_t rate_mandatory;;
4322 
4323 		supband = hw->wiphy->bands[band];
4324 		if (supband == NULL || supband->n_bitrates == 0)
4325 			continue;
4326 
4327 		/* Per-band legacy br_mask. */
4328 		lvif->br_mask.control[band].legacy = (1 << supband->n_bitrates) - 1;
4329 
4330 		/* basic_rates for the current band. */
4331 		if (hw->conf.chandef.chan == NULL ||
4332 		    hw->conf.chandef.chan->band != band)
4333 			continue;
4334 
4335 		switch (band) {
4336 		case NL80211_BAND_2GHZ:
4337 			/* We have to assume 11g support here. */
4338 			rate_mandatory = IEEE80211_RATE_MANDATORY_G |
4339 			    IEEE80211_RATE_MANDATORY_B;
4340 			break;
4341 		case NL80211_BAND_5GHZ:
4342 			rate_mandatory = IEEE80211_RATE_MANDATORY_A;
4343 			break;
4344 		default:
4345 			continue;
4346 		}
4347 
4348 		for (i = 0; i < supband->n_bitrates; i++) {
4349 			if ((supband->bitrates[i].flags & rate_mandatory) != 0)
4350 				vif->bss_conf.basic_rates |= BIT(i);
4351 		}
4352 	}
4353 
4354 	memcpy(vif->addr, mac, IEEE80211_ADDR_LEN);
4355 	vif->p2p = false;
4356 	vif->probe_req_reg = false;
4357 	vif->type = lkpi_opmode_to_vif_type(opmode);
4358 	lvif->wdev.iftype = vif->type;
4359 	/* Need to fill in other fields as well. */
4360 	IMPROVE();
4361 
4362 	/* Create a chanctx to be used later. */
4363 	IMPROVE("lkpi_alloc_lchanctx reserved as many as can be");
4364 	(void) lkpi_find_lchanctx_reserved(hw, lvif);
4365 
4366 	/* XXX-BZ hardcoded for now! */
4367 #if 1
4368 	RCU_INIT_POINTER(vif->bss_conf.chanctx_conf, NULL);
4369 	vif->bss_conf.vif = vif;
4370 	/* vap->iv_myaddr is not set until net80211::vap_setup or vap_attach. */
4371 	IEEE80211_ADDR_COPY(vif->bss_conf.addr, mac);
4372 	lvif->lvif_ifllevent = EVENTHANDLER_REGISTER(iflladdr_event,
4373 	    lkpi_vif_iflladdr, vif, EVENTHANDLER_PRI_ANY);
4374 	vif->bss_conf.link_id = 0;	/* Non-MLO operation. */
4375 	vif->bss_conf.chanreq.oper.chan = lhw->dflt_chandef.chan;
4376 	vif->bss_conf.chanreq.oper.width = NL80211_CHAN_WIDTH_20_NOHT;
4377 	vif->bss_conf.use_short_preamble = false;	/* vap->iv_flags IEEE80211_F_SHPREAMBLE */
4378 	vif->bss_conf.use_short_slot = false;		/* vap->iv_flags IEEE80211_F_SHSLOT */
4379 	vif->bss_conf.qos = false;
4380 	vif->bss_conf.use_cts_prot = false;		/* vap->iv_protmode */
4381 	vif->bss_conf.ht_operation_mode = IEEE80211_HT_OP_MODE_PROTECTION_NONE;
4382 	IEEE80211_ADDR_COPY(vif->cfg.ap_addr, ieee80211broadcastaddr);
4383 	vif->cfg.aid = 0;
4384 	vif->cfg.assoc = false;
4385 	vif->cfg.idle = true;
4386 	vif->cfg.ps = false;
4387 	IMPROVE("Check other fields and then figure out whats is left elsewhere of them");
4388 	/*
4389 	 * We need to initialize it to something as the bss_info_changed call
4390 	 * will try to copy from it in iwlwifi and NULL is a panic.
4391 	 * We will set the proper one in scan_to_auth() before being assoc.
4392 	 */
4393 	vif->bss_conf.bssid = ieee80211broadcastaddr;
4394 #endif
4395 #if 0
4396 	vif->bss_conf.dtim_period = 0; /* IEEE80211_DTIM_DEFAULT ; must stay 0. */
4397 	IEEE80211_ADDR_COPY(vif->bss_conf.bssid, bssid);
4398 	vif->bss_conf.beacon_int = ic->ic_bintval;
4399 	/* iwlwifi bug. */
4400 	if (vif->bss_conf.beacon_int < 16)
4401 		vif->bss_conf.beacon_int = 16;
4402 #endif
4403 
4404 	/* Link Config */
4405 	vif->link_conf[0] = &vif->bss_conf;
4406 	for (i = 0; i < nitems(vif->link_conf); i++) {
4407 		IMPROVE("more than 1 link one day");
4408 	}
4409 
4410 	/* Setup queue defaults; driver may override in (*add_interface). */
4411 	for (i = 0; i < IEEE80211_NUM_ACS; i++) {
4412 		if (ieee80211_hw_check(hw, QUEUE_CONTROL))
4413 			vif->hw_queue[i] = IEEE80211_INVAL_HW_QUEUE;
4414 		else if (hw->queues >= IEEE80211_NUM_ACS)
4415 			vif->hw_queue[i] = i;
4416 		else
4417 			vif->hw_queue[i] = 0;
4418 
4419 		/* Initialize the queue to running. Stopped? */
4420 		lvif->hw_queue_stopped[i] = false;
4421 	}
4422 	vif->cab_queue = IEEE80211_INVAL_HW_QUEUE;
4423 
4424 	IMPROVE();
4425 
4426 	wiphy_lock(hw->wiphy);
4427 	error = lkpi_80211_mo_start(hw);
4428 	if (error != 0) {
4429 		wiphy_unlock(hw->wiphy);
4430 		ic_printf(ic, "%s: failed to start hw: %d\n", __func__, error);
4431 		mtx_destroy(&lvif->mtx);
4432 		free(lvif, M_80211_VAP);
4433 		return (NULL);
4434 	}
4435 
4436 	error = lkpi_80211_mo_add_interface(hw, vif);
4437 	if (error != 0) {
4438 		IMPROVE();	/* XXX-BZ mo_stop()? */
4439 		wiphy_unlock(hw->wiphy);
4440 		ic_printf(ic, "%s: failed to add interface: %d\n", __func__, error);
4441 		mtx_destroy(&lvif->mtx);
4442 		free(lvif, M_80211_VAP);
4443 		return (NULL);
4444 	}
4445 	wiphy_unlock(hw->wiphy);
4446 
4447 	LKPI_80211_LHW_LVIF_LOCK(lhw);
4448 	TAILQ_INSERT_TAIL(&lhw->lvif_head, lvif, lvif_entry);
4449 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
4450 
4451 	/* Set bss_info. */
4452 	bss_changed = 0;
4453 	lkpi_bss_info_change(hw, vif, bss_changed);
4454 
4455 	/* Configure tx queues (conf_tx), default WME & send BSS_CHANGED_QOS. */
4456 	IMPROVE("Hardcoded values; to fix see 802.11-2016, 9.4.2.29 EDCA Parameter Set element");
4457 	wiphy_lock(hw->wiphy);
4458 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
4459 
4460 		bzero(&txqp, sizeof(txqp));
4461 		txqp.cw_min = 15;
4462 		txqp.cw_max = 1023;
4463 		txqp.txop = 0;
4464 		txqp.aifs = 2;
4465 		error = lkpi_80211_mo_conf_tx(hw, vif, /* link_id */0, ac, &txqp);
4466 		if (error != 0)
4467 			ic_printf(ic, "%s: conf_tx ac %u failed %d\n",
4468 			    __func__, ac, error);
4469 	}
4470 	bss_changed = BSS_CHANGED_QOS;
4471 	lkpi_bss_info_change(hw, vif, bss_changed);
4472 
4473 	/* Force MC init. */
4474 	lkpi_update_mcast_filter_locked(ic);
4475 
4476 	wiphy_unlock(hw->wiphy);
4477 
4478 	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
4479 
4480 	/* Now we have a valid vap->iv_ifp.  Any checksum offloading goes below. */
4481 
4482 	IMPROVE();
4483 
4484 	/* Override with LinuxKPI method so we can drive mac80211/cfg80211. */
4485 	lvif->iv_newstate = vap->iv_newstate;
4486 	vap->iv_newstate = lkpi_iv_newstate;
4487 	lvif->iv_update_bss = vap->iv_update_bss;
4488 	vap->iv_update_bss = lkpi_iv_update_bss;
4489 	lvif->iv_recv_mgmt = vap->iv_recv_mgmt;
4490 	vap->iv_recv_mgmt = lkpi_iv_sta_recv_mgmt;
4491 
4492 #ifdef LKPI_80211_HW_CRYPTO
4493 	/* Key management. */
4494 	if (lkpi_hwcrypto && lhw->ops->set_key != NULL) {
4495 		vap->iv_key_set = lkpi_iv_key_set;
4496 		vap->iv_key_delete = lkpi_iv_key_delete;
4497 		vap->iv_key_update_begin = lkpi_iv_key_update_begin;
4498 		vap->iv_key_update_end = lkpi_iv_key_update_end;
4499 	}
4500 #endif
4501 
4502 #ifdef LKPI_80211_HT
4503 	/* Stay with the iv_ampdu_rxmax,limit / iv_ampdu_density defaults until later. */
4504 #endif
4505 
4506 	ieee80211_ratectl_init(vap);
4507 
4508 	/* Complete setup. */
4509 	ieee80211_vap_attach(vap, ieee80211_media_change,
4510 	    ieee80211_media_status, mac);
4511 
4512 #ifdef LKPI_80211_HT
4513 	/*
4514 	 * Modern chipset/fw/drv will do A-MPDU in drv/fw and fail
4515 	 * to do so if they cannot do the crypto too.
4516 	 */
4517 	if (!lkpi_hwcrypto && IEEE80211_CONF_AMPDU_OFFLOAD(ic))
4518 		vap->iv_flags_ht &= ~IEEE80211_FHT_AMPDU_RX;
4519 #endif
4520 
4521 	if (hw->max_listen_interval == 0)
4522 		hw->max_listen_interval = 7 * (ic->ic_lintval / ic->ic_bintval);
4523 	hw->conf.listen_interval = hw->max_listen_interval;
4524 
4525 	wiphy_lock(hw->wiphy);
4526 	/* XXX-BZ do we need to be able to update these? */
4527 	hw->wiphy->frag_threshold = vap->iv_fragthreshold;
4528 	lkpi_80211_mo_set_frag_threshold(hw, vap->iv_fragthreshold);
4529 	hw->wiphy->rts_threshold = vap->iv_rtsthreshold;
4530 	lkpi_80211_mo_set_rts_threshold(hw, vap->iv_rtsthreshold);
4531 	wiphy_unlock(hw->wiphy);
4532 	/* any others? */
4533 
4534 	/* Add per-VIF/VAP sysctls. */
4535 	sysctl_ctx_init(&lvif->sysctl_ctx);
4536 
4537 	node = SYSCTL_ADD_NODE(&lvif->sysctl_ctx,
4538 	    SYSCTL_CHILDREN(&sysctl___compat_linuxkpi_80211),
4539 	    OID_AUTO, if_name(vap->iv_ifp),
4540 	    CTLFLAG_RD | CTLFLAG_SKIP | CTLFLAG_MPSAFE, NULL, "VIF Information");
4541 
4542 	SYSCTL_ADD_PROC(&lvif->sysctl_ctx,
4543 	    SYSCTL_CHILDREN(node), OID_AUTO, "dump_stas",
4544 	    CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_MPSAFE, lvif, 0,
4545 	    lkpi_80211_dump_stas, "A", "Dump sta statistics of this vif");
4546 	SYSCTL_ADD_PROC(&lvif->sysctl_ctx,
4547 	    SYSCTL_CHILDREN(node), OID_AUTO, "dump_stas_queues",
4548 	    CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_MPSAFE | CTLFLAG_SKIP, lvif, 0,
4549 	    lkpi_80211_dump_sta_queues, "A",
4550 	    "Dump queue statistics for any sta of this vif");
4551 
4552 	IMPROVE();
4553 
4554 	return (vap);
4555 }
4556 
4557 void
4558 linuxkpi_ieee80211_unregister_hw(struct ieee80211_hw *hw)
4559 {
4560 
4561 	wiphy_unregister(hw->wiphy);
4562 	linuxkpi_ieee80211_ifdetach(hw);
4563 
4564 	IMPROVE();
4565 }
4566 
4567 void
4568 linuxkpi_ieee80211_restart_hw(struct ieee80211_hw *hw)
4569 {
4570 
4571 	TODO();
4572 }
4573 
4574 static void
4575 lkpi_ic_vap_delete(struct ieee80211vap *vap)
4576 {
4577 	struct ieee80211com *ic;
4578 	struct lkpi_hw *lhw;
4579 	struct ieee80211_hw *hw;
4580 	struct lkpi_vif *lvif;
4581 	struct ieee80211_vif *vif;
4582 
4583 	lvif = VAP_TO_LVIF(vap);
4584 	vif = LVIF_TO_VIF(lvif);
4585 	ic = vap->iv_ic;
4586 	lhw = ic->ic_softc;
4587 	hw = LHW_TO_HW(lhw);
4588 
4589 	EVENTHANDLER_DEREGISTER(iflladdr_event, lvif->lvif_ifllevent);
4590 
4591 	/* Clear up per-VIF/VAP sysctls. */
4592 	sysctl_ctx_free(&lvif->sysctl_ctx);
4593 
4594 	ieee80211_draintask(ic, &lvif->sw_scan_task);
4595 
4596 	LKPI_80211_LHW_LVIF_LOCK(lhw);
4597 	TAILQ_REMOVE(&lhw->lvif_head, lvif, lvif_entry);
4598 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
4599 
4600 	ieee80211_ratectl_deinit(vap);
4601 	ieee80211_vap_detach(vap);
4602 
4603 	IMPROVE("clear up other bits in this state");
4604 
4605 	lkpi_80211_mo_remove_interface(hw, vif);
4606 
4607 	/* Single VAP, so we can do this here. */
4608 	lkpi_80211_mo_stop(hw, false);			/* XXX SUSPEND */
4609 
4610 	mtx_destroy(&lvif->mtx);
4611 	free(lvif, M_80211_VAP);
4612 }
4613 
4614 static void
4615 lkpi_ic_update_mcast(struct ieee80211com *ic)
4616 {
4617 	struct ieee80211vap *vap;
4618 	struct lkpi_hw *lhw;
4619 
4620 	lhw = ic->ic_softc;
4621 
4622 	LKPI_80211_LHW_MC_LOCK(lhw);
4623 	/* Cleanup anything on the current list. */
4624 	lkpi_cleanup_mcast_list_locked(lhw);
4625 
4626 	/* Build up the new list (or allmulti). */
4627 	if (ic->ic_allmulti == 0) {
4628 		TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
4629 			if_foreach_llmaddr(vap->iv_ifp,
4630 			    lkpi_ic_update_mcast_copy, &lhw->mc_list);
4631 		lhw->mc_all_multi = false;
4632 	} else {
4633 		lhw->mc_all_multi = true;
4634 	}
4635 	LKPI_80211_LHW_MC_UNLOCK(lhw);
4636 
4637 	lkpi_update_mcast_filter(ic);
4638 	TRACEOK();
4639 }
4640 
4641 static void
4642 lkpi_ic_update_promisc(struct ieee80211com *ic)
4643 {
4644 
4645 	UNIMPLEMENTED;
4646 }
4647 
4648 static void
4649 lkpi_ic_update_chw(struct ieee80211com *ic)
4650 {
4651 
4652 	UNIMPLEMENTED;
4653 }
4654 
4655 /* Start / stop device. */
4656 static void
4657 lkpi_ic_parent(struct ieee80211com *ic)
4658 {
4659 	struct lkpi_hw *lhw;
4660 	struct ieee80211_hw *hw;
4661 #ifdef HW_START_STOP
4662 	int error;
4663 #endif
4664 	bool start_all;
4665 
4666 	IMPROVE();
4667 
4668 	lhw = ic->ic_softc;
4669 	hw = LHW_TO_HW(lhw);
4670 	start_all = false;
4671 
4672 	/* IEEE80211_UNLOCK(ic); */
4673 	wiphy_lock(hw->wiphy);
4674 	if (ic->ic_nrunning > 0) {
4675 #ifdef HW_START_STOP
4676 		error = lkpi_80211_mo_start(hw);
4677 		if (error == 0)
4678 #endif
4679 			start_all = true;
4680 	} else {
4681 #ifdef HW_START_STOP
4682 		lkpi_80211_mo_stop(hw, false);		/* XXX SUSPEND */
4683 #endif
4684 	}
4685 	wiphy_unlock(hw->wiphy);
4686 	/* IEEE80211_LOCK(ic); */
4687 
4688 	if (start_all)
4689 		ieee80211_start_all(ic);
4690 }
4691 
4692 bool
4693 linuxkpi_ieee80211_is_ie_id_in_ie_buf(const u8 ie, const u8 *ie_ids,
4694     size_t ie_ids_len)
4695 {
4696 	int i;
4697 
4698 	for (i = 0; i < ie_ids_len; i++) {
4699 		if (ie == *ie_ids)
4700 			return (true);
4701 	}
4702 
4703 	return (false);
4704 }
4705 
4706 /* Return true if skipped; false if error. */
4707 bool
4708 linuxkpi_ieee80211_ie_advance(size_t *xp, const u8 *ies, size_t ies_len)
4709 {
4710 	size_t x;
4711 	uint8_t l;
4712 
4713 	x = *xp;
4714 
4715 	KASSERT(x < ies_len, ("%s: x %zu ies_len %zu ies %p\n",
4716 	    __func__, x, ies_len, ies));
4717 	l = ies[x + 1];
4718 	x += 2 + l;
4719 
4720 	if (x > ies_len)
4721 		return (false);
4722 
4723 	*xp = x;
4724 	return (true);
4725 }
4726 
4727 static uint8_t *
4728 lkpi_scan_ies_add(uint8_t *p, struct ieee80211_scan_ies *scan_ies,
4729     uint32_t band_mask, struct ieee80211vap *vap, struct ieee80211_hw *hw)
4730 {
4731 	struct ieee80211_supported_band *supband;
4732 	struct linuxkpi_ieee80211_channel *channels;
4733 	struct ieee80211com *ic;
4734 	const struct ieee80211_channel *chan;
4735 	const struct ieee80211_rateset *rs;
4736 	uint8_t *pb;
4737 	int band, i;
4738 
4739 	ic = vap->iv_ic;
4740 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
4741 		if ((band_mask & (1 << band)) == 0)
4742 			continue;
4743 
4744 		supband = hw->wiphy->bands[band];
4745 		/*
4746 		 * This should not happen;
4747 		 * band_mask is a bitmask of valid bands to scan on.
4748 		 */
4749 		if (supband == NULL || supband->n_channels == 0)
4750 			continue;
4751 
4752 		/* Find a first channel to get the mode and rates from. */
4753 		channels = supband->channels;
4754 		chan = NULL;
4755 		for (i = 0; i < supband->n_channels; i++) {
4756 			uint32_t flags;
4757 
4758 			if (channels[i].flags & IEEE80211_CHAN_DISABLED)
4759 				continue;
4760 
4761 			flags = 0;
4762 			switch (band) {
4763 			case NL80211_BAND_2GHZ:
4764 				flags |= IEEE80211_CHAN_G;
4765 				break;
4766 			case NL80211_BAND_5GHZ:
4767 				flags |= IEEE80211_CHAN_A;
4768 				break;
4769 			default:
4770 				panic("%s:%d: unupported band %d\n",
4771 				    __func__, __LINE__, band);
4772 			}
4773 
4774 			chan = ieee80211_find_channel(ic,
4775 			    channels[i].center_freq, flags);
4776 			if (chan != NULL)
4777 				break;
4778 		}
4779 
4780 		/* This really should not happen. */
4781 		if (chan == NULL)
4782 			continue;
4783 
4784 		pb = p;
4785 		rs = ieee80211_get_suprates(ic, chan);	/* calls chan2mode */
4786 		p = ieee80211_add_rates(p, rs);
4787 		p = ieee80211_add_xrates(p, rs);
4788 
4789 #if defined(LKPI_80211_HT)
4790 		if ((vap->iv_flags_ht & IEEE80211_FHT_HT) != 0) {
4791 			struct ieee80211_channel *c;
4792 
4793 			c = ieee80211_ht_adjust_channel(ic, ic->ic_curchan,
4794 			    vap->iv_flags_ht);
4795 			p = ieee80211_add_htcap_ch(p, vap, c);
4796 		}
4797 #endif
4798 #if defined(LKPI_80211_VHT)
4799 		if (band == NL80211_BAND_5GHZ &&
4800 		    (vap->iv_vht_flags & IEEE80211_FVHT_VHT) != 0) {
4801 			struct ieee80211_channel *c;
4802 
4803 			c = ieee80211_ht_adjust_channel(ic, ic->ic_curchan,
4804 			    vap->iv_flags_ht);
4805 			c = ieee80211_vht_adjust_channel(ic, c,
4806 			    vap->iv_vht_flags);
4807 			p = ieee80211_add_vhtcap_ch(p, vap, c);
4808 		}
4809 #endif
4810 
4811 		scan_ies->ies[band] = pb;
4812 		scan_ies->len[band] = p - pb;
4813 	}
4814 
4815 	/* Add common_ies */
4816 	pb = p;
4817 	if ((vap->iv_flags & IEEE80211_F_WPA1) != 0 &&
4818 	    vap->iv_wpa_ie != NULL) {
4819 		memcpy(p, vap->iv_wpa_ie, 2 + vap->iv_wpa_ie[1]);
4820 		p += 2 + vap->iv_wpa_ie[1];
4821 	}
4822 	if (vap->iv_appie_probereq != NULL) {
4823 		memcpy(p, vap->iv_appie_probereq->ie_data,
4824 		    vap->iv_appie_probereq->ie_len);
4825 		p += vap->iv_appie_probereq->ie_len;
4826 	}
4827 	scan_ies->common_ies = pb;
4828 	scan_ies->common_ie_len = p - pb;
4829 
4830 	return (p);
4831 }
4832 
4833 static void
4834 lkpi_enable_hw_scan(struct lkpi_hw *lhw)
4835 {
4836 
4837 	if (lhw->ops->hw_scan) {
4838 		/*
4839 		 * Advertise full-offload scanning.
4840 		 *
4841 		 * Not limiting to SINGLE_SCAN_ON_ALL_BANDS here as otherwise
4842 		 * we essentially disable hw_scan for all drivers not setting
4843 		 * the flag.
4844 		 */
4845 		lhw->ic->ic_flags_ext |= IEEE80211_FEXT_SCAN_OFFLOAD;
4846 		lhw->scan_flags |= LKPI_LHW_SCAN_HW;
4847 	}
4848 }
4849 
4850 #ifndef LKPI_80211_USE_SCANLIST
4851 static const uint32_t chan_pri[] = {
4852 	5180, 5500, 5745,
4853 	5260, 5580, 5660, 5825,
4854 	5220, 5300, 5540, 5620, 5700, 5785, 5865,
4855 	2437, 2412, 2422, 2462, 2472, 2432, 2452
4856 };
4857 
4858 static int
4859 lkpi_scan_chan_list_idx(const struct linuxkpi_ieee80211_channel *lc)
4860 {
4861 	int i;
4862 
4863 	for (i = 0; i < nitems(chan_pri); i++) {
4864 		if (lc->center_freq == chan_pri[i])
4865 			return (i);
4866 	}
4867 
4868 	return (-1);
4869 }
4870 
4871 static int
4872 lkpi_scan_chan_list_comp(const  struct linuxkpi_ieee80211_channel *lc1,
4873     const  struct linuxkpi_ieee80211_channel *lc2)
4874 {
4875 	int idx1, idx2;
4876 
4877 	/* Find index in list. */
4878 	idx1 = lkpi_scan_chan_list_idx(lc1);
4879 	idx2 = lkpi_scan_chan_list_idx(lc2);
4880 
4881 	if (idx1 == -1 && idx2 != -1)
4882 		return (1);
4883 	if (idx1 != -1 && idx2 == -1)
4884 		return (-1);
4885 
4886 	/* Neither on the list, use center_freq. */
4887 	if (idx1 == -1 && idx2 == -1)
4888 		return (lc1->center_freq - lc2->center_freq);
4889 
4890 	/* Whichever is first in the list. */
4891 	return (idx1 - idx2);
4892 }
4893 
4894 static void
4895 lkpi_scan_chan_list_resort(struct linuxkpi_ieee80211_channel **cpp, size_t nchan)
4896 {
4897 	struct linuxkpi_ieee80211_channel *lc, *nc;
4898 	size_t i, j;
4899 	int rc;
4900 
4901 	for (i = (nchan - 1); i > 0; i--) {
4902 		for (j = i; j > 0 ; j--) {
4903 			lc = *(cpp + j);
4904 			nc = *(cpp + j - 1);
4905 			rc = lkpi_scan_chan_list_comp(lc, nc);
4906 			if (rc < 0) {
4907 				*(cpp + j) = nc;
4908 				*(cpp + j - 1) = lc;
4909 			}
4910 		}
4911 	}
4912 }
4913 
4914 static bool
4915 lkpi_scan_chan(struct linuxkpi_ieee80211_channel *c,
4916     struct ieee80211com *ic, bool log)
4917 {
4918 
4919 	if ((c->flags & IEEE80211_CHAN_DISABLED) != 0) {
4920 		if (log)
4921 			TRACE_SCAN(ic, "Skipping disabled chan "
4922 			    "on band %s [%#x/%u/%#x]",
4923 			    lkpi_nl80211_band_name(c->band), c->hw_value,
4924 			    c->center_freq, c->flags);
4925 		return (false);
4926 	}
4927 	if (isclr(ic->ic_chan_active, ieee80211_mhz2ieee(c->center_freq,
4928 	    lkpi_nl80211_band_to_net80211_band(c->band)))) {
4929 		if (log)
4930 			TRACE_SCAN(ic, "Skipping !active chan "
4931 			    "on band %s [%#x/%u/%#x]",
4932 			    lkpi_nl80211_band_name(c->band), c->hw_value,
4933 			    c->center_freq, c->flags);
4934 		return (false);
4935 	}
4936 	return (true);
4937 }
4938 #endif
4939 
4940 static void
4941 lkpi_ic_scan_start(struct ieee80211com *ic)
4942 {
4943 	struct lkpi_hw *lhw;
4944 	struct ieee80211_hw *hw;
4945 	struct lkpi_vif *lvif;
4946 	struct ieee80211_vif *vif;
4947 	struct ieee80211_scan_state *ss;
4948 	struct ieee80211vap *vap;
4949 	int error;
4950 	bool is_hw_scan;
4951 
4952 	lhw = ic->ic_softc;
4953 	ss = ic->ic_scan;
4954 	vap = ss->ss_vap;
4955 	TRACE_SCAN(ic, "scan_flags %b", lhw->scan_flags, LKPI_LHW_SCAN_BITS);
4956 
4957 	LKPI_80211_LHW_SCAN_LOCK(lhw);
4958 	if ((lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0) {
4959 		/* A scan is still running. */
4960 		LKPI_80211_LHW_SCAN_UNLOCK(lhw);
4961 		TRACE_SCAN(ic, "Trying to start new scan while still running; "
4962 		    "cancelling new net80211 scan; scan_flags %b",
4963 		    lhw->scan_flags, LKPI_LHW_SCAN_BITS);
4964 		ieee80211_cancel_scan(vap);
4965 		return;
4966 	}
4967 	is_hw_scan = (lhw->scan_flags & LKPI_LHW_SCAN_HW) != 0;
4968 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
4969 
4970 #if 0
4971 	if (vap->iv_state != IEEE80211_S_SCAN) {
4972 		TODO("We need to be able to scan if not in S_SCAN");
4973 		TRACE_SCAN(ic, "scan_flags %b iv_state %d",
4974 		    lhw->scan_flags, LKPI_LHW_SCAN_BITS, vap->iv_state);
4975 		ieee80211_cancel_scan(vap);
4976 		return;
4977 	}
4978 #endif
4979 
4980 	hw = LHW_TO_HW(lhw);
4981 	if (!is_hw_scan) {
4982 		/* If hw_scan is cleared clear FEXT_SCAN_OFFLOAD too. */
4983 		vap->iv_flags_ext &= ~IEEE80211_FEXT_SCAN_OFFLOAD;
4984 
4985 		lvif = VAP_TO_LVIF(vap);
4986 		vif = LVIF_TO_VIF(lvif);
4987 
4988 		if (vap->iv_state == IEEE80211_S_SCAN) {
4989 			wiphy_lock(hw->wiphy);
4990 			lkpi_hw_conf_idle(hw, false);
4991 			wiphy_unlock(hw->wiphy);
4992 		}
4993 
4994 		LKPI_80211_LHW_SCAN_LOCK(lhw);
4995 		lhw->scan_flags |= LKPI_LHW_SCAN_RUNNING;
4996 		LKPI_80211_LHW_SCAN_UNLOCK(lhw);
4997 
4998 		lkpi_update_mcast_filter(ic);
4999 
5000 		TRACE_SCAN(vap->iv_ic, "Starting SW_SCAN: scan_flags %b",
5001 		    lhw->scan_flags, LKPI_LHW_SCAN_BITS);
5002 		lkpi_80211_mo_sw_scan_start(hw, vif, vif->addr);
5003 		/* net80211::scan_start() handled PS for us. */
5004 		IMPROVE();
5005 		/* XXX Also means it is too late to flush queues?
5006 		 * need to check iv_sta_ps or overload? */
5007 		/* XXX want to adjust ss end time/ maxdwell? */
5008 
5009 	} else {
5010 		struct ieee80211_scan_request *hw_req;
5011 		struct linuxkpi_ieee80211_channel *lc, **cpp;
5012 		struct cfg80211_ssid *ssids;
5013 		struct cfg80211_scan_6ghz_params *s6gp;
5014 		size_t chan_len, nchan, ssids_len, s6ghzlen;
5015 		int band, i, ssid_count, common_ie_len;
5016 #ifndef LKPI_80211_USE_SCANLIST
5017 		int n;
5018 #endif
5019 		uint32_t band_mask;
5020 		uint8_t *ie, *ieend;
5021 		bool running;
5022 
5023 		ssid_count = min(ss->ss_nssid, hw->wiphy->max_scan_ssids);
5024 		ssids_len = ssid_count * sizeof(*ssids);
5025 		s6ghzlen = 0 * (sizeof(*s6gp));			/* XXX-BZ */
5026 
5027 		band_mask = 0;
5028 		nchan = 0;
5029 		if (ieee80211_hw_check(hw, SINGLE_SCAN_ON_ALL_BANDS)) {
5030 #ifdef LKPI_80211_USE_SCANLIST
5031 		/* Avoid net80211 scan lists until it has proper scan offload support. */
5032 			for (i = ss->ss_next; i < ss->ss_last; i++) {
5033 				nchan++;
5034 				band = lkpi_net80211_chan_to_nl80211_band(
5035 				    ss->ss_chans[ss->ss_next + i]);
5036 				band_mask |= (1 << band);
5037 			}
5038 #else
5039 			/* Instead we scan for all channels all the time. */
5040 			for (band = 0; band < NUM_NL80211_BANDS; band++) {
5041 				switch (band) {
5042 				case NL80211_BAND_2GHZ:
5043 				case NL80211_BAND_5GHZ:
5044 					break;
5045 				default:
5046 					continue;
5047 				}
5048 				if (hw->wiphy->bands[band] != NULL) {
5049 					struct linuxkpi_ieee80211_channel *channels;
5050 					int n;
5051 
5052 					band_mask |= (1 << band);
5053 
5054 					channels = hw->wiphy->bands[band]->channels;
5055 					n = hw->wiphy->bands[band]->n_channels;
5056 					for (i = 0; i < n; i++) {
5057 						if (lkpi_scan_chan(&channels[i], ic, true))
5058 							nchan++;
5059 					}
5060 				}
5061 			}
5062 #endif
5063 		} else {
5064 			IMPROVE("individual band scans not yet supported, only scanning first band");
5065 			/* In theory net80211 should drive this. */
5066 			/* Probably we need to add local logic for now;
5067 			 * need to deal with scan_complete
5068 			 * and cancel_scan and keep local state.
5069 			 * Also cut the nchan down above.
5070 			 */
5071 			/* XXX-BZ ath10k does not set this but still does it? &$%^ */
5072 		}
5073 
5074 		chan_len = nchan * (sizeof(lc) + sizeof(*lc));
5075 
5076 		common_ie_len = 0;
5077 		if ((vap->iv_flags & IEEE80211_F_WPA1) != 0 &&
5078 		    vap->iv_wpa_ie != NULL)
5079 			common_ie_len += vap->iv_wpa_ie[1];
5080 		if (vap->iv_appie_probereq != NULL)
5081 			common_ie_len += vap->iv_appie_probereq->ie_len;
5082 
5083 		/* We would love to check this at an earlier stage... */
5084 		if (common_ie_len >  hw->wiphy->max_scan_ie_len) {
5085 			ic_printf(ic, "WARNING: %s: common_ie_len %d > "
5086 			    "wiphy->max_scan_ie_len %d\n", __func__,
5087 			    common_ie_len, hw->wiphy->max_scan_ie_len);
5088 		}
5089 
5090 		hw_req = malloc(sizeof(*hw_req) + ssids_len +
5091 		    s6ghzlen + chan_len + lhw->supbands * lhw->scan_ie_len +
5092 		    common_ie_len, M_LKPI80211, M_WAITOK | M_ZERO);
5093 
5094 		hw_req->req.flags = 0;			/* XXX ??? */
5095 		/* hw_req->req.wdev */
5096 		hw_req->req.wiphy = hw->wiphy;
5097 		hw_req->req.no_cck = false;		/* XXX */
5098 
5099 		/*
5100 		 * In general setting duration[_mandatory] seems to pessimise
5101 		 * default scanning behaviour.  We only use it for BGSCANnig
5102 		 * to keep the dwell times small.
5103 		 * Setting duration_mandatory makes this the maximum dwell
5104 		 * time (otherwise may be shorter).  Duration is in TU.
5105 		 */
5106 		if ((ic->ic_flags_ext & IEEE80211_FEXT_BGSCAN) != 0) {
5107 			unsigned long dwell;
5108 
5109 			if ((ic->ic_caps & IEEE80211_C_BGSCAN) == 0 ||
5110 			    (vap->iv_flags & IEEE80211_F_BGSCAN) == 0)
5111 				ic_printf(ic, "BGSCAN despite off: %b, %b, %b\n",
5112 				    ic->ic_flags_ext, IEEE80211_FEXT_BITS,
5113 				    vap->iv_flags, IEEE80211_F_BITS,
5114 				    ic->ic_caps, IEEE80211_C_BITS);
5115 
5116 			dwell = ss->ss_mindwell;
5117 			if (dwell == 0)
5118 				dwell = msecs_to_ticks(20);
5119 
5120 			hw_req->req.duration_mandatory = true;
5121 			hw_req->req.duration = TICKS_2_USEC(dwell) / 1024;
5122 		}
5123 
5124 #ifdef __notyet__
5125 		hw_req->req.flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
5126 		memcpy(hw_req->req.mac_addr, xxx, IEEE80211_ADDR_LEN);
5127 		memset(hw_req->req.mac_addr_mask, 0xxx, IEEE80211_ADDR_LEN);
5128 #endif
5129 		eth_broadcast_addr(hw_req->req.bssid);
5130 
5131 		hw_req->req.n_channels = nchan;
5132 		cpp = (struct linuxkpi_ieee80211_channel **)(hw_req + 1);
5133 		lc = (struct linuxkpi_ieee80211_channel *)(cpp + nchan);
5134 #ifdef LKPI_80211_USE_SCANLIST
5135 		for (i = 0; i < nchan; i++) {
5136 			*(cpp + i) =
5137 			    (struct linuxkpi_ieee80211_channel *)(lc + i);
5138 		}
5139 		/* Avoid net80211 scan lists until it has proper scan offload support. */
5140 		for (i = 0; i < nchan; i++) {
5141 			struct ieee80211_channel *c;
5142 
5143 			c = ss->ss_chans[ss->ss_next + i];
5144 			lc->center_freq = c->ic_freq;	/* XXX */
5145 			/* lc->flags */
5146 			lc->band = lkpi_net80211_chan_to_nl80211_band(c);
5147 			lc->max_power = c->ic_maxpower;
5148 			/* lc-> ... */
5149 			lc++;
5150 		}
5151 #else
5152 		/* Add bands in reverse order for scanning. */
5153 		n = 0;
5154 		for (band = NUM_NL80211_BANDS - 1; band >= 0; band--) {
5155 			struct ieee80211_supported_band *supband;
5156 			struct linuxkpi_ieee80211_channel *channels;
5157 
5158 			/* Band disabled for scanning? */
5159 			if ((band_mask & (1 << band)) == 0)
5160 				continue;
5161 
5162 			/* Nothing to scan in band? */
5163 			supband = hw->wiphy->bands[band];
5164 			if (supband == NULL || supband->n_channels == 0)
5165 				continue;
5166 
5167 			channels = supband->channels;
5168 			for (i = 0; i < supband->n_channels; i++) {
5169 				if (lkpi_scan_chan(&channels[i], ic, false))
5170 					*(cpp + n++) = &channels[i];
5171 			}
5172 		}
5173 		if (lkpi_order_scanlist)
5174 			lkpi_scan_chan_list_resort(cpp, nchan);
5175 
5176 		if ((linuxkpi_debug_80211 & D80211_SCAN) != 0) {
5177 			printf("%s:%d: %s SCAN Channel List (nchan=%zu): ",
5178 			    __func__, __LINE__, ic->ic_name, nchan);
5179 			for (i = 0; i < nchan; i++) {
5180 				struct linuxkpi_ieee80211_channel *xc;
5181 
5182 				xc = *(cpp + i);
5183 				printf(" %d(%d)",
5184 				    ieee80211_mhz2ieee(xc->center_freq,
5185 				        lkpi_nl80211_band_to_net80211_band(
5186 					xc->band)),
5187 				    xc->center_freq);
5188 			}
5189 			printf("\n");
5190 		}
5191 #endif
5192 
5193 		hw_req->req.n_ssids = ssid_count;
5194 		if (hw_req->req.n_ssids > 0) {
5195 			ssids = (struct cfg80211_ssid *)lc;
5196 			hw_req->req.ssids = ssids;
5197 			for (i = 0; i < ssid_count; i++) {
5198 				ssids->ssid_len = ss->ss_ssid[i].len;
5199 				memcpy(ssids->ssid, ss->ss_ssid[i].ssid,
5200 				    ss->ss_ssid[i].len);
5201 				ssids++;
5202 			}
5203 			s6gp = (struct cfg80211_scan_6ghz_params *)ssids;
5204 		} else {
5205 			s6gp = (struct cfg80211_scan_6ghz_params *)lc;
5206 		}
5207 
5208 		/* 6GHz one day. */
5209 		hw_req->req.n_6ghz_params = 0;
5210 		hw_req->req.scan_6ghz_params = NULL;
5211 		hw_req->req.scan_6ghz = false;	/* Weird boolean; not what you think. */
5212 		/* s6gp->... */
5213 
5214 		ie = ieend = (uint8_t *)s6gp;
5215 		/* Copy per-band IEs, copy common IEs */
5216 		ieend = lkpi_scan_ies_add(ie, &hw_req->ies, band_mask, vap, hw);
5217 		hw_req->req.ie = ie;
5218 		hw_req->req.ie_len = ieend - ie;
5219 		hw_req->req.scan_start = jiffies;
5220 
5221 		lvif = VAP_TO_LVIF(vap);
5222 		vif = LVIF_TO_VIF(lvif);
5223 
5224 		LKPI_80211_LHW_SCAN_LOCK(lhw);
5225 		/* Re-check under lock. */
5226 		running = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
5227 		if (!running) {
5228 			KASSERT(lhw->hw_req == NULL, ("%s: ic %p lhw %p hw_req %p "
5229 			    "!= NULL\n", __func__, ic, lhw, lhw->hw_req));
5230 
5231 			lhw->scan_flags |= LKPI_LHW_SCAN_RUNNING;
5232 			lhw->hw_req = hw_req;
5233 		}
5234 		LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5235 		if (running) {
5236 			free(hw_req, M_LKPI80211);
5237 			TRACE_SCAN(ic, "Trying to start new scan while still "
5238 			    "running (2); cancelling new net80211 scan; "
5239 			    "scan_flags %b",
5240 			    lhw->scan_flags, LKPI_LHW_SCAN_BITS);
5241 			ieee80211_cancel_scan(vap);
5242 			return;
5243 		}
5244 
5245 		wiphy_lock(hw->wiphy);
5246 		lkpi_update_mcast_filter_locked(ic);
5247 		TRACE_SCAN(ic, "Starting HW_SCAN: scan_flags %b, "
5248 		    "ie_len %d, n_ssids %d, n_chan %d, common_ie_len %d [%d, %d]",
5249 		    lhw->scan_flags, LKPI_LHW_SCAN_BITS, hw_req->req.ie_len,
5250 		    hw_req->req.n_ssids, hw_req->req.n_channels,
5251 		    hw_req->ies.common_ie_len,
5252 		    hw_req->ies.len[NL80211_BAND_2GHZ],
5253 		    hw_req->ies.len[NL80211_BAND_5GHZ]);
5254 
5255 		error = lkpi_80211_mo_hw_scan(hw, vif, hw_req);
5256 		wiphy_unlock(hw->wiphy);
5257 		if (error != 0) {
5258 			bool scan_done;
5259 			int e;
5260 
5261 			TRACE_SCAN(ic, "hw_scan failed; scan_flags %b, error %d",
5262 			    lhw->scan_flags, LKPI_LHW_SCAN_BITS, error);
5263 			ieee80211_cancel_scan(vap);
5264 
5265 			/*
5266 			 * ieee80211_scan_completed must be called in either
5267 			 * case of error or none.  So let the free happen there
5268 			 * and only there.
5269 			 * That would be fine in theory but in practice drivers
5270 			 * behave differently:
5271 			 * ath10k does not return hw_scan until after scan_complete
5272 			 *        and can then still return an error.
5273 			 * rtw88 can return 1 or -EBUSY without scan_complete
5274 			 * iwlwifi can return various errors before scan starts
5275 			 * ...
5276 			 * So we cannot rely on that behaviour and have to check
5277 			 * and balance between both code paths.
5278 			 */
5279 			e = 0;
5280 			scan_done = true;
5281 			LKPI_80211_LHW_SCAN_LOCK(lhw);
5282 			if ((lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0) {
5283 
5284 				free(lhw->hw_req, M_LKPI80211);
5285 				lhw->hw_req = NULL;
5286 				/*
5287 				 * The ieee80211_cancel_scan() above runs in a
5288 				 * taskq and it may take ages for the previous
5289 				 * scan to clear;  starting a new one right away
5290 				 * we run into the problem that the old one is
5291 				 * still active.
5292 				 */
5293 				e = msleep(lhw, &lhw->scan_mtx, 0, "lhwscanstop", hz);
5294 				scan_done = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
5295 
5296 				/*
5297 				 * Now we can clear running if no one else did.
5298 				 */
5299 				lhw->scan_flags &= ~LKPI_LHW_SCAN_RUNNING;
5300 			}
5301 			LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5302 			lkpi_update_mcast_filter(ic);
5303 			if (!scan_done) {
5304 				ic_printf(ic, "ERROR: %s: timeout/error to wait "
5305 				    "for ieee80211_cancel_scan: %d\n", __func__, e);
5306 				return;
5307 			}
5308 
5309 			/*
5310 			 * XXX-SIGH magic number.
5311 			 * rtw88 has a magic "return 1" if offloading scan is
5312 			 * not possible.  Fall back to sw scan in that case.
5313 			 */
5314 			if (error == 1) {
5315 				/*
5316 				 * We need to put this into some defered context
5317 				 * the net80211 scan may not be done yet
5318 				 * (ic_flags & IEEE80211_F_SCAN) and we cannot
5319 				 * wait here; if we do scan_curchan_task always
5320 				 * runs after our timeout to finalize the scan.
5321 				 */
5322 				ieee80211_runtask(ic, &lvif->sw_scan_task);
5323 				return;
5324 			}
5325 
5326 			ic_printf(ic, "ERROR: %s: hw_scan returned %d\n",
5327 			    __func__, error);
5328 		}
5329 	}
5330 }
5331 
5332 static void
5333 lkpi_sw_scan_task(void *arg, int pending __unused)
5334 {
5335 	struct lkpi_hw *lhw;
5336 	struct lkpi_vif *lvif;
5337 	struct ieee80211vap *vap;
5338 	struct ieee80211_scan_state *ss;
5339 
5340 	lvif = arg;
5341 	vap = LVIF_TO_VAP(lvif);
5342 	lhw = vap->iv_ic->ic_softc;
5343 	ss = vap->iv_ic->ic_scan;
5344 
5345 	LKPI_80211_LHW_SCAN_LOCK(lhw);
5346 	/*
5347 	 * We will re-enable this at scan_end calling lkpi_enable_hw_scan().
5348 	 * IEEE80211_FEXT_SCAN_OFFLOAD will be cleared by lkpi_ic_scan_start.
5349 	 */
5350 	lhw->scan_flags &= ~LKPI_LHW_SCAN_HW;
5351 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5352 
5353 	TRACE_SCAN(vap->iv_ic, "Triggering SW_SCAN: pending %d, scan_flags %b",
5354 	    pending, lhw->scan_flags, LKPI_LHW_SCAN_BITS);
5355 
5356 	/*
5357 	 * This will call ic_scan_start() and we will get into the right path
5358 	 * unless other scans started in between.
5359 	 */
5360 	ieee80211_start_scan(vap,
5361 	    IEEE80211_SCAN_ONCE,
5362 	    msecs_to_ticks(10000), /* 10000 ms (=~ 50 chan * 200 ms) */
5363 	    ss->ss_mindwell ? ss->ss_mindwell : msecs_to_ticks(20),
5364 	    ss->ss_maxdwell ? ss->ss_maxdwell : msecs_to_ticks(200),
5365 	    vap->iv_des_nssid, vap->iv_des_ssid);
5366 }
5367 
5368 static void
5369 lkpi_ic_scan_end(struct ieee80211com *ic)
5370 {
5371 	struct lkpi_hw *lhw;
5372 	bool is_hw_scan;
5373 
5374 	lhw = ic->ic_softc;
5375 	TRACE_SCAN(ic, "scan_flags %b", lhw->scan_flags, LKPI_LHW_SCAN_BITS);
5376 
5377 	LKPI_80211_LHW_SCAN_LOCK(lhw);
5378 	if ((lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) == 0) {
5379 		LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5380 		return;
5381 	}
5382 	is_hw_scan = (lhw->scan_flags & LKPI_LHW_SCAN_HW) != 0;
5383 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5384 
5385 	if (!is_hw_scan) {
5386 		struct ieee80211_scan_state *ss;
5387 		struct ieee80211vap *vap;
5388 		struct ieee80211_hw *hw;
5389 		struct lkpi_vif *lvif;
5390 		struct ieee80211_vif *vif;
5391 
5392 		ss = ic->ic_scan;
5393 		vap = ss->ss_vap;
5394 		hw = LHW_TO_HW(lhw);
5395 		lvif = VAP_TO_LVIF(vap);
5396 		vif = LVIF_TO_VIF(lvif);
5397 
5398 		lkpi_80211_mo_sw_scan_complete(hw, vif);
5399 
5400 		/* Send PS to stop buffering if n80211 does not for us? */
5401 
5402 		if (vap->iv_state == IEEE80211_S_SCAN) {
5403 			wiphy_lock(hw->wiphy);
5404 			lkpi_hw_conf_idle(hw, true);
5405 			wiphy_unlock(hw->wiphy);
5406 		}
5407 	}
5408 
5409 	/*
5410 	 * In case we disabled the hw_scan in lkpi_ic_scan_start() and
5411 	 * switched to swscan, re-enable hw_scan if available.
5412 	 */
5413 	lkpi_enable_hw_scan(lhw);
5414 
5415 	/* Clear the scanning chandef. */
5416 	memset(&lhw->scan_chandef, 0, sizeof(lhw->scan_chandef));
5417 
5418 	LKPI_80211_LHW_SCAN_LOCK(lhw);
5419 	wakeup(lhw);
5420 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5421 }
5422 
5423 static void
5424 lkpi_ic_scan_curchan(struct ieee80211_scan_state *ss,
5425     unsigned long maxdwell)
5426 {
5427 	struct lkpi_hw *lhw;
5428 	bool is_hw_scan;
5429 
5430 	lhw = ss->ss_ic->ic_softc;
5431 	TRACE_SCAN(ss->ss_ic, "scan_flags %b chan %d maxdwell %lu",
5432 	    lhw->scan_flags, LKPI_LHW_SCAN_BITS,
5433 	    ss->ss_ic->ic_curchan->ic_ieee, maxdwell);
5434 
5435 	LKPI_80211_LHW_SCAN_LOCK(lhw);
5436 	is_hw_scan = (lhw->scan_flags & LKPI_LHW_SCAN_HW) != 0;
5437 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5438 	if (!is_hw_scan)
5439 		lhw->ic_scan_curchan(ss, maxdwell);
5440 }
5441 
5442 static void
5443 lkpi_ic_scan_mindwell(struct ieee80211_scan_state *ss)
5444 {
5445 	struct lkpi_hw *lhw;
5446 	bool is_hw_scan;
5447 
5448 	lhw = ss->ss_ic->ic_softc;
5449 	TRACE_SCAN(ss->ss_ic, "scan_flags %b chan %d mindwell %lu",
5450 	    lhw->scan_flags, LKPI_LHW_SCAN_BITS,
5451 	    ss->ss_ic->ic_curchan->ic_ieee, ss->ss_mindwell);
5452 
5453 	LKPI_80211_LHW_SCAN_LOCK(lhw);
5454 	is_hw_scan = (lhw->scan_flags & LKPI_LHW_SCAN_HW) != 0;
5455 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5456 	if (!is_hw_scan)
5457 		lhw->ic_scan_mindwell(ss);
5458 }
5459 
5460 struct lkpi_ic_set_channel_iter_arg {
5461 	struct linuxkpi_ieee80211_channel *chan;
5462 	struct ieee80211_chanctx_conf *chanctx_conf;
5463 };
5464 
5465 static void
5466 lkpi_ic_set_channel_chanctx_iterf(struct ieee80211_hw *hw,
5467     struct ieee80211_chanctx_conf *chanctx_conf, void *arg)
5468 {
5469 	struct lkpi_ic_set_channel_iter_arg *chanctx_iter_arg;
5470 
5471 	chanctx_iter_arg = arg;
5472 	if (chanctx_iter_arg->chanctx_conf != NULL)
5473 		return;
5474 
5475 	if (chanctx_iter_arg->chan == chanctx_conf->def.chan)
5476 		chanctx_iter_arg->chanctx_conf = chanctx_conf;
5477 }
5478 
5479 static void
5480 lkpi_ic_set_channel(struct ieee80211com *ic)
5481 {
5482 	struct lkpi_hw *lhw;
5483 	struct ieee80211_hw *hw;
5484 	struct ieee80211_channel *c;
5485 	struct linuxkpi_ieee80211_channel *chan;
5486 	struct ieee80211_chanctx_conf *chanctx_conf;
5487 	uint32_t changed;
5488 	int error;
5489 	bool hw_scan, scan_running;
5490 
5491 	IEEE80211_UNLOCK_ASSERT(ic);
5492 
5493 	lhw = ic->ic_softc;
5494 
5495 	c = ic->ic_curchan;
5496 	if (c == NULL || c == IEEE80211_CHAN_ANYC) {
5497 		ic_printf(ic, "%s: Unset channel: c %p, ignoring update\n",
5498 		    __func__, c);
5499 		return;
5500 	}
5501 
5502 	chan = lkpi_find_lkpi80211_chan(lhw, c);
5503 	if (chan == NULL) {
5504 		ic_printf(ic, "%s: No channel found for c %p(%d) chan %p\n",
5505 		    __func__, c, c->ic_ieee, chan);
5506 		return;
5507 	}
5508 
5509 	/*
5510 	 * All net80211 callers call ieee80211_radiotap_chan_change().
5511 	 * That means we have nothing to do ourselves.
5512 	 */
5513 
5514 	/* If we have a hw_scan running do not switch channels. */
5515 	LKPI_80211_LHW_SCAN_LOCK(lhw);
5516 	scan_running = (lhw->scan_flags & LKPI_LHW_SCAN_RUNNING) != 0;
5517 	hw_scan = (lhw->scan_flags & LKPI_LHW_SCAN_HW) != 0;
5518 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
5519 	if (scan_running && hw_scan) {
5520 		TRACE_SCAN(ic, "scan_flags %b chan %d nothing to do.",
5521 		    lhw->scan_flags, LKPI_LHW_SCAN_BITS,
5522 		    c->ic_ieee);
5523 		/* Let us hope we set tx power levels elsewhere. */
5524 		return;
5525 	}
5526 
5527 	hw = LHW_TO_HW(lhw);
5528 	wiphy_lock(hw->wiphy);
5529 	if (scan_running) {
5530 		struct ieee80211vap *vap;
5531 		struct lkpi_vif *lvif;
5532 		struct ieee80211_vif *vif;
5533 
5534 		/*
5535 		 * For now and for scanning just pick the first VIF.
5536 		 * net80211 will need to grow DBDC/link_id support
5537 		 * for us to find the vif/chanctx otherwise.
5538 		 */
5539 		vap = TAILQ_FIRST(&ic->ic_vaps);
5540 		lvif = VAP_TO_LVIF(vap);
5541 		vif = LVIF_TO_VIF(lvif);
5542 
5543 		/* We always set the chandef to no-HT for scanning. */
5544 		cfg80211_chandef_create(&lhw->scan_chandef, chan,
5545 		    NL80211_CHAN_NO_HT);
5546 #ifdef LINUXKPI_DEBUG_80211
5547 		if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
5548 			ic_printf(ic, "%s:%d: initialized lhw->scan_chandef\n",
5549 			    __func__, __LINE__);
5550 #endif
5551 
5552 		/*
5553 		 * This works for as long as we do not do BGSCANs; otherwise
5554 		 * it'll have to be offchan work.
5555 		 */
5556 		chanctx_conf = lkpi_get_chanctx_conf(hw, vif);
5557 		changed = lkpi_init_chanctx_conf(hw, &lhw->scan_chandef, chanctx_conf);
5558 		error = lkpi_set_chanctx_conf(hw, vif, chanctx_conf, changed, true);
5559 
5560 		TRACE_SCAN(ic, "scan_flags %b chan %d ???, error %d",
5561 		    lhw->scan_flags, LKPI_LHW_SCAN_BITS,
5562 		    c->ic_ieee, error);
5563 
5564 		IMPROVE("max power for scanning; TODO in lkpi_80211_update_chandef");
5565 
5566 	} else if (lhw->emulate_chanctx) {
5567 		/*
5568 		 * We do not set the channel here for normal chanctx operation.
5569 		 * That's just a setup to fail. scan_to_auth will setup all the
5570 		 * other neccessary options for this to work.
5571 		 */
5572 		struct lkpi_ic_set_channel_iter_arg chanctx_iter_arg = {
5573 			.chan		= chan,
5574 			.chanctx_conf	= NULL,
5575 		};
5576 		struct cfg80211_chan_def chandef;
5577 
5578 		lkpi_init_chandef(ic, &chandef, chan, c, false);
5579 
5580 		ieee80211_iter_chan_contexts_mtx(hw,
5581 		    lkpi_ic_set_channel_chanctx_iterf, &chanctx_iter_arg);
5582 
5583 		if (chanctx_iter_arg.chanctx_conf == NULL) {
5584 			/* No chanctx found for this channel. */
5585 			struct ieee80211vap *vap;
5586 			struct lkpi_vif *lvif;
5587 			struct ieee80211_vif *vif;
5588 
5589 			/*
5590 			 * For now just pick the first VIF.
5591 			 * net80211 will need to grow DBDC/link_id support
5592 			 * for us to find the vif/chanctx otherwise.
5593 			 */
5594 			vap = TAILQ_FIRST(&ic->ic_vaps);
5595 			lvif = VAP_TO_LVIF(vap);
5596 			vif = LVIF_TO_VIF(lvif);
5597 
5598 #ifdef LINUXKPI_DEBUG_80211
5599 			if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
5600 				ic_printf(ic, "%s:%d: using on stack chandef\n",
5601 				    __func__, __LINE__);
5602 #endif
5603 			chanctx_conf = lkpi_get_chanctx_conf(hw, vif);
5604 			changed = lkpi_init_chanctx_conf(hw, &chandef, chanctx_conf);
5605 			IMPROVE("update HT, VHT, bw, ...");
5606 			error = lkpi_set_chanctx_conf(hw, vif, chanctx_conf, changed, true);
5607 
5608 		} else {
5609 			/*
5610 			 * We know we are on the same channel.
5611 			 * Do we really have to reset everything?
5612 			 */
5613 			IMPROVE("update HT, VHT, bw, ...");
5614 
5615 #ifdef LINUXKPI_DEBUG_80211
5616 			if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
5617 				ic_printf(ic, "%s:%d: using on stack chandef\n",
5618 				    __func__, __LINE__);
5619 #endif
5620 
5621 			chanctx_conf = chanctx_iter_arg.chanctx_conf;
5622 			changed = lkpi_init_chanctx_conf(hw, &chandef, chanctx_conf);
5623 			lkpi_80211_mo_change_chanctx(hw, chanctx_conf, changed);
5624 		}
5625 	}
5626 
5627 	/* Currently PS is hard coded off! Not sure it belongs here. */
5628 	IMPROVE("PS");
5629 	if (ieee80211_hw_check(hw, SUPPORTS_PS) &&
5630 	    (hw->conf.flags & IEEE80211_CONF_PS) != 0) {
5631 		hw->conf.flags &= ~IEEE80211_CONF_PS;
5632 		error = lkpi_80211_mo_config(hw, IEEE80211_CONF_CHANGE_PS);
5633 		if (error != 0 && error != EOPNOTSUPP)
5634 			ic_printf(ic, "ERROR: %s: config %#0x returned "
5635 			    "%d\n", __func__, IEEE80211_CONF_CHANGE_PS,
5636 			    error);
5637 	}
5638 
5639 	wiphy_unlock(hw->wiphy);
5640 }
5641 
5642 static struct ieee80211_node *
5643 lkpi_ic_node_alloc(struct ieee80211vap *vap,
5644     const uint8_t mac[IEEE80211_ADDR_LEN])
5645 {
5646 	struct ieee80211com *ic;
5647 	struct lkpi_hw *lhw;
5648 	struct ieee80211_node *ni;
5649 	struct ieee80211_hw *hw;
5650 	struct lkpi_sta *lsta;
5651 
5652 	ic = vap->iv_ic;
5653 	lhw = ic->ic_softc;
5654 
5655 	/* We keep allocations de-coupled so we can deal with the two worlds. */
5656 	if (lhw->ic_node_alloc == NULL)
5657 		return (NULL);
5658 
5659 	ni = lhw->ic_node_alloc(vap, mac);
5660 	if (ni == NULL)
5661 		return (NULL);
5662 
5663 	hw = LHW_TO_HW(lhw);
5664 	lsta = lkpi_lsta_alloc(vap, mac, hw, ni);
5665 	if (lsta == NULL) {
5666 		if (lhw->ic_node_free != NULL)
5667 			lhw->ic_node_free(ni);
5668 		return (NULL);
5669 	}
5670 
5671 	return (ni);
5672 }
5673 
5674 static int
5675 lkpi_ic_node_init(struct ieee80211_node *ni)
5676 {
5677 	struct ieee80211com *ic;
5678 	struct lkpi_hw *lhw;
5679 	int error;
5680 
5681 	ic = ni->ni_ic;
5682 	lhw = ic->ic_softc;
5683 
5684 	if (lhw->ic_node_init != NULL) {
5685 		error = lhw->ic_node_init(ni);
5686 		if (error != 0)
5687 			return (error);
5688 	}
5689 
5690 	/* XXX-BZ Sync other state over. */
5691 	IMPROVE();
5692 
5693 	return (0);
5694 }
5695 
5696 static void
5697 lkpi_ic_node_cleanup(struct ieee80211_node *ni)
5698 {
5699 	struct ieee80211com *ic;
5700 	struct lkpi_hw *lhw;
5701 
5702 	ic = ni->ni_ic;
5703 	lhw = ic->ic_softc;
5704 
5705 	/* XXX-BZ remove from driver, ... */
5706 	IMPROVE();
5707 
5708 	if (lhw->ic_node_cleanup != NULL)
5709 		lhw->ic_node_cleanup(ni);
5710 }
5711 
5712 static void
5713 lkpi_ic_node_free(struct ieee80211_node *ni)
5714 {
5715 	struct ieee80211com *ic;
5716 	struct lkpi_hw *lhw;
5717 	struct lkpi_sta *lsta;
5718 
5719 	ic = ni->ni_ic;
5720 	lhw = ic->ic_softc;
5721 	lsta = ni->ni_drv_data;
5722 
5723 	/* KASSERT lsta is not NULL here. Print ni/ni__refcnt. */
5724 
5725 	/*
5726 	 * Pass in the original ni just in case of error we could check that
5727 	 * it is the same as lsta->ni.
5728 	 */
5729 	lkpi_lsta_free(lsta, ni);
5730 
5731 	if (lhw->ic_node_free != NULL)
5732 		lhw->ic_node_free(ni);
5733 }
5734 
5735 /*
5736  * lkpi_xmit() called from both the (*ic_raw_xmit) as well as the (*ic_transmit)
5737  * call path.
5738  * Unfortunately they have slightly different invariants.  See
5739  * ieee80211_raw_output() and ieee80211_parent_xmitpkt().
5740  * Both take care of the ni reference in case of error, and otherwise during
5741  * the callback after transmit.
5742  * The difference is that in case of error (*ic_raw_xmit) needs us to release
5743  * the mbuf, while (*ic_transmit) will free the mbuf itself.
5744  */
5745 static int
5746 lkpi_xmit(struct ieee80211_node *ni, struct mbuf *m,
5747     const struct ieee80211_bpf_params *params __unused,
5748     bool freem)
5749 {
5750 	struct lkpi_sta *lsta;
5751 	int error;
5752 
5753 	lsta = ni->ni_drv_data;
5754 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
5755 #if 0
5756 	if (!lsta->added_to_drv || !lsta->txq_ready) {
5757 #else
5758 	/*
5759 	 * Backout this part of 886653492945f which breaks rtw88 or
5760 	 * in general drivers without (*sta_state)() but only the
5761 	 * legacy fallback to (*sta_add)().
5762 	 */
5763 	if (!lsta->txq_ready) {
5764 #endif
5765 		LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
5766 		if (freem)
5767 			m_freem(m);
5768 		return (ENETDOWN);
5769 	}
5770 
5771 	/* Queue the packet and enqueue the task to handle it. */
5772 	error = mbufq_enqueue(&lsta->txq, m);
5773 	if (error != 0) {
5774 		LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
5775 		if (freem)
5776 			m_freem(m);
5777 #ifdef LINUXKPI_DEBUG_80211
5778 		if (linuxkpi_debug_80211 & D80211_TRACE_TX)
5779 			ic_printf(ni->ni_ic, "%s: mbufq_enqueue failed: %d\n",
5780 			    __func__, error);
5781 #endif
5782 		return (ENETDOWN);
5783 	}
5784 	taskqueue_enqueue(taskqueue_thread, &lsta->txq_task);
5785 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
5786 
5787 #ifdef LINUXKPI_DEBUG_80211
5788 	if (linuxkpi_debug_80211 & D80211_TRACE_TX)
5789 		printf("%s:%d lsta %p ni %p %6D mbuf_qlen %d\n",
5790 		    __func__, __LINE__, lsta, ni, ni->ni_macaddr, ":",
5791 		    mbufq_len(&lsta->txq));
5792 #endif
5793 
5794 	return (0);
5795 }
5796 
5797 static int
5798 lkpi_ic_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
5799         const struct ieee80211_bpf_params *params __unused)
5800 {
5801 	return (lkpi_xmit(ni, m, NULL, true));
5802 }
5803 
5804 #ifdef LKPI_80211_HW_CRYPTO
5805 /*
5806  * This is a bit of a hack given we know we are operating on a
5807  * single frame and we know that hardware will deal with it.
5808  * But otherwise the enmic bit and the encrypt bit need to be
5809  * decoupled.
5810  */
5811 static int
5812 lkpi_hw_crypto_prepare_tkip(struct ieee80211_key *k,
5813     struct ieee80211_key_conf *kc, struct sk_buff *skb)
5814 {
5815 	struct ieee80211_hdr *hdr;
5816 	uint32_t hlen, hdrlen;
5817 	uint8_t *p;
5818 
5819 	/*
5820 	 * TKIP only happens on data.
5821 	 */
5822 	hdr = (void *)skb->data;
5823 	if (!ieee80211_is_data_present(hdr->frame_control))
5824 		return (0);
5825 
5826 	/*
5827 	 * "enmic" (though we do not do that).
5828 	 */
5829 	/* any conditions to not apply this? */
5830 	if (skb_tailroom(skb) < ieee80211_crypto_get_key_txmic_len(k))
5831 		return (ENOBUFS);
5832 
5833 	p = skb_put(skb, ieee80211_crypto_get_key_txmic_len(k));
5834 	if ((kc->flags & IEEE80211_KEY_FLAG_PUT_MIC_SPACE) != 0)
5835 		goto encrypt;
5836 
5837 	/*
5838 	 * (*enmic) which we hopefully do not have to do with hw accel.
5839 	 * That means if we make it here we have a problem.
5840 	 */
5841 	TODO("(*enmic)");
5842 	return (ENXIO);
5843 
5844 encrypt:
5845 	/*
5846 	 * "encrypt" (though we do not do that).
5847 	 */
5848 	/*
5849 	 * Check if we have anything to do as requested by driver
5850 	 * or if we are done?
5851 	 */
5852 	if ((kc->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) == 0 &&
5853 	    (kc->flags & IEEE80211_KEY_FLAG_GENERATE_IV) == 0)
5854 			return (0);
5855 
5856 	hlen = k->wk_cipher->ic_header;
5857 	if (skb_headroom(skb) < hlen)
5858 		return (ENOBUFS);
5859 
5860 	hdr = (void *)skb->data;
5861 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
5862 	p = skb_push(skb, hlen);
5863 	memmove(p, p + hlen, hdrlen);
5864 
5865 	/* If driver request space only we are done. */
5866 	if ((kc->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) != 0)
5867 		return (0);
5868 
5869 	p += hdrlen;
5870 	k->wk_cipher->ic_setiv(k, p);
5871 
5872 	/* If we make it hear we do sw encryption. */
5873 	TODO("sw encrypt");
5874 	return (ENXIO);
5875 }
5876 
5877 static int
5878 lkpi_hw_crypto_prepare_ccmp(struct ieee80211_key *k,
5879     struct ieee80211_key_conf *kc, struct sk_buff *skb)
5880 {
5881 	struct ieee80211_hdr *hdr;
5882 	uint32_t hlen, hdrlen;
5883 	uint8_t *p;
5884 
5885 	hdr = (void *)skb->data;
5886 
5887 	/*
5888 	 * Check if we have anythig to do as requested by driver
5889 	 * or if we are done?
5890 	 */
5891 	if ((kc->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) == 0 &&
5892 	    (kc->flags & IEEE80211_KEY_FLAG_GENERATE_IV) == 0 &&
5893 	    /* MFP */
5894 	    !((kc->flags & IEEE80211_KEY_FLAG_GENERATE_IV_MGMT) != 0 &&
5895 		ieee80211_is_mgmt(hdr->frame_control)))
5896 			return (0);
5897 
5898 	hlen = k->wk_cipher->ic_header;
5899 	if (skb_headroom(skb) < hlen)
5900 		return (ENOBUFS);
5901 
5902 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
5903 	p = skb_push(skb, hlen);
5904 	memmove(p, p + hlen, hdrlen);
5905 
5906 	/* If driver request space only we are done. */
5907 	if ((kc->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) != 0)
5908 		return (0);
5909 
5910 	p += hdrlen;
5911 	k->wk_cipher->ic_setiv(k, p);
5912 
5913 	return (0);
5914 }
5915 
5916 static int
5917 lkpi_hw_crypto_prepare(struct lkpi_sta *lsta, struct ieee80211_key *k,
5918     struct sk_buff *skb)
5919 {
5920 	struct ieee80211_tx_info *info;
5921 	struct ieee80211_key_conf *kc;
5922 
5923 	KASSERT(lsta != NULL, ("%s: lsta is NULL", __func__));
5924 	KASSERT(k != NULL, ("%s: key is NULL", __func__));
5925 	KASSERT(skb != NULL, ("%s: skb is NULL", __func__));
5926 
5927 	kc = lsta->kc[k->wk_keyix];
5928 
5929 	info = IEEE80211_SKB_CB(skb);
5930 	info->control.hw_key = kc;
5931 
5932 	/* MUST NOT happen. KASSERT? */
5933 	if (kc == NULL) {
5934 		ic_printf(lsta->ni->ni_ic, "%s: lsta %p k %p skb %p, "
5935 		    "kc is NULL on hw crypto offload\n", __func__, lsta, k, skb);
5936 		return (ENXIO);
5937 	}
5938 
5939 	switch (kc->cipher) {
5940 	case WLAN_CIPHER_SUITE_TKIP:
5941 		return (lkpi_hw_crypto_prepare_tkip(k, kc, skb));
5942 	case WLAN_CIPHER_SUITE_CCMP:
5943 		return (lkpi_hw_crypto_prepare_ccmp(k, kc, skb));
5944 	case WLAN_CIPHER_SUITE_GCMP:
5945 		return (lkpi_hw_crypto_prepare_ccmp(k, kc, skb));
5946 	case WLAN_CIPHER_SUITE_WEP40:
5947 	case WLAN_CIPHER_SUITE_WEP104:
5948 	case WLAN_CIPHER_SUITE_CCMP_256:
5949 	case WLAN_CIPHER_SUITE_GCMP_256:
5950 	case WLAN_CIPHER_SUITE_AES_CMAC:
5951 	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
5952 	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
5953 	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
5954 	default:
5955 		ic_printf(lsta->ni->ni_ic, "%s: lsta %p k %p kc %p skb %p, "
5956 		    "unsupported cipher suite %u (%s)\n", __func__, lsta, k, kc,
5957 		    skb, kc->cipher, lkpi_cipher_suite_to_name(kc->cipher));
5958 		return (EOPNOTSUPP);
5959 	}
5960 }
5961 
5962 static uint8_t
5963 lkpi_hw_crypto_tailroom(struct lkpi_sta *lsta, struct ieee80211_key *k)
5964 {
5965 	struct ieee80211_key_conf *kc;
5966 
5967 	kc = lsta->kc[k->wk_keyix];
5968 	if (kc == NULL)
5969 		return (0);
5970 
5971 	IMPROVE("which other flags need tailroom?");
5972 	if (kc->flags & (IEEE80211_KEY_FLAG_PUT_MIC_SPACE))
5973 		return (32);	/* Large enough to hold everything and pow2. */
5974 
5975 	return (0);
5976 }
5977 #endif
5978 
5979 static void
5980 lkpi_80211_txq_tx_one(struct lkpi_sta *lsta, struct mbuf *m)
5981 {
5982 	struct ieee80211_node *ni;
5983 	struct ieee80211_frame *wh;
5984 	struct ieee80211_key *k;
5985 	struct sk_buff *skb;
5986 	struct ieee80211com *ic;
5987 	struct lkpi_hw *lhw;
5988 	struct ieee80211_hw *hw;
5989 	struct lkpi_vif *lvif;
5990 	struct ieee80211_vif *vif;
5991 	struct ieee80211_channel *c;
5992 	struct ieee80211_tx_control control;
5993 	struct ieee80211_tx_info *info;
5994 	struct ieee80211_sta *sta;
5995 	struct ieee80211_hdr *hdr;
5996 	struct lkpi_txq *ltxq;
5997 	void *buf;
5998 	ieee80211_keyix keyix;
5999 	uint8_t ac, tid, tailroom;
6000 
6001 	M_ASSERTPKTHDR(m);
6002 #ifdef LINUXKPI_DEBUG_80211
6003 	if (linuxkpi_debug_80211 & D80211_TRACE_TX_DUMP)
6004 		hexdump(mtod(m, const void *), m->m_len, "RAW TX (plain) ", 0);
6005 #endif
6006 
6007 	ni = lsta->ni;
6008 	ieee80211_output_seqno_assign(ni, -1, m);
6009 
6010 	k = NULL;
6011 	keyix = IEEE80211_KEYIX_NONE;
6012 	wh = mtod(m, struct ieee80211_frame *);
6013 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
6014 
6015 #ifdef LKPI_80211_HW_CRYPTO
6016 		if (lkpi_hwcrypto) {
6017 			k = ieee80211_crypto_get_txkey(ni, m);
6018 			if (k != NULL && lsta->kc[k->wk_keyix] != NULL)
6019 				keyix = k->wk_keyix;
6020 		}
6021 #endif
6022 
6023 		/* Encrypt the frame if need be. */
6024 		if (keyix == IEEE80211_KEYIX_NONE) {
6025 			/* Retrieve key for TX && do software encryption. */
6026 			k = ieee80211_crypto_encap(ni, m);
6027 			if (k == NULL) {
6028 				ieee80211_free_node(ni);
6029 				m_freem(m);
6030 				return;
6031 			}
6032 		}
6033 	}
6034 
6035 	ic = ni->ni_ic;
6036 	lhw = ic->ic_softc;
6037 	hw = LHW_TO_HW(lhw);
6038 	c = ni->ni_chan;
6039 
6040 	if (ieee80211_radiotap_active_vap(ni->ni_vap)) {
6041 		struct lkpi_radiotap_tx_hdr *rtap;
6042 
6043 		rtap = &lhw->rtap_tx;
6044 		rtap->wt_flags = 0;
6045 		if (k != NULL)
6046 			rtap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
6047 		if (m->m_flags & M_FRAG)
6048 			rtap->wt_flags |= IEEE80211_RADIOTAP_F_FRAG;
6049 		IMPROVE();
6050 		rtap->wt_rate = 0;
6051 		if (c != NULL && c != IEEE80211_CHAN_ANYC) {
6052 			rtap->wt_chan_freq = htole16(c->ic_freq);
6053 			rtap->wt_chan_flags = htole16(c->ic_flags);
6054 		}
6055 
6056 		ieee80211_radiotap_tx(ni->ni_vap, m);
6057 	}
6058 
6059 #ifdef LKPI_80211_HW_CRYPTO
6060 	if (lkpi_hwcrypto && keyix != IEEE80211_KEYIX_NONE)
6061 		tailroom = lkpi_hw_crypto_tailroom(lsta, k);
6062 	else
6063 #endif
6064 		tailroom = 0;
6065 
6066 	/*
6067 	 * net80211 should handle hw->extra_tx_headroom.
6068 	 * Though for as long as we are copying we don't mind.
6069 	 * XXX-BZ rtw88 asks for too much headroom for ipv6+tcp:
6070 	 * https://lists.freebsd.org/archives/freebsd-transport/2022-February/000012.html
6071 	 */
6072 	skb = dev_alloc_skb(hw->extra_tx_headroom + tailroom + m->m_pkthdr.len);
6073 	if (skb == NULL) {
6074 		static uint8_t skb_alloc_failures = 0;
6075 
6076 		if (skb_alloc_failures++ == 0) {
6077 			int tid;
6078 
6079 			sta = LSTA_TO_STA(lsta);
6080 			ic_printf(ic, "ERROR %s: skb alloc failed %d + %d, lsta %p sta %p ni %p\n",
6081 			    __func__, hw->extra_tx_headroom, m->m_pkthdr.len, lsta, sta, ni);
6082 			for (tid = 0; tid < nitems(sta->txq); tid++) {
6083 				if (sta->txq[tid] == NULL)
6084 					continue;
6085 				ltxq = TXQ_TO_LTXQ(sta->txq[tid]);
6086 				ic_printf(ic, "  tid %d ltxq %p flags %b skb_queue_len %u\n",
6087 				    tid, ltxq, ltxq->flags, LKPI_TXQ_FLAGS_BITS, skb_queue_len(&ltxq->skbq));
6088 			}
6089 		}
6090 		ieee80211_free_node(ni);
6091 		m_freem(m);
6092 		return;
6093 	}
6094 	skb_reserve(skb, hw->extra_tx_headroom);
6095 
6096 	/* XXX-BZ we need a SKB version understanding mbuf. */
6097 	/* Save the mbuf for ieee80211_tx_complete(). */
6098 	skb->m_free_func = lkpi_ieee80211_free_skb_mbuf;
6099 	skb->m = m;
6100 #if 0
6101 	skb_put_data(skb, m->m_data, m->m_pkthdr.len);
6102 #else
6103 	buf = skb_put(skb, m->m_pkthdr.len);
6104 	m_copydata(m, 0, m->m_pkthdr.len, buf);
6105 #endif
6106 	/* Save the ni. */
6107 	m->m_pkthdr.PH_loc.ptr = ni;
6108 
6109 	lvif = VAP_TO_LVIF(ni->ni_vap);
6110 	vif = LVIF_TO_VIF(lvif);
6111 
6112 	hdr = (void *)skb->data;
6113 	tid = linuxkpi_ieee80211_get_tid(hdr, true);
6114 	if (tid == IEEE80211_NONQOS_TID) { /* == IEEE80211_NUM_TIDS */
6115 		if (!ieee80211_is_data(hdr->frame_control)) {
6116 			/* MGMT and CTRL frames go on TID 7/VO. */
6117 			skb->priority = 7;
6118 			ac = IEEE80211_AC_VO;
6119 		} else {
6120 			/* Other non-QOS traffic goes to BE. */
6121 			/* Contrary to net80211 we MUST NOT promote M_EAPOL. */
6122 			skb->priority = 0;
6123 			ac = IEEE80211_AC_BE;
6124 		}
6125 	} else {
6126 		skb->priority = tid & IEEE80211_QOS_CTL_TID_MASK;
6127 		ac = ieee80211e_up_to_ac[tid & 7];
6128 	}
6129 	skb_set_queue_mapping(skb, ac);
6130 
6131 	info = IEEE80211_SKB_CB(skb);
6132 	info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
6133 	/* Slight delay; probably only happens on scanning so fine? */
6134 	if (c == NULL || c == IEEE80211_CHAN_ANYC)
6135 		c = ic->ic_curchan;
6136 	info->band = lkpi_net80211_chan_to_nl80211_band(c);
6137 	info->hw_queue = vif->hw_queue[ac];
6138 	if ((m->m_flags & M_EAPOL) != 0) {
6139 		info->control.flags |= IEEE80211_TX_CTRL_PORT_CTRL_PROTO;
6140 		info->flags |= IEEE80211_TX_CTL_USE_MINRATE;	/* mt76 */
6141 		TRACE_RATES("M_EAPOL -> TX_CTL_USE_MINRATE");
6142 	}
6143 	info->control.vif = vif;
6144 
6145 	/* IMPROVE("MLO"); */
6146 	info->control.flags |=
6147 	    u32_encode_bits(IEEE80211_LINK_UNSPECIFIED, IEEE80211_TX_CTRL_MLO_LINK);
6148 
6149 	if (tid != IEEE80211_NONQOS_TID) {
6150 		struct ieee80211_tx_ampdu *tap;
6151 
6152 		tap = &ni->ni_tx_ampdu[tid];
6153 		if (ieee80211_is_data_qos(hdr->frame_control) &&
6154 		    !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
6155 		    !is_multicast_ether_addr(hdr->addr1) &&
6156 		    IEEE80211_AMPDU_RUNNING(tap))
6157 			info->flags |= IEEE80211_TX_CTL_AMPDU;
6158 	}
6159 
6160 	/* XXX-BZ info->control.rates for non-HW rate control and injected packets. */
6161 #ifdef __notyet__
6162 #ifdef LKPI_80211_HT
6163 	info->control.rts_cts_rate_idx=
6164 	info->control.use_rts= /* RTS */
6165 	info->control.use_cts_prot= /* RTS/CTS*/
6166 #endif
6167 #endif
6168 
6169 	sta = LSTA_TO_STA(lsta);
6170 #ifdef LKPI_80211_HW_CRYPTO
6171 	if (lkpi_hwcrypto && keyix != IEEE80211_KEYIX_NONE) {
6172 		int error;
6173 
6174 		error = lkpi_hw_crypto_prepare(lsta, k, skb);
6175 		if (error != 0) {
6176 			/*
6177 			 * We only have to free the skb which will free the
6178 			 * mbuf and release the reference on the ni.
6179 			 */
6180 			dev_kfree_skb(skb);
6181 			return;
6182 		}
6183 		/* Reset header as data might have moved. */
6184 		hdr = (void *)skb->data;
6185 	}
6186 #endif
6187 
6188 	IMPROVE();
6189 
6190 	ltxq = NULL;
6191 	if (!ieee80211_is_data_present(hdr->frame_control)) {
6192 		if (vif->type == NL80211_IFTYPE_STATION &&
6193 		    lsta->added_to_drv &&
6194 		    sta->txq[IEEE80211_NUM_TIDS] != NULL)
6195 			ltxq = TXQ_TO_LTXQ(sta->txq[IEEE80211_NUM_TIDS]);
6196 	} else if (lsta->added_to_drv &&
6197 	    sta->txq[skb->priority] != NULL) {
6198 		ltxq = TXQ_TO_LTXQ(sta->txq[skb->priority]);
6199 	}
6200 	if (ltxq == NULL)
6201 		goto ops_tx;
6202 
6203 	KASSERT(ltxq != NULL, ("%s: lsta %p sta %p m %p skb %p "
6204 	    "ltxq %p != NULL\n", __func__, lsta, sta, m, skb, ltxq));
6205 
6206 	LKPI_80211_LTXQ_LOCK(ltxq);
6207 	skb_queue_tail(&ltxq->skbq, skb);
6208 	ltxq->frms_enqueued++;
6209 #ifdef LINUXKPI_DEBUG_80211
6210 	if (linuxkpi_debug_80211 & D80211_TRACE_TX)
6211 		printf("%s:%d mo_wake_tx_queue :: %d %lu lsta %p sta %p "
6212 		    "ni %p %6D skb %p lxtq %p { qlen %u, ac %d tid %u } "
6213 		    "WAKE_TX_Q ac %d prio %u qmap %u\n",
6214 		    __func__, __LINE__,
6215 		    curthread->td_tid, jiffies,
6216 		    lsta, sta, ni, ni->ni_macaddr, ":", skb, ltxq,
6217 		    skb_queue_len(&ltxq->skbq), ltxq->txq.ac,
6218 		    ltxq->txq.tid, ac, skb->priority, skb->qmap);
6219 #endif
6220 	LKPI_80211_LTXQ_UNLOCK(ltxq);
6221 	wiphy_lock(hw->wiphy);
6222 	lkpi_80211_mo_wake_tx_queue(hw, &ltxq->txq, true);
6223 	wiphy_unlock(hw->wiphy);
6224 	return;
6225 
6226 ops_tx:
6227 #ifdef LINUXKPI_DEBUG_80211
6228 	if (linuxkpi_debug_80211 & D80211_TRACE_TX)
6229 		printf("%s:%d mo_tx :: lsta %p { added_to_drv %d } sta %p "
6230 		    "ni %p %6D skb %p TX ac %d prio %u qmap %u\n",
6231 		    __func__, __LINE__, lsta, lsta->added_to_drv, sta,
6232 		    ni, ni->ni_macaddr, ":", skb, ac, skb->priority, skb->qmap);
6233 #endif
6234 	memset(&control, 0, sizeof(control));
6235 	if (lsta->added_to_drv)
6236 		control.sta = sta;
6237 	wiphy_lock(hw->wiphy);
6238 	lkpi_80211_mo_tx(hw, &control, skb);
6239 	lsta->frms_tx++;
6240 	wiphy_unlock(hw->wiphy);
6241 }
6242 
6243 static void
6244 lkpi_80211_txq_task(void *ctx, int pending)
6245 {
6246 	struct lkpi_sta *lsta;
6247 	struct mbufq mq;
6248 	struct mbuf *m;
6249 	bool shall_tx;
6250 
6251 	lsta = ctx;
6252 
6253 #ifdef LINUXKPI_DEBUG_80211
6254 	if (linuxkpi_debug_80211 & D80211_TRACE_TX)
6255 		printf("%s:%d lsta %p ni %p %6D pending %d mbuf_qlen %d\n",
6256 		    __func__, __LINE__, lsta, lsta->ni, lsta->ni->ni_macaddr, ":",
6257 		    pending, mbufq_len(&lsta->txq));
6258 #endif
6259 
6260 	mbufq_init(&mq, IFQ_MAXLEN);
6261 
6262 	LKPI_80211_LSTA_TXQ_LOCK(lsta);
6263 	/*
6264 	 * Do not re-check lsta->txq_ready here; we may have a pending
6265 	 * disassoc/deauth frame still.  On the contrary if txq_ready is
6266 	 * false we do not have a valid sta anymore in the firmware so no
6267 	 * point to try to TX.
6268 	 * We also use txq_ready as a semaphore and will drain the txq manually
6269 	 * if needed on our way towards SCAN/INIT in the state machine.
6270 	 */
6271 #if 0
6272 	shall_tx = lsta->added_to_drv && lsta->txq_ready;
6273 #else
6274 	/*
6275 	 * Backout this part of 886653492945f which breaks rtw88 or
6276 	 * in general drivers without (*sta_state)() but only the
6277 	 * legacy fallback to (*sta_add)().
6278 	 */
6279 	shall_tx = lsta->txq_ready;
6280 #endif
6281 	if (__predict_true(shall_tx))
6282 		mbufq_concat(&mq, &lsta->txq);
6283 	/*
6284 	 * else a state change will push the packets out manually or
6285 	 * lkpi_lsta_free() will drain the lsta->txq and free the mbufs.
6286 	 */
6287 	LKPI_80211_LSTA_TXQ_UNLOCK(lsta);
6288 
6289 	m = mbufq_dequeue(&mq);
6290 	while (m != NULL) {
6291 		lkpi_80211_txq_tx_one(lsta, m);
6292 		m = mbufq_dequeue(&mq);
6293 	}
6294 }
6295 
6296 static int
6297 lkpi_ic_transmit(struct ieee80211com *ic, struct mbuf *m)
6298 {
6299 
6300 	/* XXX TODO */
6301 	IMPROVE();
6302 
6303 	/* Quick and dirty cheating hack. */
6304 	struct ieee80211_node *ni;
6305 
6306 	ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
6307 	return (lkpi_xmit(ni, m, NULL, false));
6308 }
6309 
6310 #ifdef LKPI_80211_HT
6311 static int
6312 lkpi_ic_recv_action(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
6313     const uint8_t *frm, const uint8_t *efrm)
6314 {
6315 	struct ieee80211com *ic;
6316 	struct lkpi_hw *lhw;
6317 
6318 	ic = ni->ni_ic;
6319 	lhw = ic->ic_softc;
6320 
6321 	TRACEOK("recv_action called");
6322 
6323 	return (lhw->ic_recv_action(ni, wh, frm, efrm));
6324 }
6325 
6326 static int
6327 lkpi_ic_send_action(struct ieee80211_node *ni, int category, int action, void *sa)
6328 {
6329 	struct ieee80211com *ic;
6330 	struct lkpi_hw *lhw;
6331 
6332 	ic = ni->ni_ic;
6333 	lhw = ic->ic_softc;
6334 
6335 	TRACEOK("send_action with action %d called", action);
6336 
6337 	return (lhw->ic_send_action(ni, category, action, sa));
6338 }
6339 
6340 
6341 static int
6342 lkpi_ic_ampdu_enable(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
6343 {
6344 	struct ieee80211com *ic;
6345 	struct lkpi_hw *lhw;
6346 
6347 	ic = ni->ni_ic;
6348 	lhw = ic->ic_softc;
6349 
6350 	TRACEOK("ieee80211_ampdu_enable called");
6351 
6352 	return (lhw->ic_ampdu_enable(ni, tap));
6353 }
6354 
6355 /*
6356  * (*ic_addba_request)() is called by ieee80211_ampdu_request() before
6357  * calling send_action(CAT_BA, BA_ADDBA_REQUEST).
6358  *
6359  * NB: returns 0 on ERROR!
6360  */
6361 static int
6362 lkpi_ic_addba_request(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap,
6363     int dialogtoken, int baparamset, int batimeout)
6364 {
6365 	struct ieee80211com *ic;
6366 	struct lkpi_hw *lhw;
6367 	struct ieee80211_hw *hw;
6368 	struct ieee80211vap *vap;
6369 	struct lkpi_vif *lvif;
6370 	struct ieee80211_vif *vif;
6371 	struct lkpi_sta *lsta;
6372 	struct ieee80211_sta *sta;
6373 	struct ieee80211_ampdu_params params = { };
6374 	int error;
6375 
6376 	ic = ni->ni_ic;
6377 	lhw = ic->ic_softc;
6378 	hw = LHW_TO_HW(lhw);
6379 	vap = ni->ni_vap;
6380 	lvif = VAP_TO_LVIF(vap);
6381 	vif = LVIF_TO_VIF(lvif);
6382 	lsta = ni->ni_drv_data;
6383 	sta = LSTA_TO_STA(lsta);
6384 
6385 	TRACEOK("ADDBA REQ tid %u", tap->txa_tid);
6386 
6387 	if (!lsta->added_to_drv) {
6388 		ic_printf(ic, "%s: lsta %p ni %p, sta %p not added to firmware\n",
6389 		    __func__, lsta, ni, sta);
6390 		return (0);
6391 	}
6392 
6393 	params.sta = sta;
6394 	params.action = IEEE80211_AMPDU_TX_START;
6395 	/* Keep 0 here! */
6396 	params.buf_size = 0;
6397 	params.timeout = 0;
6398 	params.ssn = tap->txa_start & (IEEE80211_SEQ_RANGE-1);
6399 	params.tid = tap->txa_tid;
6400 	params.amsdu = false;
6401 
6402 	/* We get called from if_transmit all the way up unlocked in net80211. */
6403 	IEEE80211_UNLOCK_ASSERT(ic);
6404 	wiphy_lock(hw->wiphy);
6405 	error = lkpi_80211_mo_ampdu_action(hw, vif, &params);
6406 	wiphy_unlock(hw->wiphy);
6407 	if (error == IEEE80211_AMPDU_TX_START_IMMEDIATE) {
6408 		ic_printf(ic, "%s: mo_ampdu_action returned AMPDU_TX_START_IMMEDIATE. "
6409 		    "ni %p tap %p\n", __func__, ni, tap);
6410 	} else if (error != 0) {
6411 		ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p tap %p\n",
6412 		    __func__, error, ni, tap);
6413 		return (0);
6414 	}
6415 
6416 	if (sta->txq[tap->txa_tid] != NULL) {
6417 		struct lkpi_txq *ltxq;
6418 
6419 		ltxq = TXQ_TO_LTXQ(sta->txq[tap->txa_tid]);
6420 		TRACEOK("ADDBA REQ ltxq tid %u flags %b qlen %d", tap->txa_tid,
6421 		    ltxq->flags, LKPI_TXQ_FLAGS_BITS, skb_queue_len(&ltxq->skbq));
6422 		ltxq->flags |= LKPI_TXQ_STOPPED_BA;
6423 	}
6424 
6425 	return (lhw->ic_addba_request(ni, tap, dialogtoken, baparamset, batimeout));
6426 }
6427 
6428 /*
6429  * (*ic_addba_response)() is called from ht_recv_action_ba_addba_response()
6430  * and calls the default ieee80211_addba_response() which always returns 1.
6431  *
6432  * NB: No error checking in net80211!
6433  * Staying with 0 is an error.
6434  */
6435 static int
6436 lkpi_ic_addba_response(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap,
6437     int status, int baparamset, int batimeout)
6438 {
6439 	struct ieee80211com *ic;
6440 	struct lkpi_hw *lhw;
6441 	struct ieee80211_hw *hw;
6442 	struct ieee80211vap *vap;
6443 	struct lkpi_vif *lvif;
6444 	struct ieee80211_vif *vif;
6445 	struct lkpi_sta *lsta;
6446 	struct ieee80211_sta *sta;
6447 	struct ieee80211_ampdu_params params = { };
6448 	int error;
6449 
6450 	ic = ni->ni_ic;
6451 	lhw = ic->ic_softc;
6452 	hw = LHW_TO_HW(lhw);
6453 	vap = ni->ni_vap;
6454 	lvif = VAP_TO_LVIF(vap);
6455 	vif = LVIF_TO_VIF(lvif);
6456 	lsta = ni->ni_drv_data;
6457 	sta = LSTA_TO_STA(lsta);
6458 
6459 	TRACEOK("ADDBA RESP status %d (0 == SUCCESS) tid %u", status, tap->txa_tid);
6460 
6461 	if (!lsta->added_to_drv) {
6462 		ic_printf(ic, "%s: lsta %p ni %p, sta %p not added to firmware\n",
6463 		    __func__, lsta, ni, sta);
6464 		return (0);
6465 	}
6466 
6467 	if (status == IEEE80211_STATUS_SUCCESS) {
6468 		params.sta = sta;
6469 		params.action = IEEE80211_AMPDU_TX_OPERATIONAL;
6470 		params.buf_size = tap->txa_wnd;
6471 		params.timeout = 0;
6472 		params.ssn = 0;
6473 		params.tid = tap->txa_tid;
6474 		if ((tap->txa_flags & IEEE80211_AGGR_AMSDU) != 0)
6475 			params.amsdu = true;
6476 		else
6477 			params.amsdu = false;
6478 	} else {
6479 		/* We need to free the allocated resources. */
6480 		params.sta = sta;
6481 		switch (status) {
6482 			/* params.action = FLUSH, FLUSH_CONT */
6483 		default:
6484 			params.action = IEEE80211_AMPDU_TX_STOP_CONT;
6485 			break;
6486 		}
6487 		params.buf_size = 0;
6488 		params.timeout = 0;
6489 		params.ssn = 0;
6490 		params.tid = tap->txa_tid;
6491 		params.amsdu = false;
6492 	}
6493 
6494 	/* We are called all they way up from ieee80211_input* without lock. */
6495 	wiphy_lock(hw->wiphy);
6496 	error = lkpi_80211_mo_ampdu_action(hw, vif, &params);
6497 	wiphy_unlock(hw->wiphy);
6498 	if (error != 0) {
6499 		ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p tap %p\n",
6500 		    __func__, error, ni, tap);
6501 		return (0);
6502 	}
6503 
6504 	if (sta->txq[tap->txa_tid] != NULL) {
6505 		struct lkpi_txq *ltxq;
6506 
6507 		ltxq = TXQ_TO_LTXQ(sta->txq[tap->txa_tid]);
6508 		TRACEOK("ADDBA RESP ltxq tid %u flags %b qlen %d", tap->txa_tid,
6509 		    ltxq->flags, LKPI_TXQ_FLAGS_BITS, skb_queue_len(&ltxq->skbq));
6510 		ltxq->flags &= ~LKPI_TXQ_STOPPED_BA;
6511 
6512 		lkpi_80211_mo_wake_tx_queue(hw, sta->txq[tap->txa_tid], true);
6513 	}
6514 
6515 	IMPROVE_HT("who unleashes the TXQ? and when?, do we need to ni->ni_txseqs[tid] = tap->txa_start & 0xfff;");
6516 
6517 	return (lhw->ic_addba_response(ni, tap, status, baparamset, batimeout));
6518 }
6519 
6520 /*
6521  * (*ic_addba_stop)() is called from ampdu_tx_stop(), ht_recv_action_ba_delba(),
6522  * and ieee80211_ampdu_stop() and calls the default ieee80211_addba_stop().
6523  */
6524 static void
6525 lkpi_ic_addba_stop(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
6526 {
6527 	struct ieee80211com *ic;
6528 	struct lkpi_hw *lhw;
6529 	struct ieee80211_hw *hw;
6530 	struct ieee80211vap *vap;
6531 	struct lkpi_vif *lvif;
6532 	struct ieee80211_vif *vif;
6533 	struct lkpi_sta *lsta;
6534 	struct ieee80211_sta *sta;
6535 	struct ieee80211_ampdu_params params = { };
6536 	int error;
6537 
6538 	ic = ni->ni_ic;
6539 	lhw = ic->ic_softc;
6540 	hw = LHW_TO_HW(lhw);
6541 	vap = ni->ni_vap;
6542 	lvif = VAP_TO_LVIF(vap);
6543 	vif = LVIF_TO_VIF(lvif);
6544 	lsta = ni->ni_drv_data;
6545 	sta = LSTA_TO_STA(lsta);
6546 
6547 	if (!lsta->added_to_drv) {
6548 		ic_printf(ic, "%s: lsta %p ni %p, sta %p not added to firmware\n",
6549 		    __func__, lsta, ni, sta);
6550 		goto n80211;
6551 	}
6552 
6553 	/* We need to free the allocated resources. */
6554 	params.sta = sta;
6555 	IMPROVE("net80211 does not provide a reason to us");
6556 	params.action = IEEE80211_AMPDU_TX_STOP_CONT; /* params.action = FLUSH, FLUSH_CONT */
6557 	params.buf_size = 0;
6558 	params.timeout = 0;
6559 	params.ssn = 0;
6560 	params.tid = tap->txa_tid;
6561 	params.amsdu = false;
6562 
6563 	IEEE80211_UNLOCK(ic);
6564 	wiphy_lock(hw->wiphy);
6565 	error = lkpi_80211_mo_ampdu_action(hw, vif, &params);
6566 	wiphy_unlock(hw->wiphy);
6567 	IEEE80211_LOCK(ic);
6568 	if (error != 0) {
6569 		ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p tap %p\n",
6570 		    __func__, error, ni, tap);
6571 		goto n80211;
6572 	}
6573 
6574 	IMPROVE_HT("anyting else?");
6575 
6576 n80211:
6577 	lhw->ic_addba_stop(ni, tap);
6578 }
6579 
6580 static void
6581 lkpi_ic_addba_response_timeout(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
6582 {
6583 	struct ieee80211com *ic;
6584 	struct lkpi_hw *lhw;
6585 	struct lkpi_sta *lsta;
6586 	struct ieee80211_sta *sta;
6587 
6588 	ic = ni->ni_ic;
6589 	lhw = ic->ic_softc;
6590 	lsta = ni->ni_drv_data;
6591 	sta = LSTA_TO_STA(lsta);
6592 
6593 	TRACEOK("ADDBA RESP TIMEO tid %u", tap->txa_tid);
6594 
6595 	IMPROVE_HT();
6596 
6597 	if (!lsta->added_to_drv) {
6598 		ic_printf(ic, "%s: lsta %p ni %p, sta %p not added to firmware\n",
6599 		    __func__, lsta, ni, sta);
6600 		goto n80211;
6601 	}
6602 
6603 	/* We need to re-enable the txq and get packets out. */
6604 	if (sta->txq[tap->txa_tid] != NULL) {
6605 		struct lkpi_txq *ltxq;
6606 		struct ieee80211_hw *hw;
6607 
6608 		ltxq = TXQ_TO_LTXQ(sta->txq[tap->txa_tid]);
6609 		TRACEOK("ADDBA RESP TIMEO ltxq tid %u flags %b qlen %d",
6610 		    tap->txa_tid, ltxq->flags, LKPI_TXQ_FLAGS_BITS,
6611 		    skb_queue_len(&ltxq->skbq));
6612 		ltxq->flags &= ~LKPI_TXQ_STOPPED_BA;
6613 
6614 		hw = LHW_TO_HW(lhw);
6615 		lkpi_80211_mo_wake_tx_queue(hw, sta->txq[tap->txa_tid], true);
6616 	}
6617 
6618 n80211:
6619 	lhw->ic_addba_response_timeout(ni, tap);
6620 }
6621 
6622 static void
6623 lkpi_ic_bar_response(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap,
6624     int status)
6625 {
6626 	struct ieee80211com *ic;
6627 	struct lkpi_hw *lhw;
6628 
6629 	ic = ni->ni_ic;
6630 	lhw = ic->ic_softc;
6631 
6632 	IMPROVE_HT();
6633 
6634 	lhw->ic_bar_response(ni, tap, status);
6635 }
6636 
6637 static int
6638 lkpi_ic_ampdu_rx_start(struct ieee80211_node *ni, struct ieee80211_rx_ampdu *rap,
6639     int baparamset, int batimeout, int baseqctl)
6640 {
6641 	struct ieee80211com *ic;
6642 	struct lkpi_hw *lhw;
6643 	struct ieee80211_hw *hw;
6644 	struct ieee80211vap *vap;
6645 	struct lkpi_vif *lvif;
6646 	struct ieee80211_vif *vif;
6647 	struct lkpi_sta *lsta;
6648 	struct ieee80211_sta *sta;
6649 	struct ieee80211_ampdu_params params = { };
6650 	int error;
6651 
6652 	ic = ni->ni_ic;
6653 	lhw = ic->ic_softc;
6654 	hw = LHW_TO_HW(lhw);
6655 	vap = ni->ni_vap;
6656 	lvif = VAP_TO_LVIF(vap);
6657 	vif = LVIF_TO_VIF(lvif);
6658 	lsta = ni->ni_drv_data;
6659 	sta = LSTA_TO_STA(lsta);
6660 
6661 	IEEE80211_UNLOCK_ASSERT(ic);
6662 
6663 	if (!lsta->added_to_drv) {
6664 		ic_printf(ic, "%s: lsta %p ni %p vap %p, sta %p not added to firmware\n",
6665 		    __func__, lsta, ni, vap, sta);
6666 		return (-ENXIO);
6667 	}
6668 
6669 	if (lsta->state != IEEE80211_STA_AUTHORIZED) {
6670 		ic_printf(ic, "%s: lsta %p ni %p vap %p, sta %p state %d not AUTHORIZED\n",
6671 		    __func__, lsta, ni, vap, sta, lsta->state);
6672 		return (-ENXIO);
6673 	}
6674 
6675 	params.sta = sta;
6676 	params.action = IEEE80211_AMPDU_RX_START;
6677 	params.buf_size = _IEEE80211_MASKSHIFT(le16toh(baparamset), IEEE80211_BAPS_BUFSIZ);
6678 	if (params.buf_size == 0)
6679 		params.buf_size = IEEE80211_MAX_AMPDU_BUF_HT;
6680 	else
6681 		params.buf_size = min(params.buf_size, IEEE80211_MAX_AMPDU_BUF_HT);
6682 	if (hw->max_rx_aggregation_subframes > 0 &&
6683 	    params.buf_size > hw->max_rx_aggregation_subframes)
6684 		params.buf_size = hw->max_rx_aggregation_subframes;
6685 	params.timeout = le16toh(batimeout);
6686 	params.ssn = _IEEE80211_MASKSHIFT(le16toh(baseqctl), IEEE80211_BASEQ_START);
6687 	params.tid = _IEEE80211_MASKSHIFT(le16toh(baparamset), IEEE80211_BAPS_TID);
6688 
6689 	/* Based on net80211::ampdu_rx_start(). */
6690 	if ((vap->iv_htcaps & IEEE80211_HTC_RX_AMSDU_AMPDU) &&
6691 	    (_IEEE80211_MASKSHIFT(baparamset, IEEE80211_BAPS_AMSDU)))
6692 		params.amsdu = true;
6693 	else
6694 		params.amsdu = false;
6695 
6696 	wiphy_lock(hw->wiphy);
6697 	error = lkpi_80211_mo_ampdu_action(hw, vif, &params);
6698 	wiphy_unlock(hw->wiphy);
6699 	if (error != 0) {
6700 		ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p rap %p\n",
6701 		    __func__, error, ni, rap);
6702 		return (error);
6703 	}
6704 
6705 	if (!ieee80211_hw_check(hw, SUPPORTS_REORDERING_BUFFER)) {
6706 		IMPROVE("%s: TODO: SUPPORTS_REORDERING_BUFFER not set; check net80211\n", __func__);
6707 	}
6708 
6709 	IMPROVE_HT("net80211 is missing the error check on return and assumes success");
6710 
6711 	error = lhw->ic_ampdu_rx_start(ni, rap, baparamset, batimeout, baseqctl);
6712 	return (error);
6713 }
6714 
6715 static void
6716 lkpi_ic_ampdu_rx_stop(struct ieee80211_node *ni, struct ieee80211_rx_ampdu *rap)
6717 {
6718 	struct ieee80211com *ic;
6719 	struct lkpi_hw *lhw;
6720 	struct ieee80211_hw *hw;
6721 	struct ieee80211vap *vap;
6722 	struct lkpi_vif *lvif;
6723 	struct ieee80211_vif *vif;
6724 	struct lkpi_sta *lsta;
6725 	struct ieee80211_sta *sta;
6726 	struct ieee80211_ampdu_params params = { };
6727 	int error;
6728 	uint8_t tid;
6729 	bool ic_locked;
6730 
6731 	ic = ni->ni_ic;
6732 	lhw = ic->ic_softc;
6733 
6734 	/*
6735 	 * We should not (cannot) call into mac80211 ops with AMPDU_RX_STOP if
6736 	 * we did not START.  Some drivers pass it down to firmware which will
6737 	 * simply barf and net80211 calls ieee80211_ht_node_cleanup() from
6738 	 * ieee80211_ht_node_init() amongst others which will iterate over all
6739 	 * tid and call ic_ampdu_rx_stop() unconditionally.
6740 	 * XXX net80211 should probably be more "gentle" in these cases and
6741 	 * track some state itself.
6742 	 */
6743 	if ((rap->rxa_flags & IEEE80211_AGGR_RUNNING) == 0)
6744 		goto net80211_only;
6745 
6746 	hw = LHW_TO_HW(lhw);
6747 	vap = ni->ni_vap;
6748 	lvif = VAP_TO_LVIF(vap);
6749 	vif = LVIF_TO_VIF(lvif);
6750 	lsta = ni->ni_drv_data;
6751 	if (lsta == NULL) {
6752 		ic_printf(ic, "%s: lsta %p ni %p vap %p, lsta is NULL\n",
6753 		    __func__, lsta, ni, vap);
6754 		goto net80211_only;
6755 	}
6756 	sta = LSTA_TO_STA(lsta);
6757 
6758 	if (!lsta->added_to_drv) {
6759 		ic_printf(ic, "%s: lsta %p ni %p vap %p, sta %p not added to firmware\n",
6760 		    __func__, lsta, ni, vap, sta);
6761 		goto net80211_only;
6762 	}
6763 
6764 	if (lsta->state != IEEE80211_STA_AUTHORIZED) {
6765 		ic_printf(ic, "%s: lsta %p ni %p vap %p, sta %p state %d not AUTHORIZED\n",
6766 		    __func__, lsta, ni, vap, sta, lsta->state);
6767 		goto net80211_only;
6768 	}
6769 
6770 	IMPROVE_HT("This really should be passed from ht_recv_action_ba_delba.");
6771 	for (tid = 0; tid < WME_NUM_TID; tid++) {
6772 		if (&ni->ni_rx_ampdu[tid] == rap)
6773 			break;
6774 	}
6775 	if (tid == WME_NUM_TID) {
6776 		ic_printf(ic, "%s: lsta %p ni %p vap %p, sta %p TID not found\n",
6777 		    __func__, lsta, ni, vap, sta);
6778 		goto net80211_only;
6779 	}
6780 
6781 	params.sta = sta;
6782 	params.action = IEEE80211_AMPDU_RX_STOP;
6783 	params.buf_size = 0;
6784 	params.timeout = 0;
6785 	params.ssn = 0;
6786 	params.tid = tid;
6787 	params.amsdu = false;
6788 
6789 	ic_locked = IEEE80211_IS_LOCKED(ic);
6790 	if (ic_locked)
6791 		IEEE80211_UNLOCK(ic);
6792 	wiphy_lock(hw->wiphy);
6793 	error = lkpi_80211_mo_ampdu_action(hw, vif, &params);
6794 	wiphy_unlock(hw->wiphy);
6795 	if (ic_locked)
6796 		IEEE80211_LOCK(ic);
6797 	if (error != 0)
6798 		ic_printf(ic, "%s: mo_ampdu_action returned %d. ni %p rap %p\n",
6799 		    __func__, error, ni, rap);
6800 
6801 net80211_only:
6802 	lhw->ic_ampdu_rx_stop(ni, rap);
6803 }
6804 #endif
6805 
6806 int
6807 linuxkpi_ieee80211_start_tx_ba_session(struct ieee80211_sta *sta, uint8_t tid,
6808     int timeout)
6809 {
6810 	struct lkpi_sta *lsta;
6811 	struct ieee80211_hw *hw;
6812 	struct lkpi_hw *lhw;
6813 	struct ieee80211_tx_ampdu *tap;
6814 	int worked;
6815 
6816 	lsta = STA_TO_LSTA(sta);
6817 
6818 	/* If tid is out of range, fail gracefully. */
6819 	/* XXX-BZ are we limited to 8? */
6820 	if (tid >= IEEE80211_NUM_TIDS) {
6821 		net80211_vap_printf(lsta->ni->ni_vap, "%s: tid %u out of range "
6822 		    ">= %u\n", __func__, tid, IEEE80211_NUM_TIDS);
6823 		return (-EINVAL);
6824 	}
6825 
6826 	hw = lsta->hw;
6827 	lhw = HW_TO_LHW(hw);
6828 
6829 	/* No ampdu_action support, just error. */
6830 	if (lhw->ops->ampdu_action == NULL) {
6831 		net80211_vap_printf(lsta->ni->ni_vap, "%s: (*ampdu_action) "
6832 		    "not supported\n", __func__);
6833 		return (-ENOTSUPP);
6834 	}
6835 
6836 	/* Does HW allow us to set this up? */
6837 	if (!ieee80211_hw_check(hw, AMPDU_AGGREGATION)) {
6838 		net80211_vap_printf(lsta->ni->ni_vap, "%s: !AMPDU_AGGREGATION\n",
6839 		    __func__);
6840 		return (-ENOTSUPP);
6841 	}
6842 	if (ieee80211_hw_check(hw, TX_AMPDU_SETUP_IN_HW)) {
6843 		net80211_vap_printf(lsta->ni->ni_vap, "%s: TX_AMPDU_SETUP_IN_HW\n",
6844 		    __func__);
6845 		return (-EPERM);
6846 	}
6847 
6848 	/* We need at least HT or higher support enabled. */
6849 	if (!sta->deflink.ht_cap.ht_supported &&
6850 	    !sta->deflink.vht_cap.vht_supported &&
6851 	    !sta->deflink.he_cap.has_he &&
6852 	    !sta->deflink.eht_cap.has_eht) {
6853 		net80211_vap_printf(lsta->ni->ni_vap, "%s: HT or later not "
6854 		    "supported\n", __func__);
6855 		return (-EINVAL);
6856 	}
6857 
6858 #ifdef __notyet__
6859 	/*
6860 	 * We need some rate limiting/disabling in case we try too hard and
6861 	 * get NACKed over and over.
6862 	 * XXX-BZ This check should likely go to addba_req along with a counter.
6863 	 */
6864 	if (lsta->block_ba)
6865 		return (-EACCESS);
6866 #endif
6867 
6868 	/* XXX-BZ locking? */
6869 
6870 	/* Do we have a running session already? */
6871 	tap = &lsta->ni->ni_tx_ampdu[tid];
6872 	if (IEEE80211_AMPDU_REQUESTED(tap)) {
6873 		net80211_vap_printf(lsta->ni->ni_vap, "%s: "
6874 		    "AMPDU requested/running\n", __func__);
6875 		return (-EINPROGRESS);
6876 	}
6877 
6878 	/* Tell net80211 to setup an aggr sessions. */
6879 	/* XXX-BZ we have no way to carry the timeout forward easily. */
6880 	worked = ieee80211_ampdu_tx_request_ext(lsta->ni, tid);
6881 	TRACEOK("ieee80211_ampdu_tx_request_ext %d", worked);
6882 
6883 	if (worked != 1) {
6884 		net80211_vap_printf(lsta->ni->ni_vap, "%s: "
6885 		    "ieee80211_ampdu_tx_request_ext returned %d != 1\n",
6886 		    __func__, worked);
6887 		return (-EINVAL);
6888 	}
6889 
6890 	/*
6891 	 * How do we make sure the EAPOL handshake has completed?
6892 	 * Let ieee80211_output do it.
6893 	 */
6894 	if (1) {
6895 		/* Immediately trigger the setup and output of the action frame. */
6896 		worked = ieee80211_ampdu_request(lsta->ni, tap);
6897 		if (worked != 1) {
6898 			net80211_vap_printf(lsta->ni->ni_vap, "%s: "
6899 			    "ieee80211_ampdu_request returned %d != 1\n",
6900 			    __func__, worked);
6901 			return (-EAGAIN);
6902 		}
6903 	}
6904 
6905 	return (0);
6906 }
6907 
6908 static void
6909 lkpi_ic_getradiocaps_ht(struct ieee80211com *ic, struct ieee80211_hw *hw,
6910     uint8_t *bands, int *chan_flags, enum nl80211_band band)
6911 {
6912 #ifdef LKPI_80211_HT
6913 	struct ieee80211_sta_ht_cap *ht_cap;
6914 
6915 	ht_cap = &hw->wiphy->bands[band]->ht_cap;
6916 	if (!ht_cap->ht_supported)
6917 		return;
6918 
6919 	switch (band) {
6920 	case NL80211_BAND_2GHZ:
6921 		setbit(bands, IEEE80211_MODE_11NG);
6922 		break;
6923 	case NL80211_BAND_5GHZ:
6924 		setbit(bands, IEEE80211_MODE_11NA);
6925 		break;
6926 	default:
6927 		IMPROVE("Unsupported band %d", band);
6928 		return;
6929 	}
6930 
6931 	ic->ic_htcaps = IEEE80211_HTC_HT;	/* HT operation */
6932 
6933 	/*
6934 	 * Rather than manually checking each flag and
6935 	 * translating IEEE80211_HT_CAP_ to IEEE80211_HTCAP_,
6936 	 * simply copy the 16bits.
6937 	 */
6938 	ic->ic_htcaps |= ht_cap->cap;
6939 
6940 	/* Then deal with the other flags. */
6941 	if (ieee80211_hw_check(hw, AMPDU_AGGREGATION))
6942 		ic->ic_htcaps |= IEEE80211_HTC_AMPDU;
6943 #ifdef __notyet__
6944 	if (ieee80211_hw_check(hw, TX_AMSDU))
6945 		ic->ic_htcaps |= IEEE80211_HTC_AMSDU;
6946 	if (ieee80211_hw_check(hw, SUPPORTS_AMSDU_IN_AMPDU))
6947 		ic->ic_htcaps |= (IEEE80211_HTC_RX_AMSDU_AMPDU |
6948 		    IEEE80211_HTC_TX_AMSDU_AMPDU);
6949 #endif
6950 
6951 	IMPROVE("PS, ampdu_*, ht_cap.mcs.tx_params, ...");
6952 
6953 	/* Only add HT40 channels if supported. */
6954 	if ((ic->ic_htcaps & IEEE80211_HTCAP_CHWIDTH40) != 0 &&
6955 	    chan_flags != NULL)
6956 		*chan_flags |= NET80211_CBW_FLAG_HT40;
6957 #endif
6958 }
6959 
6960 static void
6961 lkpi_ic_getradiocaps(struct ieee80211com *ic, int maxchan,
6962     int *n, struct ieee80211_channel *c)
6963 {
6964 	struct lkpi_hw *lhw;
6965 	struct ieee80211_hw *hw;
6966 	struct linuxkpi_ieee80211_channel *channels;
6967 	uint8_t bands[IEEE80211_MODE_BYTES];
6968 	int chan_flags, error, i, nchans;
6969 
6970 	/* Channels */
6971 	lhw = ic->ic_softc;
6972 	hw = LHW_TO_HW(lhw);
6973 
6974 	/* NL80211_BAND_2GHZ */
6975 	nchans = 0;
6976 	if (hw->wiphy->bands[NL80211_BAND_2GHZ] != NULL)
6977 		nchans = hw->wiphy->bands[NL80211_BAND_2GHZ]->n_channels;
6978 	if (nchans > 0) {
6979 		struct ieee80211_supported_band *supband;
6980 
6981 		memset(bands, 0, sizeof(bands));
6982 		chan_flags = 0;
6983 		setbit(bands, IEEE80211_MODE_11B);
6984 
6985 		/* Check for 11g (simplified). */
6986 		supband = hw->wiphy->bands[NL80211_BAND_2GHZ];
6987 		for (i = 0; i < supband->n_bitrates; i++) {
6988 			if ((supband->bitrates[i].flags &
6989 			    IEEE80211_RATE_MANDATORY_G) != 0) {
6990 				setbit(bands, IEEE80211_MODE_11G);
6991 				break;
6992 			}
6993 		}
6994 
6995 		IMPROVE("the bitrates may have flags?");
6996 
6997 		lkpi_ic_getradiocaps_ht(ic, hw, bands, &chan_flags,
6998 		    NL80211_BAND_2GHZ);
6999 
7000 		channels = supband->channels;
7001 		for (i = 0; i < nchans && *n < maxchan; i++) {
7002 			uint32_t nflags = 0;
7003 			int cflags = chan_flags;
7004 
7005 			if (channels[i].flags & IEEE80211_CHAN_DISABLED) {
7006 				ic_printf(ic, "%s: Skipping disabled chan "
7007 				    "[%u/%u/%#x]\n", __func__,
7008 				    channels[i].hw_value,
7009 				    channels[i].center_freq, channels[i].flags);
7010 				continue;
7011 			}
7012 			if (channels[i].flags & IEEE80211_CHAN_NO_IR)
7013 				nflags |= (IEEE80211_CHAN_NOADHOC|IEEE80211_CHAN_PASSIVE);
7014 			if (channels[i].flags & IEEE80211_CHAN_RADAR)
7015 				nflags |= IEEE80211_CHAN_DFS;
7016 			if (channels[i].flags & IEEE80211_CHAN_NO_160MHZ)
7017 				cflags &= ~(NET80211_CBW_FLAG_VHT160|NET80211_CBW_FLAG_VHT80P80);
7018 			if (channels[i].flags & IEEE80211_CHAN_NO_80MHZ)
7019 				cflags &= ~NET80211_CBW_FLAG_VHT80;
7020 			/* XXX how to map the remaining enum ieee80211_channel_flags? */
7021 			if (channels[i].flags & IEEE80211_CHAN_NO_HT40)
7022 				cflags &= ~NET80211_CBW_FLAG_HT40;
7023 
7024 			error = ieee80211_add_channel_cbw(c, maxchan, n,
7025 			    ieee80211_mhz2ieee(channels[i].center_freq,
7026 				lkpi_nl80211_band_to_net80211_band(channels[i].band)),
7027 			    channels[i].center_freq, channels[i].max_power,
7028 			    nflags, bands, cflags);
7029 			/* net80211::ENOBUFS: *n >= maxchans */
7030 			if (error != 0 && error != ENOBUFS)
7031 				ic_printf(ic, "%s: Adding chan %u/%u/%#x/%#x/%#x/%#x "
7032 				    "returned error %d\n",
7033 				    __func__, channels[i].hw_value,
7034 				    channels[i].center_freq, channels[i].flags,
7035 				    nflags, chan_flags, cflags, error);
7036 			if (error != 0)
7037 				break;
7038 		}
7039 	}
7040 
7041 	/* NL80211_BAND_5GHZ */
7042 	nchans = 0;
7043 	if (hw->wiphy->bands[NL80211_BAND_5GHZ] != NULL)
7044 		nchans = hw->wiphy->bands[NL80211_BAND_5GHZ]->n_channels;
7045 	if (nchans > 0) {
7046 		memset(bands, 0, sizeof(bands));
7047 		chan_flags = 0;
7048 		setbit(bands, IEEE80211_MODE_11A);
7049 
7050 		lkpi_ic_getradiocaps_ht(ic, hw, bands, &chan_flags,
7051 		    NL80211_BAND_5GHZ);
7052 
7053 #ifdef LKPI_80211_VHT
7054 		if (hw->wiphy->bands[NL80211_BAND_5GHZ]->vht_cap.vht_supported) {
7055 
7056 			ic->ic_flags_ext |= IEEE80211_FEXT_VHT;
7057 			ic->ic_vht_cap.vht_cap_info =
7058 			    hw->wiphy->bands[NL80211_BAND_5GHZ]->vht_cap.cap;
7059 			ic->ic_vht_cap.supp_mcs =
7060 			    hw->wiphy->bands[NL80211_BAND_5GHZ]->vht_cap.vht_mcs;
7061 
7062 			setbit(bands, IEEE80211_MODE_VHT_5GHZ);
7063 			chan_flags |= NET80211_CBW_FLAG_VHT80;
7064 			if (IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_IS_160MHZ(
7065 			    ic->ic_vht_cap.vht_cap_info))
7066 				chan_flags |= NET80211_CBW_FLAG_VHT160;
7067 			if (IEEE80211_VHTCAP_SUPP_CHAN_WIDTH_IS_160_80P80MHZ(
7068 			    ic->ic_vht_cap.vht_cap_info))
7069 				chan_flags |= NET80211_CBW_FLAG_VHT80P80;
7070 		}
7071 #endif
7072 
7073 		channels = hw->wiphy->bands[NL80211_BAND_5GHZ]->channels;
7074 		for (i = 0; i < nchans && *n < maxchan; i++) {
7075 			uint32_t nflags = 0;
7076 			int cflags = chan_flags;
7077 
7078 			if (channels[i].flags & IEEE80211_CHAN_DISABLED) {
7079 				ic_printf(ic, "%s: Skipping disabled chan "
7080 				    "[%u/%u/%#x]\n", __func__,
7081 				    channels[i].hw_value,
7082 				    channels[i].center_freq, channels[i].flags);
7083 				continue;
7084 			}
7085 			if (channels[i].flags & IEEE80211_CHAN_NO_IR)
7086 				nflags |= (IEEE80211_CHAN_NOADHOC|IEEE80211_CHAN_PASSIVE);
7087 			if (channels[i].flags & IEEE80211_CHAN_RADAR)
7088 				nflags |= IEEE80211_CHAN_DFS;
7089 			if (channels[i].flags & IEEE80211_CHAN_NO_160MHZ)
7090 				cflags &= ~(NET80211_CBW_FLAG_VHT160|NET80211_CBW_FLAG_VHT80P80);
7091 			if (channels[i].flags & IEEE80211_CHAN_NO_80MHZ)
7092 				cflags &= ~NET80211_CBW_FLAG_VHT80;
7093 			/* XXX hwo to map the remaining enum ieee80211_channel_flags? */
7094 			if (channels[i].flags & IEEE80211_CHAN_NO_HT40)
7095 				cflags &= ~NET80211_CBW_FLAG_HT40;
7096 
7097 			error = ieee80211_add_channel_cbw(c, maxchan, n,
7098 			    ieee80211_mhz2ieee(channels[i].center_freq,
7099 				lkpi_nl80211_band_to_net80211_band(channels[i].band)),
7100 			    channels[i].center_freq, channels[i].max_power,
7101 			    nflags, bands, cflags);
7102 			/* net80211::ENOBUFS: *n >= maxchans */
7103 			if (error != 0 && error != ENOBUFS)
7104 				ic_printf(ic, "%s: Adding chan %u/%u/%#x/%#x/%#x/%#x "
7105 				    "returned error %d\n",
7106 				    __func__, channels[i].hw_value,
7107 				    channels[i].center_freq, channels[i].flags,
7108 				    nflags, chan_flags, cflags, error);
7109 			if (error != 0)
7110 				break;
7111 		}
7112 	}
7113 }
7114 
7115 static void *
7116 lkpi_ieee80211_ifalloc(void)
7117 {
7118 	struct ieee80211com *ic;
7119 
7120 	ic = malloc(sizeof(*ic), M_LKPI80211, M_WAITOK | M_ZERO);
7121 
7122 	/* Setting these happens later when we have device information. */
7123 	ic->ic_softc = NULL;
7124 	ic->ic_name = "linuxkpi";
7125 
7126 	return (ic);
7127 }
7128 
7129 struct ieee80211_hw *
7130 linuxkpi_ieee80211_alloc_hw(size_t priv_len, const struct ieee80211_ops *ops)
7131 {
7132 	struct ieee80211_hw *hw;
7133 	struct lkpi_hw *lhw;
7134 	struct wiphy *wiphy;
7135 	int ac;
7136 	bool emuchanctx;
7137 
7138 	/*
7139 	 * Do certain checks before starting to allocate resources.
7140 	 * Store results in temporary variables.
7141 	 */
7142 
7143 	/* ac1d519c01ca introduced emulating chanctx changes. */
7144 	emuchanctx = false;
7145 	if (ops->add_chanctx == ieee80211_emulate_add_chanctx &&
7146 	    ops->change_chanctx == ieee80211_emulate_change_chanctx &&
7147 	    ops->remove_chanctx == ieee80211_emulate_remove_chanctx) {
7148 		/*
7149 		 * If we emulate the chanctx ops, we must not have
7150 		 * assign_vif_chanctx and unassign_vif_chanctx.
7151 		 */
7152 		if (ops->assign_vif_chanctx != NULL ||
7153 		    ops->unassign_vif_chanctx != NULL) {
7154 			/* Fail gracefully. */
7155 			printf("%s: emulate_chanctx but "
7156 			    "assign_vif_chanctx %p != NULL || "
7157 			    "unassign_vif_chanctx %p != NULL\n", __func__,
7158 			    ops->assign_vif_chanctx, ops->unassign_vif_chanctx);
7159 			return (NULL);
7160 		}
7161 		emuchanctx = true;
7162 	}
7163 	if (!emuchanctx && (ops->add_chanctx == ieee80211_emulate_add_chanctx ||
7164 	    ops->change_chanctx == ieee80211_emulate_change_chanctx ||
7165 	    ops->remove_chanctx == ieee80211_emulate_remove_chanctx)) {
7166 		printf("%s: not emulating chanctx changes but emulating "
7167 		    "function set: %d/%d/%d\n", __func__,
7168 		    ops->add_chanctx == ieee80211_emulate_add_chanctx,
7169 		    ops->change_chanctx == ieee80211_emulate_change_chanctx,
7170 		    ops->remove_chanctx == ieee80211_emulate_remove_chanctx);
7171 		return (NULL);
7172 	}
7173 	if (!emuchanctx && (ops->add_chanctx == NULL || ops->change_chanctx == NULL ||
7174 	    ops->remove_chanctx == NULL || ops->assign_vif_chanctx == NULL ||
7175 	    ops->unassign_vif_chanctx == NULL)) {
7176 		printf("%s: not all functions set for chanctx operations "
7177 		    "(emulating chanctx %d): %p/%p/%p %p/%p\n",
7178 		    __func__, emuchanctx,
7179 		    ops->add_chanctx, ops->change_chanctx, ops->remove_chanctx,
7180 		    ops->assign_vif_chanctx, ops->unassign_vif_chanctx);
7181 		return (NULL);
7182 	}
7183 
7184 	/* Get us and the driver data also allocated. */
7185 	wiphy = wiphy_new(&linuxkpi_mac80211cfgops, sizeof(*lhw) + priv_len);
7186 	if (wiphy == NULL)
7187 		return (NULL);
7188 
7189 	lhw = wiphy_priv(wiphy);
7190 	lhw->ops = ops;
7191 
7192 	LKPI_80211_LHW_SCAN_LOCK_INIT(lhw);
7193 	LKPI_80211_LHW_TXQ_LOCK_INIT(lhw);
7194 	spin_lock_init(&lhw->txq_lock);
7195 	sx_init_flags(&lhw->lvif_sx, "lhw-lvif", SX_RECURSE | SX_DUPOK);
7196 	LKPI_80211_LHW_MC_LOCK_INIT(lhw);
7197 	TAILQ_INIT(&lhw->lvif_head);
7198 	__hw_addr_init(&lhw->mc_list);
7199 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
7200 		spin_lock_init(&lhw->txq_scheduled_lock[ac]);
7201 		lhw->txq_generation[ac] = 1;
7202 		TAILQ_INIT(&lhw->txq_scheduled[ac]);
7203 	}
7204 
7205 	/* Chanctx_conf */
7206 	INIT_LIST_HEAD(&lhw->lchanctx_list);
7207 	INIT_LIST_HEAD(&lhw->lchanctx_list_reserved);
7208 	lhw->emulate_chanctx = emuchanctx;
7209 
7210 	/* Deferred RX path. */
7211 	LKPI_80211_LHW_RXQ_LOCK_INIT(lhw);
7212 	TASK_INIT(&lhw->rxq_task, 0, lkpi_80211_lhw_rxq_task, lhw);
7213 	mbufq_init(&lhw->rxq, 32 * NAPI_POLL_WEIGHT);
7214 	lhw->rxq_stopped = false;
7215 
7216 	/*
7217 	 * XXX-BZ TODO make sure there is a "_null" function to all ops
7218 	 * not initialized.
7219 	 */
7220 	hw = LHW_TO_HW(lhw);
7221 	hw->wiphy = wiphy;
7222 	hw->conf.flags |= IEEE80211_CONF_IDLE;
7223 	hw->priv = (void *)(lhw + 1);
7224 
7225 	/* BSD Specific. */
7226 	lhw->ic = lkpi_ieee80211_ifalloc();
7227 
7228 	if (lhw->emulate_chanctx)
7229 		ic_printf(lhw->ic, "Using chanctx emulation.\n");
7230 	IMPROVE();
7231 
7232 	return (hw);
7233 }
7234 
7235 void
7236 linuxkpi_ieee80211_iffree(struct ieee80211_hw *hw)
7237 {
7238 	struct lkpi_hw *lhw;
7239 	struct mbuf *m;
7240 	int ac;
7241 
7242 	lhw = HW_TO_LHW(hw);
7243 	free(lhw->ic, M_LKPI80211);
7244 	lhw->ic = NULL;
7245 
7246 	/*
7247 	 * Drain the deferred RX path.
7248 	 */
7249 	LKPI_80211_LHW_RXQ_LOCK(lhw);
7250 	lhw->rxq_stopped = true;
7251 	LKPI_80211_LHW_RXQ_UNLOCK(lhw);
7252 
7253 	/* Drain taskq, won't be restarted due to rxq_stopped being set. */
7254 	while (taskqueue_cancel(taskqueue_thread, &lhw->rxq_task, NULL) != 0)
7255 		taskqueue_drain(taskqueue_thread, &lhw->rxq_task);
7256 
7257 	/* Flush mbufq (make sure to release ni refs!). */
7258 	m = mbufq_dequeue(&lhw->rxq);
7259 	while (m != NULL) {
7260 #ifdef LKPI_80211_USE_MTAG
7261 		struct m_tag *mtag;
7262 
7263 		mtag = m_tag_locate(m, MTAG_ABI_LKPI80211, LKPI80211_TAG_RXNI, NULL);
7264 		if (mtag != NULL) {
7265 			struct lkpi_80211_tag_rxni *rxni;
7266 
7267 			rxni = (struct lkpi_80211_tag_rxni *)(mtag + 1);
7268 			ieee80211_free_node(rxni->ni);
7269 		}
7270 #else
7271 		if (m->m_pkthdr.PH_loc.ptr != NULL) {
7272 			struct ieee80211_node *ni;
7273 
7274 			ni = m->m_pkthdr.PH_loc.ptr;
7275 			ieee80211_free_node(ni);
7276 		}
7277 #endif
7278 		m_freem(m);
7279 		m = mbufq_dequeue(&lhw->rxq);
7280 	}
7281 	KASSERT(mbufq_empty(&lhw->rxq), ("%s: lhw %p has rxq len %d != 0\n",
7282 	    __func__, lhw, mbufq_len(&lhw->rxq)));
7283 	LKPI_80211_LHW_RXQ_LOCK_DESTROY(lhw);
7284 
7285 	wiphy_lock(hw->wiphy);
7286 	/* Chanctx_conf. */
7287 	if (!list_empty_careful(&lhw->lchanctx_list)) {
7288 		struct lkpi_chanctx *lchanctx, *next;
7289 		struct ieee80211_chanctx_conf *chanctx_conf;
7290 
7291 		list_for_each_entry_safe(lchanctx, next, &lhw->lchanctx_list, entry) {
7292 			if (lchanctx->added_to_drv) {
7293 				/* In reality we should panic? */
7294 				chanctx_conf = &lchanctx->chanctx_conf;
7295 				lkpi_80211_mo_remove_chanctx(hw, chanctx_conf);
7296 			}
7297 			list_del(&lchanctx->entry);
7298 			/* No need to reset the lchanctx here as we will free it below. */
7299 			list_add_rcu(&lchanctx->entry, &lhw->lchanctx_list_reserved);
7300 		}
7301 	}
7302 	if (!list_empty_careful(&lhw->lchanctx_list_reserved)) {
7303 		struct lkpi_chanctx *lchanctx, *next;
7304 
7305 		list_for_each_entry_safe(lchanctx, next, &lhw->lchanctx_list_reserved, entry) {
7306 			list_del(&lchanctx->entry);
7307 			if (lchanctx->added_to_drv)
7308 				panic("%s: lchanctx %p on reserved list still added_to_drv\n",
7309 				    __func__, lchanctx);
7310 			free(lchanctx, M_LKPI80211);
7311 		}
7312 	}
7313 	wiphy_unlock(hw->wiphy);
7314 
7315 	LKPI_80211_LHW_MC_LOCK(lhw);
7316 	lkpi_cleanup_mcast_list_locked(lhw);
7317 	LKPI_80211_LHW_MC_UNLOCK(lhw);
7318 
7319 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
7320 		spin_lock_destroy(&lhw->txq_scheduled_lock[ac]);
7321 
7322 	/* Cleanup more of lhw here or in wiphy_free()? */
7323 	spin_lock_destroy(&lhw->txq_lock);
7324 	LKPI_80211_LHW_TXQ_LOCK_DESTROY(lhw);
7325 	LKPI_80211_LHW_SCAN_LOCK_DESTROY(lhw);
7326 	sx_destroy(&lhw->lvif_sx);
7327 	LKPI_80211_LHW_MC_LOCK_DESTROY(lhw)
7328 	IMPROVE();
7329 }
7330 
7331 void
7332 linuxkpi_set_ieee80211_dev(struct ieee80211_hw *hw)
7333 {
7334 	struct lkpi_hw *lhw;
7335 	struct ieee80211com *ic;
7336 	struct device *dev;
7337 
7338 	lhw = HW_TO_LHW(hw);
7339 	ic = lhw->ic;
7340 
7341 	/* Save the backpointer from net80211 to LinuxKPI. */
7342 	ic->ic_softc = lhw;
7343 
7344 	/*
7345 	 * Set a proper name before ieee80211_ifattach() if dev is set.
7346 	 * ath1xk also unset the dev so we need to check.
7347 	 * Also we will (ab)use this opportunity to register the
7348 	 * power management sub-children if thay exist (for suspend/resume).
7349 	 */
7350 	dev = wiphy_dev(hw->wiphy);
7351 	if (dev != NULL) {
7352 		ic->ic_name = dev_name(dev);
7353 		if (dev->bsddev != NULL) {
7354 			bus_identify_children(dev->bsddev);
7355 			bus_enumerate_hinted_children(dev->bsddev);
7356 			bus_topo_lock();
7357 			bus_attach_children(dev->bsddev);
7358 			bus_topo_unlock();
7359 		}
7360 	} else {
7361 		TODO("adjust arguments to still have the old dev or go through "
7362 		    "the hoops of getting the bsddev from hw and detach; "
7363 		    "or do in XXX; check ath1kx drivers");
7364 	}
7365 
7366 	/* XXX-BZ do we also need to set wiphy name? */
7367 }
7368 
7369 struct ieee80211_hw *
7370 linuxkpi_wiphy_to_ieee80211_hw(struct wiphy *wiphy)
7371 {
7372 	struct lkpi_hw *lhw;
7373 
7374 	lhw = wiphy_priv(wiphy);
7375 	return (LHW_TO_HW(lhw));
7376 }
7377 
7378 static void
7379 lkpi_radiotap_attach(struct lkpi_hw *lhw)
7380 {
7381 	struct ieee80211com *ic;
7382 
7383 	ic = lhw->ic;
7384 	ieee80211_radiotap_attach(ic,
7385 	    &lhw->rtap_tx.wt_ihdr, sizeof(lhw->rtap_tx),
7386 	    LKPI_RTAP_TX_FLAGS_PRESENT,
7387 	    &lhw->rtap_rx.wr_ihdr, sizeof(lhw->rtap_rx),
7388 	    LKPI_RTAP_RX_FLAGS_PRESENT);
7389 }
7390 
7391 int
7392 linuxkpi_ieee80211_ifattach(struct ieee80211_hw *hw)
7393 {
7394 	struct ieee80211com *ic;
7395 	struct lkpi_hw *lhw;
7396 	int band, i;
7397 
7398 	lhw = HW_TO_LHW(hw);
7399 	ic = lhw->ic;
7400 
7401 	/* We do it this late as wiphy->dev should be set for the name. */
7402 	lhw->workq = alloc_ordered_workqueue(wiphy_name(hw->wiphy), 0);
7403 	if (lhw->workq == NULL)
7404 		return (-EAGAIN);
7405 
7406 	/* XXX-BZ figure this out how they count his... */
7407 	if (!is_zero_ether_addr(hw->wiphy->perm_addr)) {
7408 		IEEE80211_ADDR_COPY(ic->ic_macaddr,
7409 		    hw->wiphy->perm_addr);
7410 	} else if (hw->wiphy->n_addresses > 0) {
7411 		/* We take the first one. */
7412 		IEEE80211_ADDR_COPY(ic->ic_macaddr,
7413 		    hw->wiphy->addresses[0].addr);
7414 	} else {
7415 		ic_printf(ic, "%s: warning, no hardware address!\n", __func__);
7416 	}
7417 
7418 #ifdef __not_yet__
7419 	/* See comment in lkpi_80211_txq_tx_one(). */
7420 	ic->ic_headroom = hw->extra_tx_headroom;
7421 #endif
7422 
7423 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
7424 	ic->ic_opmode = IEEE80211_M_STA;
7425 
7426 	/* Set device capabilities. */
7427 	/* XXX-BZ we need to get these from linux80211/drivers and convert. */
7428 	ic->ic_caps =
7429 	    IEEE80211_C_STA |
7430 	    IEEE80211_C_MONITOR |
7431 	    IEEE80211_C_WPA |		/* WPA/RSN */
7432 #ifdef LKPI_80211_WME
7433 	    IEEE80211_C_WME |
7434 #endif
7435 #if 0
7436 	    IEEE80211_C_PMGT |
7437 #endif
7438 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
7439 	    IEEE80211_C_SHPREAMBLE	/* short preamble supported */
7440 	    ;
7441 
7442 #ifdef LKPI_80211_BGSCAN
7443 	if (lhw->ops->hw_scan)
7444 		ic->ic_caps |= IEEE80211_C_BGSCAN;
7445 #endif
7446 
7447 	lkpi_enable_hw_scan(lhw);
7448 
7449 	/* Does the driver/firmware handle rate countrol? */
7450 	/* Currently only older iwlwifi mvm devices are in this category. */
7451 	if (bootverbose && !ieee80211_hw_check(hw, HAS_RATE_CONTROL))
7452 		ic_printf(ic, "NOTE: rate control not supported by LinuxKPI; "
7453 		    "expect low rates only\n");
7454 
7455 	/* Does HW support Fragmentation offload? */
7456 	if (ieee80211_hw_check(hw, SUPPORTS_TX_FRAG))
7457 		ic->ic_flags_ext |= IEEE80211_FEXT_FRAG_OFFLOAD;
7458 
7459 	/* Does HW support full AMPDU[-TX] offload? */
7460 	if (ieee80211_hw_check(hw, AMPDU_AGGREGATION))
7461 		ic->ic_flags_ext |= IEEE80211_FEXT_AMPDU_OFFLOAD;
7462 #ifdef __notyet__
7463 	if (ieee80211_hw_check(hw, TX_AMSDU))
7464 	if (ieee80211_hw_check(hw, SUPPORTS_AMSDU_IN_AMPDU))
7465 #endif
7466 
7467 	/*
7468 	 * The wiphy variables report bitmasks of avail antennas.
7469 	 * (*get_antenna) get the current bitmask sets which can be
7470 	 * altered by (*set_antenna) for some drivers.
7471 	 * XXX-BZ will the count alone do us much good long-term in net80211?
7472 	 */
7473 	if (hw->wiphy->available_antennas_rx ||
7474 	    hw->wiphy->available_antennas_tx) {
7475 		uint32_t rxs, txs;
7476 
7477 		if (lkpi_80211_mo_get_antenna(hw, &txs, &rxs) == 0) {
7478 			ic->ic_rxstream = bitcount32(rxs);
7479 			ic->ic_txstream = bitcount32(txs);
7480 		}
7481 	}
7482 
7483 	ic->ic_cryptocaps = 0;
7484 #ifdef LKPI_80211_HW_CRYPTO
7485 	if (lkpi_hwcrypto && hw->wiphy->n_cipher_suites > 0) {
7486 		uint32_t hwciphers;
7487 
7488 		hwciphers = 0;
7489 		for (i = 0; i < hw->wiphy->n_cipher_suites; i++) {
7490 			uint32_t cs;
7491 
7492 			cs = lkpi_l80211_to_net80211_cyphers(
7493 			    ic, hw->wiphy->cipher_suites[i]);
7494 			if (cs == IEEE80211_CRYPTO_TKIP) {
7495 				/*
7496 				 * We do set this here.  We will only find out
7497 				 * when doing a SET_KEY operation depending on
7498 				 * what the driver returns.
7499 				 * net80211::ieee80211_crypto_newkey()
7500 				 * checks this so we will have to do flags
7501 				 * surgery later.
7502 				 */
7503 				cs |= IEEE80211_CRYPTO_TKIPMIC;
7504 			}
7505 			hwciphers |= cs;
7506 		}
7507 		/*
7508 		 * (20250415) nothing anywhere in the path checks we actually
7509 		 * support all these in net80211.
7510 		 * net80211 supports _256 variants but the ioctl does not.
7511 		 */
7512 		IMPROVE("as net80211 grows more support, enable them");
7513 		hwciphers &= (IEEE80211_CRYPTO_WEP |
7514 		    IEEE80211_CRYPTO_TKIP | IEEE80211_CRYPTO_TKIPMIC |
7515 		    IEEE80211_CRYPTO_AES_CCM | IEEE80211_CRYPTO_AES_GCM_128);
7516 		/*
7517 		 * We only support CCMP here, so further filter.
7518 		 * Also permit TKIP if turned on.
7519 		 */
7520 		hwciphers &= (IEEE80211_CRYPTO_AES_CCM |
7521 		    IEEE80211_CRYPTO_AES_GCM_128 |
7522 		    (lkpi_hwcrypto_tkip ? (IEEE80211_CRYPTO_TKIP |
7523 		    IEEE80211_CRYPTO_TKIPMIC) : 0));
7524 		ieee80211_set_hardware_ciphers(ic, hwciphers);
7525 	}
7526 #endif
7527 
7528 	lkpi_ic_getradiocaps(ic, IEEE80211_CHAN_MAX, &ic->ic_nchans,
7529 	    ic->ic_channels);
7530 
7531 	ieee80211_ifattach(ic);
7532 
7533 	ic->ic_update_mcast = lkpi_ic_update_mcast;
7534 	ic->ic_update_promisc = lkpi_ic_update_promisc;
7535 	ic->ic_update_chw = lkpi_ic_update_chw;
7536 	ic->ic_parent = lkpi_ic_parent;
7537 	ic->ic_scan_start = lkpi_ic_scan_start;
7538 	ic->ic_scan_end = lkpi_ic_scan_end;
7539 	ic->ic_set_channel = lkpi_ic_set_channel;
7540 	ic->ic_transmit = lkpi_ic_transmit;
7541 	ic->ic_raw_xmit = lkpi_ic_raw_xmit;
7542 	ic->ic_vap_create = lkpi_ic_vap_create;
7543 	ic->ic_vap_delete = lkpi_ic_vap_delete;
7544 	ic->ic_getradiocaps = lkpi_ic_getradiocaps;
7545 	ic->ic_wme.wme_update = lkpi_ic_wme_update;
7546 
7547 	lhw->ic_scan_curchan = ic->ic_scan_curchan;
7548 	ic->ic_scan_curchan = lkpi_ic_scan_curchan;
7549 	lhw->ic_scan_mindwell = ic->ic_scan_mindwell;
7550 	ic->ic_scan_mindwell = lkpi_ic_scan_mindwell;
7551 
7552 	lhw->ic_node_alloc = ic->ic_node_alloc;
7553 	ic->ic_node_alloc = lkpi_ic_node_alloc;
7554 	lhw->ic_node_init = ic->ic_node_init;
7555 	ic->ic_node_init = lkpi_ic_node_init;
7556 	lhw->ic_node_cleanup = ic->ic_node_cleanup;
7557 	ic->ic_node_cleanup = lkpi_ic_node_cleanup;
7558 	lhw->ic_node_free = ic->ic_node_free;
7559 	ic->ic_node_free = lkpi_ic_node_free;
7560 
7561 #ifdef LKPI_80211_HT
7562 	/*
7563 	 * Only attach if the driver/firmware supports (*ampdu_action)().
7564 	 * Otherwise it is in the hands of net80211.
7565 	 */
7566 	if (lhw->ops->ampdu_action != NULL) {
7567 		lhw->ic_recv_action = ic->ic_recv_action;
7568 		ic->ic_recv_action = lkpi_ic_recv_action;
7569 		lhw->ic_send_action = ic->ic_send_action;
7570 		ic->ic_send_action = lkpi_ic_send_action;
7571 
7572 		lhw->ic_ampdu_enable = ic->ic_ampdu_enable;
7573 		ic->ic_ampdu_enable = lkpi_ic_ampdu_enable;
7574 
7575 		lhw->ic_addba_request = ic->ic_addba_request;
7576 		ic->ic_addba_request = lkpi_ic_addba_request;
7577 		lhw->ic_addba_response = ic->ic_addba_response;
7578 		ic->ic_addba_response = lkpi_ic_addba_response;
7579 		lhw->ic_addba_stop = ic->ic_addba_stop;
7580 		ic->ic_addba_stop = lkpi_ic_addba_stop;
7581 		lhw->ic_addba_response_timeout = ic->ic_addba_response_timeout;
7582 		ic->ic_addba_response_timeout = lkpi_ic_addba_response_timeout;
7583 
7584 		lhw->ic_bar_response = ic->ic_bar_response;
7585 		ic->ic_bar_response = lkpi_ic_bar_response;
7586 
7587 		lhw->ic_ampdu_rx_start = ic->ic_ampdu_rx_start;
7588 		ic->ic_ampdu_rx_start = lkpi_ic_ampdu_rx_start;
7589 		lhw->ic_ampdu_rx_stop = ic->ic_ampdu_rx_stop;
7590 		ic->ic_ampdu_rx_stop = lkpi_ic_ampdu_rx_stop;
7591 	}
7592 #endif
7593 
7594 	lkpi_radiotap_attach(lhw);
7595 
7596 	/*
7597 	 * Assign the first possible channel for now;  seems Realtek drivers
7598 	 * expect one.
7599 	 * Also remember the amount of bands we support and the most rates
7600 	 * in any band so we can scale [(ext) sup rates] IE(s) accordingly.
7601 	 */
7602 	lhw->supbands = lhw->max_rates = 0;
7603 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
7604 		struct ieee80211_supported_band *supband;
7605 		struct linuxkpi_ieee80211_channel *channels;
7606 
7607 		supband = hw->wiphy->bands[band];
7608 		if (supband == NULL || supband->n_channels == 0)
7609 			continue;
7610 
7611 		lhw->supbands++;
7612 		lhw->max_rates = max(lhw->max_rates, supband->n_bitrates);
7613 
7614 		/* If we have a channel, we need to keep counting supbands. */
7615 		if (hw->conf.chandef.chan != NULL)
7616 			continue;
7617 
7618 		channels = supband->channels;
7619 		for (i = 0; i < supband->n_channels; i++) {
7620 
7621 			if (channels[i].flags & IEEE80211_CHAN_DISABLED)
7622 				continue;
7623 
7624 			cfg80211_chandef_create(&hw->conf.chandef, &channels[i],
7625 #ifdef LKPI_80211_HT
7626 			    (ic->ic_flags_ht & IEEE80211_FHT_HT) ? NL80211_CHAN_HT20 :
7627 #endif
7628 			    NL80211_CHAN_NO_HT);
7629 			lhw->dflt_chandef = hw->conf.chandef;
7630 #ifdef LINUXKPI_DEBUG_80211
7631 			if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
7632 				ic_printf(ic, "%s:%d: initialized "
7633 				    "hw->conf.chandef and dflt_chandef to %p\n",
7634 				    __func__, __LINE__, &lhw->dflt_chandef);
7635 #endif
7636 			break;
7637 		}
7638 	}
7639 
7640 	IMPROVE("see net80211::ieee80211_chan_init vs. wiphy->bands[].bitrates possibly in lkpi_ic_getradiocaps?");
7641 
7642 	/* Make sure we do not support more than net80211 is willing to take. */
7643 	if (lhw->max_rates > IEEE80211_RATE_MAXSIZE) {
7644 		ic_printf(ic, "%s: limiting max_rates %d to %d!\n", __func__,
7645 		    lhw->max_rates, IEEE80211_RATE_MAXSIZE);
7646 		lhw->max_rates = IEEE80211_RATE_MAXSIZE;
7647 	}
7648 
7649 	/*
7650 	 * The maximum supported bitrates on any band + size for
7651 	 * DSSS Parameter Set give our per-band IE size.
7652 	 * SSID is the responsibility of the driver and goes on the side.
7653 	 * The user specified bits coming from the vap go into the
7654 	 * "common ies" fields.
7655 	 */
7656 	lhw->scan_ie_len = 2 + IEEE80211_RATE_SIZE;
7657 	if (lhw->max_rates > IEEE80211_RATE_SIZE)
7658 		lhw->scan_ie_len += 2 + (lhw->max_rates - IEEE80211_RATE_SIZE);
7659 
7660 	if (hw->wiphy->features & NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) {
7661 		/*
7662 		 * net80211 does not seem to support the DSSS Parameter Set but
7663 		 * some of the drivers insert it so calculate the extra fixed
7664 		 * space in.
7665 		 */
7666 		lhw->scan_ie_len += 2 + 1;
7667 	}
7668 
7669 #if defined(LKPI_80211_HT)
7670 	if ((ic->ic_htcaps & IEEE80211_HTC_HT) != 0)
7671 		lhw->scan_ie_len += sizeof(struct ieee80211_ie_htcap);
7672 #endif
7673 #if defined(LKPI_80211_VHT)
7674 	if (IEEE80211_CONF_VHT(ic))
7675 		lhw->scan_ie_len += 2 + sizeof(struct ieee80211_vht_cap);
7676 #endif
7677 
7678 	/* Reduce the max_scan_ie_len "left" by the amount we consume already. */
7679 	if (hw->wiphy->max_scan_ie_len > 0) {
7680 		if (lhw->scan_ie_len > hw->wiphy->max_scan_ie_len)
7681 			goto err;
7682 		hw->wiphy->max_scan_ie_len -= lhw->scan_ie_len;
7683 	}
7684 
7685 	if (bootverbose) {
7686 		if (hw->netdev_features != 0)
7687 			ic_printf(ic, "netdev_features %b\n",
7688 			    hw->netdev_features, NETIF_F_BITS);
7689 		ieee80211_announce(ic);
7690 	}
7691 
7692 	return (0);
7693 err:
7694 	IMPROVE("TODO FIXME CLEANUP");
7695 	return (-EAGAIN);
7696 }
7697 
7698 void
7699 linuxkpi_ieee80211_ifdetach(struct ieee80211_hw *hw)
7700 {
7701 	struct lkpi_hw *lhw;
7702 	struct ieee80211com *ic;
7703 
7704 	lhw = HW_TO_LHW(hw);
7705 	ic = lhw->ic;
7706 	ieee80211_ifdetach(ic);
7707 }
7708 
7709 void
7710 linuxkpi_ieee80211_iterate_interfaces(struct ieee80211_hw *hw,
7711     enum ieee80211_iface_iter flags,
7712     void(*iterfunc)(void *, uint8_t *, struct ieee80211_vif *),
7713     void *arg)
7714 {
7715 	struct lkpi_hw *lhw;
7716 	struct lkpi_vif *lvif;
7717 	struct ieee80211_vif *vif;
7718 	bool active, atomic, nin_drv;
7719 
7720 	lhw = HW_TO_LHW(hw);
7721 
7722 	if (flags & ~(IEEE80211_IFACE_ITER_NORMAL|
7723 	    IEEE80211_IFACE_ITER_RESUME_ALL|
7724 	    IEEE80211_IFACE_SKIP_SDATA_NOT_IN_DRIVER|
7725 	    IEEE80211_IFACE_ITER_ACTIVE|IEEE80211_IFACE_ITER__ATOMIC|
7726 	    IEEE80211_IFACE_ITER__MTX)) {
7727 		ic_printf(lhw->ic, "XXX TODO %s flags(%#x) not yet supported.\n",
7728 		    __func__, flags);
7729 	}
7730 
7731 	if ((flags & IEEE80211_IFACE_ITER__MTX) != 0)
7732 		lockdep_assert_wiphy(hw->wiphy);
7733 
7734 	active = (flags & IEEE80211_IFACE_ITER_ACTIVE) != 0;
7735 	atomic = (flags & IEEE80211_IFACE_ITER__ATOMIC) != 0;
7736 	nin_drv = (flags & IEEE80211_IFACE_SKIP_SDATA_NOT_IN_DRIVER) != 0;
7737 
7738 	if (atomic) {
7739 		IMPROVE("LKPI_80211_LHW_LVIF_LOCK atomic assume to be rcu?");
7740 		LKPI_80211_LHW_LVIF_LOCK(lhw);
7741 	}
7742 	TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
7743 		struct ieee80211vap *vap;
7744 
7745 		vif = LVIF_TO_VIF(lvif);
7746 
7747 		/*
7748 		 * If we want "active" interfaces, we need to distinguish on
7749 		 * whether the driver knows about them or not to be able to
7750 		 * handle the "resume" case correctly.  Skip the ones the
7751 		 * driver does not know about.
7752 		 */
7753 		if (active && !lvif->added_to_drv &&
7754 		    (flags & IEEE80211_IFACE_ITER_RESUME_ALL) != 0)
7755 			continue;
7756 
7757 		/*
7758 		 * If we shall skip interfaces not added to the driver do so
7759 		 * if we haven't yet.
7760 		 */
7761 		if (nin_drv && !lvif->added_to_drv)
7762 			continue;
7763 
7764 		/*
7765 		 * Run the iterator function if we are either not asking
7766 		 * asking for active only or if the VAP is "running".
7767 		 */
7768 		/* XXX-BZ probably should have state in the lvif as well. */
7769 		vap = LVIF_TO_VAP(lvif);
7770 		if (!active || (vap->iv_state != IEEE80211_S_INIT))
7771 			iterfunc(arg, vif->addr, vif);
7772 	}
7773 	if (atomic)
7774 		LKPI_80211_LHW_LVIF_UNLOCK(lhw);
7775 }
7776 
7777 static void
7778 lkpi_ieee80211_iterate_keys(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
7779     ieee80211_keyix keyix, struct lkpi_sta *lsta,
7780     void(*iterfunc)(struct ieee80211_hw *, struct ieee80211_vif *,
7781 	struct ieee80211_sta *, struct ieee80211_key_conf *, void *),
7782     void *arg)
7783 {
7784 #ifdef LINUXKPI_DEBUG_80211
7785 	if (linuxkpi_debug_80211 & D80211_TRACE_HW_CRYPTO)
7786 		net80211_vap_printf(LVIF_TO_VAP(VIF_TO_LVIF(vif)),
7787 		    "%s:%d: lsta %6D added_to_drv %d kc[keyix %u] %p\n",
7788 		    __func__, __LINE__, LSTA_TO_STA(lsta)->addr, ":",
7789 		    lsta->added_to_drv, keyix, lsta->kc[keyix]);
7790 #endif
7791 
7792 	if (!lsta->added_to_drv)
7793 		return;
7794 
7795 	if (lsta->kc[keyix] == NULL)
7796 		return;
7797 
7798 	iterfunc(hw, vif, LSTA_TO_STA(lsta), lsta->kc[keyix], arg);
7799 }
7800 
7801 void
7802 linuxkpi_ieee80211_iterate_keys(struct ieee80211_hw *hw,
7803     struct ieee80211_vif *vif,
7804     void(*iterfunc)(struct ieee80211_hw *, struct ieee80211_vif *,
7805         struct ieee80211_sta *, struct ieee80211_key_conf *, void *),
7806     void *arg, bool rcu)
7807 {
7808 	struct lkpi_sta *lsta;
7809 	struct lkpi_vif *lvif;
7810 
7811 	lvif = VIF_TO_LVIF(vif);
7812 
7813 	if (rcu) {
7814 		rcu_read_lock_held();		/* XXX-BZ is this correct? */
7815 
7816 		if (vif == NULL) {
7817 			TODO();
7818 		} else {
7819 			list_for_each_entry_rcu(lsta, &lvif->lsta_list, lsta_list) {
7820 				for (ieee80211_keyix keyix = 0; keyix < nitems(lsta->kc);
7821 				    keyix++)
7822 					lkpi_ieee80211_iterate_keys(hw, vif,
7823 					    keyix, lsta, iterfunc, arg);
7824 			}
7825 		}
7826 	} else {
7827 		TODO("Used by suspend/resume; order of keys as installed to "
7828 		"firmware is important; we'll need to rewrite some code for that");
7829 		lockdep_assert_wiphy(hw->wiphy);
7830 
7831 		if (vif == NULL) {
7832 			TODO();
7833 		} else {
7834 			list_for_each_entry(lsta, &lvif->lsta_list, lsta_list) {
7835 				for (ieee80211_keyix keyix = 0; keyix < nitems(lsta->kc);
7836 				    keyix++)
7837 					lkpi_ieee80211_iterate_keys(hw, vif,
7838 					    keyix, lsta, iterfunc, arg);
7839 			}
7840 		}
7841 	}
7842 }
7843 
7844 void
7845 linuxkpi_ieee80211_iterate_chan_contexts(struct ieee80211_hw *hw,
7846     void(*iterfunc)(struct ieee80211_hw *, struct ieee80211_chanctx_conf *,
7847 	void *),
7848     void *arg)
7849 {
7850 	struct lkpi_hw *lhw;
7851 	struct lkpi_chanctx *lchanctx;
7852 
7853 	KASSERT(hw != NULL && iterfunc != NULL,
7854 	    ("%s: hw %p iterfunc %p arg %p\n", __func__, hw, iterfunc, arg));
7855 
7856 	lhw = HW_TO_LHW(hw);
7857 
7858 	rcu_read_lock();
7859 	list_for_each_entry_rcu(lchanctx, &lhw->lchanctx_list, entry) {
7860 		if (!lchanctx->added_to_drv)
7861 			continue;
7862 		iterfunc(hw, &lchanctx->chanctx_conf, arg);
7863 	}
7864 	rcu_read_unlock();
7865 }
7866 
7867 void
7868 linuxkpi_ieee80211_iterate_stations_atomic(struct ieee80211_hw *hw,
7869    void (*iterfunc)(void *, struct ieee80211_sta *), void *arg)
7870 {
7871 	struct lkpi_hw *lhw;
7872 	struct lkpi_vif *lvif;
7873 	struct lkpi_sta *lsta;
7874 	struct ieee80211_sta *sta;
7875 
7876 	KASSERT(hw != NULL && iterfunc != NULL,
7877 	    ("%s: hw %p iterfunc %p arg %p\n", __func__, hw, iterfunc, arg));
7878 
7879 	lhw = HW_TO_LHW(hw);
7880 
7881 	LKPI_80211_LHW_LVIF_LOCK(lhw);
7882 	TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
7883 
7884 		rcu_read_lock();
7885 		list_for_each_entry_rcu(lsta, &lvif->lsta_list, lsta_list) {
7886 			if (!lsta->added_to_drv)
7887 				continue;
7888 			sta = LSTA_TO_STA(lsta);
7889 			iterfunc(arg, sta);
7890 		}
7891 		rcu_read_unlock();
7892 	}
7893 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
7894 }
7895 
7896 struct linuxkpi_ieee80211_regdomain *
7897 lkpi_get_linuxkpi_ieee80211_regdomain(size_t n)
7898 {
7899 	struct linuxkpi_ieee80211_regdomain *regd;
7900 
7901 	regd = kzalloc(sizeof(*regd) + n * sizeof(struct ieee80211_reg_rule),
7902 	    GFP_KERNEL);
7903 	return (regd);
7904 }
7905 
7906 int
7907 linuxkpi_regulatory_set_wiphy_regd_sync(struct wiphy *wiphy,
7908     struct linuxkpi_ieee80211_regdomain *regd)
7909 {
7910 	struct lkpi_hw *lhw;
7911 	struct ieee80211com *ic;
7912 	struct ieee80211_regdomain *rd;
7913 
7914 	lhw = wiphy_priv(wiphy);
7915 	ic = lhw->ic;
7916 
7917 	rd = &ic->ic_regdomain;
7918 	if (rd->isocc[0] == '\0') {
7919 		rd->isocc[0] = regd->alpha2[0];
7920 		rd->isocc[1] = regd->alpha2[1];
7921 	}
7922 
7923 	TODO();
7924 	/* XXX-BZ finish the rest. */
7925 
7926 	return (0);
7927 }
7928 
7929 void
7930 linuxkpi_ieee80211_scan_completed(struct ieee80211_hw *hw,
7931     struct cfg80211_scan_info *info)
7932 {
7933 	struct lkpi_hw *lhw;
7934 	struct ieee80211com *ic;
7935 	struct ieee80211_scan_state *ss;
7936 
7937 	lhw = wiphy_priv(hw->wiphy);
7938 	ic = lhw->ic;
7939 	ss = ic->ic_scan;
7940 
7941 	TRACE_SCAN(ic, "scan_flags %b info { %ju, %6D, aborted %d }",
7942 	    lhw->scan_flags, LKPI_LHW_SCAN_BITS,
7943 	    (uintmax_t)info->scan_start_tsf, info->tsf_bssid, ":",
7944 	    info->aborted);
7945 
7946 	ieee80211_scan_done(ss->ss_vap);
7947 
7948 	LKPI_80211_LHW_SCAN_LOCK(lhw);
7949 	free(lhw->hw_req, M_LKPI80211);
7950 	lhw->hw_req = NULL;
7951 	lhw->scan_flags &= ~LKPI_LHW_SCAN_RUNNING;
7952 	/* The wakeup(lhw) will be called from lkpi_ic_scan_end(). */
7953 	/* wakeup(lhw); */
7954 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
7955 
7956 	return;
7957 }
7958 
7959 static void
7960 lkpi_80211_lhw_rxq_rx_one(struct lkpi_hw *lhw, struct mbuf *m)
7961 {
7962 	struct ieee80211_node *ni;
7963 #ifdef LKPI_80211_USE_MTAG
7964 	struct m_tag *mtag;
7965 #endif
7966 	int ok;
7967 
7968 	ni = NULL;
7969 #ifdef LKPI_80211_USE_MTAG
7970         mtag = m_tag_locate(m, MTAG_ABI_LKPI80211, LKPI80211_TAG_RXNI, NULL);
7971 	if (mtag != NULL) {
7972 		struct lkpi_80211_tag_rxni *rxni;
7973 
7974 		rxni = (struct lkpi_80211_tag_rxni *)(mtag + 1);
7975 		ni = rxni->ni;
7976 	}
7977 #else
7978 	if (m->m_pkthdr.PH_loc.ptr != NULL) {
7979 		ni = m->m_pkthdr.PH_loc.ptr;
7980 		m->m_pkthdr.PH_loc.ptr = NULL;
7981 	}
7982 #endif
7983 
7984 	if (ni != NULL) {
7985 		ok = ieee80211_input_mimo(ni, m);
7986 		ieee80211_free_node(ni);		/* Release the reference. */
7987 		if (ok < 0)
7988 			m_freem(m);
7989 	} else {
7990 		ok = ieee80211_input_mimo_all(lhw->ic, m);
7991 		/* mbuf got consumed. */
7992 	}
7993 
7994 #ifdef LINUXKPI_DEBUG_80211
7995 	if (linuxkpi_debug_80211 & D80211_TRACE_RX)
7996 		printf("TRACE-RX: %s: handled frame type %#0x\n", __func__, ok);
7997 #endif
7998 }
7999 
8000 static void
8001 lkpi_80211_lhw_rxq_task(void *ctx, int pending)
8002 {
8003 	struct lkpi_hw *lhw;
8004 	struct mbufq mq;
8005 	struct mbuf *m;
8006 
8007 	lhw = ctx;
8008 
8009 #ifdef LINUXKPI_DEBUG_80211
8010 	if (linuxkpi_debug_80211 & D80211_TRACE_RX)
8011 		printf("TRACE-RX: %s: lhw %p pending %d mbuf_qlen %d\n",
8012 		    __func__, lhw, pending, mbufq_len(&lhw->rxq));
8013 #endif
8014 
8015 	mbufq_init(&mq, IFQ_MAXLEN);
8016 
8017 	LKPI_80211_LHW_RXQ_LOCK(lhw);
8018 	mbufq_concat(&mq, &lhw->rxq);
8019 	LKPI_80211_LHW_RXQ_UNLOCK(lhw);
8020 
8021 	m = mbufq_dequeue(&mq);
8022 	while (m != NULL) {
8023 		lkpi_80211_lhw_rxq_rx_one(lhw, m);
8024 		m = mbufq_dequeue(&mq);
8025 	}
8026 }
8027 
8028 static void
8029 lkpi_convert_rx_status(struct ieee80211_hw *hw, struct lkpi_sta *lsta,
8030     struct ieee80211_rx_status *rx_status,
8031     struct ieee80211_rx_stats *rx_stats,
8032     uint8_t *rssip)
8033 {
8034 	struct ieee80211_supported_band *supband;
8035 	struct rate_info rxrate;
8036 	int i;
8037 	uint8_t rssi;
8038 
8039 	memset(&rxrate, 0, sizeof(rxrate));
8040 	memset(rx_stats, 0, sizeof(*rx_stats));
8041 	rx_stats->r_flags = IEEE80211_R_NF | IEEE80211_R_RSSI;
8042 	/* XXX-BZ correct hardcoded noise floor, survey data? */
8043 	rx_stats->c_nf = -96;
8044 	if (ieee80211_hw_check(hw, SIGNAL_DBM) &&
8045 	    !(rx_status->flag & RX_FLAG_NO_SIGNAL_VAL))
8046 		rssi = rx_status->signal;
8047 	else
8048 		rssi = rx_stats->c_nf;
8049 	/*
8050 	 * net80211 signal strength data are in .5 dBm units relative to
8051 	 * the current noise floor (see comment in ieee80211_node.h).
8052 	 */
8053 	rssi -= rx_stats->c_nf;
8054 	if (rssip != NULL)
8055 		*rssip = rssi;
8056 	rx_stats->c_rssi = rssi * 2;
8057 	rx_stats->r_flags |= IEEE80211_R_BAND;
8058 	rx_stats->c_band =
8059 	    lkpi_nl80211_band_to_net80211_band(rx_status->band);
8060 	rx_stats->r_flags |= IEEE80211_R_FREQ | IEEE80211_R_IEEE;
8061 	rx_stats->c_freq = rx_status->freq;
8062 	rx_stats->c_ieee = ieee80211_mhz2ieee(rx_stats->c_freq, rx_stats->c_band);
8063 
8064 	rx_stats->c_rx_tsf = rx_status->mactime;
8065 
8066 	/* XXX RX_FLAG_MACTIME_IS_RTAP_TS64 ? */
8067 	if ((rx_status->flag & RX_FLAG_MACTIME) ==
8068 	    (RX_FLAG_MACTIME_START|RX_FLAG_MACTIME_END)) {
8069 		rx_stats->r_flags |= IEEE80211_R_TSF64;
8070 		/* XXX RX_FLAG_MACTIME_PLCP_START ? */
8071 		if ((rx_status->flag & RX_FLAG_MACTIME) == RX_FLAG_MACTIME_START)
8072 			rx_stats->r_flags |= IEEE80211_R_TSF_START;
8073 		if ((rx_status->flag & RX_FLAG_MACTIME) == RX_FLAG_MACTIME_END)
8074 			rx_stats->r_flags |= IEEE80211_R_TSF_END;
8075 		/* XXX-BZ if TSF_END will net80211 do the unwind of time? */
8076 	}
8077 
8078 	if (rx_status->chains != 0) {
8079 		int cc;
8080 		int8_t crssi;
8081 
8082 		rx_stats->c_chain = rx_status->chains;
8083 		rx_stats->r_flags |= IEEE80211_R_C_CHAIN;
8084 
8085 		cc = 0;
8086 		for (i = 0; i < nitems(rx_status->chain_signal); i++) {
8087 			if (!(rx_status->chains & BIT(i)))
8088 				continue;
8089 			crssi = rx_status->chain_signal[i];
8090 			crssi -= rx_stats->c_nf;
8091 			rx_stats->c_rssi_ctl[i] = crssi * 2;
8092 			rx_stats->c_rssi_ext[i] = crssi * 2;	/* XXX _ext ??? ATH thing? */
8093 			/* We currently only have the global noise floor value. */
8094 			rx_stats->c_nf_ctl[i] = rx_stats->c_nf;
8095 			rx_stats->c_nf_ext[i] = rx_stats->c_nf;
8096 			cc++;
8097 		}
8098 		if (cc > 0)
8099 			 rx_stats->r_flags |= (IEEE80211_R_C_NF | IEEE80211_R_C_RSSI);
8100 	}
8101 
8102 	/* XXX-NET80211 We are not going to populate c_phytype! */
8103 
8104 	switch (rx_status->encoding) {
8105 	case RX_ENC_LEGACY:
8106 	{
8107 		uint32_t legacy = 0;
8108 
8109 		supband = hw->wiphy->bands[rx_status->band];
8110 		if (supband != NULL)
8111 			legacy = supband->bitrates[rx_status->rate_idx].bitrate;
8112 		rx_stats->c_rate = legacy;
8113 		rxrate.legacy = legacy;
8114 		/* Is there a LinuxKPI way of reporting IEEE80211_RX_F_CCK / _OFDM? */
8115 		break;
8116 	}
8117 	case RX_ENC_HT:
8118 		rx_stats->c_pktflags |= IEEE80211_RX_F_HT;
8119 		rx_stats->c_rate = rx_status->rate_idx;		/* mcs */
8120 		rxrate.flags |= RATE_INFO_FLAGS_MCS;
8121 		rxrate.mcs = rx_status->rate_idx;
8122 		if ((rx_status->enc_flags & RX_ENC_FLAG_SHORT_GI) != 0) {
8123 			rx_stats->c_pktflags |= IEEE80211_RX_F_SHORTGI;
8124 			rxrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
8125 		}
8126 		break;
8127 	case RX_ENC_VHT:
8128 		rx_stats->c_pktflags |= IEEE80211_RX_F_VHT;
8129 		rx_stats->c_rate = rx_status->rate_idx;		/* mcs */
8130 		rx_stats->c_vhtnss = rx_status->nss;
8131 		rxrate.flags |= RATE_INFO_FLAGS_VHT_MCS;
8132 		rxrate.mcs = rx_status->rate_idx;
8133 		rxrate.nss = rx_status->nss;
8134 		if ((rx_status->enc_flags & RX_ENC_FLAG_SHORT_GI) != 0) {
8135 			rx_stats->c_pktflags |= IEEE80211_RX_F_SHORTGI;
8136 			rxrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
8137 		}
8138 		break;
8139 	case RX_ENC_HE:
8140 		rxrate.flags |= RATE_INFO_FLAGS_HE_MCS;
8141 		rxrate.mcs = rx_status->rate_idx;
8142 		rxrate.nss = rx_status->nss;
8143 		/* XXX TODO */
8144 		TODO("net80211 has not matching encoding for %u", rx_status->encoding);
8145 		break;
8146 	case RX_ENC_EHT:
8147 		rxrate.flags |= RATE_INFO_FLAGS_EHT_MCS;
8148 		rxrate.mcs = rx_status->rate_idx;
8149 		rxrate.nss = rx_status->nss;
8150 		/* XXX TODO */
8151 		TODO("net80211 has not matching encoding for %u", rx_status->encoding);
8152 		break;
8153 	}
8154 
8155 	rxrate.bw = rx_status->bw;
8156 	switch (rx_status->bw) {
8157 	case RATE_INFO_BW_20:
8158 		rx_stats->c_width = IEEE80211_RX_FW_20MHZ;
8159 		break;
8160 	case RATE_INFO_BW_40:
8161 		rx_stats->c_width = IEEE80211_RX_FW_40MHZ;
8162 		break;
8163 	case RATE_INFO_BW_80:
8164 		rx_stats->c_width = IEEE80211_RX_FW_80MHZ;
8165 		break;
8166 	case RATE_INFO_BW_160:
8167 		rx_stats->c_width = IEEE80211_RX_FW_160MHZ;
8168 		break;
8169 	case RATE_INFO_BW_320:
8170 	case RATE_INFO_BW_HE_RU:
8171 	case RATE_INFO_BW_EHT_RU:
8172 	case RATE_INFO_BW_5:
8173 	case RATE_INFO_BW_10:
8174 		TODO("net80211 has not matching bandwidth for %u", rx_status->bw);
8175 		break;
8176 	}
8177 
8178 	if ((rx_status->enc_flags & RX_ENC_FLAG_LDPC) != 0)
8179 		rx_stats->c_pktflags |= IEEE80211_RX_F_LDPC;
8180 	if ((rx_status->enc_flags & RX_ENC_FLAG_STBC_MASK) != 0)
8181 		 rx_stats->c_pktflags |= IEEE80211_RX_F_STBC;
8182 
8183 	/*
8184 	 * We only need these for LKPI_80211_HW_CRYPTO in theory but in
8185 	 * case the hardware does something we do not expect always leave
8186 	 * these enabled.  Leaving this commant as documentation for the || 1.
8187 	 */
8188 #if defined(LKPI_80211_HW_CRYPTO) || 1
8189 	if (rx_status->flag & RX_FLAG_DECRYPTED) {
8190 		rx_stats->c_pktflags |= IEEE80211_RX_F_DECRYPTED;
8191 		/* Only valid if decrypted is set. */
8192 		if (rx_status->flag & RX_FLAG_PN_VALIDATED)
8193 			rx_stats->c_pktflags |= IEEE80211_RX_F_PN_VALIDATED;
8194 	}
8195 	if (rx_status->flag & RX_FLAG_IV_STRIPPED)
8196 		rx_stats->c_pktflags |= IEEE80211_RX_F_IV_STRIP;
8197 	if (rx_status->flag & RX_FLAG_ICV_STRIPPED)
8198 		rx_stats->c_pktflags |= IEEE80211_RX_F_ICV_STRIP;
8199 	if (rx_status->flag & RX_FLAG_MIC_STRIPPED)
8200 		rx_stats->c_pktflags |= IEEE80211_RX_F_MIC_STRIP;
8201 	if (rx_status->flag & RX_FLAG_MMIC_STRIPPED)
8202 		rx_stats->c_pktflags |= IEEE80211_RX_F_MMIC_STRIP;
8203 	if (rx_status->flag & RX_FLAG_MMIC_ERROR)
8204 		rx_stats->c_pktflags |= IEEE80211_RX_F_FAIL_MMIC;
8205 	if (rx_status->flag & RX_FLAG_FAILED_FCS_CRC)
8206 		rx_stats->c_pktflags |= IEEE80211_RX_F_FAIL_FCSCRC;
8207 #endif
8208 
8209 	/* Fill in some sinfo bits to fill gaps not reported byt the driver. */
8210 	if (lsta != NULL) {
8211 		memcpy(&lsta->sinfo.rxrate, &rxrate, sizeof(rxrate));
8212 		lsta->sinfo.filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
8213 
8214 		if (rx_status->chains != 0) {
8215 			lsta->sinfo.chains = rx_status->chains;
8216 			memcpy(lsta->sinfo.chain_signal, rx_status->chain_signal,
8217 			    sizeof(lsta->sinfo.chain_signal));
8218 			lsta->sinfo.filled |= BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL);
8219 		}
8220 	}
8221 }
8222 
8223 #ifdef LINUXKPI_DEBUG_80211
8224 static void
8225 lkpi_rx_log_beacon(struct mbuf *m, struct lkpi_hw *lhw,
8226     struct ieee80211_rx_status *rx_status)
8227 {
8228 	struct ieee80211_mgmt *f;
8229 	uint8_t *e;
8230 	char ssid[IEEE80211_NWID_LEN * 4 + 1];
8231 
8232 	memset(ssid, '\0', sizeof(ssid));
8233 
8234 	f = mtod(m, struct ieee80211_mgmt *);
8235 	e = f->u.beacon.variable;
8236 	/*
8237 	 * Usually SSID is right after the fixed part and for debugging we will
8238 	 * be fine should we miss it if it is not.
8239 	 */
8240 	while ((e - (uint8_t *)f) < m->m_len) {
8241 		if (*e == IEEE80211_ELEMID_SSID)
8242 			break;
8243 		e += (2 + *(e + 1));
8244 	}
8245 	if (*e == IEEE80211_ELEMID_SSID) {
8246 		int i, len;
8247 		char *p;
8248 
8249 		p = ssid;
8250 		len = m->m_len - ((e + 2) - (uint8_t *)f);
8251 		if (len > *(e + 1))
8252 			len = *(e + 1);
8253 		e += 2;
8254 		for (i = 0; i < len; i++) {
8255 			/* Printable character? */
8256 			if (*e >= 0x20 && *e < 0x7f) {
8257 				*p++ = *e++;
8258 			} else {
8259 				snprintf(p, 5, "%#04x", *e++);
8260 				p += 4;
8261 			}
8262 		}
8263 		*p = '\0';
8264 	}
8265 
8266 	/* We print skb, skb->data, m as we are seeing 'ghost beacons'. */
8267 	TRACE_SCAN_BEACON(lhw->ic, "Beacon: scan_flags %b, band %s freq %u chan %-4d "
8268 	    "len %d { %#06x %#06x %6D %6D %6D %#06x %ju %u %#06x SSID '%s' }",
8269 	    lhw->scan_flags, LKPI_LHW_SCAN_BITS,
8270 	    lkpi_nl80211_band_name(rx_status->band), rx_status->freq,
8271 	    linuxkpi_ieee80211_frequency_to_channel(rx_status->freq, 0),
8272 	    m->m_pkthdr.len, f->frame_control, f->duration_id,
8273 	    f->da, ":", f->sa, ":", f->bssid, ":", f->seq_ctrl,
8274 	    (uintmax_t)le64_to_cpu(f->u.beacon.timestamp),
8275 	    le16_to_cpu(f->u.beacon.beacon_int),
8276 	    le16_to_cpu(f->u.beacon.capab_info), ssid);
8277 }
8278 #endif
8279 
8280 /* For %list see comment towards the end of the function. */
8281 void
8282 linuxkpi_ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
8283     struct ieee80211_sta *sta, struct napi_struct *napi __unused,
8284     struct list_head *list __unused)
8285 {
8286 	struct lkpi_hw *lhw;
8287 	struct ieee80211com *ic;
8288 	struct mbuf *m;
8289 	struct skb_shared_info *shinfo;
8290 	struct ieee80211_rx_status *rx_status;
8291 	struct ieee80211_rx_stats rx_stats;
8292 	struct ieee80211_node *ni;
8293 	struct ieee80211vap *vap;
8294 	struct ieee80211_hdr *hdr;
8295 	struct lkpi_sta *lsta;
8296 	int i, offset, ok, error;
8297 	uint8_t rssi;
8298 	bool is_beacon;
8299 
8300 	lhw = HW_TO_LHW(hw);
8301 	ic = lhw->ic;
8302 
8303 	if (skb->len < 2) {
8304 		/* Need 80211 stats here. */
8305 		counter_u64_add(ic->ic_ierrors, 1);
8306 		IMPROVE();
8307 		goto err;
8308 	}
8309 
8310 	/*
8311 	 * For now do the data copy; we can later improve things. Might even
8312 	 * have an mbuf backing the skb data then?
8313 	 */
8314 	m = m_get3(skb->len, M_NOWAIT, MT_DATA, M_PKTHDR);
8315 	if (m == NULL) {
8316 		counter_u64_add(ic->ic_ierrors, 1);
8317 		goto err;
8318 	}
8319 	m_copyback(m, 0, skb->tail - skb->data, skb->data);
8320 
8321 	shinfo = skb_shinfo(skb);
8322 	offset = m->m_len;
8323 	for (i = 0; i < shinfo->nr_frags; i++) {
8324 		m_copyback(m, offset, shinfo->frags[i].size,
8325 		    (uint8_t *)linux_page_address(shinfo->frags[i].page) +
8326 		    shinfo->frags[i].offset);
8327 		offset += shinfo->frags[i].size;
8328 	}
8329 
8330 	rx_status = IEEE80211_SKB_RXCB(skb);
8331 
8332 	hdr = (void *)skb->data;
8333 	is_beacon = ieee80211_is_beacon(hdr->frame_control);
8334 
8335 #ifdef LINUXKPI_DEBUG_80211
8336 	/*
8337 	 * We use the mbuf here as otherwise the variable part might
8338 	 * be in skb frags.
8339 	 */
8340 	if (is_beacon && ((linuxkpi_debug_80211 & D80211_SCAN_BEACON) != 0))
8341 		lkpi_rx_log_beacon(m, lhw, rx_status);
8342 
8343 	if (is_beacon && (linuxkpi_debug_80211 & D80211_TRACE_RX_BEACONS) == 0 &&
8344 	   (linuxkpi_debug_80211 & D80211_SCAN_BEACON) == 0)
8345 		goto no_trace_beacons;
8346 
8347 	if (linuxkpi_debug_80211 & D80211_TRACE_RX)
8348 		printf("TRACE-RX: %s: skb %p l/d/t-len (%u/%u/%u) "
8349 		    "h %p d %p t %p e %p sh %p (%u) m %p plen %u len %u%s\n",
8350 		    __func__, skb, skb->len, skb->data_len,
8351 		    skb->truesize, skb->head, skb->data, skb->tail, skb->end,
8352 		    shinfo, shinfo->nr_frags,
8353 		    m, m->m_pkthdr.len, m->m_len, is_beacon ? " beacon" : "");
8354 
8355 	if (linuxkpi_debug_80211 & D80211_TRACE_RX_DUMP)
8356 		hexdump(mtod(m, const void *), m->m_len, "RX (raw) ", 0);
8357 
8358 	/* Implement a dump_rxcb() !!! */
8359 	if ((linuxkpi_debug_80211 & D80211_TRACE_RX) != 0 ||
8360 	    (linuxkpi_debug_80211 & D80211_SCAN_BEACON) != 0)
8361 		printf("TRACE-RX: %s: RXCB: %ju %ju %u, %b, %u, %#0x, %#0x, "
8362 		    "%u band %u, %u { %d %d %d %d }, %d, %#x %#x %#x %#x %u %u %u\n",
8363 			__func__,
8364 			(uintmax_t)rx_status->boottime_ns,
8365 			(uintmax_t)rx_status->mactime,
8366 			rx_status->device_timestamp,
8367 			rx_status->flag, IEEE80211_RX_STATUS_FLAGS_BITS,
8368 			rx_status->freq,
8369 			rx_status->bw,
8370 			rx_status->encoding,
8371 			rx_status->ampdu_reference,
8372 			rx_status->band,
8373 			rx_status->chains,
8374 			rx_status->chain_signal[0],
8375 			rx_status->chain_signal[1],
8376 			rx_status->chain_signal[2],
8377 			rx_status->chain_signal[3],
8378 			rx_status->signal,
8379 			rx_status->enc_flags,
8380 			rx_status->he_dcm,
8381 			rx_status->he_gi,
8382 			rx_status->he_ru,
8383 			rx_status->zero_length_psdu_type,
8384 			rx_status->nss,
8385 			rx_status->rate_idx);
8386 no_trace_beacons:
8387 #endif
8388 
8389 	lsta = NULL;
8390 	if (sta != NULL) {
8391 		lsta = STA_TO_LSTA(sta);
8392 		ni = ieee80211_ref_node(lsta->ni);
8393 	} else {
8394 		struct ieee80211_frame_min *wh;
8395 
8396 		wh = mtod(m, struct ieee80211_frame_min *);
8397 		ni = ieee80211_find_rxnode(ic, wh);
8398 		if (ni != NULL)
8399 			lsta = ni->ni_drv_data;
8400 	}
8401 
8402 	rssi = 0;
8403 	lkpi_convert_rx_status(hw, lsta, rx_status, &rx_stats, &rssi);
8404 
8405 	ok = ieee80211_add_rx_params(m, &rx_stats);
8406 	if (ok == 0) {
8407 		m_freem(m);
8408 		counter_u64_add(ic->ic_ierrors, 1);
8409 		goto err;
8410 	}
8411 
8412 	if (ni != NULL)
8413 		vap = ni->ni_vap;
8414 	else
8415 		/*
8416 		 * XXX-BZ can we improve this by looking at the frame hdr
8417 		 * or other meta-data passed up?
8418 		 */
8419 		vap = TAILQ_FIRST(&ic->ic_vaps);
8420 
8421 #ifdef LINUXKPI_DEBUG_80211
8422 	if (linuxkpi_debug_80211 & D80211_TRACE_RX)
8423 		printf("TRACE-RX: %s: sta %p lsta %p state %d ni %p vap %p%s\n",
8424 		    __func__, sta, lsta, (lsta != NULL) ? lsta->state : -1,
8425 		    ni, vap, is_beacon ? " beacon" : "");
8426 #endif
8427 
8428 	if (ni != NULL && vap != NULL && is_beacon &&
8429 	    rx_status->device_timestamp > 0 &&
8430 	    m->m_pkthdr.len >= sizeof(struct ieee80211_frame)) {
8431 		struct lkpi_vif *lvif;
8432 		struct ieee80211_vif *vif;
8433 		struct ieee80211_frame *wh;
8434 
8435 		lvif = VAP_TO_LVIF(vap);
8436 		vif = LVIF_TO_VIF(lvif);
8437 
8438 		wh = mtod(m, struct ieee80211_frame *);
8439 		if (!IEEE80211_ADDR_EQ(wh->i_addr2, vif->cfg.ap_addr))
8440 			goto skip_device_ts;
8441 
8442 		IMPROVE("TIMING_BEACON_ONLY?");
8443 		/* mac80211 specific (not net80211) so keep it here. */
8444 		vif->bss_conf.sync_device_ts = rx_status->device_timestamp;
8445 		/*
8446 		 * net80211 should take care of the other information (sync_tsf,
8447 		 * sync_dtim_count) as otherwise we need to parse the beacon.
8448 		 */
8449 skip_device_ts:
8450 		;
8451 	}
8452 
8453 	if (vap != NULL && vap->iv_state > IEEE80211_S_INIT &&
8454 	    ieee80211_radiotap_active_vap(vap)) {
8455 		struct lkpi_radiotap_rx_hdr *rtap;
8456 
8457 		rtap = &lhw->rtap_rx;
8458 		rtap->wr_tsft = rx_status->device_timestamp;
8459 		rtap->wr_flags = 0;
8460 		if (rx_status->enc_flags & RX_ENC_FLAG_SHORTPRE)
8461 			rtap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
8462 		if (rx_status->enc_flags & RX_ENC_FLAG_SHORT_GI)
8463 			rtap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTGI;
8464 #if 0	/* .. or it does not given we strip it below. */
8465 		if (ieee80211_hw_check(hw, RX_INCLUDES_FCS))
8466 			rtap->wr_flags |= IEEE80211_RADIOTAP_F_FCS;
8467 #endif
8468 		if (rx_status->flag & RX_FLAG_FAILED_FCS_CRC)
8469 			rtap->wr_flags |= IEEE80211_RADIOTAP_F_BADFCS;
8470 		rtap->wr_rate = 0;
8471 		IMPROVE();
8472 		/* XXX TODO status->encoding / rate_index / bw */
8473 		rtap->wr_chan_freq = htole16(rx_stats.c_freq);
8474 		if (ic->ic_curchan->ic_ieee == rx_stats.c_ieee)
8475 			rtap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
8476 		rtap->wr_dbm_antsignal = rssi;
8477 		rtap->wr_dbm_antnoise = rx_stats.c_nf;
8478 	}
8479 
8480 	if (ieee80211_hw_check(hw, RX_INCLUDES_FCS))
8481 		m_adj(m, -IEEE80211_CRC_LEN);
8482 
8483 #if 0
8484 	if (list != NULL) {
8485 		/*
8486 		* Normally this would be queued up and delivered by
8487 		* netif_receive_skb_list(), napi_gro_receive(), or the like.
8488 		* See mt76::mac80211.c as only current possible consumer.
8489 		*/
8490 		IMPROVE("we simply pass the packet to net80211 to deal with.");
8491 	}
8492 #endif
8493 
8494 	/* Attach meta-information to the mbuf for the deferred RX path. */
8495 	if (ni != NULL) {
8496 #ifdef LKPI_80211_USE_MTAG
8497 		struct m_tag *mtag;
8498 		struct lkpi_80211_tag_rxni *rxni;
8499 
8500 		mtag = m_tag_alloc(MTAG_ABI_LKPI80211, LKPI80211_TAG_RXNI,
8501 		    sizeof(*rxni), IEEE80211_M_NOWAIT);
8502 		if (mtag == NULL) {
8503 			m_freem(m);
8504 			counter_u64_add(ic->ic_ierrors, 1);
8505 			goto err;
8506 		}
8507 		rxni = (struct lkpi_80211_tag_rxni *)(mtag + 1);
8508 		rxni->ni = ni;		/* We hold a reference. */
8509 		m_tag_prepend(m, mtag);
8510 #else
8511 		m->m_pkthdr.PH_loc.ptr = ni;	/* We hold a reference. */
8512 #endif
8513 	}
8514 
8515 	LKPI_80211_LHW_RXQ_LOCK(lhw);
8516 	if (lhw->rxq_stopped) {
8517 		LKPI_80211_LHW_RXQ_UNLOCK(lhw);
8518 		m_freem(m);
8519 		counter_u64_add(ic->ic_ierrors, 1);
8520 		goto err;
8521 	}
8522 
8523 	error = mbufq_enqueue(&lhw->rxq, m);
8524 	if (error != 0) {
8525 		LKPI_80211_LHW_RXQ_UNLOCK(lhw);
8526 		m_freem(m);
8527 		counter_u64_add(ic->ic_ierrors, 1);
8528 #ifdef LINUXKPI_DEBUG_80211
8529 		if (linuxkpi_debug_80211 & D80211_TRACE_RX)
8530 			ic_printf(ni->ni_ic, "%s: mbufq_enqueue failed: %d\n",
8531 			    __func__, error);
8532 #endif
8533 		goto err;
8534 	}
8535 	taskqueue_enqueue(taskqueue_thread, &lhw->rxq_task);
8536 	LKPI_80211_LHW_RXQ_UNLOCK(lhw);
8537 
8538 	IMPROVE();
8539 
8540 err:
8541 	/* The skb is ours so we can free it :-) */
8542 	kfree_skb(skb);
8543 }
8544 
8545 uint8_t
8546 linuxkpi_ieee80211_get_tid(struct ieee80211_hdr *hdr, bool nonqos_ok)
8547 {
8548 	const struct ieee80211_frame *wh;
8549 	uint8_t tid;
8550 
8551 	/* Linux seems to assume this is a QOS-Data-Frame */
8552 	KASSERT(nonqos_ok || ieee80211_is_data_qos(hdr->frame_control),
8553 	   ("%s: hdr %p fc %#06x not qos_data\n", __func__, hdr,
8554 	   hdr->frame_control));
8555 
8556 	wh = (const struct ieee80211_frame *)hdr;
8557 	tid = ieee80211_gettid(wh);
8558 	KASSERT(nonqos_ok || tid == (tid & IEEE80211_QOS_TID), ("%s: tid %u "
8559 	   "not expected (%u?)\n", __func__, tid, IEEE80211_NONQOS_TID));
8560 
8561 	return (tid);
8562 }
8563 
8564 /* -------------------------------------------------------------------------- */
8565 
8566 static void
8567 lkpi_wiphy_work(struct work_struct *work)
8568 {
8569 	struct lkpi_wiphy *lwiphy;
8570 	struct wiphy *wiphy;
8571 	struct wiphy_work *wk;
8572 
8573 	lwiphy = container_of(work, struct lkpi_wiphy, wwk);
8574 	wiphy = LWIPHY_TO_WIPHY(lwiphy);
8575 
8576 	wiphy_lock(wiphy);
8577 
8578 	LKPI_80211_LWIPHY_WORK_LOCK(lwiphy);
8579 	wk = list_first_entry_or_null(&lwiphy->wwk_list, struct wiphy_work, entry);
8580 	/* If there is nothing we do nothing. */
8581 	if (wk == NULL) {
8582 		LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8583 		wiphy_unlock(wiphy);
8584 		return;
8585 	}
8586 	list_del_init(&wk->entry);
8587 
8588 	/* More work to do? */
8589 	if (!list_empty(&lwiphy->wwk_list))
8590 		schedule_work(work);
8591 	LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8592 
8593 	/* Finally call the (*wiphy_work_fn)() function. */
8594 	wk->fn(wiphy, wk);
8595 
8596 	wiphy_unlock(wiphy);
8597 }
8598 
8599 void
8600 linuxkpi_wiphy_work_queue(struct wiphy *wiphy, struct wiphy_work *wwk)
8601 {
8602 	struct lkpi_wiphy *lwiphy;
8603 
8604 	lwiphy = WIPHY_TO_LWIPHY(wiphy);
8605 
8606 	LKPI_80211_LWIPHY_WORK_LOCK(lwiphy);
8607 	/* Do not double-queue. */
8608 	if (list_empty(&wwk->entry))
8609 		list_add_tail(&wwk->entry, &lwiphy->wwk_list);
8610 	LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8611 
8612 	/*
8613 	 * See how ieee80211_queue_work() work continues in Linux or if things
8614 	 * migrate here over time?
8615 	 * Use a system queue from linux/workqueue.h for now.
8616 	 */
8617 	queue_work(system_wq, &lwiphy->wwk);
8618 }
8619 
8620 void
8621 linuxkpi_wiphy_work_cancel(struct wiphy *wiphy, struct wiphy_work *wwk)
8622 {
8623 	struct lkpi_wiphy *lwiphy;
8624 
8625 	lwiphy = WIPHY_TO_LWIPHY(wiphy);
8626 
8627 	LKPI_80211_LWIPHY_WORK_LOCK(lwiphy);
8628 	/* Only cancel if queued. */
8629 	if (!list_empty(&wwk->entry))
8630 		list_del_init(&wwk->entry);
8631 	LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8632 }
8633 
8634 void
8635 linuxkpi_wiphy_work_flush(struct wiphy *wiphy, struct wiphy_work *wwk)
8636 {
8637 	struct lkpi_wiphy *lwiphy;
8638 	struct wiphy_work *wk;
8639 
8640 	lwiphy = WIPHY_TO_LWIPHY(wiphy);
8641 	LKPI_80211_LWIPHY_WORK_LOCK(lwiphy);
8642 	/* If wwk is unset, flush everything; called when wiphy is shut down. */
8643 	if (wwk != NULL && list_empty(&wwk->entry)) {
8644 		LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8645 		return;
8646 	}
8647 
8648 	while (!list_empty(&lwiphy->wwk_list)) {
8649 
8650 		wk = list_first_entry(&lwiphy->wwk_list, struct wiphy_work,
8651 		    entry);
8652 		list_del_init(&wk->entry);
8653 		LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8654 		wk->fn(wiphy, wk);
8655 		LKPI_80211_LWIPHY_WORK_LOCK(lwiphy);
8656 		if (wk == wwk)
8657 			break;
8658 	}
8659 	LKPI_80211_LWIPHY_WORK_UNLOCK(lwiphy);
8660 }
8661 
8662 void
8663 lkpi_wiphy_delayed_work_timer(struct timer_list *tl)
8664 {
8665 	struct wiphy_delayed_work *wdwk;
8666 
8667 	wdwk = timer_container_of(wdwk, tl, timer);
8668 	wiphy_work_queue(wdwk->wiphy, &wdwk->work);
8669 }
8670 
8671 void
8672 linuxkpi_wiphy_delayed_work_queue(struct wiphy *wiphy,
8673     struct wiphy_delayed_work *wdwk, unsigned long delay)
8674 {
8675 	if (delay == 0) {
8676 		/* Run right away. */
8677 		del_timer(&wdwk->timer);
8678 		wiphy_work_queue(wiphy, &wdwk->work);
8679 	} else {
8680 		wdwk->wiphy = wiphy;
8681 		mod_timer(&wdwk->timer, jiffies + delay);
8682 	}
8683 }
8684 
8685 void
8686 linuxkpi_wiphy_delayed_work_cancel(struct wiphy *wiphy,
8687     struct wiphy_delayed_work *wdwk)
8688 {
8689 	del_timer_sync(&wdwk->timer);
8690 	wiphy_work_cancel(wiphy, &wdwk->work);
8691 }
8692 
8693 void
8694 linuxkpi_wiphy_delayed_work_flush(struct wiphy *wiphy,
8695     struct wiphy_delayed_work *wdwk)
8696 {
8697 	lockdep_assert_held(&wiphy->mtx);
8698 
8699 	del_timer_sync(&wdwk->timer);
8700 	wiphy_work_flush(wiphy, &wdwk->work);
8701 }
8702 
8703 /* -------------------------------------------------------------------------- */
8704 
8705 struct wiphy *
8706 linuxkpi_wiphy_new(const struct cfg80211_ops *ops, size_t priv_len)
8707 {
8708 	struct lkpi_wiphy *lwiphy;
8709 	struct wiphy *wiphy;
8710 
8711 	lwiphy = kzalloc(sizeof(*lwiphy) + priv_len, GFP_KERNEL);
8712 	if (lwiphy == NULL)
8713 		return (NULL);
8714 	lwiphy->ops = ops;
8715 
8716 	LKPI_80211_LWIPHY_WORK_LOCK_INIT(lwiphy);
8717 	INIT_LIST_HEAD(&lwiphy->wwk_list);
8718 	INIT_WORK(&lwiphy->wwk, lkpi_wiphy_work);
8719 
8720 	wiphy = LWIPHY_TO_WIPHY(lwiphy);
8721 
8722 	mutex_init(&wiphy->mtx);
8723 	TODO();
8724 
8725 	return (wiphy);
8726 }
8727 
8728 void
8729 linuxkpi_wiphy_free(struct wiphy *wiphy)
8730 {
8731 	struct lkpi_wiphy *lwiphy;
8732 
8733 	if (wiphy == NULL)
8734 		return;
8735 
8736 	linuxkpi_wiphy_work_flush(wiphy, NULL);
8737 	mutex_destroy(&wiphy->mtx);
8738 
8739 	lwiphy = WIPHY_TO_LWIPHY(wiphy);
8740 	LKPI_80211_LWIPHY_WORK_LOCK_DESTROY(lwiphy);
8741 
8742 	kfree(lwiphy);
8743 }
8744 
8745 static void
8746 lkpi_wiphy_band_annotate(struct wiphy *wiphy)
8747 {
8748 	int band;
8749 
8750 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
8751 		struct ieee80211_supported_band *supband;
8752 		int i;
8753 
8754 		supband = wiphy->bands[band];
8755 		if (supband == NULL)
8756 			continue;
8757 
8758 		switch (band) {
8759 		case NL80211_BAND_2GHZ:
8760 		case NL80211_BAND_5GHZ:
8761 			break;
8762 		default:
8763 #ifdef LINUXKPI_DEBUG_80211
8764 			IMPROVE("band %d(%s) not yet supported",
8765 			    band, lkpi_nl80211_band_name(band));
8766 			/* For bands added here, also check lkpi_lsta_alloc(). */
8767 #endif
8768 			continue;
8769 		}
8770 
8771 		/* Band bitrates are times 10; e.g., 55 is 5.5Mbit/s. */
8772 		for (i = 0; i < supband->n_bitrates; i++) {
8773 			switch (band) {
8774 			case NL80211_BAND_2GHZ:
8775 				switch (supband->bitrates[i].bitrate) {
8776 				case 110:
8777 				case 55:
8778 				case 20:
8779 				case 10:
8780 					supband->bitrates[i].flags |=
8781 					    IEEE80211_RATE_MANDATORY_B;
8782 					/* FALLTHROUGH */
8783 				/* 11g only */
8784 				case 240:
8785 				case 120:
8786 				case 60:
8787 					supband->bitrates[i].flags |=
8788 					    IEEE80211_RATE_MANDATORY_G;
8789 					break;
8790 				}
8791 				break;
8792 			case NL80211_BAND_5GHZ:
8793 				switch (supband->bitrates[i].bitrate) {
8794 				case 240:
8795 				case 120:
8796 				case 60:
8797 					supband->bitrates[i].flags |=
8798 					    IEEE80211_RATE_MANDATORY_A;
8799 					break;
8800 				}
8801 				break;
8802 			}
8803 			TRACE_RATES("band %d bitrate[%d/%u] %u flags %#010x",
8804 			    band, i, supband->n_bitrates,
8805 			    supband->bitrates[i].bitrate,
8806 			    supband->bitrates[i].flags);
8807 		}
8808 	}
8809 }
8810 
8811 int
8812 linuxkpi_80211_wiphy_register(struct wiphy *wiphy)
8813 {
8814 	TODO("Lots of checks and initialization");
8815 
8816 	lkpi_wiphy_band_annotate(wiphy);
8817 
8818 	return (0);
8819 }
8820 
8821 static uint32_t
8822 lkpi_cfg80211_calculate_bitrate_ht(struct rate_info *rate)
8823 {
8824 	TODO("cfg80211_calculate_bitrate_ht");
8825 	return (rate->legacy);
8826 }
8827 
8828 static uint32_t
8829 lkpi_cfg80211_calculate_bitrate_vht(struct rate_info *rate)
8830 {
8831 	TODO("cfg80211_calculate_bitrate_vht");
8832 	return (rate->legacy);
8833 }
8834 
8835 uint32_t
8836 linuxkpi_cfg80211_calculate_bitrate(struct rate_info *rate)
8837 {
8838 
8839 	/* Beware: order! */
8840 	if (rate->flags & RATE_INFO_FLAGS_MCS)
8841 		return (lkpi_cfg80211_calculate_bitrate_ht(rate));
8842 
8843 	if (rate->flags & RATE_INFO_FLAGS_VHT_MCS)
8844 		return (lkpi_cfg80211_calculate_bitrate_vht(rate));
8845 
8846 	IMPROVE("HE/EHT/...");
8847 
8848 	return (rate->legacy);
8849 }
8850 
8851 uint32_t
8852 linuxkpi_ieee80211_channel_to_frequency(uint32_t channel,
8853     enum nl80211_band band)
8854 {
8855 
8856 	switch (band) {
8857 	case NL80211_BAND_2GHZ:
8858 		return (ieee80211_ieee2mhz(channel, IEEE80211_CHAN_2GHZ));
8859 		break;
8860 	case NL80211_BAND_5GHZ:
8861 		return (ieee80211_ieee2mhz(channel, IEEE80211_CHAN_5GHZ));
8862 		break;
8863 	default:
8864 		/* XXX abort, retry, error, panic? */
8865 		break;
8866 	}
8867 
8868 	return (0);
8869 }
8870 
8871 uint32_t
8872 linuxkpi_ieee80211_frequency_to_channel(uint32_t freq, uint32_t flags __unused)
8873 {
8874 
8875 	return (ieee80211_mhz2ieee(freq, 0));
8876 }
8877 
8878 #if 0
8879 static struct lkpi_sta *
8880 lkpi_find_lsta_by_ni(struct lkpi_vif *lvif, struct ieee80211_node *ni)
8881 {
8882 	struct lkpi_sta *lsta, *temp;
8883 
8884 	rcu_read_lock();
8885 	list_for_each_entry_rcu(lsta, &lvif->lsta_list, lsta_list) {
8886 		if (lsta->ni == ni) {
8887 			rcu_read_unlock();
8888 			return (lsta);
8889 		}
8890 	}
8891 	rcu_read_unlock();
8892 
8893 	return (NULL);
8894 }
8895 #endif
8896 
8897 struct ieee80211_sta *
8898 linuxkpi_ieee80211_find_sta(struct ieee80211_vif *vif, const u8 *peer)
8899 {
8900 	struct lkpi_vif *lvif;
8901 	struct lkpi_sta *lsta;
8902 	struct ieee80211_sta *sta;
8903 
8904 	lvif = VIF_TO_LVIF(vif);
8905 
8906 	rcu_read_lock();
8907 	list_for_each_entry_rcu(lsta, &lvif->lsta_list, lsta_list) {
8908 		sta = LSTA_TO_STA(lsta);
8909 		if (IEEE80211_ADDR_EQ(sta->addr, peer)) {
8910 			rcu_read_unlock();
8911 			return (sta);
8912 		}
8913 	}
8914 	rcu_read_unlock();
8915 	return (NULL);
8916 }
8917 
8918 struct ieee80211_sta *
8919 linuxkpi_ieee80211_find_sta_by_ifaddr(struct ieee80211_hw *hw,
8920     const uint8_t *addr, const uint8_t *ourvifaddr)
8921 {
8922 	struct lkpi_hw *lhw;
8923 	struct lkpi_vif *lvif;
8924 	struct lkpi_sta *lsta;
8925 	struct ieee80211_vif *vif;
8926 	struct ieee80211_sta *sta;
8927 
8928 	lhw = wiphy_priv(hw->wiphy);
8929 	sta = NULL;
8930 
8931 	LKPI_80211_LHW_LVIF_LOCK(lhw);
8932 	TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
8933 
8934 		/* XXX-BZ check our address from the vif. */
8935 
8936 		vif = LVIF_TO_VIF(lvif);
8937 		if (ourvifaddr != NULL &&
8938 		    !IEEE80211_ADDR_EQ(vif->addr, ourvifaddr))
8939 			continue;
8940 		sta = linuxkpi_ieee80211_find_sta(vif, addr);
8941 		if (sta != NULL)
8942 			break;
8943 	}
8944 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
8945 
8946 	if (sta != NULL) {
8947 		lsta = STA_TO_LSTA(sta);
8948 		if (!lsta->added_to_drv)
8949 			return (NULL);
8950 	}
8951 
8952 	return (sta);
8953 }
8954 
8955 struct sk_buff *
8956 linuxkpi_ieee80211_tx_dequeue(struct ieee80211_hw *hw,
8957     struct ieee80211_txq *txq)
8958 {
8959 	struct lkpi_txq *ltxq;
8960 	struct lkpi_vif *lvif;
8961 	struct sk_buff *skb;
8962 
8963 	IMPROVE("wiphy_lock? or assert?");
8964 	skb = NULL;
8965 	ltxq = TXQ_TO_LTXQ(txq);
8966 	ltxq->flags |= LKPI_TXQ_SEEN_DEQUEUE;
8967 
8968 	if ((ltxq->flags & (LKPI_TXQ_STOPPED|LKPI_TXQ_STOPPED_BA)) != 0)
8969 		goto stopped;
8970 
8971 	lvif = VIF_TO_LVIF(ltxq->txq.vif);
8972 	if (lvif->hw_queue_stopped[ltxq->txq.ac]) {
8973 		ltxq->flags |= LKPI_TXQ_STOPPED;
8974 		goto stopped;
8975 	}
8976 
8977 	IMPROVE("hw(TX_FRAG_LIST)");
8978 
8979 	LKPI_80211_LTXQ_LOCK(ltxq);
8980 	skb = skb_dequeue(&ltxq->skbq);
8981 	if (skb != NULL)
8982 		ltxq->frms_dequeued++;
8983 	LKPI_80211_LTXQ_UNLOCK(ltxq);
8984 
8985 stopped:
8986 	return (skb);
8987 }
8988 
8989 void
8990 linuxkpi_ieee80211_txq_get_depth(struct ieee80211_txq *txq,
8991     unsigned long *frame_cnt, unsigned long *byte_cnt)
8992 {
8993 	struct lkpi_txq *ltxq;
8994 	struct sk_buff *skb;
8995 	unsigned long fc, bc;
8996 
8997 	ltxq = TXQ_TO_LTXQ(txq);
8998 
8999 	fc = bc = 0;
9000 	LKPI_80211_LTXQ_LOCK(ltxq);
9001 	skb_queue_walk(&ltxq->skbq, skb) {
9002 		fc++;
9003 		bc += skb->len;
9004 	}
9005 	LKPI_80211_LTXQ_UNLOCK(ltxq);
9006 	if (frame_cnt)
9007 		*frame_cnt = fc;
9008 	if (byte_cnt)
9009 		*byte_cnt = bc;
9010 
9011 	/* Validate that this is doing the correct thing. */
9012 	/* Should we keep track on en/dequeue? */
9013 	IMPROVE();
9014 }
9015 
9016 /*
9017  * We are called from ieee80211_free_txskb() or ieee80211_tx_status().
9018  * The latter tries to derive the success status from the info flags
9019  * passed back from the driver.  rawx_mit() saves the ni on the m and the
9020  * m on the skb for us to be able to give feedback to net80211.
9021  */
9022 static void
9023 _lkpi_ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb,
9024     int status)
9025 {
9026 	struct ieee80211_node *ni;
9027 	struct mbuf *m;
9028 
9029 	if (skb == NULL)
9030 		return;
9031 
9032 	m = skb->m;
9033 	skb->m = NULL;
9034 
9035 	if (m != NULL) {
9036 		ni = m->m_pkthdr.PH_loc.ptr;
9037 		/* Status: 0 is ok, != 0 is error. */
9038 		ieee80211_tx_complete(ni, m, status);
9039 		/* ni & mbuf were consumed. */
9040 	}
9041 }
9042 
9043 void
9044 linuxkpi_ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb,
9045     int status)
9046 {
9047 
9048 	_lkpi_ieee80211_free_txskb(hw, skb, status);
9049 	kfree_skb(skb);
9050 }
9051 
9052 void
9053 linuxkpi_ieee80211_tx_status_ext(struct ieee80211_hw *hw,
9054     struct ieee80211_tx_status *txstat)
9055 {
9056 	struct sk_buff *skb;
9057 	struct ieee80211_tx_info *info, _info = { };
9058 	struct ieee80211_ratectl_tx_status txs;
9059 	struct ieee80211_node *ni;
9060 	int status;
9061 
9062 	skb = txstat->skb;
9063 	if (skb != NULL && skb->m != NULL) {
9064 		struct mbuf *m;
9065 
9066 		m = skb->m;
9067 		ni = m->m_pkthdr.PH_loc.ptr;
9068 		memset(&txs, 0, sizeof(txs));
9069 	} else {
9070 		ni = NULL;
9071 	}
9072 
9073 	/*
9074 	 * If we have no info information on tx, set info to an all-zero struct
9075 	 * to make the code (and debug output) simpler.
9076 	 */
9077 	info = txstat->info;
9078 	if (info == NULL)
9079 		info = &_info;
9080 	if (info->flags & IEEE80211_TX_STAT_ACK) {
9081 		status = 0;	/* No error. */
9082 		txs.status = IEEE80211_RATECTL_TX_SUCCESS;
9083 	} else {
9084 		status = 1;
9085 		txs.status = IEEE80211_RATECTL_TX_FAIL_UNSPECIFIED;
9086 	}
9087 
9088 	if (ni != NULL) {
9089 		txs.pktlen = skb->len;
9090 		txs.flags |= IEEE80211_RATECTL_STATUS_PKTLEN;
9091 		if (info->status.rates[0].count > 1) {
9092 			txs.long_retries = info->status.rates[0].count - 1;	/* 1 + retries in drivers. */
9093 			txs.flags |= IEEE80211_RATECTL_STATUS_LONG_RETRY;
9094 		}
9095 #if 0		/* Unused in net80211 currently. */
9096 		/* XXX-BZ convert check .flags for MCS/VHT/.. */
9097 		txs.final_rate = info->status.rates[0].idx;
9098 		txs.flags |= IEEE80211_RATECTL_STATUS_FINAL_RATE;
9099 #endif
9100 		if (info->status.flags & IEEE80211_TX_STATUS_ACK_SIGNAL_VALID) {
9101 			txs.rssi = info->status.ack_signal;		/* XXX-BZ CONVERT? */
9102 			txs.flags |= IEEE80211_RATECTL_STATUS_RSSI;
9103 		}
9104 
9105 		IMPROVE("only update rate if needed but that requires us to get a proper rate from mo_sta_statistics");
9106 		ieee80211_ratectl_tx_complete(ni, &txs);
9107 		ieee80211_ratectl_rate(ni->ni_vap->iv_bss, NULL, 0);
9108 
9109 #ifdef LINUXKPI_DEBUG_80211
9110 		if (linuxkpi_debug_80211 & D80211_TRACE_TX) {
9111 			printf("TX-RATE: %s: long_retries %d\n", __func__,
9112 			    txs.long_retries);
9113 		}
9114 #endif
9115 	}
9116 
9117 #ifdef LINUXKPI_DEBUG_80211
9118 	if (linuxkpi_debug_80211 & D80211_TRACE_TX)
9119 		printf("TX-STATUS: %s: hw %p skb %p status %d : flags %b "
9120 		    "band %u hw_queue %u tx_time_est %d : "
9121 		    "rates [ %u %u %#x, %u %u %#x, %u %u %#x, %u %u %#x ] "
9122 		    "ack_signal %u ampdu_ack_len %u ampdu_len %u antenna %u "
9123 		    "tx_time %u flags %b "
9124 		    "status_driver_data [ %p %p ]\n",
9125 		    __func__, hw, skb, status, info->flags, IEEE80211_TX_INFO_FLAGS,
9126 		    info->band, info->hw_queue, info->tx_time_est,
9127 		    info->status.rates[0].idx, info->status.rates[0].count,
9128 		    info->status.rates[0].flags,
9129 		    info->status.rates[1].idx, info->status.rates[1].count,
9130 		    info->status.rates[1].flags,
9131 		    info->status.rates[2].idx, info->status.rates[2].count,
9132 		    info->status.rates[2].flags,
9133 		    info->status.rates[3].idx, info->status.rates[3].count,
9134 		    info->status.rates[3].flags,
9135 		    info->status.ack_signal, info->status.ampdu_ack_len,
9136 		    info->status.ampdu_len, info->status.antenna,
9137 		    info->status.tx_time, info->status.flags, IEEE80211_TX_STATUS_FLAGS,
9138 		    info->status.status_driver_data[0],
9139 		    info->status.status_driver_data[1]);
9140 #endif
9141 
9142 	if (txstat->free_list) {
9143 		_lkpi_ieee80211_free_txskb(hw, skb, status);
9144 		if (skb != NULL)
9145 			list_add_tail(&skb->list, txstat->free_list);
9146 	} else {
9147 		linuxkpi_ieee80211_free_txskb(hw, skb, status);
9148 	}
9149 }
9150 
9151 void
9152 linuxkpi_ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
9153 {
9154 	struct ieee80211_tx_status status;
9155 
9156 	memset(&status, 0, sizeof(status));
9157 	status.info = IEEE80211_SKB_CB(skb);
9158 	status.skb = skb;
9159 	/* sta, n_rates, rates, free_list? */
9160 
9161 	ieee80211_tx_status_ext(hw, &status);
9162 }
9163 
9164 /*
9165  * This is an internal bandaid for the moment for the way we glue
9166  * skbs and mbufs together for TX.  Once we have skbs backed by
9167  * mbufs this should go away.
9168  * This is a public function but kept on the private KPI (lkpi_)
9169  * and is not exposed by a header file.
9170  */
9171 static void
9172 lkpi_ieee80211_free_skb_mbuf(void *p)
9173 {
9174 	struct ieee80211_node *ni;
9175 	struct mbuf *m;
9176 
9177 	if (p == NULL)
9178 		return;
9179 
9180 	m = (struct mbuf *)p;
9181 	M_ASSERTPKTHDR(m);
9182 
9183 	ni = m->m_pkthdr.PH_loc.ptr;
9184 	m->m_pkthdr.PH_loc.ptr = NULL;
9185 	if (ni != NULL)
9186 		ieee80211_free_node(ni);
9187 	m_freem(m);
9188 }
9189 
9190 void
9191 linuxkpi_ieee80211_queue_delayed_work(struct ieee80211_hw *hw,
9192     struct delayed_work *w, int delay)
9193 {
9194 	struct lkpi_hw *lhw;
9195 
9196 	/* Need to make sure hw is in a stable (non-suspended) state. */
9197 	IMPROVE();
9198 
9199 	lhw = HW_TO_LHW(hw);
9200 	queue_delayed_work(lhw->workq, w, delay);
9201 }
9202 
9203 void
9204 linuxkpi_ieee80211_queue_work(struct ieee80211_hw *hw,
9205     struct work_struct *w)
9206 {
9207 	struct lkpi_hw *lhw;
9208 
9209 	/* Need to make sure hw is in a stable (non-suspended) state. */
9210 	IMPROVE();
9211 
9212 	lhw = HW_TO_LHW(hw);
9213 	queue_work(lhw->workq, w);
9214 }
9215 
9216 struct sk_buff *
9217 linuxkpi_ieee80211_probereq_get(struct ieee80211_hw *hw, const uint8_t *addr,
9218     const uint8_t *ssid, size_t ssid_len, size_t tailroom)
9219 {
9220 	struct sk_buff *skb;
9221 	struct ieee80211_frame *wh;
9222 	uint8_t *p;
9223 	size_t len;
9224 
9225 	len = sizeof(*wh);
9226 	len += 2 + ssid_len;
9227 
9228 	skb = dev_alloc_skb(hw->extra_tx_headroom + len + tailroom);
9229 	if (skb == NULL)
9230 		return (NULL);
9231 
9232 	skb_reserve(skb, hw->extra_tx_headroom);
9233 
9234 	wh = skb_put_zero(skb, sizeof(*wh));
9235 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0;
9236 	wh->i_fc[0] |= IEEE80211_FC0_SUBTYPE_PROBE_REQ | IEEE80211_FC0_TYPE_MGT;
9237 	IEEE80211_ADDR_COPY(wh->i_addr1, ieee80211broadcastaddr);
9238 	IEEE80211_ADDR_COPY(wh->i_addr2, addr);
9239 	IEEE80211_ADDR_COPY(wh->i_addr3, ieee80211broadcastaddr);
9240 
9241 	p = skb_put(skb, 2 + ssid_len);
9242 	*p++ = IEEE80211_ELEMID_SSID;
9243 	*p++ = ssid_len;
9244 	if (ssid_len > 0)
9245 		memcpy(p, ssid, ssid_len);
9246 
9247 	return (skb);
9248 }
9249 
9250 struct sk_buff *
9251 linuxkpi_ieee80211_pspoll_get(struct ieee80211_hw *hw,
9252     struct ieee80211_vif *vif)
9253 {
9254 	struct lkpi_vif *lvif;
9255 	struct ieee80211vap *vap;
9256 	struct sk_buff *skb;
9257 	struct ieee80211_frame_pspoll *psp;
9258 	uint16_t v;
9259 
9260 	skb = dev_alloc_skb(hw->extra_tx_headroom + sizeof(*psp));
9261 	if (skb == NULL)
9262 		return (NULL);
9263 
9264 	skb_reserve(skb, hw->extra_tx_headroom);
9265 
9266 	lvif = VIF_TO_LVIF(vif);
9267 	vap = LVIF_TO_VAP(lvif);
9268 
9269 	psp = skb_put_zero(skb, sizeof(*psp));
9270 	psp->i_fc[0] = IEEE80211_FC0_VERSION_0;
9271 	psp->i_fc[0] |= IEEE80211_FC0_SUBTYPE_PS_POLL | IEEE80211_FC0_TYPE_CTL;
9272 	v = htole16(vif->cfg.aid | 1<<15 | 1<<16);
9273 	memcpy(&psp->i_aid, &v, sizeof(v));
9274 	IEEE80211_ADDR_COPY(psp->i_bssid, vap->iv_bss->ni_macaddr);
9275 	IEEE80211_ADDR_COPY(psp->i_ta, vif->addr);
9276 
9277 	return (skb);
9278 }
9279 
9280 struct sk_buff *
9281 linuxkpi_ieee80211_nullfunc_get(struct ieee80211_hw *hw,
9282     struct ieee80211_vif *vif, int linkid, bool qos)
9283 {
9284 	struct sk_buff *skb;
9285 	struct ieee80211_frame *nullf;
9286 
9287 	IMPROVE("linkid");
9288 
9289 	skb = dev_alloc_skb(hw->extra_tx_headroom + sizeof(*nullf));
9290 	if (skb == NULL)
9291 		return (NULL);
9292 
9293 	skb_reserve(skb, hw->extra_tx_headroom);
9294 
9295 	nullf = skb_put_zero(skb, sizeof(*nullf));
9296 	nullf->i_fc[0] = IEEE80211_FC0_VERSION_0;
9297 	nullf->i_fc[0] |= IEEE80211_FC0_SUBTYPE_NODATA | IEEE80211_FC0_TYPE_DATA;
9298 	nullf->i_fc[1] = IEEE80211_FC1_DIR_TODS;
9299 
9300 	/* XXX-BZ if link is given, this is different. */
9301 	IEEE80211_ADDR_COPY(nullf->i_addr1, vif->cfg.ap_addr);
9302 	IEEE80211_ADDR_COPY(nullf->i_addr2, vif->addr);
9303 	IEEE80211_ADDR_COPY(nullf->i_addr3, vif->cfg.ap_addr);
9304 
9305 	return (skb);
9306 }
9307 
9308 struct wireless_dev *
9309 linuxkpi_ieee80211_vif_to_wdev(struct ieee80211_vif *vif)
9310 {
9311 	struct lkpi_vif *lvif;
9312 
9313 	lvif = VIF_TO_LVIF(vif);
9314 	return (&lvif->wdev);
9315 }
9316 
9317 void
9318 linuxkpi_ieee80211_connection_loss(struct ieee80211_vif *vif)
9319 {
9320 	struct lkpi_vif *lvif;
9321 	struct ieee80211vap *vap;
9322 	enum ieee80211_state nstate;
9323 	int arg;
9324 
9325 	lvif = VIF_TO_LVIF(vif);
9326 	vap = LVIF_TO_VAP(lvif);
9327 
9328 	/*
9329 	 * Go to init; otherwise we need to elaborately check state and
9330 	 * handle accordingly, e.g., if in RUN we could call iv_bmiss.
9331 	 * Let the statemachine handle all neccessary changes.
9332 	 */
9333 	nstate = IEEE80211_S_INIT;
9334 	arg = 0;	/* Not a valid reason. */
9335 
9336 	ic_printf(vap->iv_ic, "%s: vif %p vap %p state %s (synched %d, assoc %d "
9337 	    "beacons %d dtim_period %d)\n", __func__, vif, vap,
9338 	    ieee80211_state_name[vap->iv_state],
9339 	    lvif->lvif_bss_synched, vif->cfg.assoc, lvif->beacons,
9340 	    vif->bss_conf.dtim_period);
9341 	ieee80211_new_state(vap, nstate, arg);
9342 }
9343 
9344 void
9345 linuxkpi_ieee80211_beacon_loss(struct ieee80211_vif *vif)
9346 {
9347 	struct lkpi_vif *lvif;
9348 	struct ieee80211vap *vap;
9349 
9350 	lvif = VIF_TO_LVIF(vif);
9351 	vap = LVIF_TO_VAP(lvif);
9352 
9353 	ic_printf(vap->iv_ic, "%s: vif %p vap %p state %s (synched %d, assoc %d "
9354 	    "beacons %d dtim_period %d)\n", __func__, vif, vap,
9355 	    ieee80211_state_name[vap->iv_state],
9356 	    lvif->lvif_bss_synched, vif->cfg.assoc, lvif->beacons,
9357 	    vif->bss_conf.dtim_period);
9358 	ieee80211_beacon_miss(vap->iv_ic);
9359 }
9360 
9361 /* -------------------------------------------------------------------------- */
9362 
9363 void
9364 linuxkpi_ieee80211_stop_queue(struct ieee80211_hw *hw, int qnum)
9365 {
9366 	struct lkpi_hw *lhw;
9367 	struct lkpi_vif *lvif;
9368 	struct ieee80211_vif *vif;
9369 	int ac_count, ac;
9370 
9371 	KASSERT(qnum < hw->queues, ("%s: qnum %d >= hw->queues %d, hw %p\n",
9372 	    __func__, qnum, hw->queues, hw));
9373 
9374 	lhw = wiphy_priv(hw->wiphy);
9375 
9376 	/* See lkpi_ic_vap_create(). */
9377 	if (hw->queues >= IEEE80211_NUM_ACS)
9378 		ac_count = IEEE80211_NUM_ACS;
9379 	else
9380 		ac_count = 1;
9381 
9382 	LKPI_80211_LHW_LVIF_LOCK(lhw);
9383 	TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
9384 
9385 		vif = LVIF_TO_VIF(lvif);
9386 		for (ac = 0; ac < ac_count; ac++) {
9387 			IMPROVE_TXQ("LOCKING");
9388 			if (qnum == vif->hw_queue[ac]) {
9389 #ifdef LINUXKPI_DEBUG_80211
9390 				/*
9391 				 * For now log this to better understand
9392 				 * how this is supposed to work.
9393 				 */
9394 				if (lvif->hw_queue_stopped[ac] &&
9395 				    (linuxkpi_debug_80211 & D80211_IMPROVE_TXQ) != 0)
9396 					ic_printf(lhw->ic, "%s:%d: lhw %p hw %p "
9397 					    "lvif %p vif %p ac %d qnum %d already "
9398 					    "stopped\n", __func__, __LINE__,
9399 					    lhw, hw, lvif, vif, ac, qnum);
9400 #endif
9401 				lvif->hw_queue_stopped[ac] = true;
9402 			}
9403 		}
9404 	}
9405 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
9406 }
9407 
9408 void
9409 linuxkpi_ieee80211_stop_queues(struct ieee80211_hw *hw)
9410 {
9411 	int i;
9412 
9413 	IMPROVE_TXQ("Locking; do we need further info?");
9414 	for (i = 0; i < hw->queues; i++)
9415 		linuxkpi_ieee80211_stop_queue(hw, i);
9416 }
9417 
9418 
9419 static void
9420 lkpi_ieee80211_wake_queues(struct ieee80211_hw *hw, int hwq)
9421 {
9422 	struct lkpi_hw *lhw;
9423 	struct lkpi_vif *lvif;
9424 	struct lkpi_sta *lsta;
9425 	int ac_count, ac, tid;
9426 
9427 	/* See lkpi_ic_vap_create(). */
9428 	if (hw->queues >= IEEE80211_NUM_ACS)
9429 		ac_count = IEEE80211_NUM_ACS;
9430 	else
9431 		ac_count = 1;
9432 
9433 	lhw = wiphy_priv(hw->wiphy);
9434 
9435 	IMPROVE_TXQ("Locking");
9436 	LKPI_80211_LHW_LVIF_LOCK(lhw);
9437 	TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
9438 		struct ieee80211_vif *vif;
9439 
9440 		vif = LVIF_TO_VIF(lvif);
9441 		for (ac = 0; ac < ac_count; ac++) {
9442 
9443 			if (hwq == vif->hw_queue[ac]) {
9444 
9445 				/* XXX-BZ what about software scan? */
9446 
9447 #ifdef LINUXKPI_DEBUG_80211
9448 				/*
9449 				 * For now log this to better understand
9450 				 * how this is supposed to work.
9451 				 */
9452 				if (!lvif->hw_queue_stopped[ac] &&
9453 				    (linuxkpi_debug_80211 & D80211_IMPROVE_TXQ) != 0)
9454 					ic_printf(lhw->ic, "%s:%d: lhw %p hw %p "
9455 					    "lvif %p vif %p ac %d hw_q not stopped\n",
9456 					    __func__, __LINE__,
9457 					    lhw, hw, lvif, vif, ac);
9458 #endif
9459 				lvif->hw_queue_stopped[ac] = false;
9460 
9461 				rcu_read_lock();
9462 				list_for_each_entry_rcu(lsta, &lvif->lsta_list, lsta_list) {
9463 					struct ieee80211_sta *sta;
9464 
9465 					sta = LSTA_TO_STA(lsta);
9466 					for (tid = 0; tid < nitems(sta->txq); tid++) {
9467 						struct lkpi_txq *ltxq;
9468 
9469 						if (sta->txq[tid] == NULL)
9470 							continue;
9471 
9472 						if (sta->txq[tid]->ac != ac)
9473 							continue;
9474 
9475 						ltxq = TXQ_TO_LTXQ(sta->txq[tid]);
9476 						if ((ltxq->flags & LKPI_TXQ_STOPPED) == 0)
9477 							continue;
9478 
9479 						ltxq->flags &= ~LKPI_TXQ_STOPPED;
9480 
9481 						if (!skb_queue_empty(&ltxq->skbq))
9482 							lkpi_80211_mo_wake_tx_queue(hw, sta->txq[tid], false);
9483 					}
9484 				}
9485 				rcu_read_unlock();
9486 			}
9487 		}
9488 	}
9489 	LKPI_80211_LHW_LVIF_UNLOCK(lhw);
9490 }
9491 
9492 static void
9493 lkpi_ieee80211_wake_queues_locked(struct ieee80211_hw *hw)
9494 {
9495 	int i;
9496 
9497 	IMPROVE_TXQ("Is this all/enough here?");
9498 	for (i = 0; i < hw->queues; i++)
9499 		lkpi_ieee80211_wake_queues(hw, i);
9500 }
9501 
9502 void
9503 linuxkpi_ieee80211_wake_queues(struct ieee80211_hw *hw)
9504 {
9505 	struct lkpi_hw *lhw;
9506 	unsigned long flags;
9507 
9508 	lhw = HW_TO_LHW(hw);
9509 
9510 	spin_lock_irqsave(&lhw->txq_lock, flags);
9511 	lkpi_ieee80211_wake_queues_locked(hw);
9512 	spin_unlock_irqrestore(&lhw->txq_lock, flags);
9513 }
9514 
9515 void
9516 linuxkpi_ieee80211_wake_queue(struct ieee80211_hw *hw, int qnum)
9517 {
9518 	struct lkpi_hw *lhw;
9519 	unsigned long flags;
9520 
9521 	KASSERT(qnum < hw->queues, ("%s: qnum %d >= hw->queues %d, hw %p\n",
9522 	    __func__, qnum, hw->queues, hw));
9523 
9524 	lhw = HW_TO_LHW(hw);
9525 
9526 	spin_lock_irqsave(&lhw->txq_lock, flags);
9527 	lkpi_ieee80211_wake_queues(hw, qnum);
9528 	spin_unlock_irqrestore(&lhw->txq_lock, flags);
9529 }
9530 
9531 void
9532 linuxkpi_ieee80211_handle_wake_tx_queue(struct ieee80211_hw *hw,
9533     struct ieee80211_txq *txq)
9534 {
9535 	struct lkpi_hw *lhw;
9536 
9537 	lhw = HW_TO_LHW(hw);
9538 
9539 	LKPI_80211_LHW_TXQ_LOCK(lhw);
9540 	ieee80211_txq_schedule_start(hw, txq->ac);
9541 	do {
9542 		struct lkpi_txq *ltxq;
9543 		struct ieee80211_txq *ntxq;
9544 		struct ieee80211_tx_control control;
9545 		struct sk_buff *skb;
9546 
9547 		ntxq = ieee80211_next_txq(hw, txq->ac);
9548 		if (ntxq == NULL)
9549 			break;
9550 		ltxq = TXQ_TO_LTXQ(ntxq);
9551 
9552 		memset(&control, 0, sizeof(control));
9553 		control.sta = ntxq->sta;
9554 		do {
9555 			skb = linuxkpi_ieee80211_tx_dequeue(hw, ntxq);
9556 			if (skb == NULL)
9557 				break;
9558 			ltxq->frms_tx++;
9559 			lkpi_80211_mo_tx(hw, &control, skb);
9560 		} while(1);
9561 
9562 		ieee80211_return_txq(hw, ntxq, false);
9563 	} while (1);
9564 	ieee80211_txq_schedule_end(hw, txq->ac);
9565 	LKPI_80211_LHW_TXQ_UNLOCK(lhw);
9566 }
9567 
9568 /* -------------------------------------------------------------------------- */
9569 
9570 /* This is just hardware queues. */
9571 /*
9572  * Being called from the driver thus use _bh() locking.
9573  */
9574 void
9575 linuxkpi_ieee80211_txq_schedule_start(struct ieee80211_hw *hw, uint8_t ac)
9576 {
9577 	struct lkpi_hw *lhw;
9578 
9579 	lhw = HW_TO_LHW(hw);
9580 
9581 	if (ac >= IEEE80211_NUM_ACS) {
9582 		ic_printf(lhw->ic, "%s: ac %u out of bounds.\n", __func__, ac);
9583 		return;
9584 	}
9585 
9586 	spin_lock_bh(&lhw->txq_scheduled_lock[ac]);
9587 	IMPROVE("check AIRTIME_FAIRNESS");
9588 	if (++lhw->txq_generation[ac] == 0)
9589 		lhw->txq_generation[ac]++;
9590 	spin_unlock_bh(&lhw->txq_scheduled_lock[ac]);
9591 }
9592 
9593 struct ieee80211_txq *
9594 linuxkpi_ieee80211_next_txq(struct ieee80211_hw *hw, uint8_t ac)
9595 {
9596 	struct lkpi_hw *lhw;
9597 	struct ieee80211_txq *txq;
9598 	struct lkpi_txq *ltxq;
9599 
9600 	lhw = HW_TO_LHW(hw);
9601 	txq = NULL;
9602 
9603 	if (ac >= IEEE80211_NUM_ACS) {
9604 		ic_printf(lhw->ic, "%s: ac %u out of bounds.\n", __func__, ac);
9605 		return (NULL);
9606 	}
9607 
9608 	spin_lock_bh(&lhw->txq_scheduled_lock[ac]);
9609 
9610 	/* Check that we are scheduled. */
9611 	if (lhw->txq_generation[ac] == 0)
9612 		goto out;
9613 
9614 	ltxq = TAILQ_FIRST(&lhw->txq_scheduled[ac]);
9615 	if (ltxq == NULL)
9616 		goto out;
9617 	if (ltxq->txq_generation == lhw->txq_generation[ac])
9618 		goto out;
9619 	if ((ltxq->flags & (LKPI_TXQ_STOPPED|LKPI_TXQ_STOPPED_BA)) != 0)
9620 		goto out;
9621 
9622 	IMPROVE("check AIRTIME_FAIRNESS");
9623 
9624 	TAILQ_REMOVE(&lhw->txq_scheduled[ac], ltxq, txq_entry);
9625 	ltxq->txq_generation = lhw->txq_generation[ac];
9626 	txq = &ltxq->txq;
9627 	TAILQ_ELEM_INIT(ltxq, txq_entry);
9628 
9629 out:
9630 	spin_unlock_bh(&lhw->txq_scheduled_lock[ac]);
9631 
9632 	return (txq);
9633 }
9634 
9635 void linuxkpi_ieee80211_schedule_txq(struct ieee80211_hw *hw,
9636     struct ieee80211_txq *txq, bool withoutpkts)
9637 {
9638 	struct lkpi_hw *lhw;
9639 	struct lkpi_txq *ltxq;
9640 	bool ltxq_empty;
9641 
9642 	ltxq = TXQ_TO_LTXQ(txq);
9643 
9644 	/* Only schedule if work to do or asked to anyway. */
9645 	LKPI_80211_LTXQ_LOCK(ltxq);
9646 	ltxq_empty = skb_queue_empty(&ltxq->skbq);
9647 	LKPI_80211_LTXQ_UNLOCK(ltxq);
9648 	if (!withoutpkts && ltxq_empty)
9649 		goto out;
9650 
9651 	lhw = HW_TO_LHW(hw);
9652 	spin_lock_bh(&lhw->txq_scheduled_lock[txq->ac]);
9653 	/*
9654 	 * Make sure we do not double-schedule. We do this by checking tqe_prev,
9655 	 * the previous entry in our tailq. tqe_prev is always valid if this entry
9656 	 * is queued, tqe_next may be NULL if this is the only element in the list.
9657 	 */
9658 	if (ltxq->txq_entry.tqe_prev != NULL)
9659 		goto unlock;
9660 
9661 	TAILQ_INSERT_TAIL(&lhw->txq_scheduled[txq->ac], ltxq, txq_entry);
9662 unlock:
9663 	spin_unlock_bh(&lhw->txq_scheduled_lock[txq->ac]);
9664 
9665 out:
9666 	return;
9667 }
9668 
9669 /* -------------------------------------------------------------------------- */
9670 
9671 struct lkpi_cfg80211_bss {
9672 	u_int refcnt;
9673 	struct cfg80211_bss bss;
9674 };
9675 
9676 struct lkpi_cfg80211_get_bss_iter_lookup {
9677 	struct wiphy *wiphy;
9678 	struct linuxkpi_ieee80211_channel *chan;
9679 	const uint8_t *bssid;
9680 	const uint8_t *ssid;
9681 	size_t ssid_len;
9682 	enum ieee80211_bss_type bss_type;
9683 	enum ieee80211_privacy privacy;
9684 
9685 	/*
9686 	 * Something to store a copy of the result as the net80211 scan cache
9687 	 * is not refoucnted so a scan entry might go away any time.
9688 	 */
9689 	bool match;
9690 	struct cfg80211_bss *bss;
9691 };
9692 
9693 static void
9694 lkpi_cfg80211_get_bss_iterf(void *arg, const struct ieee80211_scan_entry *se)
9695 {
9696 	struct lkpi_cfg80211_get_bss_iter_lookup *lookup;
9697 	size_t ielen;
9698 
9699 	lookup = arg;
9700 
9701 	/* Do not try to find another match. */
9702 	if (lookup->match)
9703 		return;
9704 
9705 	/* Nothing to store result. */
9706 	if (lookup->bss == NULL)
9707 		return;
9708 
9709 	if (lookup->privacy != IEEE80211_PRIVACY_ANY) {
9710 		/* if (se->se_capinfo & IEEE80211_CAPINFO_PRIVACY) */
9711 		/* We have no idea what to compare to as the drivers only request ANY */
9712 		return;
9713 	}
9714 
9715 	if (lookup->bss_type != IEEE80211_BSS_TYPE_ANY) {
9716 		/* if (se->se_capinfo & (IEEE80211_CAPINFO_IBSS|IEEE80211_CAPINFO_ESS)) */
9717 		/* We have no idea what to compare to as the drivers only request ANY */
9718 		return;
9719 	}
9720 
9721 	if (lookup->chan != NULL) {
9722 		struct linuxkpi_ieee80211_channel *chan;
9723 
9724 		chan = linuxkpi_ieee80211_get_channel(lookup->wiphy,
9725 		    se->se_chan->ic_freq);
9726 		if (chan == NULL || chan != lookup->chan)
9727 			return;
9728 	}
9729 
9730 	if (lookup->bssid && !IEEE80211_ADDR_EQ(lookup->bssid, se->se_bssid))
9731 		return;
9732 
9733 	if (lookup->ssid) {
9734 		if (lookup->ssid_len != se->se_ssid[1] ||
9735 		    se->se_ssid[1] == 0)
9736 			return;
9737 		if (memcmp(lookup->ssid, se->se_ssid+2, lookup->ssid_len) != 0)
9738 			return;
9739 	}
9740 
9741 	ielen = se->se_ies.len;
9742 
9743 	lookup->bss->ies = malloc(sizeof(*lookup->bss->ies) + ielen,
9744 	    M_LKPI80211, M_NOWAIT | M_ZERO);
9745 	if (lookup->bss->ies == NULL)
9746 		return;
9747 
9748 	lookup->bss->ies->data = (uint8_t *)lookup->bss->ies + sizeof(*lookup->bss->ies);
9749 	lookup->bss->ies->len = ielen;
9750 	if (ielen)
9751 		memcpy(lookup->bss->ies->data, se->se_ies.data, ielen);
9752 
9753 	lookup->match = true;
9754 }
9755 
9756 struct cfg80211_bss *
9757 linuxkpi_cfg80211_get_bss(struct wiphy *wiphy, struct linuxkpi_ieee80211_channel *chan,
9758     const uint8_t *bssid, const uint8_t *ssid, size_t ssid_len,
9759     enum ieee80211_bss_type bss_type, enum ieee80211_privacy privacy)
9760 {
9761 	struct lkpi_cfg80211_bss *lbss;
9762 	struct lkpi_cfg80211_get_bss_iter_lookup lookup;
9763 	struct lkpi_hw *lhw;
9764 	struct ieee80211vap *vap;
9765 
9766 	lhw = wiphy_priv(wiphy);
9767 
9768 	/* Let's hope we can alloc. */
9769 	lbss = malloc(sizeof(*lbss), M_LKPI80211, M_NOWAIT | M_ZERO);
9770 	if (lbss == NULL) {
9771 		ic_printf(lhw->ic, "%s: alloc failed.\n", __func__);
9772 		return (NULL);
9773 	}
9774 
9775 	lookup.wiphy = wiphy;
9776 	lookup.chan = chan;
9777 	lookup.bssid = bssid;
9778 	lookup.ssid = ssid;
9779 	lookup.ssid_len = ssid_len;
9780 	lookup.bss_type = bss_type;
9781 	lookup.privacy = privacy;
9782 	lookup.match = false;
9783 	lookup.bss = &lbss->bss;
9784 
9785 	IMPROVE("Iterate over all VAPs comparing perm_addr and addresses?");
9786 	vap = TAILQ_FIRST(&lhw->ic->ic_vaps);
9787 	ieee80211_scan_iterate(vap, lkpi_cfg80211_get_bss_iterf, &lookup);
9788 	if (!lookup.match) {
9789 		free(lbss, M_LKPI80211);
9790 		return (NULL);
9791 	}
9792 
9793 	refcount_init(&lbss->refcnt, 1);
9794 	return (&lbss->bss);
9795 }
9796 
9797 void
9798 linuxkpi_cfg80211_put_bss(struct wiphy *wiphy, struct cfg80211_bss *bss)
9799 {
9800 	struct lkpi_cfg80211_bss *lbss;
9801 
9802 	lbss = container_of(bss, struct lkpi_cfg80211_bss, bss);
9803 
9804 	/* Free everything again on refcount ... */
9805 	if (refcount_release(&lbss->refcnt)) {
9806 		free(lbss->bss.ies, M_LKPI80211);
9807 		free(lbss, M_LKPI80211);
9808 	}
9809 }
9810 
9811 void
9812 linuxkpi_cfg80211_bss_flush(struct wiphy *wiphy)
9813 {
9814 	struct lkpi_hw *lhw;
9815 	struct ieee80211com *ic;
9816 	struct ieee80211vap *vap;
9817 
9818 	lhw = wiphy_priv(wiphy);
9819 	ic = lhw->ic;
9820 
9821 	/*
9822 	 * If we haven't called ieee80211_ifattach() yet
9823 	 * or there is no VAP, there are no scans to flush.
9824 	 */
9825 	if (ic == NULL ||
9826 	    (lhw->sc_flags & LKPI_MAC80211_DRV_STARTED) == 0)
9827 		return;
9828 
9829 	/* Should only happen on the current one? Not seen it late enough. */
9830 	IEEE80211_LOCK(ic);
9831 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
9832 		ieee80211_scan_flush(vap);
9833 	IEEE80211_UNLOCK(ic);
9834 }
9835 
9836 /* -------------------------------------------------------------------------- */
9837 
9838 static bool
9839 cfg80211_chan_def_are_same(struct cfg80211_chan_def *cd1,
9840     struct cfg80211_chan_def *cd2)
9841 {
9842 
9843 	if (cd1 == cd2)
9844 		return (true);
9845 
9846 	if (cd1 == NULL || cd2 == NULL)
9847 		return (false);
9848 
9849 	if (cd1->chan != cd2->chan)
9850 		return (false);
9851 
9852 	if (cd1->width != cd2->width)
9853 		return (false);
9854 
9855 	if (cd1->center_freq1 != cd2->center_freq1)
9856 		return (false);
9857 
9858 	if (cd1->center_freq2 != cd2->center_freq2)
9859 		return (false);
9860 
9861 	if (cd1->punctured != cd2->punctured)
9862 		return (false);
9863 
9864 	return (true);
9865 }
9866 
9867 /*
9868  * hw->conf get initialized/set in various places for us:
9869  * - linuxkpi_ieee80211_alloc_hw(): flags
9870  * - linuxkpi_ieee80211_ifattach(): chandef
9871  * - lkpi_ic_vap_create(): listen_interval
9872  * - lkpi_ic_set_channel(): chandef, flags
9873  */
9874 
9875 static int
9876 lkpi_80211_update_chandef(struct ieee80211_hw *hw,
9877     struct ieee80211_chanctx_conf *new)
9878 {
9879 	struct lkpi_hw *lhw;
9880 	struct cfg80211_chan_def *cd;
9881 	uint32_t changed;
9882 	int error;
9883 	bool same;
9884 
9885 	lockdep_assert_wiphy(hw->wiphy);
9886 
9887 	lhw = HW_TO_LHW(hw);
9888 	if (!lhw->emulate_chanctx)
9889 		return (0);
9890 
9891 	if (new == NULL || new->def.chan == NULL) {
9892 		/*
9893 		 * In case of remove "new" is NULL, we need to get us to some
9894 		 * basic channel width but we'd also need to set the channel
9895 		 * accordingly somewhere.
9896 		 * The same is true if we are scanning in which case the
9897 		 * scan_chandef should have a channel set.
9898 		 */
9899 		if (lhw->scan_chandef.chan != NULL) {
9900 #ifdef LINUXKPI_DEBUG_80211
9901 			if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
9902 				ic_printf(lhw->ic, "%s:%d: using scan_chandef %p\n",
9903 				    __func__, __LINE__, &lhw->scan_chandef);
9904 #endif
9905 			cd = &lhw->scan_chandef;
9906 		} else {
9907 #ifdef LINUXKPI_DEBUG_80211
9908 			if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
9909 				ic_printf(lhw->ic, "%s:%d: using dflt_chandef %p\n",
9910 				    __func__, __LINE__, &lhw->dflt_chandef);
9911 #endif
9912 			cd = &lhw->dflt_chandef;
9913 		}
9914 	} else {
9915 #ifdef LINUXKPI_DEBUG_80211
9916 		if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
9917 			ic_printf(lhw->ic, "%s:%d: using chanctx %p chandef %p\n",
9918 			    __func__, __LINE__, new, &new->def);
9919 #endif
9920 		cd = &new->def;
9921 	}
9922 
9923 	changed = 0;
9924 	same = cfg80211_chan_def_are_same(cd, &hw->conf.chandef);
9925 	if (!same) {
9926 		/* Copy; the chan pointer is fine and will stay valid. */
9927 		hw->conf.chandef = *cd;
9928 		changed |= IEEE80211_CONF_CHANGE_CHANNEL;
9929 	}
9930 	IMPROVE("IEEE80211_CONF_CHANGE_PS, IEEE80211_CONF_CHANGE_POWER");
9931 
9932 #ifdef LINUXKPI_DEBUG_80211
9933 	if ((linuxkpi_debug_80211 & D80211_CHANDEF) != 0)
9934 		ic_printf(lhw->ic, "%s:%d: chanctx %p { %u } cd %p { %u } "
9935 		    "hw->conf.chandef %p { %u %d %u %u %u }, "
9936 		    "changed %#04x same %d\n",
9937 		    __func__, __LINE__,
9938 		    new, (new != NULL && new->def.chan != NULL) ?
9939 			new->def.chan->center_freq : 0,
9940 		    cd, cd->chan->center_freq,
9941 		    &hw->conf.chandef, hw->conf.chandef.chan->center_freq,
9942 		    hw->conf.chandef.width,
9943 		    hw->conf.chandef.center_freq1,
9944 		    hw->conf.chandef.center_freq2,
9945 		    hw->conf.chandef.punctured,
9946 		    changed, same);
9947 #endif
9948 
9949 	if (changed == 0)
9950 		return (0);
9951 
9952 	error = lkpi_80211_mo_config(hw, changed);
9953 	return (error);
9954 }
9955 
9956 int
9957 ieee80211_emulate_add_chanctx(struct ieee80211_hw *hw,
9958     struct ieee80211_chanctx_conf *chanctx_conf)
9959 {
9960 	int error;
9961 
9962 	lockdep_assert_wiphy(hw->wiphy);
9963 
9964 #ifdef LINUXKPI_DEBUG_80211
9965 	if ((linuxkpi_debug_80211 & D80211_TRACE) != 0) {
9966 		struct lkpi_hw *lhw;
9967 
9968 		lhw = HW_TO_LHW(hw);
9969 		ic_printf(lhw->ic, "%s:%d: chanctx_conf %p\n",
9970 		    __func__, __LINE__, chanctx_conf);
9971 	}
9972 #endif
9973 
9974 	hw->conf.radar_enabled = chanctx_conf->radar_enabled;
9975 	error = lkpi_80211_update_chandef(hw, chanctx_conf);
9976 	return (error);
9977 }
9978 
9979 void
9980 ieee80211_emulate_remove_chanctx(struct ieee80211_hw *hw,
9981     struct ieee80211_chanctx_conf *chanctx_conf __unused)
9982 {
9983 
9984 	lockdep_assert_wiphy(hw->wiphy);
9985 
9986 #ifdef LINUXKPI_DEBUG_80211
9987 	if ((linuxkpi_debug_80211 & D80211_TRACE) != 0) {
9988 		struct lkpi_hw *lhw;
9989 
9990 		lhw = HW_TO_LHW(hw);
9991 		ic_printf(lhw->ic, "%s:%d: chanctx_conf %p\n",
9992 		    __func__, __LINE__, chanctx_conf);
9993 	}
9994 #endif
9995 
9996 	hw->conf.radar_enabled = false;
9997 	lkpi_80211_update_chandef(hw, NULL);
9998 }
9999 
10000 void
10001 ieee80211_emulate_change_chanctx(struct ieee80211_hw *hw,
10002     struct ieee80211_chanctx_conf *chanctx_conf, uint32_t changed __unused)
10003 {
10004 
10005 	lockdep_assert_wiphy(hw->wiphy);
10006 
10007 #ifdef LINUXKPI_DEBUG_80211
10008 	if ((linuxkpi_debug_80211 & D80211_TRACE) != 0) {
10009 		struct lkpi_hw *lhw;
10010 
10011 		lhw = HW_TO_LHW(hw);
10012 		ic_printf(lhw->ic, "%s:%d: chanctx_conf %p\n",
10013 		    __func__, __LINE__, chanctx_conf);
10014 	}
10015 #endif
10016 
10017 	hw->conf.radar_enabled = chanctx_conf->radar_enabled;
10018 	lkpi_80211_update_chandef(hw, chanctx_conf);
10019 }
10020 
10021 int
10022 ieee80211_emulate_switch_vif_chanctx(struct ieee80211_hw *hw,
10023     struct ieee80211_vif_chanctx_switch *vifs, int n_vifs,
10024     enum ieee80211_chanctx_switch_mode mode __unused)
10025 {
10026 	struct ieee80211_chanctx_conf *chanctx_conf;
10027 	int error;
10028 
10029 	lockdep_assert_wiphy(hw->wiphy);
10030 
10031 	/* Sanity check. */
10032 	if (n_vifs <= 0)
10033 		return (-EINVAL);
10034 	if (vifs == NULL || vifs[0].new_ctx == NULL)
10035 		return (-EINVAL);
10036 
10037 	/*
10038 	 * What to do if n_vifs > 1?
10039 	 * Does that make sense for drivers not supporting chanctx?
10040 	 */
10041 	hw->conf.radar_enabled = vifs[0].new_ctx->radar_enabled;
10042 	chanctx_conf = vifs[0].new_ctx;
10043 	error = lkpi_80211_update_chandef(hw, chanctx_conf);
10044 	return (error);
10045 }
10046 
10047 /* -------------------------------------------------------------------------- */
10048 /* LinuxKPI 802.11 PM. */
10049 int
10050 lkpi_80211_suspend(struct ieee80211com *ic, pm_message_t state)
10051 {
10052 	struct lkpi_hw *lhw;
10053 	struct ieee80211_hw *hw;
10054 	int error;
10055 
10056 	lhw = ic->ic_softc;
10057 	hw = LHW_TO_HW(lhw);
10058 	error = 0;
10059 
10060 	/* Check:
10061 	 * - device_set_wakeup_capable() / device_can_wakeup()
10062 	 * - hw->wiphy->wowlan to be non-NULL, if so contents.
10063 	 * - hw->wiphy->max_sched_scan_ssids (rtw88)
10064 	 */
10065 	if ((lkpi_suspend_type & 0x2) != 0) {
10066 		struct cfg80211_wowlan wowlan;
10067 
10068 		IMPROVE("various options for WoWLAN");
10069 		memset(&wowlan, 0, sizeof(wowlan));
10070 		wiphy_lock(hw->wiphy);
10071 		error = lkpi_80211_mo_suspend(hw, &wowlan);
10072 		wiphy_unlock(hw->wiphy);
10073 		if (error == EOPNOTSUPP)
10074 			error = 0;
10075 	}
10076 	if ((lkpi_suspend_type & 0x1) != 0) {
10077 		struct lkpi_vif *lvif;
10078 
10079 		ieee80211_suspend_all(ic);
10080 
10081 		wiphy_lock(hw->wiphy);
10082 		/*
10083 		 * At the end of this net80211 will run a task to call
10084 		 * (*ic_parent)() which is entirely unhelpful as we do not
10085 		 * know when it will happen.  So deal with it here.
10086 		 */
10087 		TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
10088 			lkpi_80211_mo_remove_interface(hw, LVIF_TO_VIF(lvif));
10089 		}
10090 
10091 		if ((lhw->sc_flags & LKPI_MAC80211_DRV_STARTED) != 0)
10092 			lkpi_80211_mo_stop(hw, true);
10093 		wiphy_unlock(hw->wiphy);
10094 	}
10095 
10096 	if (error < 0)
10097 		error = -error;
10098 
10099 	if (error != 0)
10100 		ic_printf(ic, "%s: SUSPEND FAILED: %d\n", __func__, error);
10101 
10102 	return (error);
10103 }
10104 
10105 int
10106 lkpi_80211_resume(struct ieee80211com *ic)
10107 {
10108 	struct lkpi_hw *lhw;
10109 	struct ieee80211_hw *hw;
10110 	int error;
10111 	bool hw_scan_running;
10112 
10113 	lhw = ic->ic_softc;
10114 	hw = LHW_TO_HW(lhw);
10115 	error = 0;
10116 
10117 	/*
10118 	 * Ongoing HW scans during suspend are a problem on resume.
10119 	 * Be verbose about that.
10120 	 */
10121 	LKPI_80211_LHW_SCAN_LOCK(lhw);
10122 	hw_scan_running = (lhw->scan_flags & (LKPI_LHW_SCAN_RUNNING|LKPI_LHW_SCAN_HW)) != 0;
10123 	LKPI_80211_LHW_SCAN_UNLOCK(lhw);
10124 	if (hw_scan_running)
10125 		ic_printf(ic, "%s: WARNING: ongoing hw scan on resume!\n", __func__);
10126 
10127 	if ((lkpi_suspend_type & 0x1) != 0) {
10128 		struct lkpi_vif *lvif;
10129 
10130 		wiphy_lock(hw->wiphy);
10131 		error = lkpi_80211_mo_start(hw);
10132 		if (error != 0 && error != EEXIST) {
10133 			ic_printf(ic, "%s: mo_start failed: %d\n",
10134 			    __func__, error);
10135 			wiphy_unlock(hw->wiphy);
10136 			goto err;
10137 		}
10138 
10139 		TAILQ_FOREACH(lvif, &lhw->lvif_head, lvif_entry) {
10140 			error = lkpi_80211_mo_add_interface(hw, LVIF_TO_VIF(lvif));
10141 			if (error != 0) {
10142 				struct ieee80211vap *vap;
10143 
10144 				vap = LVIF_TO_VAP(lvif);
10145 				ic_printf(ic, "%s: mo_add_interface %s failed: %d\n",
10146 				    __func__, if_name(vap->iv_ifp), error);
10147 				wiphy_unlock(hw->wiphy);
10148 				goto err;
10149 			}
10150 		}
10151 		wiphy_unlock(hw->wiphy);
10152 
10153 		ieee80211_resume_all(ic);
10154 	}
10155 
10156 	if ((lkpi_suspend_type & 0x2) != 0) {
10157 		wiphy_lock(hw->wiphy);
10158 		error = lkpi_80211_mo_resume(hw);
10159 		wiphy_unlock(hw->wiphy);
10160 		if (error == EOPNOTSUPP)
10161 			error = 0;
10162 	}
10163 
10164 err:
10165 	if (error < 0)
10166 		error = -error;
10167 
10168 	return (error);
10169 }
10170 
10171 /* -------------------------------------------------------------------------- */
10172 MODULE_VERSION(linuxkpi_wlan, 1);
10173 MODULE_DEPEND(linuxkpi_wlan, linuxkpi, 1, 1, 1);
10174 MODULE_DEPEND(linuxkpi_wlan, wlan, 1, 1, 1);
10175