diff --git a/sys/compat/linuxkpi/common/include/linux/ieee80211.h b/sys/compat/linuxkpi/common/include/linux/ieee80211.h
index dee8c385464..6698b84dc1c 100644
--- a/sys/compat/linuxkpi/common/include/linux/ieee80211.h
+++ b/sys/compat/linuxkpi/common/include/linux/ieee80211.h
@@ -71,6 +71,7 @@ struct ieee80211_mmie_16 {
 
 #define	IEEE80211_MAX_MPDU_LEN_HT_BA		4095	/* 9.3.2.1 Format of Data frames; non-VHT non-DMG STA */
 #define	IEEE80211_MAX_MPDU_LEN_HT_3839		3839
+#define	IEEE80211_MAX_MPDU_LEN_HT_7935		7935
 #define	IEEE80211_MAX_MPDU_LEN_VHT_3895		3895
 #define	IEEE80211_MAX_MPDU_LEN_VHT_7991		7991
 #define	IEEE80211_MAX_MPDU_LEN_VHT_11454	11454
@@ -83,10 +84,14 @@ struct ieee80211_mmie_16 {
 #define	IEEE80211_P2P_OPPPS_CTWINDOW_MASK	0x7f
 #define	IEEE80211_P2P_OPPPS_ENABLE_BIT		BIT(7)
 
+/* 802.11-2016, 9.2.4.5.1, Table 9-6 QoS Control Field */
 #define	IEEE80211_QOS_CTL_TAG1D_MASK		0x0007
 #define	IEEE80211_QOS_CTL_TID_MASK		IEEE80211_QOS_TID
 #define	IEEE80211_QOS_CTL_EOSP			0x0010
-#define	IEEE80211_QOS_CTL_A_MSDU_PRESENT	0x0080	/* 9.2.4.5.1, Table 9-6 QoS Control Field */
+#define	IEEE80211_QOS_CTL_A_MSDU_PRESENT	0x0080
+#define	IEEE80211_QOS_CTL_ACK_POLICY_MASK	0x0060
+#define	IEEE80211_QOS_CTL_ACK_POLICY_NOACK	0x0020
+#define	IEEE80211_QOS_CTL_MESH_CONTROL_PRESENT	0x0100
 
 #define	IEEE80211_RATE_SHORT_PREAMBLE		BIT(0)
 
@@ -151,6 +156,13 @@ enum ieee80211_min_mpdu_start_spacing {
 #define	IEEE80211_FCTL_STYPE			IEEE80211_FC0_SUBTYPE_MASK
 #define	IEEE80211_FCTL_ORDER			(IEEE80211_FC1_ORDER << 8)
 #define	IEEE80211_FCTL_PROTECTED		(IEEE80211_FC1_PROTECTED << 8)
+#define	IEEE80211_FCTL_FROMDS			(IEEE80211_FC1_DIR_FROMDS << 8)
+#define	IEEE80211_FCTL_TODS			(IEEE80211_FC1_DIR_TODS << 8)
+#define	IEEE80211_FCTL_MOREFRAGS		(IEEE80211_FC1_MORE_FRAG << 8)
+
+#define	IEEE80211_FTYPE_MGMT			IEEE80211_FC0_TYPE_MGT
+#define	IEEE80211_FTYPE_CTL			IEEE80211_FC0_TYPE_CTL
+#define	IEEE80211_FTYPE_DATA			IEEE80211_FC0_TYPE_DATA
 
 #define	IEEE80211_STYPE_ASSOC_REQ		IEEE80211_FC0_SUBTYPE_ASSOC_REQ
 #define	IEEE80211_STYPE_REASSOC_REQ		IEEE80211_FC0_SUBTYPE_REASSOC_REQ
@@ -204,8 +216,10 @@ enum ieee80211_tdls_action_code {
 #define	WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING			BIT(2  % 8)
 #define	WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT			BIT(22 % 8)
 #define	WLAN_EXT_CAPA8_OPMODE_NOTIF				BIT(62 % 8)
+
 #define	WLAN_EXT_CAPA10_TWT_REQUESTER_SUPPORT			BIT(5)		/* XXX */
 #define	WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT	BIT(7)		/* XXX */
+#define	WLAN_EXT_CAPA10_TWT_RESPONDER_SUPPORT			BIT(6)		/* XXX */
 
 
 /* iwlwifi/mvm/utils:: for (ac = IEEE80211_AC_VO; ac <= IEEE80211_AC_VI; ac++) */
@@ -225,6 +239,36 @@ enum ieee80211_ac_numbers {
 #define	IEEE80211_WMM_IE_STA_QOSINFO_AC_BE	8
 #define	IEEE80211_WMM_IE_STA_QOSINFO_SP_ALL	0xf
 
+
+/* XXX net80211 calls these IEEE80211_HTCAP_* */
+#define	IEEE80211_HT_CAP_LDPC_CODING		0x0001	/* IEEE80211_HTCAP_LDPC */
+#define	IEEE80211_HT_CAP_SUP_WIDTH_20_40	0x0002	/* IEEE80211_HTCAP_CHWIDTH40 */
+#define	IEEE80211_HT_CAP_GRN_FLD		0x0010	/* IEEE80211_HTCAP_GREENFIELD */
+#define	IEEE80211_HT_CAP_SGI_20			0x0020	/* IEEE80211_HTCAP_SHORTGI20 */
+#define	IEEE80211_HT_CAP_SGI_40			0x0040	/* IEEE80211_HTCAP_SHORTGI40 */
+#define	IEEE80211_HT_CAP_TX_STBC		0x0080	/* IEEE80211_HTCAP_TXSTBC */
+#define	IEEE80211_HT_CAP_RX_STBC		0x0100	/* IEEE80211_HTCAP_RXSTBC */
+#define	IEEE80211_HT_CAP_RX_STBC_SHIFT		8	/* IEEE80211_HTCAP_RXSTBC_S */
+#define	IEEE80211_HT_CAP_MAX_AMSDU		0x0800	/* IEEE80211_HTCAP_MAXAMSDU */
+#define	IEEE80211_HT_CAP_DSSSCCK40		0x1000	/* IEEE80211_HTCAP_DSSSCCK40 */
+#define	IEEE80211_HT_CAP_SM_PS			0x000c	/* IEEE80211_HTCAP_SMPS */
+#define	IEEE80211_HT_CAP_SM_PS_SHIFT		2
+#define	IEEE80211_HT_CAP_LSIG_TXOP_PROT		0x8000	/* IEEE80211_HTCAP_LSIGTXOPPROT */
+
+#define	IEEE80211_HT_MCS_TX_DEFINED		0x0001
+#define	IEEE80211_HT_MCS_TX_RX_DIFF		0x0002
+#define	IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT	2
+#define	IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK	0x0c
+#define	IEEE80211_HT_MCS_RX_HIGHEST_MASK	0x3ff
+#define	IEEE80211_HT_MCS_MASK_LEN		10
+
+struct ieee80211_mcs_info {
+	uint8_t		rx_mask[IEEE80211_HT_MCS_MASK_LEN];
+	uint16_t	rx_highest;
+	uint8_t		tx_params;
+	uint8_t		__reserved[3];
+};
+
 struct vht_mcs {
 	uint16_t	rx_mcs_map;
 	uint16_t	rx_highest;
@@ -232,9 +276,19 @@ struct vht_mcs {
 	uint16_t	tx_highest;
 };
 
+/* 802.11-2020, 9.4.2.55.1 HT Capabilities element structure */
+struct ieee80211_ht_cap {
+	uint16_t				cap_info;
+	uint8_t					ampdu_params_info;
+	struct ieee80211_mcs_info		mcs;
+	uint16_t				extended_ht_cap_info;
+	uint32_t				tx_BF_cap_info;
+	uint8_t					antenna_selection_info;
+};
+
 struct ieee80211_vht_cap {
-	struct vht_mcs				supp_mcs;;
 	__le32					vht_cap_info;
+	struct vht_mcs				supp_mcs;
 };
 
 #define	IEEE80211_HT_MAX_AMPDU_FACTOR		13
@@ -248,13 +302,14 @@ enum ieee80211_ampdu_mlme_action {
 	IEEE80211_AMPDU_RX_STOP,
 	IEEE80211_AMPDU_TX_OPERATIONAL,
 	IEEE80211_AMPDU_TX_START,
-	IEEE80211_AMPDU_TX_START_DELAY_ADDBA,
-	IEEE80211_AMPDU_TX_START_IMMEDIATE,
 	IEEE80211_AMPDU_TX_STOP_CONT,
 	IEEE80211_AMPDU_TX_STOP_FLUSH,
 	IEEE80211_AMPDU_TX_STOP_FLUSH_CONT
 };
 
+#define	IEEE80211_AMPDU_TX_START_IMMEDIATE	1
+#define	IEEE80211_AMPDU_TX_START_DELAY_ADDBA	2
+
 enum ieee80211_chanctx_switch_mode {
 	CHANCTX_SWMODE_REASSIGN_VIF,
 	CHANCTX_SWMODE_SWAP_CONTEXTS,
@@ -335,11 +390,15 @@ enum ieee80211_tx_info_flags {
 	IEEE80211_TX_INTFL_DONT_ENCRYPT		= BIT(13),
 	IEEE80211_TX_CTL_NO_CCK_RATE		= BIT(14),
 	IEEE80211_TX_CTL_INJECTED		= BIT(15),
+	IEEE80211_TX_CTL_HW_80211_ENCAP		= BIT(16),
+	IEEE80211_TX_CTL_USE_MINRATE		= BIT(17),
+	IEEE80211_TX_CTL_RATE_CTRL_PROBE	= BIT(18),
 };
 
 enum ieee80211_tx_control_flags {
 	/* XXX TODO .. right shift numbers */
 	IEEE80211_TX_CTRL_PORT_CTRL_PROTO	= BIT(0),
+	IEEE80211_TX_CTRL_PS_RESPONSE		= BIT(1),
 };
 
 enum ieee80211_tx_rate_flags {
@@ -378,6 +437,16 @@ struct ieee80211_hdr_3addr {	/* net80211::ieee80211_frame */
 struct ieee80211_vendor_ie {
 };
 
+/* 802.11-2020, Table 9-359-Block Ack Action field values */
+enum ieee80211_back {
+	WLAN_ACTION_ADDBA_REQ		= 0,
+};
+
+/* 802.11-2020, Table 9-51-Category values */
+enum ieee80211_category {
+	WLAN_CATEGORY_BACK		= 3,
+};
+
 /* 9.3.3.2 Format of Management frames */
 struct ieee80211_mgmt {
 	__le16		frame_control;
@@ -421,6 +490,16 @@ struct ieee80211_mgmt {
 					uint16_t toa_error;
 					uint8_t variable[0];
 				} ftm;
+				/* 802.11-2016, 9.6.5.2 ADDBA Request frame format */
+				struct {
+					uint8_t action_code;
+					uint8_t dialog_token;
+					uint16_t capab;
+					uint16_t timeout;
+					uint16_t start_seq_num;
+					/* Optional follows... */
+					uint8_t variable[0];
+				} addba_req;
 			} u;
 		} action;
 	} u;
@@ -449,17 +528,35 @@ enum ieee80211_eid {
 	WLAN_EID_SUPP_RATES			= 1,
 	WLAN_EID_DS_PARAMS			= 3,
 	WLAN_EID_TIM				= 5,
-	WLAN_EID_COUNTRY			= 7, /* IEEE80211_ELEMID_COUNTRY */
+	WLAN_EID_COUNTRY			= 7,	/* IEEE80211_ELEMID_COUNTRY */
 	WLAN_EID_REQUEST			= 10,
 	WLAN_EID_CHANNEL_SWITCH			= 37,
 	WLAN_EID_MEASURE_REPORT			= 39,
-	WLAN_EID_RSN				= 48, /* IEEE80211_ELEMID_RSN */
+	WLAN_EID_HT_CAPABILITY			= 45,	/* IEEE80211_ELEMID_HTCAP */
+	WLAN_EID_RSN				= 48,	/* IEEE80211_ELEMID_RSN */
 	WLAN_EID_EXT_SUPP_RATES			= 50,
 	WLAN_EID_EXT_CHANSWITCH_ANN		= 60,
+	WLAN_EID_MULTIPLE_BSSID			= 71,	/* IEEE80211_ELEMID_MULTIBSSID */
+	WLAN_EID_MULTI_BSSID_IDX		= 85,
 	WLAN_EID_EXT_CAPABILITY			= 127,
+	WLAN_EID_VHT_CAPABILITY			= 191,	/* IEEE80211_ELEMID_VHT_CAP */
 	WLAN_EID_VENDOR_SPECIFIC		= 221,
 };
 
+enum ieee80211_eid_ext {
+	WLAN_EID_EXT_HE_CAPABILITY		= 35,
+};
+
+#define	for_each_element(_elem, _data, _len) \
+	for (_elem = (const struct element *)(_data); \
+	    (((const uint8_t *)(_data) + (_len) - (const uint8_t *)_elem) >= sizeof(*_elem)) && \
+		(((const uint8_t *)(_data) + (_len) - (const uint8_t *)_elem) >= (sizeof(*_elem) + _elem->datalen)); \
+	    _elem = (const struct element *)(_elem->data + _elem->datalen))
+
+#define	for_each_element_id(_elem, _eid, _data, _len) \
+	for_each_element(_elem, _data, _len) \
+		if (_elem->id == (_eid))
+
 /* 9.4.1.7, Table 9-45. Reason codes. */
 enum ieee80211_reason_code {
 	/* reserved				= 0, */
@@ -502,6 +599,46 @@ enum {
 	IEEE80211_TRIGGER_TYPE_MASK		= 0xf
 };
 
+/* 802.11-2020, Figure 9-687-Control field format; 802.11ax-2021 */
+#define	IEEE80211_TWT_CONTROL_NEG_TYPE_BROADCAST	BIT(3)
+#define	IEEE80211_TWT_CONTROL_RX_DISABLED		BIT(4)
+#define	IEEE80211_TWT_CONTROL_WAKE_DUR_UNIT		BIT(5)
+
+/* 802.11-2020, Figure 9-688-Request Type field format; 802.11ax-2021 */
+#define	IEEE80211_TWT_REQTYPE_SETUP_CMD		(BIT(1) | BIT(2) | BIT(3))
+#define	IEEE80211_TWT_REQTYPE_TRIGGER		BIT(4)
+#define	IEEE80211_TWT_REQTYPE_IMPLICIT		BIT(5)
+#define	IEEE80211_TWT_REQTYPE_FLOWTYPE		BIT(6)
+#define	IEEE80211_TWT_REQTYPE_FLOWID		(BIT(7) | BIT(8) | BIT(9))
+#define	IEEE80211_TWT_REQTYPE_WAKE_INT_EXP	(BIT(10) | BIT(11) | BIT(12) | BIT(13) | BIT(14))
+#define	IEEE80211_TWT_REQTYPE_PROTECTION	BIT(15)
+
+struct ieee80211_twt_params {
+	int	mantissa, min_twt_dur, twt;
+	uint16_t				req_type;
+};
+
+struct ieee80211_twt_setup {
+	int	control;
+	struct ieee80211_twt_params		*params;
+};
+
+/* 802.11-2020, Table 9-297-TWT Setup Command field values */
+enum ieee80211_twt_setup_cmd {
+	TWT_SETUP_CMD_REQUEST			= 0,
+	TWT_SETUP_CMD_SUGGEST			= 1,
+	/* DEMAND				= 2, */
+	/* GROUPING				= 3, */
+	TWT_SETUP_CMD_ACCEPT			= 4,
+	/* ALTERNATE				= 5 */
+	TWT_SETUP_CMD_DICTATE			= 6,
+	TWT_SETUP_CMD_REJECT			= 7,
+};
+
+struct ieee80211_bssid_index {
+	int	bssid_index;
+};
+
 /* net80211: IEEE80211_IS_CTL() */
 static __inline bool
 ieee80211_is_ctl(__le16 fc)
diff --git a/sys/compat/linuxkpi/common/include/linux/nl80211.h b/sys/compat/linuxkpi/common/include/linux/nl80211.h
index f6572cc8f6b..a85abfc1045 100644
--- a/sys/compat/linuxkpi/common/include/linux/nl80211.h
+++ b/sys/compat/linuxkpi/common/include/linux/nl80211.h
@@ -51,6 +51,7 @@ enum nl80211_feature_flags {
 	NL80211_FEATURE_TX_POWER_INSERTION		= BIT(14),
 	NL80211_FEATURE_WFA_TPC_IE_IN_PROBES		= BIT(15),
 	NL80211_FEATURE_AP_SCAN				= BIT(16),
+	NL80211_FEATURE_ACTIVE_MONITOR			= BIT(17),
 };
 
 enum nl80211_pmsr_ftm_failure_flags {
@@ -159,6 +160,7 @@ enum nl80211_iftype {
 	NL80211_IFTYPE_P2P_GO,
 	NL80211_IFTYPE_MESH_POINT,
 	NL80211_IFTYPE_WDS,
+	NL80211_IFTYPE_OCB,
 
 	/* Keep this last. */
 	NUM_NL80211_IFTYPES
@@ -215,6 +217,14 @@ enum nl80211_ext_feature {
 	NL80211_EXT_FEATURE_AQL,
 	NL80211_EXT_FEATURE_AIRTIME_FAIRNESS,
 	NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT,
+	NL80211_EXT_FEATURE_BEACON_RATE_LEGACY,
+	NL80211_EXT_FEATURE_BEACON_RATE_HT,
+	NL80211_EXT_FEATURE_BEACON_RATE_VHT,
+	NL80211_EXT_FEATURE_BEACON_RATE_HE,
+	NL80211_EXT_FEATURE_BSS_COLOR,
+	NL80211_EXT_FEATURE_FILS_DISCOVERY,
+	NL80211_EXT_FEATURE_RADAR_BACKGROUND,
+	NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP,
 
 	/* Keep this last. */
 	NUM_NL80211_EXT_FEATURES
@@ -241,6 +251,7 @@ enum nl80211_sta_info {
 	NL80211_STA_INFO_TX_FAILED,
 	NL80211_STA_INFO_TX_RETRIES,
 	NL80211_STA_INFO_RX_DURATION,
+	NL80211_STA_INFO_TX_DURATION,
 };
 
 enum nl80211_ftm_stats {
@@ -294,7 +305,7 @@ enum nl80211_key_type {
 	NL80211_KEYTYPE_PAIRWISE,
 };
 
-enum nl80211_rate_info_he_ru_alloc {
+enum nl80211_he_ru_alloc {
 	NL80211_RATE_INFO_HE_RU_ALLOC_26,
 	NL80211_RATE_INFO_HE_RU_ALLOC_52,
 	NL80211_RATE_INFO_HE_RU_ALLOC_106,
@@ -304,7 +315,7 @@ enum nl80211_rate_info_he_ru_alloc {
 	NL80211_RATE_INFO_HE_RU_ALLOC_2x996,
 };
 
-enum nl80211_rate_info_he_gi {
+enum nl80211_he_gi {
 	NL80211_RATE_INFO_HE_GI_0_8,
 	NL80211_RATE_INFO_HE_GI_1_6,
 	NL80211_RATE_INFO_HE_GI_3_2,
@@ -344,6 +355,8 @@ enum nl80211_tx_rate_setting {
 };
 
 enum nl80211_txrate_gi {
+	NL80211_TXRATE_DEFAULT_GI,
+	NL80211_TXRATE_FORCE_SGI,
 	NL80211_TXRATE_FORCE_LGI,
 };
 
@@ -353,4 +366,7 @@ enum nl80211_probe_resp_offload_support {
 	NL80211_PROBE_RESP_OFFLOAD_SUPPORT_P2P,
 };
 
+#define	NL80211_KCK_LEN				16
+#define	NL80211_KEK_LEN				16
+#define	NL80211_REPLAY_CTR_LEN			8
 #endif	/* _LINUXKPI_LINUX_NL80211_H */
diff --git a/sys/compat/linuxkpi/common/include/net/cfg80211.h b/sys/compat/linuxkpi/common/include/net/cfg80211.h
index 06a3ee626f0..15040ead370 100644
--- a/sys/compat/linuxkpi/common/include/net/cfg80211.h
+++ b/sys/compat/linuxkpi/common/include/net/cfg80211.h
@@ -79,6 +79,7 @@ enum cfg80211_rate_info_flags {
 };
 
 extern const uint8_t rfc1042_header[6];
+extern const uint8_t bridge_tunnel_header[6];
 
 enum ieee80211_privacy {
 	IEEE80211_PRIVACY_ANY,
@@ -125,29 +126,9 @@ struct linuxkpi_ieee80211_channel {
 	int     max_antenna_gain, max_reg_power;
 	int     orig_flags;
 	int	dfs_cac_ms, dfs_state;
+	int	orig_mpwr;
 };
 
-/* XXX net80211 calls these IEEE80211_HTCAP_* */
-#define	IEEE80211_HT_CAP_LDPC_CODING		0x0001	/* IEEE80211_HTCAP_LDPC */
-#define	IEEE80211_HT_CAP_SUP_WIDTH_20_40	0x0002	/* IEEE80211_HTCAP_CHWIDTH40 */
-#define	IEEE80211_HT_CAP_GRN_FLD		0x0010	/* IEEE80211_HTCAP_GREENFIELD */
-#define	IEEE80211_HT_CAP_SGI_20			0x0020	/* IEEE80211_HTCAP_SHORTGI20 */
-#define	IEEE80211_HT_CAP_SGI_40			0x0040	/* IEEE80211_HTCAP_SHORTGI40 */
-#define	IEEE80211_HT_CAP_TX_STBC		0x0080	/* IEEE80211_HTCAP_TXSTBC */
-#define	IEEE80211_HT_CAP_RX_STBC		0x0100	/* IEEE80211_HTCAP_RXSTBC */
-#define	IEEE80211_HT_CAP_RX_STBC_SHIFT		8	/* IEEE80211_HTCAP_RXSTBC_S */
-#define	IEEE80211_HT_CAP_MAX_AMSDU		0x0800	/* IEEE80211_HTCAP_MAXAMSDU */
-#define	IEEE80211_HT_CAP_DSSSCCK40		0x1000	/* IEEE80211_HTCAP_DSSSCCK40 */
-#define	IEEE80211_HT_CAP_SM_PS			0x000c	/* IEEE80211_HTCAP_SMPS */
-#define	IEEE80211_HT_CAP_SM_PS_SHIFT		2
-#define	IEEE80211_HT_CAP_LSIG_TXOP_PROT		0x8000	/* IEEE80211_HTCAP_LSIGTXOPPROT */
-
-#define	IEEE80211_HT_MCS_TX_DEFINED		0x0001
-#define	IEEE80211_HT_MCS_TX_RX_DIFF		0x0002
-#define	IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT	2
-#define	IEEE80211_HT_MCS_RX_HIGHEST_MASK	0x3FF
-#define	IEEE80211_HT_MCS_MASK_LEN		10
-
 enum ieee80211_vht_mcs_support {
 	LKPI_IEEE80211_VHT_MCS_SUPPORT_0_7,
 	LKPI_IEEE80211_VHT_MCS_SUPPORT_0_8,
@@ -163,9 +144,21 @@ struct cfg80211_bitrate_mask {
 		uint16_t			vht_mcs[16];	/* XXX? */
 		uint16_t			he_mcs[16];	/* XXX? */
 		enum nl80211_txrate_gi		gi;
+		enum nl80211_he_gi		he_gi;
+		uint8_t				he_ltf;
 	} control[NUM_NL80211_BANDS];
 };
 
+enum rate_info_bw {
+	RATE_INFO_BW_20		= 0,
+	RATE_INFO_BW_5,
+	RATE_INFO_BW_10,
+	RATE_INFO_BW_40,
+	RATE_INFO_BW_80,
+	RATE_INFO_BW_160,
+	RATE_INFO_BW_HE_RU,
+};
+
 struct rate_info {
 	/* TODO FIXME */
 	int	bw, flags, he_dcm, he_gi, he_ru_alloc, legacy, mcs, nss;
@@ -182,13 +175,9 @@ struct ieee80211_rate {
 struct ieee80211_sta_ht_cap {
 		/* TODO FIXME */
 	int	ampdu_density, ampdu_factor;
-	bool		ht_supported;
-	uint16_t	cap;
-	struct mcs {
-		uint16_t	rx_mask[IEEE80211_HT_MCS_MASK_LEN];	/* XXX ? > 4 (rtw88) */
-		int		rx_highest;
-		uint32_t	tx_params;
-	} mcs;
+	bool					ht_supported;
+	uint16_t				cap;
+	struct ieee80211_mcs_info		mcs;
 };
 
 /* XXX net80211 calls these IEEE80211_VHTCAP_* */
@@ -245,6 +234,10 @@ struct ieee80211_sta_vht_cap {
 	struct vht_mcs		vht_mcs;
 };
 
+enum ieee80211_vht_opmode {
+	IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT	= 4,
+};
+
 struct cfg80211_connect_resp_params {
 		/* XXX TODO */
 	uint8_t				*bssid;
@@ -391,6 +384,7 @@ struct cfg80211_scan_request {
 	int					ie_len;
 	uint8_t					*ie;
 	uint8_t					mac_addr[ETH_ALEN], mac_addr_mask[ETH_ALEN];
+	uint8_t					bssid[ETH_ALEN];
 	int					n_ssids;
 	int					n_6ghz_params;
 	int					n_channels;
@@ -413,6 +407,8 @@ struct cfg80211_sched_scan_request {
 	int					n_scan_plans;
 	int					n_ssids;
 	int					n_channels;
+	int					ie_len;
+	uint8_t					*ie;
 	struct cfg80211_match_set		*match_sets;
 	struct cfg80211_sched_scan_plan		*scan_plans;
 	struct cfg80211_ssid			*ssids;
@@ -629,10 +625,12 @@ struct linuxkpi_ieee80211_regdomain {
 /* XXX-BZ this are insensible values probably ... */
 #define	IEEE80211_HE_MAC_CAP0_HTC_HE			0x1
 #define	IEEE80211_HE_MAC_CAP0_TWT_REQ			0x2
+#define	IEEE80211_HE_MAC_CAP0_TWT_RES			0x4
 
 #define	IEEE80211_HE_MAC_CAP1_LINK_ADAPTATION		0x1
 #define	IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8	0x2
 #define	IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US	0x4
+#define	IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_MASK	0x8
 
 #define	IEEE80211_HE_MAC_CAP2_32BIT_BA_BITMAP		0x1
 #define	IEEE80211_HE_MAC_CAP2_ACK_EN			0x2
@@ -640,6 +638,8 @@ struct linuxkpi_ieee80211_regdomain {
 #define	IEEE80211_HE_MAC_CAP2_LINK_ADAPTATION		0x8
 #define	IEEE80211_HE_MAC_CAP2_BCAST_TWT			0x10
 #define	IEEE80211_HE_MAC_CAP2_ALL_ACK			0x20
+#define	IEEE80211_HE_MAC_CAP2_MU_CASCADING		0x40
+#define	IEEE80211_HE_MAC_CAP2_TRS			0x80
 
 #define	IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_VHT_2	0x1
 #define	IEEE80211_HE_MAC_CAP3_OMI_CONTROL		0x2
@@ -648,18 +648,24 @@ struct linuxkpi_ieee80211_regdomain {
 #define	IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_EXT_3	0x40
 #define	IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_MASK	0x70
 #define	IEEE80211_HE_MAC_CAP3_RX_CTRL_FRAME_TO_MULTIBSS	0x80
+#define	IEEE80211_HE_MAC_CAP3_FLEX_TWT_SCHED		0x80
+#define	IEEE80211_HE_MAC_CAP3_OFDMA_RA			0x80
 
 #define	IEEE80211_HE_MAC_CAP4_AMDSU_IN_AMPDU		0x1
 #define	IEEE80211_HE_MAC_CAP4_BQR			0x2
 #define	IEEE80211_HE_MAC_CAP4_MULTI_TID_AGG_TX_QOS_B39	0x4
 #define	IEEE80211_HE_MAC_CAP4_AMSDU_IN_AMPDU		0x8
 #define	IEEE80211_HE_MAC_CAP4_OPS			0x10
+#define	IEEE80211_HE_MAC_CAP4_BSRP_BQRP_A_MPDU_AGG	0x20
 
 #define	IEEE80211_HE_MAC_CAP5_HE_DYNAMIC_SM_PS		0x1
 #define	IEEE80211_HE_MAC_CAP5_HT_VHT_TRIG_FRAME_RX	0x2
 #define	IEEE80211_HE_MAC_CAP5_MULTI_TID_AGG_TX_QOS_B40	0x4
 #define	IEEE80211_HE_MAC_CAP5_MULTI_TID_AGG_TX_QOS_B41	0x8
 #define	IEEE80211_HE_MAC_CAP5_UL_2x996_TONE_RU		0x10
+#define	IEEE80211_HE_MAC_CAP5_OM_CTRL_UL_MU_DATA_DIS_RX	0x20
+#define	IEEE80211_HE_MAC_CAP5_PUNCTURED_SOUNDING	0x40
+#define	IEEE80211_HE_MAC_CAP5_SUBCHAN_SELECTIVE_TRANSMISSION	0x80
 
 #define	IEEE80211_HE_MCS_NOT_SUPPORTED			0x0
 #define	IEEE80211_HE_MCS_SUPPORT_0_7			0x1
@@ -671,11 +677,16 @@ struct linuxkpi_ieee80211_regdomain {
 #define	IEEE80211_HE_6GHZ_CAP_MIN_MPDU_START		0x04
 #define	IEEE80211_HE_6GHZ_CAP_MAX_MPDU_LEN		0x08
 #define	IEEE80211_HE_6GHZ_CAP_MAX_AMPDU_LEN_EXP		0x10
+#define	IEEE80211_HE_6GHZ_CAP_SM_PS			0x20
+#define	IEEE80211_HE_6GHZ_MAX_AMPDU_FACTOR		0x40
 
 #define	IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G		0x1
 #define	IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G	0x2
 #define	IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G		0x4
 #define	IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G	0x8
+#define	IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_2G	0x10
+#define	IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_RU_MAPPING_IN_5G	0x20
+#define	IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_MASK			0x40
 
 #define	IEEE80211_HE_PHY_CAP1_DEVICE_CLASS_A		0x1
 #define	IEEE80211_HE_PHY_CAP1_LDPC_CODING_IN_PAYLOAD	0x2
@@ -688,6 +699,8 @@ struct linuxkpi_ieee80211_regdomain {
 #define	IEEE80211_HE_PHY_CAP2_STBC_TX_UNDER_80MHZ	0x4
 #define	IEEE80211_HE_PHY_CAP2_STBC_RX_UNDER_80MHZ	0x8
 #define	IEEE80211_HE_PHY_CAP2_DOPPLER_TX		0x10
+#define	IEEE80211_HE_PHY_CAP2_UL_MU_PARTIAL_MU_MIMO	0x20
+#define	IEEE80211_HE_PHY_CAP2_UL_MU_FULL_MU_MIMO	0x40
 
 #define	IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_MASK	0x1
 #define	IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_NO_DCM	0x2
@@ -702,18 +715,25 @@ struct linuxkpi_ieee80211_regdomain {
 #define	IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_BPSK	0x40
 #define	IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_BPSK	0x80
 #define	IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_MASK	0x80
+#define	IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_RX_QPSK	0x80
+#define	IEEE80211_HE_PHY_CAP3_DCM_MAX_CONST_TX_QPSK	0x80
+#define	IEEE80211_HE_PHY_CAP3_DCM_MAX_RX_NSS_2		0x80
 
 #define	IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_8	0x1
 #define	IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_8	0x2
 #define	IEEE80211_HE_PHY_CAP4_SU_BEAMFORMEE			0x4
 #define	IEEE80211_HE_PHY_CAP4_MU_BEAMFORMER			0x8
 #define	IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_4	0x10
+#define	IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_4	0x20
+#define	IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_MASK	0x40
+#define	IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_UNDER_80MHZ_MASK	0x80
 
 #define	IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_2	0x1
 #define	IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_2	0x2
 #define	IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK	0x4
 #define	IEEE80211_HE_PHY_CAP5_NG16_MU_FEEDBACK				0x8
 #define	IEEE80211_HE_PHY_CAP5_NG16_SU_FEEDBACK				0x10
+#define	IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_ABOVE_80MHZ_MASK	0x20
 
 #define	IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT	0x1
 #define	IEEE80211_HE_PHY_CAP6_TRIG_MU_BEAMFORMER_FB	0x2
@@ -723,6 +743,8 @@ struct linuxkpi_ieee80211_regdomain {
 #define	IEEE80211_HE_PHY_CAP6_CODEBOOK_SIZE_42_SU	0x40
 #define	IEEE80211_HE_PHY_CAP6_CODEBOOK_SIZE_75_MU	0x80
 #define	IEEE80211_HE_PHY_CAP6_PARTIAL_BW_EXT_RANGE	0x80
+#define	IEEE80211_HE_PHY_CAP6_TRIG_CQI_FB		0x80
+#define	IEEE80211_HE_PHY_CAP6_PARTIAL_BANDWIDTH_DL_MUMIMO	0x80
 
 #define	IEEE80211_HE_PHY_CAP7_HE_SU_MU_PPDU_4XLTF_AND_08_US_GI	0x1
 #define	IEEE80211_HE_PHY_CAP7_MAX_NC_1				0x2
@@ -731,14 +753,18 @@ struct linuxkpi_ieee80211_regdomain {
 #define	IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_AR		0x8
 #define	IEEE80211_HE_PHY_CAP7_POWER_BOOST_FACTOR_SUPP		0x10
 #define	IEEE80211_HE_PHY_CAP7_STBC_RX_ABOVE_80MHZ		0x20
+#define	IEEE80211_HE_PHY_CAP7_STBC_TX_ABOVE_80MHZ		0x40
+#define	IEEE80211_HE_PHY_CAP7_PSR_BASED_SR			0x80
 
 #define	IEEE80211_HE_PHY_CAP8_20MHZ_IN_160MHZ_HE_PPDU		0x1
 #define	IEEE80211_HE_PHY_CAP8_20MHZ_IN_40MHZ_HE_PPDU_IN_2G	0x2
 #define	IEEE80211_HE_PHY_CAP8_80MHZ_IN_160MHZ_HE_PPDU		0x4
-#define	IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_2x996			0x8
-#define	IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_242			0x10
-#define	IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI	0x20
-#define	IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_996			0x40
+#define	IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_242			0x8
+#define	IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_484			0x10
+#define	IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_996			0x18
+#define	IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_2x996			0x20
+#define	IEEE80211_HE_PHY_CAP8_DCM_MAX_RU_MASK			0x28
+#define	IEEE80211_HE_PHY_CAP8_HE_ER_SU_PPDU_4XLTF_AND_08_US_GI	0x40
 #define	IEEE80211_HE_PHY_CAP8_HE_ER_SU_1XLTF_AND_08_US_GI	0x80
 
 #define	IEEE80211_HE_PHY_CAP9_NOMINAL_PKT_PADDING_0US		0x1
@@ -782,6 +808,14 @@ struct ieee80211_sta_he_cap {
 	uint8_t					ppe_thres[IEEE80211_STA_HE_CAP_PPE_THRES_MAX];
 };
 
+struct cfg80211_he_bss_color {
+	int	color, enabled;
+};
+
+struct ieee80211_he_obss_pd {
+	bool					enable;
+};
+
 struct ieee80211_sta_he_6ghz_capa {
 	/* TODO FIXME */
 	int	capa;
@@ -800,7 +834,7 @@ struct ieee80211_sband_iftype_data {
 
 struct ieee80211_supported_band {
 	/* TODO FIXME */
-	struct linuxkpi_ieee80211_channel		*channels;
+	struct linuxkpi_ieee80211_channel	*channels;
 	struct ieee80211_rate			*bitrates;
 	struct ieee80211_sband_iftype_data	*iftype_data;
 	int					n_channels;
@@ -856,6 +890,7 @@ struct ieee80211_iface_combination {
 	int					n_limits;
 	int		max_interfaces, num_different_channels;
 	int		beacon_int_infra_match, beacon_int_min_gcd;
+	int		radar_detect_widths;
 };
 
 struct iface_combination_params {
@@ -910,20 +945,24 @@ enum cfg80211_regulatory {
 	REGULATORY_COUNTRY_IE_FOLLOW_POWER	= BIT(6),
 };
 
-#define	WIPHY_FLAG_AP_UAPSD			0x00000001
-#define	WIPHY_FLAG_HAS_CHANNEL_SWITCH		0x00000002
-#define	WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL	0x00000004
-#define	WIPHY_FLAG_HAVE_AP_SME			0x00000008
-#define	WIPHY_FLAG_IBSS_RSN			0x00000010
-#define	WIPHY_FLAG_NETNS_OK			0x00000020
-#define	WIPHY_FLAG_OFFCHAN_TX			0x00000040
-#define	WIPHY_FLAG_PS_ON_BY_DEFAULT		0x00000080
-#define	WIPHY_FLAG_SPLIT_SCAN_6GHZ		0x00000100
-#define	WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK		0x00000200
-#define	WIPHY_FLAG_SUPPORTS_FW_ROAM		0x00000400
-#define	WIPHY_FLAG_SUPPORTS_TDLS		0x00000800
-#define	WIPHY_FLAG_TDLS_EXTERNAL_SETUP		0x00001000
-#define	WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD	0x00002000
+enum wiphy_flags {
+	WIPHY_FLAG_AP_UAPSD			= BIT(0),
+	WIPHY_FLAG_HAS_CHANNEL_SWITCH		= BIT(1),
+	WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL	= BIT(2),
+	WIPHY_FLAG_HAVE_AP_SME			= BIT(3),
+	WIPHY_FLAG_IBSS_RSN			= BIT(4),
+	WIPHY_FLAG_NETNS_OK			= BIT(5),
+	WIPHY_FLAG_OFFCHAN_TX			= BIT(6),
+	WIPHY_FLAG_PS_ON_BY_DEFAULT		= BIT(7),
+	WIPHY_FLAG_SPLIT_SCAN_6GHZ		= BIT(8),
+	WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK		= BIT(9),
+	WIPHY_FLAG_SUPPORTS_FW_ROAM		= BIT(10),
+	WIPHY_FLAG_SUPPORTS_TDLS		= BIT(11),
+	WIPHY_FLAG_TDLS_EXTERNAL_SETUP		= BIT(12),
+	WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD	= BIT(13),
+	WIPHY_FLAG_4ADDR_AP			= BIT(14),
+	WIPHY_FLAG_4ADDR_STATION		= BIT(15),
+};
 
 struct wiphy {
 
@@ -961,6 +1000,7 @@ struct wiphy {
 	int     bss_select_support, max_num_pmkids, retry_long, retry_short, signal_type;
 	int	max_data_retry_count;
 	int     tx_queue_len, rfkill;
+	int	mbssid_max_interfaces;
 
 	unsigned long				ext_features[BITS_TO_LONGS(NUM_NL80211_EXT_FEATURES)];
 	struct dentry				*debugfsdir;
@@ -1040,6 +1080,7 @@ uint32_t linuxkpi_ieee80211_channel_to_frequency(uint32_t, enum nl80211_band);
 uint32_t linuxkpi_ieee80211_frequency_to_channel(uint32_t, uint32_t);
 struct linuxkpi_ieee80211_channel *
     linuxkpi_ieee80211_get_channel(struct wiphy *, uint32_t);
+void linuxkpi_cfg80211_bss_flush(struct wiphy *);
 
 /* -------------------------------------------------------------------------- */
 
@@ -1144,7 +1185,7 @@ cfg80211_find_ie_match(uint32_t f, const u8 *ies, size_t ies_len,
 }
 
 static __inline const u8 *
-cfg80211_find_ie(uint8_t  eid, uint8_t *variable, uint32_t frame_size)
+cfg80211_find_ie(uint8_t eid, const uint8_t *ie, uint32_t ielen)
 {
 	TODO();
 	return (NULL);
@@ -1183,9 +1224,16 @@ cfg80211_chandef_create(struct cfg80211_chan_def *chandef,
 		chandef->center_freq1 = chan->center_freq;
 		break;
 	default:
-		printf("%s: unsupported chan_flag %#0x\n", __func__, chan_flag);
-		/* XXX-BZ should we panic instead? */
-		chandef->width = NL80211_CHAN_WIDTH_20;
+		if (chan->flags & IEEE80211_CHAN_NO_HT40)
+			chandef->width = NL80211_CHAN_WIDTH_20;
+		else if (chan->flags & IEEE80211_CHAN_NO_80MHZ)
+			chandef->width = NL80211_CHAN_WIDTH_40;
+		else if (chan->flags & IEEE80211_CHAN_NO_160MHZ)
+			chandef->width = NL80211_CHAN_WIDTH_80;
+		else {
+			chandef->width = NL80211_CHAN_WIDTH_160;
+			IMPROVE("80P80 and 320 ...");
+		}
 		chandef->center_freq1 = chan->center_freq;
 		break;
 	};
@@ -1199,10 +1247,10 @@ cfg80211_bss_iter(struct wiphy *wiphy, struct cfg80211_chan_def *chandef,
 }
 
 struct element {
-	uint8_t		id;
-	uint8_t		datalen;
-	uint8_t		data[0];
-};
+	uint8_t					id;
+	uint8_t					datalen;
+	uint8_t					data[0];
+} __packed;
 
 static __inline const struct element *
 cfg80211_find_elem(enum ieee80211_eid eid, uint8_t *data, size_t len)
@@ -1574,7 +1622,8 @@ ieee80211_get_hdrlen_from_skb(struct sk_buff *skb)
 static __inline void
 cfg80211_bss_flush(struct wiphy *wiphy)
 {
-	TODO();
+
+	linuxkpi_cfg80211_bss_flush(wiphy);
 }
 
 static __inline bool
@@ -1616,6 +1665,38 @@ cfg80211_shutdown_all_interfaces(struct wiphy *wiphy)
 	TODO();
 }
 
+static __inline bool
+cfg80211_reg_can_beacon(struct wiphy *wiphy, struct cfg80211_chan_def *chandef,
+    enum nl80211_iftype iftype)
+{
+	TODO();
+	return (false);
+}
+
+static __inline void
+cfg80211_background_radar_event(struct wiphy *wiphy,
+    struct cfg80211_chan_def *chandef, gfp_t gfp)
+{
+	TODO();
+}
+
+static __inline const u8 *
+cfg80211_find_ext_ie(uint8_t eid, uint8_t *p, size_t len)
+{
+	TODO();
+	return (NULL);
+}
+
+static __inline bool
+cfg80211_chandef_valid(const struct cfg80211_chan_def *chandef)
+{
+	TODO();
+	return (false);
+}
+
+#define	wiphy_info(wiphy, fmt, ...)					\
+	printf("%s:%d XXX TODO " fmt, __func__, __LINE__, __VA_ARGS__)
+
 #ifndef LINUXKPI_NET80211
 #define	ieee80211_channel		linuxkpi_ieee80211_channel
 #define	ieee80211_regdomain		linuxkpi_ieee80211_regdomain
diff --git a/sys/compat/linuxkpi/common/include/net/mac80211.h b/sys/compat/linuxkpi/common/include/net/mac80211.h
index 71107c407c2..4320edc90eb 100644
--- a/sys/compat/linuxkpi/common/include/net/mac80211.h
+++ b/sys/compat/linuxkpi/common/include/net/mac80211.h
@@ -56,6 +56,7 @@ enum ieee80211_hw_conf_flags {
 	IEEE80211_CONF_IDLE			= BIT(0),
 	IEEE80211_CONF_PS			= BIT(1),
 	IEEE80211_CONF_MONITOR			= BIT(2),
+	IEEE80211_CONF_OFFCHANNEL		= BIT(3),
 };
 
 /* (*ops->config()) */
@@ -64,9 +65,11 @@ enum ieee80211_hw_conf_changed_flags {
 	IEEE80211_CONF_CHANGE_IDLE		= BIT(1),
 	IEEE80211_CONF_CHANGE_PS		= BIT(2),
 	IEEE80211_CONF_CHANGE_MONITOR		= BIT(3),
+	IEEE80211_CONF_CHANGE_POWER		= BIT(4),
 };
 
 #define	CFG80211_TESTMODE_CMD(_x)	/* XXX TODO */
+#define	CFG80211_TESTMODE_DUMP(_x)	/* XXX TODO */
 
 #define	FCS_LEN				4
 
@@ -108,6 +111,10 @@ enum ieee80211_bss_changed {
 	BSS_CHANGED_IBSS		= BIT(23),
 	BSS_CHANGED_MCAST_RATE		= BIT(24),
 	BSS_CHANGED_SSID		= BIT(25),
+	BSS_CHANGED_FILS_DISCOVERY	= BIT(26),
+	BSS_CHANGED_HE_OBSS_PD		= BIT(27),
+	BSS_CHANGED_TWT			= BIT(28),
+	BSS_CHANGED_UNSOL_BCAST_PROBE_RESP = BIT(30),
 };
 
 /* 802.11 Figure 9-256 Suite selector format. [OUI(3), SUITE TYPE(1)] */
@@ -132,6 +139,9 @@ enum ieee80211_bss_changed {
 #define	WLAN_CIPHER_SUITE_BIP_CMAC_256	WLAN_CIPHER_SUITE(13)
 /* Reserved				14-255 */
 
+/* See ISO/IEC JTC 1 N 9880 Table 11 */
+#define	WLAN_CIPHER_SUITE_SMS4		WLAN_CIPHER_SUITE_OUI(0x001472, 1)
+
 
 /* 802.11 Table 9-133 AKM suite selectors. */
 #define	WLAN_AKM_SUITE(_x)		WLAN_CIPHER_SUITE_OUI(0x000fac, _x)
@@ -155,6 +165,11 @@ enum ieee80211_bss_changed {
 
 struct ieee80211_sta;
 
+/* 802.11-2020 9.4.2.55.3 A-MPDU Parameters field */
+#define	IEEE80211_HT_AMPDU_PARM_FACTOR		0x3
+#define	IEEE80211_HT_AMPDU_PARM_DENSITY_SHIFT	2
+#define	IEEE80211_HT_AMPDU_PARM_DENSITY		(0x7 << IEEE80211_HT_AMPDU_PARM_DENSITY_SHIFT)
+
 struct ieee80211_ampdu_params {
 	/* TODO FIXME */
 	struct ieee80211_sta			*sta;
@@ -186,7 +201,13 @@ struct ieee80211_p2p_noa_attr {
 struct ieee80211_mutable_offsets {
 	/* TODO FIXME */
 	uint16_t				tim_offset;
-	int     cntdwn_counter_offs;
+	uint16_t				cntdwn_counter_offs[2];
+
+	int	mbssid_off;
+};
+
+struct mac80211_fils_discovery {
+	uint32_t				max_interval;
 };
 
 #define	WLAN_MEMBERSHIP_LEN			(8)
@@ -205,9 +226,8 @@ struct ieee80211_bss_conf {
 		uint8_t membership[WLAN_MEMBERSHIP_LEN];
 		uint8_t position[WLAN_USER_POSITION_LEN];
 	}  mu_group;
-	struct {
-		int color;
-	} he_bss_color;
+	struct cfg80211_he_bss_color		he_bss_color;
+	struct ieee80211_he_obss_pd		he_obss_pd;
 	size_t					ssid_len;
 	uint8_t					ssid[IEEE80211_NWID_LEN];
 	uint16_t				aid;
@@ -215,6 +235,7 @@ struct ieee80211_bss_conf {
 	int					arp_addr_cnt;
 
 	uint8_t					dtim_period;
+	uint8_t					sync_dtim_count;
 	bool					assoc;
 	bool					idle;
 	bool					qos;
@@ -223,12 +244,16 @@ struct ieee80211_bss_conf {
 	bool					use_cts_prot;
 	bool					use_short_preamble;
 	bool					use_short_slot;
-	uint16_t				beacon_int;
+	bool					he_support;
+	bool					csa_active;
 	uint32_t				sync_device_ts;
 	uint64_t				sync_tsf;
-	uint8_t					sync_dtim_count;
+	uint16_t				beacon_int;
 	int16_t					txpower;
+	uint32_t				basic_rates;
 	int					mcast_rate[NUM_NL80211_BANDS];
+	struct cfg80211_bitrate_mask		beacon_tx_rate;
+	struct mac80211_fils_discovery		fils_discovery;
 
 	int		ack_enabled, bssid_index, bssid_indicator, cqm_rssi_hyst, cqm_rssi_thold, ema_ap, frame_time_rts_th, ftm_responder;
 	int		htc_trig_based_pkt_ext;
@@ -236,9 +261,8 @@ struct ieee80211_bss_conf {
 	int		profile_periodicity;
 	int		twt_requester, uora_exists, uora_ocw_range;
 	int		assoc_capability, enable_beacon, hidden_ssid, ibss_joined, twt_protected;
-	int		fils_discovery, he_obss_pd, he_oper, twt_responder, unsol_bcast_probe_resp_interval;
-	unsigned long	basic_rates;
-	bool		he_support;
+	int		 he_oper, twt_responder, unsol_bcast_probe_resp_interval;
+	int		color_change_active;
 };
 
 struct ieee80211_chanctx_conf {
@@ -328,7 +352,9 @@ struct ieee80211_he_mu_edca_param_ac_rec {
 
 struct ieee80211_conf {
 	int					dynamic_ps_timeout;
+	int					power_level;
 	uint32_t				listen_interval;
+	bool					radar_enabled;
 	enum ieee80211_hw_conf_flags		flags;
 	struct cfg80211_chan_def		chandef;
 };
@@ -371,6 +397,9 @@ enum ieee80211_hw_flags {
 	IEEE80211_HW_SUPPORTS_PER_STA_GTK,
 	IEEE80211_HW_REPORTS_LOW_ACK,
 	IEEE80211_HW_QUEUE_CONTROL,
+	IEEE80211_HW_SUPPORTS_RX_DECAP_OFFLOAD,
+	IEEE80211_HW_SUPPORTS_TX_ENCAP_OFFLOAD,
+	IEEE80211_HW_SUPPORTS_RC_TABLE,
 
 	/* Keep last. */
 	NUM_IEEE80211_HW_FLAGS
@@ -423,6 +452,7 @@ enum ieee802111_key_flag {
 	IEEE80211_KEY_FLAG_PUT_MIC_SPACE	= BIT(4),
 	IEEE80211_KEY_FLAG_SW_MGMT_TX		= BIT(5),
 	IEEE80211_KEY_FLAG_GENERATE_IV_MGMT	= BIT(6),
+	IEEE80211_KEY_FLAG_GENERATE_MMIE	= BIT(7),
 };
 
 struct ieee80211_key_conf {
@@ -486,6 +516,14 @@ enum ieee80211_rx_status_flags {
 	RX_FLAG_MACTIME_END		= BIT(24),
 	RX_FLAG_ONLY_MONITOR		= BIT(25),
 	RX_FLAG_SKIP_MONITOR		= BIT(26),
+	RX_FLAG_8023			= BIT(27),
+};
+
+enum mac80211_rx_encoding {
+	RX_ENC_LEGACY		= 0,
+	RX_ENC_HT,
+	RX_ENC_VHT,
+	RX_ENC_HE
 };
 
 struct ieee80211_rx_status {
@@ -495,17 +533,7 @@ struct ieee80211_rx_status {
 	uint32_t			device_timestamp;
 	enum ieee80211_rx_status_flags	flag;
 	uint16_t			freq;
-	uint8_t				bw;
-#define	RATE_INFO_BW_20		0x01
-#define	RATE_INFO_BW_40		0x02
-#define	RATE_INFO_BW_80		0x04
-#define	RATE_INFO_BW_160	0x08
-#define	RATE_INFO_BW_HE_RU	0x10
-	uint8_t				encoding;
-#define	RX_ENC_LEGACY		0x00
-#define	RX_ENC_HE		0x01
-#define	RX_ENC_HT		0x02
-#define	RX_ENC_VHT		0x04
+	uint8_t				encoding:2, bw:3, he_ru:3;	/* enum mac80211_rx_encoding, rate_info_bw */	/* See mt76.h */
 	uint8_t				ampdu_reference;
 	uint8_t				band;
 	uint8_t				chains;
@@ -514,12 +542,25 @@ struct ieee80211_rx_status {
 	uint8_t				enc_flags;
 	uint8_t				he_dcm;
 	uint8_t				he_gi;
-	uint8_t				he_ru;
 	uint8_t				zero_length_psdu_type;
 	uint8_t				nss;
 	uint8_t				rate_idx;
 };
 
+struct ieee80211_tx_rate_status {
+};
+
+struct ieee80211_tx_status {
+	struct ieee80211_sta		*sta;
+	struct ieee80211_tx_info	*info;
+
+	u8				n_rates;
+	struct ieee80211_tx_rate_status	*rates;
+
+	struct sk_buff			*skb;
+	struct list_head		*free_list;
+};
+
 struct ieee80211_scan_ies {
 	/* TODO FIXME */
 	int		common_ie_len;
@@ -623,6 +664,15 @@ enum ieee80211_vif_driver_flags {
 	IEEE80211_VIF_SUPPORTS_UAPSD		= BIT(2),
 };
 
+#define	IEEE80211_BSS_ARP_ADDR_LIST_LEN		4
+
+struct ieee80211_vif_cfg {
+	uint16_t				aid;
+	bool					assoc;
+	int					arp_addr_cnt;
+	uint32_t				arp_addr_list[IEEE80211_BSS_ARP_ADDR_LIST_LEN];		/* big endian */
+};
+
 struct ieee80211_vif {
 	/* TODO FIXME */
 	enum nl80211_iftype		type;
@@ -633,6 +683,7 @@ struct ieee80211_vif {
 	bool				p2p;
 	bool				probe_req_reg;
 	uint8_t				addr[ETH_ALEN];
+	struct ieee80211_vif_cfg	cfg;
 	struct ieee80211_chanctx_conf	*chanctx_conf;
 	struct ieee80211_txq		*txq;
 	struct ieee80211_bss_conf	bss_conf;
@@ -729,13 +780,15 @@ enum set_key_cmd {
 	DISABLE_KEY,
 };
 
+/* 802.11-2020, 9.4.2.55.2 HT Capability Information field. */
 enum rx_enc_flags {
 	RX_ENC_FLAG_SHORTPRE	=	BIT(0),
-	RX_ENC_FLAG_SHORT_GI	=	BIT(1),
-	RX_ENC_FLAG_HT_GF	=	BIT(2),
-	RX_ENC_FLAG_LDPC	=	BIT(3),
-	RX_ENC_FLAG_BF		=	BIT(4),
-#define	RX_ENC_FLAG_STBC_SHIFT		6
+	RX_ENC_FLAG_SHORT_GI	=	BIT(2),
+	RX_ENC_FLAG_HT_GF	=	BIT(3),
+	RX_ENC_FLAG_STBC_MASK	=	BIT(4) | BIT(5),
+#define	RX_ENC_FLAG_STBC_SHIFT		4
+	RX_ENC_FLAG_LDPC	=	BIT(6),
+	RX_ENC_FLAG_BF		=	BIT(7),
 };
 
 enum sta_notify_cmd {
@@ -743,6 +796,18 @@ enum sta_notify_cmd {
 	STA_NOTIFY_SLEEP,
 };
 
+struct ieee80211_low_level_stats {
+	/* Can we make them uint64_t? */
+	uint32_t dot11ACKFailureCount;
+	uint32_t dot11FCSErrorCount;
+	uint32_t dot11RTSFailureCount;
+	uint32_t dot11RTSSuccessCount;
+};
+
+enum ieee80211_offload_flags {
+	IEEE80211_OFFLOAD_ENCAP_4ADDR,
+};
+
 struct ieee80211_ops {
 	/* TODO FIXME */
 	int  (*start)(struct ieee80211_hw *);
@@ -790,6 +855,7 @@ struct ieee80211_ops {
 	void (*sta_rc_update)(struct ieee80211_hw *, struct ieee80211_vif *, struct ieee80211_sta *, u32);
 	void (*sta_rate_tbl_update)(struct ieee80211_hw *, struct ieee80211_vif *, struct ieee80211_sta *);
 	void (*sta_set_4addr)(struct ieee80211_hw *, struct ieee80211_vif *, struct ieee80211_sta *, bool);
+	void (*sta_set_decap_offload)(struct ieee80211_hw *, struct ieee80211_vif *, struct ieee80211_sta *, bool);
 
 	u64  (*prepare_multicast)(struct ieee80211_hw *, struct netdev_hw_addr_list *);
 
@@ -800,6 +866,7 @@ struct ieee80211_ops {
 	int  (*pre_channel_switch)(struct ieee80211_hw *, struct ieee80211_vif *, struct ieee80211_channel_switch *);
 	int  (*post_channel_switch)(struct ieee80211_hw *, struct ieee80211_vif *);
 	void (*channel_switch)(struct ieee80211_hw *, struct ieee80211_vif *, struct ieee80211_channel_switch *);
+	void (*channel_switch_beacon)(struct ieee80211_hw *, struct ieee80211_vif *, struct cfg80211_chan_def *);
 	void (*abort_channel_switch)(struct ieee80211_hw *, struct ieee80211_vif *);
 	void (*channel_switch_rx_beacon)(struct ieee80211_hw *, struct ieee80211_vif *, struct ieee80211_channel_switch *);
 	int  (*tdls_channel_switch)(struct ieee80211_hw *, struct ieee80211_vif *, struct ieee80211_sta *, u8, struct cfg80211_chan_def *, struct sk_buff *, u32);
@@ -827,7 +894,11 @@ struct ieee80211_ops {
 	void (*event_callback)(struct ieee80211_hw *, struct ieee80211_vif *, const struct ieee80211_event *);
 	int  (*get_survey)(struct ieee80211_hw *, int, struct survey_info *);
 	int  (*get_ftm_responder_stats)(struct ieee80211_hw *, struct ieee80211_vif *, struct cfg80211_ftm_responder_stats *);
+
+        uint64_t (*get_tsf)(struct ieee80211_hw *, struct ieee80211_vif *);
+        void (*set_tsf)(struct ieee80211_hw *, struct ieee80211_vif *, uint64_t);
 	void (*offset_tsf)(struct ieee80211_hw *, struct ieee80211_vif *, s64);
+
 	int  (*set_bitrate_mask)(struct ieee80211_hw *, struct ieee80211_vif *, const struct cfg80211_bitrate_mask *);
 	void (*set_coverage_class)(struct ieee80211_hw *, s16);
 	int  (*set_tim)(struct ieee80211_hw *, struct ieee80211_sta *, bool);
@@ -844,16 +915,24 @@ struct ieee80211_ops {
 	int  (*join_ibss)(struct ieee80211_hw *, struct ieee80211_vif *);
 	void (*leave_ibss)(struct ieee80211_hw *, struct ieee80211_vif *);
 
-	int (*set_sar_specs)(struct ieee80211_hw *, const struct cfg80211_sar_specs *);
+	int  (*set_sar_specs)(struct ieee80211_hw *, const struct cfg80211_sar_specs *);
 
-	int (*set_tid_config)(struct ieee80211_hw *, struct ieee80211_vif *, struct ieee80211_sta *, struct cfg80211_tid_config *);
-	int (*reset_tid_config)(struct ieee80211_hw *, struct ieee80211_vif *, struct ieee80211_sta *, u8);
+	int  (*set_tid_config)(struct ieee80211_hw *, struct ieee80211_vif *, struct ieee80211_sta *, struct cfg80211_tid_config *);
+	int  (*reset_tid_config)(struct ieee80211_hw *, struct ieee80211_vif *, struct ieee80211_sta *, u8);
 
-	int (*get_et_sset_count)(struct ieee80211_hw *, struct ieee80211_vif *, int);
+	int  (*get_et_sset_count)(struct ieee80211_hw *, struct ieee80211_vif *, int);
 	void (*get_et_stats)(struct ieee80211_hw *, struct ieee80211_vif *, struct ethtool_stats *, u64 *);
 	void (*get_et_strings)(struct ieee80211_hw *, struct ieee80211_vif *, u32, u8 *);
 
 	void (*update_vif_offload)(struct ieee80211_hw *, struct ieee80211_vif *);
+
+	int  (*get_txpower)(struct ieee80211_hw *, struct ieee80211_vif *, int *);
+	int  (*get_stats)(struct ieee80211_hw *, struct ieee80211_low_level_stats *);
+
+	int  (*set_radar_background)(struct ieee80211_hw *, struct cfg80211_chan_def *);
+
+	void (*add_twt_setup)(struct ieee80211_hw *, struct ieee80211_sta *, struct ieee80211_twt_setup *);
+	void (*twt_teardown_request)(struct ieee80211_hw *, struct ieee80211_sta *, u8);
 };
 
 
@@ -1229,6 +1308,41 @@ ieee80211_vif_is_mesh(struct ieee80211_vif *vif)
 	return (false);
 }
 
+static __inline bool
+ieee80211_is_frag(struct ieee80211_hdr *hdr)
+{
+	TODO();
+	return (false);
+}
+
+static __inline bool
+ieee80211_is_first_frag(__le16 fc)
+{
+	TODO();
+	return (false);
+}
+
+static __inline bool
+ieee80211_is_pspoll(__le16 fc)
+{
+	TODO();
+	return (false);
+}
+
+static __inline bool
+ieee80211_is_robust_mgmt_frame(struct sk_buff *skb)
+{
+	TODO();
+	return (false);
+}
+
+static __inline bool
+ieee80211_has_pm(__le16 fc)
+{
+	TODO();
+	return (false);
+}
+
 static __inline bool
 ieee80211_has_a4(__le16 fc)
 {
@@ -1577,8 +1691,17 @@ ieee80211_ie_split(const u8 *ies, size_t ies_len,
 static __inline void
 ieee80211_request_smps(struct ieee80211_vif *vif, enum ieee80211_smps_mode smps)
 {
+	static const char *smps_mode_name[] = {
+		"SMPS_OFF",
+		"SMPS_STATIC",
+		"SMPS_DYNAMIC",
+		"SMPS_AUTOMATIC",
+		"SMPS_NUM_MODES"
+	};
 
-	TODO();
+	if (linuxkpi_debug_80211 & D80211_TODO)
+		printf("%s:%d: XXX LKPI80211 TODO smps %d %s\n",
+		    __func__, __LINE__, smps, smps_mode_name[smps]);
 }
 
 static __inline void
@@ -1966,7 +2089,7 @@ SET_IEEE80211_PERM_ADDR	(struct ieee80211_hw *hw, uint8_t *addr)
 }
 
 static __inline uint8_t *
-ieee80211_bss_get_ie(struct cfg80211_bss *bss, uint32_t x)
+ieee80211_bss_get_ie(struct cfg80211_bss *bss, uint32_t eid)
 {
 	TODO();
 	return (NULL);
@@ -2119,4 +2242,72 @@ ieee80211_key_replay(struct ieee80211_key_conf *key)
 	TODO();
 }
 
+static __inline uint32_t
+ieee80211_calc_rx_airtime(struct ieee80211_hw *hw,
+    struct ieee80211_rx_status *rxstat, int len)
+{
+	TODO();
+	return (0);
+}
+
+static __inline void
+ieee80211_get_tx_rates(struct ieee80211_vif *vif, struct ieee80211_sta *sta,
+    struct sk_buff *skb, struct ieee80211_tx_rate *txrate, int nrates)
+{
+	TODO();
+}
+
+static __inline void
+ieee80211_rx_list(struct ieee80211_hw *hw, struct ieee80211_sta *sta,
+    struct sk_buff *skb, struct list_head *list)
+{
+	TODO();
+}
+
+static __inline void
+ieee80211_tx_status_ext(struct ieee80211_hw *hw,
+    struct ieee80211_tx_status *txstat)
+{
+	TODO();
+}
+
+static __inline const struct element *
+ieee80211_bss_get_elem(struct cfg80211_bss *bss, uint32_t eid)
+{
+	TODO();
+	return (NULL);
+}
+
+static __inline void
+ieee80211_color_change_finish(struct ieee80211_vif *vif)
+{
+	TODO();
+}
+
+static __inline struct sk_buff *
+ieee80211_get_fils_discovery_tmpl(struct ieee80211_hw *hw,
+    struct ieee80211_vif *vif)
+{
+	TODO();
+	return (NULL);
+}
+
+static __inline struct sk_buff *
+ieee80211_get_unsol_bcast_probe_resp_tmpl(struct ieee80211_hw *hw,
+    struct ieee80211_vif *vif)
+{
+	TODO();
+	return (NULL);
+}
+
+static __inline void
+linuxkpi_ieee80211_send_bar(struct ieee80211_vif *vif, uint8_t *ra, uint16_t tid,
+    uint16_t ssn)
+{
+	TODO();
+}
+
+#define	ieee80211_send_bar(_v, _r, _t, _s)				\
+    linuxkpi_ieee80211_send_bar(_v, _r, _t, _s)
+
 #endif	/* _LINUXKPI_NET_MAC80211_H */
diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c b/sys/compat/linuxkpi/common/src/linux_80211.c
index 8f72215614c..66a0a3f87cf 100644
--- a/sys/compat/linuxkpi/common/src/linux_80211.c
+++ b/sys/compat/linuxkpi/common/src/linux_80211.c
@@ -118,6 +118,9 @@ SYSCTL_INT(_compat_linuxkpi_80211, OID_AUTO, debug, CTLFLAG_RWTUN,
 /* This is DSAP | SSAP | CTRL | ProtoID/OrgCode{3}. */
 const uint8_t rfc1042_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
 
+/* IEEE 802.11-05/0257r1 */
+const uint8_t bridge_tunnel_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
+
 const uint8_t tid_to_mac80211_ac[] = {
 	IEEE80211_AC_BE,
 	IEEE80211_AC_BK,