Update to FreeBSD stable/12 2019-02-11

Git mirror commit 606b591dae1023a71ff020faf99789059eb6591f.

33 files changed, 616 insertions, 238 deletions

diff --git a/freebsd/sbin/ifconfig/ifieee80211.c b/freebsd/sbin/ifconfig/ifieee80211.c
index dc7b88d1..c53d1113 100644
--- a/freebsd/sbin/ifconfig/ifieee80211.c
+++ b/freebsd/sbin/ifconfig/ifieee80211.c
@@ -86,6 +86,7 @@
 #include <net80211/ieee80211_superg.h>
 #include <net80211/ieee80211_tdma.h>
 #include <net80211/ieee80211_mesh.h>
+#include <net80211/ieee80211_wps.h>
 
 #include <assert.h>
 #include <ctype.h>
@@ -3136,13 +3137,6 @@ printrsnie(const char *tag, const u_int8_t *ie, size_t ielen, int maxlen)
 	}
 }
 
-/* XXX move to a public include file */
-#define IEEE80211_WPS_DEV_PASS_ID	0x1012
-#define IEEE80211_WPS_SELECTED_REG	0x1041
-#define IEEE80211_WPS_SETUP_STATE	0x1044
-#define IEEE80211_WPS_UUID_E		0x1047
-#define IEEE80211_WPS_VERSION		0x104a
-
 #define BE_READ_2(p)					\
 	((u_int16_t)					\
 	 ((((const u_int8_t *)(p))[1]      ) |		\
@@ -3164,6 +3158,7 @@ printwpsie(const char *tag, const u_int8_t *ie, size_t ielen, int maxlen)
 			"R"	/* Registrar-specified */
 		};
 		int n;
+		int f;
 
 		ie +=6, len -= 4;		/* NB: len is payload only */
 
@@ -3172,6 +3167,7 @@ printwpsie(const char *tag, const u_int8_t *ie, size_t ielen, int maxlen)
 		while (len) {
 			uint16_t tlv_type = BE_READ_2(ie);
 			uint16_t tlv_len  = BE_READ_2(ie + 2);
+			uint16_t cfg_mthd;
 
 			/* some devices broadcast invalid WPS frames */
 			if (tlv_len > len) {
@@ -3184,30 +3180,191 @@ printwpsie(const char *tag, const u_int8_t *ie, size_t ielen, int maxlen)
 			ie += 4, len -= 4;
 
 			switch (tlv_type) {
-			case IEEE80211_WPS_VERSION:
+			case IEEE80211_WPS_ATTR_VERSION:
 				printf("v:%d.%d", *ie >> 4, *ie & 0xf);
 				break;
-			case IEEE80211_WPS_SETUP_STATE:
-				/* Only 1 and 2 are valid */
-				if (*ie == 0 || *ie >= 3)
-					printf(" state:B");
+			case IEEE80211_WPS_ATTR_AP_SETUP_LOCKED:
+				printf(" ap_setup:%s", *ie ? "locked" :
+				    "unlocked");
+				break;
+			case IEEE80211_WPS_ATTR_CONFIG_METHODS:
+			case IEEE80211_WPS_ATTR_SELECTED_REGISTRAR_CONFIG_METHODS:
+				if (tlv_type == IEEE80211_WPS_ATTR_SELECTED_REGISTRAR_CONFIG_METHODS)
+					printf(" sel_reg_cfg_mthd:");
 				else
-					printf(" st:%s", *ie == 1 ? "N" : "C");
+					printf(" cfg_mthd:" );
+				cfg_mthd = BE_READ_2(ie);
+				f = 0;
+				for (n = 15; n >= 0; n--) {
+					if (f) {
+						printf(",");
+						f = 0;
+					}
+					switch (cfg_mthd & (1 << n)) {
+					case 0:
+						break;
+					case IEEE80211_WPS_CONFIG_USBA:
+						printf("usba");
+						f++;
+						break;
+					case IEEE80211_WPS_CONFIG_ETHERNET:
+						printf("ethernet");
+						f++;
+						break;
+					case IEEE80211_WPS_CONFIG_LABEL:
+						printf("label");
+						f++;
+						break;
+					case IEEE80211_WPS_CONFIG_DISPLAY:
+						if (!(cfg_mthd &
+						    (IEEE80211_WPS_CONFIG_VIRT_DISPLAY |
+						    IEEE80211_WPS_CONFIG_PHY_DISPLAY)))
+						    {
+							printf("display");
+							f++;
+						}
+						break;
+					case IEEE80211_WPS_CONFIG_EXT_NFC_TOKEN:
+						printf("ext_nfc_tokenk");
+						f++;
+						break;
+					case IEEE80211_WPS_CONFIG_INT_NFC_TOKEN:
+						printf("int_nfc_token");
+						f++;
+						break;
+					case IEEE80211_WPS_CONFIG_NFC_INTERFACE:
+						printf("nfc_interface");
+						f++;
+						break;
+					case IEEE80211_WPS_CONFIG_PUSHBUTTON:
+						if (!(cfg_mthd &
+						    (IEEE80211_WPS_CONFIG_VIRT_PUSHBUTTON |
+						    IEEE80211_WPS_CONFIG_PHY_PUSHBUTTON))) {
+							printf("push_button");
+							f++;
+						}
+						break;
+					case IEEE80211_WPS_CONFIG_KEYPAD:
+						printf("keypad");
+						f++;
+						break;
+					case IEEE80211_WPS_CONFIG_VIRT_PUSHBUTTON:
+						printf("virtual_push_button");
+						f++;
+						break;
+					case IEEE80211_WPS_CONFIG_PHY_PUSHBUTTON:
+						printf("physical_push_button");
+						f++;
+						break;
+					case IEEE80211_WPS_CONFIG_P2PS:
+						printf("p2ps");
+						f++;
+						break;
+					case IEEE80211_WPS_CONFIG_VIRT_DISPLAY:
+						printf("virtual_display");
+						f++;
+						break;
+					case IEEE80211_WPS_CONFIG_PHY_DISPLAY:
+						printf("physical_display");
+						f++;
+						break;
+					default:
+						printf("unknown_wps_config<%04x>",
+						    cfg_mthd & (1 << n));
+						f++;
+						break;
+					}
+				}
 				break;
-			case IEEE80211_WPS_SELECTED_REG:
-				printf(" sel:%s", *ie ? "T" : "F");
+			case IEEE80211_WPS_ATTR_DEV_NAME:
+				printf(" device_name:<%.*s>", tlv_len, ie);
 				break;
-			case IEEE80211_WPS_DEV_PASS_ID:
+			case IEEE80211_WPS_ATTR_DEV_PASSWORD_ID:
 				n = LE_READ_2(ie);
 				if (n < nitems(dev_pass_id))
 					printf(" dpi:%s", dev_pass_id[n]);
 				break;
-			case IEEE80211_WPS_UUID_E:
+			case IEEE80211_WPS_ATTR_MANUFACTURER:
+				printf(" manufacturer:<%.*s>", tlv_len, ie);
+				break;
+			case IEEE80211_WPS_ATTR_MODEL_NAME:
+				printf(" model_name:<%.*s>", tlv_len, ie);
+				break;
+			case IEEE80211_WPS_ATTR_MODEL_NUMBER:
+				printf(" model_number:<%.*s>", tlv_len, ie);
+				break;
+			case IEEE80211_WPS_ATTR_PRIMARY_DEV_TYPE:
+				printf(" prim_dev:");
+				for (n = 0; n < tlv_len; n++)
+					printf("%02x", ie[n]);
+				break;
+			case IEEE80211_WPS_ATTR_RF_BANDS:
+				printf(" rf:");
+				f = 0;
+				for (n = 7; n >= 0; n--) {
+					if (f) {
+						printf(",");
+						f = 0;
+					}
+					switch (*ie & (1 << n)) {
+					case 0:
+						break;
+					case IEEE80211_WPS_RF_BAND_24GHZ:
+						printf("2.4Ghz");
+						f++;
+						break;
+					case IEEE80211_WPS_RF_BAND_50GHZ:
+						printf("5Ghz");
+						f++;
+						break;
+					case IEEE80211_WPS_RF_BAND_600GHZ:
+						printf("60Ghz");
+						f++;
+						break;
+					default:
+						printf("unknown<%02x>",
+						    *ie & (1 << n));
+						f++;
+						break;
+					}
+				}
+				break;
+			case IEEE80211_WPS_ATTR_RESPONSE_TYPE:
+				printf(" resp_type:0x%02x", *ie);
+				break;
+			case IEEE80211_WPS_ATTR_SELECTED_REGISTRAR:
+				printf(" sel:%s", *ie ? "T" : "F");
+				break;
+			case IEEE80211_WPS_ATTR_SERIAL_NUMBER:
+				printf(" serial_number:<%.*s>", tlv_len, ie);
+				break;
+			case IEEE80211_WPS_ATTR_UUID_E:
 				printf(" uuid-e:");
 				for (n = 0; n < (tlv_len - 1); n++)
 					printf("%02x-", ie[n]);
 				printf("%02x", ie[n]);
 				break;
+			case IEEE80211_WPS_ATTR_VENDOR_EXT:
+				printf(" vendor:");
+				for (n = 0; n < tlv_len; n++)
+					printf("%02x", ie[n]);
+				break;
+			case IEEE80211_WPS_ATTR_WPS_STATE:
+				switch (*ie) {
+				case IEEE80211_WPS_STATE_NOT_CONFIGURED:
+					printf(" state:N");
+					break;
+				case IEEE80211_WPS_STATE_CONFIGURED:
+					printf(" state:C");
+					break;
+				default:
+					printf(" state:B<%02x>", *ie);
+					break;
+				}
+				break;
+			default:
+				printf(" unknown_wps_attr:0x%x", tlv_type);
+				break;
 			}
 			ie += tlv_len, len -= tlv_len;
 		}
@@ -3360,6 +3517,7 @@ iswpsoui(const uint8_t *frm)
 static const char *
 iename(int elemid)
 {
+	static char iename_buf[64];
 	switch (elemid) {
 	case IEEE80211_ELEMID_FHPARMS:	return " FHPARMS";
 	case IEEE80211_ELEMID_CFPARMS:	return " CFPARMS";
@@ -3377,10 +3535,21 @@ iename(int elemid)
 	case IEEE80211_ELEMID_MEASREP:	return " MEASREP";
 	case IEEE80211_ELEMID_QUIET:	return " QUIET";
 	case IEEE80211_ELEMID_IBSSDFS:	return " IBSSDFS";
+	case IEEE80211_ELEMID_RESERVED_47:
+					return " RESERVED_47";
+	case IEEE80211_ELEMID_MOBILITY_DOMAIN:
+					return " MOBILITY_DOMAIN";
+	case IEEE80211_ELEMID_RRM_ENACAPS:
+					return " RRM_ENCAPS";
+	case IEEE80211_ELEMID_OVERLAP_BSS_SCAN_PARAM:
+					return " OVERLAP_BSS";
 	case IEEE80211_ELEMID_TPC:	return " TPC";
 	case IEEE80211_ELEMID_CCKM:	return " CCKM";
+	case IEEE80211_ELEMID_EXTCAP:	return " EXTCAP";
 	}
-	return " ???";
+	snprintf(iename_buf, sizeof(iename_buf), " UNKNOWN_ELEMID_%d",
+	    elemid);
+	return (const char *) iename_buf;
 }
 
 static void
@@ -4148,7 +4317,10 @@ list_roam(int s)
 		rp = &roamparams.params[mode];
 		if (rp->rssi == 0 && rp->rate == 0)
 			continue;
-		if (mode == IEEE80211_MODE_11NA || mode == IEEE80211_MODE_11NG) {
+		if (mode == IEEE80211_MODE_11NA ||
+		    mode == IEEE80211_MODE_11NG ||
+		    mode == IEEE80211_MODE_VHT_2GHZ ||
+		    mode == IEEE80211_MODE_VHT_5GHZ) {
 			if (rp->rssi & 1)
 				LINE_CHECK("roam:%-7.7s rssi %2u.5dBm  MCS %2u    ",
 				    modename[mode], rp->rssi/2,
@@ -4168,6 +4340,21 @@ list_roam(int s)
 	}
 }
 
+/* XXX TODO: rate-to-string method... */
+static const char*
+get_mcs_mbs_rate_str(uint8_t rate)
+{
+	return (rate & IEEE80211_RATE_MCS) ? "MCS " : "Mb/s";
+}
+
+static uint8_t
+get_rate_value(uint8_t rate)
+{
+	if (rate & IEEE80211_RATE_MCS)
+		return (rate &~ IEEE80211_RATE_MCS);
+	return (rate / 2);
+}
+
 static void
 list_txparams(int s)
 {
@@ -4179,21 +4366,28 @@ list_txparams(int s)
 		tp = &txparams.params[mode];
 		if (tp->mgmtrate == 0 && tp->mcastrate == 0)
 			continue;
-		if (mode == IEEE80211_MODE_11NA || mode == IEEE80211_MODE_11NG) {
+		if (mode == IEEE80211_MODE_11NA ||
+		    mode == IEEE80211_MODE_11NG ||
+		    mode == IEEE80211_MODE_VHT_2GHZ ||
+		    mode == IEEE80211_MODE_VHT_5GHZ) {
 			if (tp->ucastrate == IEEE80211_FIXED_RATE_NONE)
-				LINE_CHECK("%-7.7s ucast NONE    mgmt %2u MCS  "
-				    "mcast %2u MCS  maxretry %u",
+				LINE_CHECK("%-7.7s ucast NONE    mgmt %2u %s "
+				    "mcast %2u %s maxretry %u",
 				    modename[mode],
-				    tp->mgmtrate &~ IEEE80211_RATE_MCS,
-				    tp->mcastrate &~ IEEE80211_RATE_MCS,
+				    get_rate_value(tp->mgmtrate),
+				    get_mcs_mbs_rate_str(tp->mgmtrate),
+				    get_rate_value(tp->mcastrate),
+				    get_mcs_mbs_rate_str(tp->mcastrate),
 				    tp->maxretry);
 			else
-				LINE_CHECK("%-7.7s ucast %2u MCS  mgmt %2u MCS  "
-				    "mcast %2u MCS  maxretry %u",
+				LINE_CHECK("%-7.7s ucast %2u MCS  mgmt %2u %s "
+				    "mcast %2u %s maxretry %u",
 				    modename[mode],
 				    tp->ucastrate &~ IEEE80211_RATE_MCS,
-				    tp->mgmtrate &~ IEEE80211_RATE_MCS,
-				    tp->mcastrate &~ IEEE80211_RATE_MCS,
+				    get_rate_value(tp->mgmtrate),
+				    get_mcs_mbs_rate_str(tp->mgmtrate),
+				    get_rate_value(tp->mcastrate),
+				    get_mcs_mbs_rate_str(tp->mcastrate),
 				    tp->maxretry);
 		} else {
 			if (tp->ucastrate == IEEE80211_FIXED_RATE_NONE)
diff --git a/freebsd/sys/dev/e1000/if_em.c b/freebsd/sys/dev/e1000/if_em.c
index 803b68ec..564a1ee2 100644
--- a/freebsd/sys/dev/e1000/if_em.c
+++ b/freebsd/sys/dev/e1000/if_em.c
@@ -295,7 +295,7 @@ static void	em_disable_aspm(struct adapter *);
 int		em_intr(void *arg);
 static void	em_disable_promisc(if_ctx_t ctx);
 
-/* MSIX handlers */
+/* MSI-X handlers */
 static int	em_if_msix_intr_assign(if_ctx_t, int);
 static int	em_msix_link(void *);
 static void	em_handle_link(void *context);
@@ -782,7 +782,9 @@ em_if_attach_pre(if_ctx_t ctx)
 	scctx->isc_msix_bar = PCIR_BAR(EM_MSIX_BAR);
 	scctx->isc_tx_nsegments = EM_MAX_SCATTER;
 	scctx->isc_nrxqsets_max = scctx->isc_ntxqsets_max = em_set_num_queues(ctx);
-	device_printf(dev, "attach_pre capping queues at %d\n", scctx->isc_ntxqsets_max);
+	if (bootverbose)
+		device_printf(dev, "attach_pre capping queues at %d\n",
+		    scctx->isc_ntxqsets_max);
 
 	if (adapter->hw.mac.type >= igb_mac_min) {
 		int try_second_bar;
@@ -1295,7 +1297,7 @@ em_if_init(if_ctx_t ctx)
 	em_if_set_promisc(ctx, IFF_PROMISC);
 	e1000_clear_hw_cntrs_base_generic(&adapter->hw);
 
-	/* MSI/X configuration for 82574 */
+	/* MSI-X configuration for 82574 */
 	if (adapter->hw.mac.type == e1000_82574) {
 		int tmp = E1000_READ_REG(&adapter->hw, E1000_CTRL_EXT);
 
@@ -1421,7 +1423,7 @@ em_if_tx_queue_intr_enable(if_ctx_t ctx, uint16_t txqid)
 
 /*********************************************************************
  *
- *  MSIX RX Interrupt Service routine
+ *  MSI-X RX Interrupt Service routine
  *
  **********************************************************************/
 static int
@@ -1436,7 +1438,7 @@ em_msix_que(void *arg)
 
 /*********************************************************************
  *
- *  MSIX Link Fast Interrupt Service routine
+ *  MSI-X Link Fast Interrupt Service routine
  *
  **********************************************************************/
 static int
@@ -1906,7 +1908,6 @@ em_allocate_pci_resources(if_ctx_t ctx)
 		for (rid = PCIR_BAR(0); rid < PCIR_CIS;) {
 			val = pci_read_config(dev, rid, 4);
 			if (EM_BAR_TYPE(val) == EM_BAR_TYPE_IO) {
-				adapter->io_rid = rid;
 				break;
 			}
 			rid += 4;
@@ -1918,8 +1919,8 @@ em_allocate_pci_resources(if_ctx_t ctx)
 			device_printf(dev, "Unable to locate IO BAR\n");
 			return (ENXIO);
 		}
-		adapter->ioport = bus_alloc_resource_any(dev,
-		    SYS_RES_IOPORT, &adapter->io_rid, RF_ACTIVE);
+		adapter->ioport = bus_alloc_resource_any(dev, SYS_RES_IOPORT,
+		    &rid, RF_ACTIVE);
 		if (adapter->ioport == NULL) {
 			device_printf(dev, "Unable to allocate bus resource: "
 			    "ioport\n");
@@ -1939,7 +1940,7 @@ em_allocate_pci_resources(if_ctx_t ctx)
 
 /*********************************************************************
  *
- *  Setup the MSIX Interrupt handlers
+ *  Set up the MSI-X Interrupt handlers
  *
  **********************************************************************/
 static int
@@ -1968,7 +1969,7 @@ em_if_msix_intr_assign(if_ctx_t ctx, int msix)
 		 * Set the bit to enable interrupt
 		 * in E1000_IMS -- bits 20 and 21
 		 * are for RX0 and RX1, note this has
-		 * NOTHING to do with the MSIX vector
+		 * NOTHING to do with the MSI-X vector
 		 */
 		if (adapter->hw.mac.type == e1000_82574) {
 			rx_que->eims = 1 << (20 + i);
@@ -1995,7 +1996,7 @@ em_if_msix_intr_assign(if_ctx_t ctx, int msix)
 		 * Set the bit to enable interrupt
 		 * in E1000_IMS -- bits 22 and 23
 		 * are for TX0 and TX1, note this has
-		 * NOTHING to do with the MSIX vector
+		 * NOTHING to do with the MSI-X vector
 		 */
 		if (adapter->hw.mac.type == e1000_82574) {
 			tx_que->eims = 1 << (22 + i);
@@ -2044,7 +2045,7 @@ igb_configure_queues(struct adapter *adapter)
 		    E1000_GPIE_MSIX_MODE | E1000_GPIE_EIAME |
 		    E1000_GPIE_PBA | E1000_GPIE_NSICR);
 
-	/* Turn on MSIX */
+	/* Turn on MSI-X */
 	switch (adapter->hw.mac.type) {
 	case e1000_82580:
 	case e1000_i350:
@@ -2178,7 +2179,7 @@ em_free_pci_resources(if_ctx_t ctx)
 	struct em_rx_queue *que = adapter->rx_queues;
 	device_t dev = iflib_get_dev(ctx);
 
-	/* Release all msix queue resources */
+	/* Release all MSI-X queue resources */
 	if (adapter->intr_type == IFLIB_INTR_MSIX)
 		iflib_irq_free(ctx, &adapter->irq);
 
@@ -2186,24 +2187,26 @@ em_free_pci_resources(if_ctx_t ctx)
 		iflib_irq_free(ctx, &que->que_irq);
 	}
 
-	/* First release all the interrupt resources */
 	if (adapter->memory != NULL) {
 		bus_release_resource(dev, SYS_RES_MEMORY,
-				     PCIR_BAR(0), adapter->memory);
+		    rman_get_rid(adapter->memory), adapter->memory);
 		adapter->memory = NULL;
 	}
 
 	if (adapter->flash != NULL) {
 		bus_release_resource(dev, SYS_RES_MEMORY,
-				     EM_FLASH, adapter->flash);
+		    rman_get_rid(adapter->flash), adapter->flash);
 		adapter->flash = NULL;
 	}
-	if (adapter->ioport != NULL)
+
+	if (adapter->ioport != NULL) {
 		bus_release_resource(dev, SYS_RES_IOPORT,
-		    adapter->io_rid, adapter->ioport);
+		    rman_get_rid(adapter->ioport), adapter->ioport);
+		adapter->ioport = NULL;
+	}
 }
 
-/* Setup MSI or MSI/X */
+/* Set up MSI or MSI-X */
 static int
 em_setup_msix(if_ctx_t ctx)
 {
@@ -2845,7 +2848,9 @@ em_if_tx_queues_alloc(if_ctx_t ctx, caddr_t *vaddrs, uint64_t *paddrs, int ntxqs
 		txr->tx_paddr = paddrs[i*ntxqs];
 	}
 
-	device_printf(iflib_get_dev(ctx), "allocated for %d tx_queues\n", adapter->tx_num_queues);
+	if (bootverbose)
+		device_printf(iflib_get_dev(ctx),
+		    "allocated for %d tx_queues\n", adapter->tx_num_queues);
 	return (0);
 fail:
 	em_if_queues_free(ctx);
@@ -2883,8 +2888,10 @@ em_if_rx_queues_alloc(if_ctx_t ctx, caddr_t *vaddrs, uint64_t *paddrs, int nrxqs
 		rxr->rx_base = (union e1000_rx_desc_extended *)vaddrs[i*nrxqs];
 		rxr->rx_paddr = paddrs[i*nrxqs];
 	}
-
-	device_printf(iflib_get_dev(ctx), "allocated for %d rx_queues\n", adapter->rx_num_queues);
+ 
+	if (bootverbose)
+		device_printf(iflib_get_dev(ctx),
+		    "allocated for %d rx_queues\n", adapter->rx_num_queues);
 
 	return (0);
 fail:
@@ -3127,7 +3134,7 @@ em_initialize_receive_unit(if_ctx_t ctx)
 	rfctl = E1000_READ_REG(hw, E1000_RFCTL);
 	rfctl |= E1000_RFCTL_EXTEN;
 	/*
-	 * When using MSIX interrupts we need to throttle
+	 * When using MSI-X interrupts we need to throttle
 	 * using the EITR register (82574 only)
 	 */
 	if (hw->mac.type == e1000_82574) {
@@ -4001,7 +4008,7 @@ em_add_hw_stats(struct adapter *adapter)
 			"Driver dropped packets");
 	SYSCTL_ADD_ULONG(ctx, child, OID_AUTO, "link_irq",
 			CTLFLAG_RD, &adapter->link_irq,
-			"Link MSIX IRQ Handled");
+			"Link MSI-X IRQ Handled");
 	SYSCTL_ADD_ULONG(ctx, child, OID_AUTO, "mbuf_defrag_fail",
 			 CTLFLAG_RD, &adapter->mbuf_defrag_failed,
 			 "Defragmenting mbuf chain failed");
@@ -4518,7 +4525,7 @@ em_print_debug_info(struct adapter *adapter)
 
 /*
  * 82574 only:
- * Write a new value to the EEPROM increasing the number of MSIX
+ * Write a new value to the EEPROM increasing the number of MSI-X
  * vectors from 3 to 5, for proper multiqueue support.
  */
 static void
@@ -4533,7 +4540,7 @@ em_enable_vectors_82574(if_ctx_t ctx)
 	printf("Current cap: %#06x\n", edata);
 	if (((edata & EM_NVM_MSIX_N_MASK) >> EM_NVM_MSIX_N_SHIFT) != 4) {
 		device_printf(dev, "Writing to eeprom: increasing "
-		    "reported MSIX vectors from 3 to 5...\n");
+		    "reported MSI-X vectors from 3 to 5...\n");
 		edata &= ~(EM_NVM_MSIX_N_MASK);
 		edata |= 4 << EM_NVM_MSIX_N_SHIFT;
 		e1000_write_nvm(hw, EM_NVM_PCIE_CTRL, 1, &edata);
diff --git a/freebsd/sys/dev/e1000/if_em.h b/freebsd/sys/dev/e1000/if_em.h
index d573107b..55ca62db 100644
--- a/freebsd/sys/dev/e1000/if_em.h
+++ b/freebsd/sys/dev/e1000/if_em.h
@@ -352,8 +352,8 @@
 
 /*
  * 82574 has a nonstandard address for EIAC
- * and since its only used in MSIX, and in
- * the em driver only 82574 uses MSIX we can
+ * and since its only used in MSI-X, and in
+ * the em driver only 82574 uses MSI-X we can
  * solve it just using this define.
  */
 #define EM_EIAC 0x000DC
@@ -468,7 +468,6 @@ struct adapter {
 	struct resource *memory;
 	struct resource *flash;
 	struct resource	*ioport;
-	int		io_rid;
 
 	struct resource	*res;
 	void		*tag;
diff --git a/freebsd/sys/dev/rtwn/if_rtwn.c b/freebsd/sys/dev/rtwn/if_rtwn.c
index 79868dc0..f660ea5d 100644
--- a/freebsd/sys/dev/rtwn/if_rtwn.c
+++ b/freebsd/sys/dev/rtwn/if_rtwn.c
@@ -155,9 +155,6 @@ static void		rtwn_stop(struct rtwn_softc *);
 
 MALLOC_DEFINE(M_RTWN_PRIV, "rtwn_priv", "rtwn driver private state");
 
-static const uint8_t rtwn_chan_2ghz[] =
-	{ 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 };
-
 static const uint16_t wme2reg[] =
 	{ R92C_EDCA_BE_PARAM, R92C_EDCA_BK_PARAM,
 	  R92C_EDCA_VI_PARAM, R92C_EDCA_VO_PARAM };
@@ -1536,9 +1533,8 @@ rtwn_getradiocaps(struct ieee80211com *ic,
 	setbit(bands, IEEE80211_MODE_11B);
 	setbit(bands, IEEE80211_MODE_11G);
 	setbit(bands, IEEE80211_MODE_11NG);
-	ieee80211_add_channel_list_2ghz(chans, maxchans, nchans,
-	    rtwn_chan_2ghz, nitems(rtwn_chan_2ghz), bands,
-	    !!(ic->ic_htcaps & IEEE80211_HTCAP_CHWIDTH40));
+	ieee80211_add_channels_default_2ghz(chans, maxchans, nchans,
+	    bands, !!(ic->ic_htcaps & IEEE80211_HTCAP_CHWIDTH40));
 
 	/* XXX workaround add_channel_list() limitations */
 	setbit(bands, IEEE80211_MODE_11A);
diff --git a/freebsd/sys/dev/rtwn/pci/rtwn_pci_reg.c b/freebsd/sys/dev/rtwn/pci/rtwn_pci_reg.c
index 8ce54f0d..5b998b5a 100644
--- a/freebsd/sys/dev/rtwn/pci/rtwn_pci_reg.c
+++ b/freebsd/sys/dev/rtwn/pci/rtwn_pci_reg.c
@@ -120,6 +120,6 @@ rtwn_pci_delay(struct rtwn_softc *sc, int usec)
 		DELAY(usec);
 	else {
 		(void) mtx_sleep(sc, &sc->sc_mtx, 0, "rtwn_pci",
-		    MAX(msecs_to_ticks(usec / 1000), 1));
+		    msecs_to_ticks(usec / 1000));
 	}
 }
diff --git a/freebsd/sys/dev/rtwn/usb/rtwn_usb_reg.c b/freebsd/sys/dev/rtwn/usb/rtwn_usb_reg.c
index 8225282e..c7cb255e 100644
--- a/freebsd/sys/dev/rtwn/usb/rtwn_usb_reg.c
+++ b/freebsd/sys/dev/rtwn/usb/rtwn_usb_reg.c
@@ -174,8 +174,6 @@ rtwn_usb_delay(struct rtwn_softc *sc, int usec)
 	/* 1ms delay as default is too big. */
 	if (usec < 1000)
 		DELAY(usec);
-	else {
-		usb_pause_mtx(&sc->sc_mtx,
-		    MAX(msecs_to_ticks(usec / 1000), 1));
-	}
+	else
+		usb_pause_mtx(&sc->sc_mtx, msecs_to_ticks(usec / 1000));
 }
diff --git a/freebsd/sys/dev/usb/wlan/if_rsu.c b/freebsd/sys/dev/usb/wlan/if_rsu.c
index 457c5616..45cd30ad 100644
--- a/freebsd/sys/dev/usb/wlan/if_rsu.c
+++ b/freebsd/sys/dev/usb/wlan/if_rsu.c
@@ -44,13 +44,9 @@ __FBSDID("$FreeBSD$");
 #include <sys/systm.h>
 #include <sys/conf.h>
 #include <sys/bus.h>
-#include <sys/rman.h>
 #include <sys/firmware.h>
 #include <sys/module.h>
 
-#include <machine/bus.h>
-#include <machine/resource.h>
-
 #include <net/bpf.h>
 #include <net/if.h>
 #include <net/if_var.h>
@@ -291,9 +287,6 @@ MODULE_DEPEND(rsu, firmware, 1, 1, 1);
 MODULE_VERSION(rsu, 1);
 USB_PNP_HOST_INFO(rsu_devs);
 
-static const uint8_t rsu_chan_2ghz[] =
-	{ 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 };
-
 static uint8_t rsu_wme_ac_xfer_map[4] = {
 	[WME_AC_BE] = RSU_BULK_TX_BE_BK,
 	[WME_AC_BK] = RSU_BULK_TX_BE_BK,
@@ -789,9 +782,8 @@ rsu_getradiocaps(struct ieee80211com *ic,
 	setbit(bands, IEEE80211_MODE_11G);
 	if (sc->sc_ht)
 		setbit(bands, IEEE80211_MODE_11NG);
-	ieee80211_add_channel_list_2ghz(chans, maxchans, nchans,
-	    rsu_chan_2ghz, nitems(rsu_chan_2ghz), bands,
-	    (ic->ic_htcaps & IEEE80211_HTCAP_CHWIDTH40) != 0);
+	ieee80211_add_channels_default_2ghz(chans, maxchans, nchans,
+	    bands, (ic->ic_htcaps & IEEE80211_HTCAP_CHWIDTH40) != 0);
 }
 
 static void
@@ -2768,7 +2760,7 @@ rsu_tx_start(struct rsu_softc *sc, struct ieee80211_node *ni,
 	struct ieee80211_frame *wh;
 	struct ieee80211_key *k = NULL;
 	struct r92s_tx_desc *txd;
-	uint8_t rate, ridx, type, cipher;
+	uint8_t rate, ridx, type, cipher, qos;
 	int prio = 0;
 	uint8_t which;
 	int hasqos;
@@ -2817,12 +2809,14 @@ rsu_tx_start(struct rsu_softc *sc, struct ieee80211_node *ni,
 		prio = M_WME_GETAC(m0);
 		which = rsu_wme_ac_xfer_map[prio];
 		hasqos = 1;
+		qos = ((const struct ieee80211_qosframe *)wh)->i_qos[0];
 	} else {
 		/* Non-QoS TID */
 		/* XXX TODO: tid=0 for non-qos TID? */
 		which = rsu_wme_ac_xfer_map[WME_AC_BE];
 		hasqos = 0;
 		prio = 0;
+		qos = 0;
 	}
 
 	qid = rsu_ac2qid[prio];
@@ -2881,6 +2875,12 @@ rsu_tx_start(struct rsu_softc *sc, struct ieee80211_node *ni,
 	if (ismcast)
 		txd->txdw2 |= htole32(R92S_TXDW2_BMCAST);
 
+	if (!ismcast && (!qos || (qos & IEEE80211_QOS_ACKPOLICY) !=
+	    IEEE80211_QOS_ACKPOLICY_NOACK)) {
+		txd->txdw2 |= htole32(R92S_TXDW2_RTY_LMT_ENA);
+		txd->txdw2 |= htole32(SM(R92S_TXDW2_RTY_LMT, tp->maxretry));
+	}
+
 	/* Force mgmt / mcast / ucast rate if needed. */
 	if (rate != 0) {
 		/* Data rate fallback limit (max). */
diff --git a/freebsd/sys/dev/usb/wlan/if_rsureg.h b/freebsd/sys/dev/usb/wlan/if_rsureg.h
index b1cd36ea..a6ab170b 100644
--- a/freebsd/sys/dev/usb/wlan/if_rsureg.h
+++ b/freebsd/sys/dev/usb/wlan/if_rsureg.h
@@ -688,6 +688,9 @@ struct r92s_tx_desc {
 #define R92S_TXDW1_HWPC		0x80000000
 
 	uint32_t	txdw2;
+#define R92S_TXDW2_RTY_LMT_M	0x0000003f
+#define R92S_TXDW2_RTY_LMT_S	0
+#define R92S_TXDW2_RTY_LMT_ENA	0x00000040
 #define R92S_TXDW2_BMCAST	0x00000080
 #define R92S_TXDW2_AGGEN	0x20000000
 #define R92S_TXDW2_BK		0x40000000
diff --git a/freebsd/sys/dev/usb/wlan/if_rum.c b/freebsd/sys/dev/usb/wlan/if_rum.c
index 5c826cac..c2f68406 100644
--- a/freebsd/sys/dev/usb/wlan/if_rum.c
+++ b/freebsd/sys/dev/usb/wlan/if_rum.c
@@ -46,10 +46,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/endian.h>
 #include <sys/kdb.h>
 
-#include <machine/bus.h>
-#include <machine/resource.h>
-#include <sys/rman.h>
-
 #include <net/bpf.h>
 #include <net/if.h>
 #include <net/if_var.h>
@@ -344,9 +340,6 @@ static const struct {
 	{ 107, 0x04 }
 };
 
-static const uint8_t rum_chan_2ghz[] =
-	{ 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 };
-
 static const uint8_t rum_chan_5ghz[] =
 	{ 34, 36, 38, 40, 42, 44, 46, 48, 52, 56, 60, 64,
 	  100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140,
@@ -3222,8 +3215,7 @@ rum_getradiocaps(struct ieee80211com *ic,
 	memset(bands, 0, sizeof(bands));
 	setbit(bands, IEEE80211_MODE_11B);
 	setbit(bands, IEEE80211_MODE_11G);
-	ieee80211_add_channel_list_2ghz(chans, maxchans, nchans,
-	    rum_chan_2ghz, nitems(rum_chan_2ghz), bands, 0);
+	ieee80211_add_channels_default_2ghz(chans, maxchans, nchans, bands, 0);
 
 	if (sc->rf_rev == RT2573_RF_5225 || sc->rf_rev == RT2573_RF_5226) {
 		setbit(bands, IEEE80211_MODE_11A);
diff --git a/freebsd/sys/dev/usb/wlan/if_run.c b/freebsd/sys/dev/usb/wlan/if_run.c
index 0feb201f..3211f1e2 100644
--- a/freebsd/sys/dev/usb/wlan/if_run.c
+++ b/freebsd/sys/dev/usb/wlan/if_run.c
@@ -46,10 +46,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/firmware.h>
 #include <sys/kdb.h>
 
-#include <machine/bus.h>
-#include <machine/resource.h>
-#include <sys/rman.h>
-
 #include <net/bpf.h>
 #include <net/if.h>
 #include <net/if_var.h>
@@ -2035,7 +2031,8 @@ run_read_eeprom(struct run_softc *sc)
 static struct ieee80211_node *
 run_node_alloc(struct ieee80211vap *vap, const uint8_t mac[IEEE80211_ADDR_LEN])
 {
-	return malloc(sizeof (struct run_node), M_DEVBUF, M_NOWAIT | M_ZERO);
+	return malloc(sizeof (struct run_node), M_80211_NODE,
+	    M_NOWAIT | M_ZERO);
 }
 
 static int
@@ -4861,8 +4858,7 @@ run_getradiocaps(struct ieee80211com *ic,
 	memset(bands, 0, sizeof(bands));
 	setbit(bands, IEEE80211_MODE_11B);
 	setbit(bands, IEEE80211_MODE_11G);
-	ieee80211_add_channel_list_2ghz(chans, maxchans, nchans,
-	    run_chan_2ghz, nitems(run_chan_2ghz), bands, 0);
+	ieee80211_add_channels_default_2ghz(chans, maxchans, nchans, bands, 0);
 
 	if (sc->rf_rev == RT2860_RF_2750 || sc->rf_rev == RT2860_RF_2850 ||
 	    sc->rf_rev == RT3070_RF_3052 || sc->rf_rev == RT3593_RF_3053 ||
diff --git a/freebsd/sys/dev/usb/wlan/if_runreg.h b/freebsd/sys/dev/usb/wlan/if_runreg.h
index c09aac8f..8561d2c1 100644
--- a/freebsd/sys/dev/usb/wlan/if_runreg.h
+++ b/freebsd/sys/dev/usb/wlan/if_runreg.h
@@ -1086,9 +1086,6 @@ struct rt2860_rxwi {
 /*
  * Channel map for run(4) driver; taken from the table below.
  */
-static const uint8_t run_chan_2ghz[] =
-	{ 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 };
-
 static const uint8_t run_chan_5ghz[] =
 	{ 36, 38, 40, 44, 46, 48, 52, 54, 56, 60, 62, 64, 100, 102, 104,
 	  108, 110, 112, 116, 118, 120, 124, 126, 128, 132, 134, 136, 140,
diff --git a/freebsd/sys/dev/usb/wlan/if_uath.c b/freebsd/sys/dev/usb/wlan/if_uath.c
index 2b97060e..541263ab 100644
--- a/freebsd/sys/dev/usb/wlan/if_uath.c
+++ b/freebsd/sys/dev/usb/wlan/if_uath.c
@@ -87,10 +87,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/endian.h>
 #include <sys/kdb.h>
 
-#include <machine/bus.h>
-#include <machine/resource.h>
-#include <sys/rman.h>
-
 #include <net/bpf.h>
 #include <net/if.h>
 #include <net/if_var.h>
diff --git a/freebsd/sys/dev/usb/wlan/if_upgt.c b/freebsd/sys/dev/usb/wlan/if_upgt.c
index e1923bab..c556d108 100644
--- a/freebsd/sys/dev/usb/wlan/if_upgt.c
+++ b/freebsd/sys/dev/usb/wlan/if_upgt.c
@@ -43,7 +43,6 @@
 #include <net/if_types.h>
 
 #include <sys/bus.h>
-#include <machine/bus.h>
 
 #include <net80211/ieee80211_var.h>
 #include <net80211/ieee80211_phy.h>
@@ -1618,7 +1617,7 @@ upgt_fw_load(struct upgt_softc *sc)
 		data_cmd->buflen = bsize;
 		upgt_bulk_tx(sc, data_cmd);
 
-		DPRINTF(sc, UPGT_DEBUG_FW, "FW offset=%d, read=%d, sent=%d\n",
+		DPRINTF(sc, UPGT_DEBUG_FW, "FW offset=%zu, read=%d, sent=%d\n",
 		    offset, n, bsize);
 		bsize = n;
 	}
@@ -1775,7 +1774,7 @@ upgt_fw_verify(struct upgt_softc *sc)
 	}
 
 	DPRINTF(sc, UPGT_DEBUG_FW,
-	    "firmware Boot Record Area found at offset %d\n", offset);
+	    "firmware Boot Record Area found at offset %zu\n", offset);
 
 	/*
 	 * Parse Boot Record Area (BRA) options.
diff --git a/freebsd/sys/dev/usb/wlan/if_ural.c b/freebsd/sys/dev/usb/wlan/if_ural.c
index 4de0a9c5..8897f148 100644
--- a/freebsd/sys/dev/usb/wlan/if_ural.c
+++ b/freebsd/sys/dev/usb/wlan/if_ural.c
@@ -47,10 +47,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/endian.h>
 #include <sys/kdb.h>
 
-#include <machine/bus.h>
-#include <machine/resource.h>
-#include <sys/rman.h>
-
 #include <net/bpf.h>
 #include <net/if.h>
 #include <net/if_var.h>
@@ -363,9 +359,6 @@ static const struct {
 	{ 161, 0x08808, 0x0242f, 0x00281 }
 };
 
-static const uint8_t ural_chan_2ghz[] =
-	{ 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 };
-
 static const uint8_t ural_chan_5ghz[] =
 	{ 36, 40, 44, 48, 52, 56, 60, 64,
 	  100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140,
@@ -1593,8 +1586,7 @@ ural_getradiocaps(struct ieee80211com *ic,
 	memset(bands, 0, sizeof(bands));
 	setbit(bands, IEEE80211_MODE_11B);
 	setbit(bands, IEEE80211_MODE_11G);
-	ieee80211_add_channel_list_2ghz(chans, maxchans, nchans,
-	    ural_chan_2ghz, nitems(ural_chan_2ghz), bands, 0);
+	ieee80211_add_channels_default_2ghz(chans, maxchans, nchans, bands, 0);
 
 	if (sc->rf_rev == RAL_RF_5222) {
 		setbit(bands, IEEE80211_MODE_11A);
diff --git a/freebsd/sys/dev/usb/wlan/if_urtw.c b/freebsd/sys/dev/usb/wlan/if_urtw.c
index a47fc0e1..3a89160b 100644
--- a/freebsd/sys/dev/usb/wlan/if_urtw.c
+++ b/freebsd/sys/dev/usb/wlan/if_urtw.c
@@ -36,10 +36,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/endian.h>
 #include <sys/kdb.h>
 
-#include <machine/bus.h>
-#include <machine/resource.h>
-#include <sys/rman.h>
-
 #include <net/if.h>
 #include <net/if_var.h>
 #include <net/if_arp.h>
@@ -217,9 +213,6 @@ static uint8_t urtw_8225z2_agc[] = {
 	0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31
 };
 
-static const uint8_t urtw_chan_2ghz[] =
-	{ 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 };
-
 static uint32_t urtw_8225_channel[] = {
 	0x0000,		/* dummy channel 0  */
 	0x085c,		/* 1  */
@@ -1587,8 +1580,7 @@ urtw_getradiocaps(struct ieee80211com *ic,
 	memset(bands, 0, sizeof(bands));
 	setbit(bands, IEEE80211_MODE_11B);
 	setbit(bands, IEEE80211_MODE_11G);
-	ieee80211_add_channel_list_2ghz(chans, maxchans, nchans,
-	    urtw_chan_2ghz, nitems(urtw_chan_2ghz), bands, 0);
+	ieee80211_add_channels_default_2ghz(chans, maxchans, nchans, bands, 0);
 }
 
 static void
diff --git a/freebsd/sys/dev/usb/wlan/if_zyd.c b/freebsd/sys/dev/usb/wlan/if_zyd.c
index 1835b58b..bb4a9e40 100644
--- a/freebsd/sys/dev/usb/wlan/if_zyd.c
+++ b/freebsd/sys/dev/usb/wlan/if_zyd.c
@@ -46,10 +46,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/endian.h>
 #include <sys/kdb.h>
 
-#include <machine/bus.h>
-#include <machine/resource.h>
-#include <sys/rman.h>
-
 #include <net/bpf.h>
 #include <net/if.h>
 #include <net/if_var.h>
@@ -2891,8 +2887,7 @@ zyd_getradiocaps(struct ieee80211com *ic,
 	memset(bands, 0, sizeof(bands));
 	setbit(bands, IEEE80211_MODE_11B);
 	setbit(bands, IEEE80211_MODE_11G);
-	ieee80211_add_channel_list_2ghz(chans, maxchans, nchans,
-	    zyd_chan_2ghz, nitems(zyd_chan_2ghz), bands, 0);
+	ieee80211_add_channels_default_2ghz(chans, maxchans, nchans, bands, 0);
 }
 
 static void
diff --git a/freebsd/sys/dev/usb/wlan/if_zydreg.h b/freebsd/sys/dev/usb/wlan/if_zydreg.h
index 724b8c57..8c4a16c5 100644
--- a/freebsd/sys/dev/usb/wlan/if_zydreg.h
+++ b/freebsd/sys/dev/usb/wlan/if_zydreg.h
@@ -421,10 +421,6 @@
 #define ZYD_CR254		0x93f8
 #define ZYD_CR255		0x93fc
 
-/* nitems(ZYD_*_CHANTABLE) */
-static const uint8_t zyd_chan_2ghz[] =
-	{ 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 };
-
 /* copied nearly verbatim from the Linux driver rewrite */
 #define	ZYD_DEF_PHY							\
 {									\
diff --git a/freebsd/sys/kern/subr_kobj.c b/freebsd/sys/kern/subr_kobj.c
index a6a888d5..3736f64c 100644
--- a/freebsd/sys/kern/subr_kobj.c
+++ b/freebsd/sys/kern/subr_kobj.c
@@ -127,35 +127,40 @@ kobj_class_compile_common(kobj_class_t cls, kobj_ops_t ops)
 	cls->ops = ops;
 }
 
-void
-kobj_class_compile(kobj_class_t cls)
+static int
+kobj_class_compile1(kobj_class_t cls, int mflags)
 {
 	kobj_ops_t ops;
 
 	KOBJ_ASSERT(MA_NOTOWNED);
 
-	/*
-	 * Allocate space for the compiled ops table.
-	 */
-	ops = malloc(sizeof(struct kobj_ops), M_KOBJ, M_NOWAIT);
-	if (!ops)
-		panic("%s: out of memory", __func__);
+	ops = malloc(sizeof(struct kobj_ops), M_KOBJ, mflags);
+	if (ops == NULL)
+		return (ENOMEM);
 
-	KOBJ_LOCK();
-	
 	/*
 	 * We may have lost a race for kobj_class_compile here - check
 	 * to make sure someone else hasn't already compiled this
 	 * class.
 	 */
+	KOBJ_LOCK();
 	if (cls->ops) {
 		KOBJ_UNLOCK();
 		free(ops, M_KOBJ);
-		return;
+		return (0);
 	}
-
 	kobj_class_compile_common(cls, ops);
 	KOBJ_UNLOCK();
+	return (0);
+}
+
+void
+kobj_class_compile(kobj_class_t cls)
+{
+	int error;
+
+	error = kobj_class_compile1(cls, M_WAITOK);
+	KASSERT(error == 0, ("kobj_class_compile1 returned %d", error));
 }
 
 void
@@ -256,24 +261,6 @@ kobj_class_free(kobj_class_t cls)
 		free(ops, M_KOBJ);
 }
 
-kobj_t
-kobj_create(kobj_class_t cls,
-	    struct malloc_type *mtype,
-	    int mflags)
-{
-	kobj_t obj;
-
-	/*
-	 * Allocate and initialise the new object.
-	 */
-	obj = malloc(cls->size, mtype, mflags | M_ZERO);
-	if (!obj)
-		return NULL;
-	kobj_init(obj, cls);
-
-	return obj;
-}
-
 static void
 kobj_init_common(kobj_t obj, kobj_class_t cls)
 {
@@ -282,30 +269,52 @@ kobj_init_common(kobj_t obj, kobj_class_t cls)
 	cls->refs++;
 }
 
-void
-kobj_init(kobj_t obj, kobj_class_t cls)
+static int
+kobj_init1(kobj_t obj, kobj_class_t cls, int mflags)
 {
-	KOBJ_ASSERT(MA_NOTOWNED);
-  retry:
-	KOBJ_LOCK();
+	int error;
 
-	/*
-	 * Consider compiling the class' method table.
-	 */
-	if (!cls->ops) {
+	KOBJ_LOCK();
+	while (cls->ops == NULL) {
 		/*
 		 * kobj_class_compile doesn't want the lock held
 		 * because of the call to malloc - we drop the lock
 		 * and re-try.
 		 */
 		KOBJ_UNLOCK();
-		kobj_class_compile(cls);
-		goto retry;
+		error = kobj_class_compile1(cls, mflags);
+		if (error != 0)
+			return (error);
+		KOBJ_LOCK();
 	}
-
 	kobj_init_common(obj, cls);
-
 	KOBJ_UNLOCK();
+	return (0);
+}
+
+kobj_t
+kobj_create(kobj_class_t cls, struct malloc_type *mtype, int mflags)
+{
+	kobj_t obj;
+
+	obj = malloc(cls->size, mtype, mflags | M_ZERO);
+	if (obj == NULL)
+		return (NULL);
+	if (kobj_init1(obj, cls, mflags) != 0) {
+		free(obj, mtype);
+		return (NULL);
+	}
+	return (obj);
+}
+
+void
+kobj_init(kobj_t obj, kobj_class_t cls)
+{
+	int error;
+
+	error = kobj_init1(obj, cls, M_NOWAIT);
+	if (error != 0)
+		panic("kobj_init1 failed: error %d", error);
 }
 
 void
diff --git a/freebsd/sys/kern/uipc_syscalls.c b/freebsd/sys/kern/uipc_syscalls.c
index 7eee73fc..567fbdc3 100644
--- a/freebsd/sys/kern/uipc_syscalls.c
+++ b/freebsd/sys/kern/uipc_syscalls.c
@@ -2199,8 +2199,10 @@ m_dispose_extcontrolm(struct mbuf *m)
 					fd = *fds++;
 					error = fget(td, fd, &cap_no_rights,
 					    &fp);
-					if (error == 0)
+					if (error == 0) {
 						fdclose(td, fp, fd);
+						fdrop(fp, td);
+					}
 				}
 			}
 			clen -= datalen;
diff --git a/freebsd/sys/net80211/ieee80211.c b/freebsd/sys/net80211/ieee80211.c
index 74aeeb80..927905bb 100644
--- a/freebsd/sys/net80211/ieee80211.c
+++ b/freebsd/sys/net80211/ieee80211.c
@@ -1634,6 +1634,17 @@ ieee80211_add_channel_list_2ghz(struct ieee80211_channel chans[], int maxchans,
 }
 
 int
+ieee80211_add_channels_default_2ghz(struct ieee80211_channel chans[],
+    int maxchans, int *nchans, const uint8_t bands[], int ht40)
+{
+	const uint8_t default_chan_list[] =
+	    { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 };
+
+	return (ieee80211_add_channel_list_2ghz(chans, maxchans, nchans,
+	    default_chan_list, nitems(default_chan_list), bands, ht40));
+}
+
+int
 ieee80211_add_channel_list_5ghz(struct ieee80211_channel chans[], int maxchans,
     int *nchans, const uint8_t ieee[], int nieee, const uint8_t bands[],
     int ht40)
diff --git a/freebsd/sys/net80211/ieee80211.h b/freebsd/sys/net80211/ieee80211.h
index db46b8f1..61389169 100644
--- a/freebsd/sys/net80211/ieee80211.h
+++ b/freebsd/sys/net80211/ieee80211.h
@@ -951,9 +951,11 @@ enum {
 	IEEE80211_ELEMID_ERP		= 42,
 	IEEE80211_ELEMID_HTCAP		= 45,
 	IEEE80211_ELEMID_QOS		= 46,
+	IEEE80211_ELEMID_RESERVED_47	= 47,
 	IEEE80211_ELEMID_RSN		= 48,
 	IEEE80211_ELEMID_XRATES		= 50,
 	IEEE80211_ELEMID_APCHANREP	= 51,
+	IEEE80211_ELEMID_MOBILITY_DOMAIN	= 54,
 	IEEE80211_ELEMID_HTINFO		= 61,
 	IEEE80211_ELEMID_SECCHAN_OFFSET	= 62,
 	IEEE80211_ELEMID_RRM_ENACAPS	= 70,
diff --git a/freebsd/sys/net80211/ieee80211_amrr.c b/freebsd/sys/net80211/ieee80211_amrr.c
index 9bb1d92d..a827f470 100644
--- a/freebsd/sys/net80211/ieee80211_amrr.c
+++ b/freebsd/sys/net80211/ieee80211_amrr.c
@@ -104,15 +104,13 @@ static void
 amrr_setinterval(const struct ieee80211vap *vap, int msecs)
 {
 	struct ieee80211_amrr *amrr = vap->iv_rs;
-	int t;
 
 	if (!amrr)
 		return;
 
 	if (msecs < 100)
 		msecs = 100;
-	t = msecs_to_ticks(msecs);
-	amrr->amrr_interval = (t < 1) ? 1 : t;
+	amrr->amrr_interval = msecs_to_ticks(msecs);
 }
 
 static void
diff --git a/freebsd/sys/net80211/ieee80211_dfs.c b/freebsd/sys/net80211/ieee80211_dfs.c
index 2c454516..119c11a7 100644
--- a/freebsd/sys/net80211/ieee80211_dfs.c
+++ b/freebsd/sys/net80211/ieee80211_dfs.c
@@ -158,8 +158,7 @@ cac_timeout(void *arg)
 		/* XXX clobbers any existing desired channel */
 		/* NB: dfs->newchan may be NULL, that's ok */
 		vap->iv_des_chan = dfs->newchan;
-		/* XXX recursive lock need ieee80211_new_state_locked */
-		ieee80211_new_state(vap, IEEE80211_S_SCAN, 0);
+		ieee80211_new_state_locked(vap, IEEE80211_S_SCAN, 0);
 	} else {
 		if_printf(vap->iv_ifp,
 		    "CAC timer on channel %u (%u MHz) expired; "
diff --git a/freebsd/sys/net80211/ieee80211_freebsd.c b/freebsd/sys/net80211/ieee80211_freebsd.c
index 57e2f23f..f8d5d0f3 100644
--- a/freebsd/sys/net80211/ieee80211_freebsd.c
+++ b/freebsd/sys/net80211/ieee80211_freebsd.c
@@ -70,8 +70,6 @@ SYSCTL_INT(_net_wlan, OID_AUTO, debug, CTLFLAG_RW, &ieee80211_debug,
 	    0, "debugging printfs");
 #endif
 
-static MALLOC_DEFINE(M_80211_COM, "80211com", "802.11 com state");
-
 static const char wlanname[] = "wlan";
 static struct if_clone *wlan_cloner;
 
@@ -138,13 +136,12 @@ int
 ieee80211_sysctl_msecs_ticks(SYSCTL_HANDLER_ARGS)
 {
 	int msecs = ticks_to_msecs(*(int *)arg1);
-	int error, t;
+	int error;
 
 	error = sysctl_handle_int(oidp, &msecs, 0, req);
 	if (error || !req->newptr)
 		return error;
-	t = msecs_to_ticks(msecs);
-	*(int *)arg1 = (t < 1) ? 1 : t;
+	*(int *)arg1 = msecs_to_ticks(msecs);
 	return 0;
 }
 
@@ -349,9 +346,6 @@ ieee80211_com_vdetach(struct ieee80211vap *vap)
 	int sleep_time;
 
 	sleep_time = msecs_to_ticks(250);
-	if (sleep_time == 0)
-		sleep_time = 1;
-
 	atomic_set_32(&vap->iv_com_state, IEEE80211_COM_DETACHED);
 	while (MS(atomic_load_32(&vap->iv_com_state), IEEE80211_COM_REF) != 0)
 		pause("comref", sleep_time);
diff --git a/freebsd/sys/net80211/ieee80211_freebsd.h b/freebsd/sys/net80211/ieee80211_freebsd.h
index a70de108..4e06b76a 100644
--- a/freebsd/sys/net80211/ieee80211_freebsd.h
+++ b/freebsd/sys/net80211/ieee80211_freebsd.h
@@ -38,6 +38,7 @@
 #include <sys/rwlock.h>
 #include <sys/sysctl.h>
 #include <sys/taskqueue.h>
+#include <sys/time.h>
 
 /*
  * Common state locking definitions.
@@ -249,9 +250,8 @@ void	ieee80211_vap_destroy(struct ieee80211vap *);
 	(((_ifp)->if_flags & IFF_UP) && \
 	 ((_ifp)->if_drv_flags & IFF_DRV_RUNNING))
 
-/* XXX TODO: cap these at 1, as hz may not be 1000 */
-#define	msecs_to_ticks(ms)	(((ms)*hz)/1000)
-#define	ticks_to_msecs(t)	(1000*(t) / hz)
+#define	msecs_to_ticks(ms)	MSEC_2_TICKS(ms)
+#define	ticks_to_msecs(t)	TICKS_2_MSEC(t)
 #define	ticks_to_secs(t)	((t) / hz)
 
 #define ieee80211_time_after(a,b) 	((long)(b) - (long)(a) < 0)
diff --git a/freebsd/sys/net80211/ieee80211_ioctl.c b/freebsd/sys/net80211/ieee80211_ioctl.c
index fb8357bd..0396e8be 100644
--- a/freebsd/sys/net80211/ieee80211_ioctl.c
+++ b/freebsd/sys/net80211/ieee80211_ioctl.c
@@ -2206,18 +2206,6 @@ ieee80211_ioctl_setregdomain(struct ieee80211vap *vap,
 }
 
 static int
-ieee80211_ioctl_setroam(struct ieee80211vap *vap,
-	const struct ieee80211req *ireq)
-{
-	if (ireq->i_len != sizeof(vap->iv_roamparms))
-		return EINVAL;
-	/* XXX validate params */
-	/* XXX? ENETRESET to push to device? */
-	return copyin(ireq->i_data, vap->iv_roamparms,
-	    sizeof(vap->iv_roamparms));
-}
-
-static int
 checkrate(const struct ieee80211_rateset *rs, int rate)
 {
 	int i;
@@ -2247,6 +2235,73 @@ checkmcs(const struct ieee80211_htrateset *rs, int mcs)
 }
 
 static int
+ieee80211_ioctl_setroam(struct ieee80211vap *vap,
+        const struct ieee80211req *ireq)
+{
+	struct ieee80211com *ic = vap->iv_ic;
+	struct ieee80211_roamparams_req *parms;
+	struct ieee80211_roamparam *src, *dst;
+	const struct ieee80211_htrateset *rs_ht;
+	const struct ieee80211_rateset *rs;
+	int changed, error, mode, is11n, nmodes;
+
+	if (ireq->i_len != sizeof(vap->iv_roamparms))
+		return EINVAL;
+
+	parms = IEEE80211_MALLOC(sizeof(*parms), M_TEMP,
+	    IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
+	if (parms == NULL)
+		return ENOMEM;
+
+	error = copyin(ireq->i_data, parms, ireq->i_len);
+	if (error != 0)
+		goto fail;
+
+	changed = 0;
+	nmodes = IEEE80211_MODE_MAX;
+
+	/* validate parameters and check if anything changed */
+	for (mode = IEEE80211_MODE_11A; mode < nmodes; mode++) {
+		if (isclr(ic->ic_modecaps, mode))
+			continue;
+		src = &parms->params[mode];
+		dst = &vap->iv_roamparms[mode];
+		rs = &ic->ic_sup_rates[mode];	/* NB: 11n maps to legacy */
+		rs_ht = &ic->ic_sup_htrates;
+		is11n = (mode == IEEE80211_MODE_11NA ||
+			 mode == IEEE80211_MODE_11NG);
+		/* XXX TODO: 11ac */
+		if (src->rate != dst->rate) {
+			if (!checkrate(rs, src->rate) &&
+			    (!is11n || !checkmcs(rs_ht, src->rate))) {
+				error = EINVAL;
+				goto fail;
+			}
+			changed++;
+		}
+		if (src->rssi != dst->rssi)
+			changed++;
+	}
+	if (changed) {
+		/*
+		 * Copy new parameters in place and notify the
+		 * driver so it can push state to the device.
+		 */
+		/* XXX locking? */
+		for (mode = IEEE80211_MODE_11A; mode < nmodes; mode++) {
+			if (isset(ic->ic_modecaps, mode))
+				vap->iv_roamparms[mode] = parms->params[mode];
+		}
+
+		if (vap->iv_roaming == IEEE80211_ROAMING_DEVICE)
+			error = ERESTART;
+	}
+
+fail:	IEEE80211_FREE(parms, M_TEMP);
+	return error;
+}
+
+static int
 ieee80211_ioctl_settxparams(struct ieee80211vap *vap,
 	const struct ieee80211req *ireq)
 {
@@ -2517,20 +2572,12 @@ ieee80211_scanreq(struct ieee80211vap *vap, struct ieee80211_scan_req *sr)
 		    sr->sr_duration > IEEE80211_IOC_SCAN_DURATION_MAX)
 			return EINVAL;
 		sr->sr_duration = msecs_to_ticks(sr->sr_duration);
-		if (sr->sr_duration < 1)
-			sr->sr_duration = 1;
 	}
 	/* convert min/max channel dwell */
-	if (sr->sr_mindwell != 0) {
+	if (sr->sr_mindwell != 0)
 		sr->sr_mindwell = msecs_to_ticks(sr->sr_mindwell);
-		if (sr->sr_mindwell < 1)
-			sr->sr_mindwell = 1;
-	}
-	if (sr->sr_maxdwell != 0) {
+	if (sr->sr_maxdwell != 0)
 		sr->sr_maxdwell = msecs_to_ticks(sr->sr_maxdwell);
-		if (sr->sr_maxdwell < 1)
-			sr->sr_maxdwell = 1;
-	}
 	/* NB: silently reduce ssid count to what is supported */
 	if (sr->sr_nssid > IEEE80211_SCAN_MAX_SSID)
 		sr->sr_nssid = IEEE80211_SCAN_MAX_SSID;
diff --git a/freebsd/sys/net80211/ieee80211_rssadapt.c b/freebsd/sys/net80211/ieee80211_rssadapt.c
index 4b49b77e..52f81a99 100644
--- a/freebsd/sys/net80211/ieee80211_rssadapt.c
+++ b/freebsd/sys/net80211/ieee80211_rssadapt.c
@@ -119,15 +119,13 @@ static void
 rssadapt_setinterval(const struct ieee80211vap *vap, int msecs)
 {
 	struct ieee80211_rssadapt *rs = vap->iv_rs;
-	int t;
 
 	if (!rs)
 		return;
 
 	if (msecs < 100)
 		msecs = 100;
-	t = msecs_to_ticks(msecs);
-	rs->interval = (t < 1) ? 1 : t;
+	rs->interval = msecs_to_ticks(msecs);
 }
 
 static void
diff --git a/freebsd/sys/net80211/ieee80211_scan.c b/freebsd/sys/net80211/ieee80211_scan.c
index 9b58ff98..86056415 100644
--- a/freebsd/sys/net80211/ieee80211_scan.c
+++ b/freebsd/sys/net80211/ieee80211_scan.c
@@ -296,7 +296,7 @@ ieee80211_scan_dump(struct ieee80211_scan_state *ss)
 
 	if_printf(vap->iv_ifp, "scan set ");
 	ieee80211_scan_dump_channels(ss);
-	printf(" dwell min %lums max %lums\n",
+	printf(" dwell min %ums max %ums\n",
 	    ticks_to_msecs(ss->ss_mindwell), ticks_to_msecs(ss->ss_maxdwell));
 }
 #endif /* IEEE80211_DEBUG */
diff --git a/freebsd/sys/net80211/ieee80211_scan_sta.c b/freebsd/sys/net80211/ieee80211_scan_sta.c
index 3ea313d5..926504f4 100644
--- a/freebsd/sys/net80211/ieee80211_scan_sta.c
+++ b/freebsd/sys/net80211/ieee80211_scan_sta.c
@@ -1361,7 +1361,6 @@ sta_roam_check(struct ieee80211_scan_state *ss, struct ieee80211vap *vap)
 	curRssi = ic->ic_node_getrssi(ni);
 	if (ucastRate == IEEE80211_FIXED_RATE_NONE) {
 		curRate = ni->ni_txrate;
-		roamRate &= IEEE80211_RATE_VAL;
 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_ROAM,
 		    "%s: currssi %d currate %u roamrssi %d roamrate %u\n",
 		    __func__, curRssi, curRate, roamRssi, roamRate);
diff --git a/freebsd/sys/net80211/ieee80211_var.h b/freebsd/sys/net80211/ieee80211_var.h
index af42a249..8fe8f01c 100644
--- a/freebsd/sys/net80211/ieee80211_var.h
+++ b/freebsd/sys/net80211/ieee80211_var.h
@@ -735,6 +735,8 @@ uint32_t ieee80211_get_channel_center_freq1(const struct ieee80211_channel *);
 uint32_t ieee80211_get_channel_center_freq2(const struct ieee80211_channel *);
 int	ieee80211_add_channel_list_2ghz(struct ieee80211_channel[], int, int *,
 	    const uint8_t[], int, const uint8_t[], int);
+int	ieee80211_add_channels_default_2ghz(struct ieee80211_channel[], int,
+	    int *, const uint8_t[], int);
 int	ieee80211_add_channel_list_5ghz(struct ieee80211_channel[], int, int *,
 	    const uint8_t[], int, const uint8_t[], int);
 struct ieee80211_channel *ieee80211_find_channel(struct ieee80211com *,
diff --git a/freebsd/sys/net80211/ieee80211_wps.h b/freebsd/sys/net80211/ieee80211_wps.h
new file mode 100644
index 00000000..32cc667e
--- /dev/null
+++ b/freebsd/sys/net80211/ieee80211_wps.h
@@ -0,0 +1,149 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
+ *
+ * Copyright (c) 2017 J.R. Oldroyd, Open Advisors Limited
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+#ifndef _NET80211_IEEE80211_WPS_H_
+#define _NET80211_IEEE80211_WPS_H_
+
+/*
+ * 802.11 WPS implementation definitions.
+ */
+
+#define IEEE80211_WPS_ATTR_AP_CHANNEL		0x1001
+#define IEEE80211_WPS_ATTR_ASSOC_STATE		0x1002
+#define IEEE80211_WPS_ATTR_AUTH_TYPE		0x1003
+#define IEEE80211_WPS_ATTR_AUTH_TYPE_FLAGS	0x1004
+#define IEEE80211_WPS_ATTR_AUTHENTICATOR	0x1005
+#define IEEE80211_WPS_ATTR_CONFIG_METHODS	0x1008
+#define IEEE80211_WPS_ATTR_CONFIG_ERROR		0x1009
+#define IEEE80211_WPS_ATTR_CONFIRM_URL4		0x100a
+#define IEEE80211_WPS_ATTR_CONFIRM_URL6		0x100b
+#define IEEE80211_WPS_ATTR_CONN_TYPE		0x100c
+#define IEEE80211_WPS_ATTR_CONN_TYPE_FLAGS	0x100d
+#define IEEE80211_WPS_ATTR_CRED			0x100e
+#define IEEE80211_WPS_ATTR_ENCR_TYPE		0x100f
+#define IEEE80211_WPS_ATTR_ENCR_TYPE_FLAGS	0x1010
+#define IEEE80211_WPS_ATTR_DEV_NAME		0x1011
+#define IEEE80211_WPS_ATTR_DEV_PASSWORD_ID	0x1012
+#define IEEE80211_WPS_ATTR_E_HASH1		0x1014
+#define IEEE80211_WPS_ATTR_E_HASH2		0x1015
+#define IEEE80211_WPS_ATTR_E_SNONCE1		0x1016
+#define IEEE80211_WPS_ATTR_E_SNONCE2		0x1017
+#define IEEE80211_WPS_ATTR_ENCR_SETTINGS	0x1018
+#define IEEE80211_WPS_ATTR_ENROLLEE_NONCE	0x101a
+#define IEEE80211_WPS_ATTR_FEATURE_ID		0x101b
+#define IEEE80211_WPS_ATTR_IDENTITY		0x101c
+#define IEEE80211_WPS_ATTR_IDENTITY_PROOF	0x101d
+#define IEEE80211_WPS_ATTR_KEY_WRAP_AUTH	0x101e
+#define IEEE80211_WPS_ATTR_KEY_ID		0x101f
+#define IEEE80211_WPS_ATTR_MAC_ADDR		0x1020
+#define IEEE80211_WPS_ATTR_MANUFACTURER		0x1021
+#define IEEE80211_WPS_ATTR_MSG_TYPE		0x1022
+#define IEEE80211_WPS_ATTR_MODEL_NAME		0x1023
+#define IEEE80211_WPS_ATTR_MODEL_NUMBER		0x1024
+#define IEEE80211_WPS_ATTR_NETWORK_INDEX	0x1026
+#define IEEE80211_WPS_ATTR_NETWORK_KEY		0x1027
+#define IEEE80211_WPS_ATTR_NETWORK_KEY_INDEX	0x1028
+#define IEEE80211_WPS_ATTR_NEW_DEVICE_NAME	0x1029
+#define IEEE80211_WPS_ATTR_NEW_PASSWORD		0x102a
+#define IEEE80211_WPS_ATTR_OOB_DEVICE_PASSWORD	0x102c
+#define IEEE80211_WPS_ATTR_OS_VERSION		0x102d
+#define IEEE80211_WPS_ATTR_POWER_LEVEL		0x102f
+#define IEEE80211_WPS_ATTR_PSK_CURRENT		0x1030
+#define IEEE80211_WPS_ATTR_PSK_MAX		0x1031
+#define IEEE80211_WPS_ATTR_PUBLIC_KEY		0x1032
+#define IEEE80211_WPS_ATTR_RADIO_ENABLE		0x1033
+#define IEEE80211_WPS_ATTR_REBOOT		0x1034
+#define IEEE80211_WPS_ATTR_REGISTRAR_CURRENT	0x1035
+#define IEEE80211_WPS_ATTR_REGISTRAR_ESTBLSHD	0x1036
+#define IEEE80211_WPS_ATTR_REGISTRAR_LIST	0x1037
+#define IEEE80211_WPS_ATTR_REGISTRAR_MAX	0x1038
+#define IEEE80211_WPS_ATTR_REGISTRAR_NONCE	0x1039
+#define IEEE80211_WPS_ATTR_REQUEST_TYPE		0x103a
+#define IEEE80211_WPS_ATTR_RESPONSE_TYPE	0x103b
+#define IEEE80211_WPS_ATTR_RF_BANDS		0x103c
+#define IEEE80211_WPS_ATTR_R_HASH1		0x103d
+#define IEEE80211_WPS_ATTR_R_HASH2		0x103e
+#define IEEE80211_WPS_ATTR_R_SNONCE1		0x103f
+#define IEEE80211_WPS_ATTR_R_SNONCE2		0x1040
+#define IEEE80211_WPS_ATTR_SELECTED_REGISTRAR	0x1041
+#define IEEE80211_WPS_ATTR_SERIAL_NUMBER	0x1042
+#define IEEE80211_WPS_ATTR_WPS_STATE		0x1044
+#define IEEE80211_WPS_ATTR_SSID			0x1045
+#define IEEE80211_WPS_ATTR_TOTAL_NETWORKS	0x1046
+#define IEEE80211_WPS_ATTR_UUID_E		0x1047
+#define IEEE80211_WPS_ATTR_UUID_R		0x1048
+#define IEEE80211_WPS_ATTR_VENDOR_EXT		0x1049
+#define IEEE80211_WPS_ATTR_VERSION		0x104a
+#define IEEE80211_WPS_ATTR_X509_CERT_REQ	0x104b
+#define IEEE80211_WPS_ATTR_X509_CERT		0x104c
+#define IEEE80211_WPS_ATTR_EAP_IDENTITY		0x104d
+#define IEEE80211_WPS_ATTR_MSG_COUNTER		0x104e
+#define IEEE80211_WPS_ATTR_PUBKEY_HASH		0x104f
+#define IEEE80211_WPS_ATTR_REKEY_KEY		0x1050
+#define IEEE80211_WPS_ATTR_KEY_LIFETIME		0x1051
+#define IEEE80211_WPS_ATTR_PERMITTED_CONFIG_METHODS	0x1052
+#define IEEE80211_WPS_ATTR_SELECTED_REGISTRAR_CONFIG_METHODS	0x1053
+#define IEEE80211_WPS_ATTR_PRIMARY_DEV_TYPE	0x1054
+#define IEEE80211_WPS_ATTR_SECONDARY_DEV_TYPE_LIST	0x1055
+#define IEEE80211_WPS_ATTR_PORTABLE_DEV		0x1056
+#define IEEE80211_WPS_ATTR_AP_SETUP_LOCKED	0x1057
+#define IEEE80211_WPS_ATTR_APPLICATION_EXT	0x1058
+#define IEEE80211_WPS_ATTR_EAP_TYPE		0x1059
+#define IEEE80211_WPS_ATTR_IV			0x1060
+#define IEEE80211_WPS_ATTR_KEY_PROVIDED_AUTO	0x1061
+#define IEEE80211_WPS_ATTR_802_1X_ENABLED	0x1062
+#define IEEE80211_WPS_ATTR_AP_SESSION_KEY	0x1063
+#define IEEE80211_WPS_ATTR_WEP_TRANSMIT_KEY	0x1064
+#define IEEE80211_WPS_ATTR_REQUESTED_DEV_TYPE	0x106a
+#define IEEE80211_WPS_ATTR_EXTENSIBILITY_TEST	0x10fa /* _NOT_ defined in the spec */
+
+/* RF bands bitmask */
+#define IEEE80211_WPS_RF_BAND_24GHZ		0x01
+#define IEEE80211_WPS_RF_BAND_50GHZ		0x02
+#define IEEE80211_WPS_RF_BAND_600GHZ		0x04
+
+/* Config methods bitmask */
+#define IEEE80211_WPS_CONFIG_USBA		0x0001
+#define IEEE80211_WPS_CONFIG_ETHERNET		0x0002
+#define IEEE80211_WPS_CONFIG_LABEL		0x0004
+#define IEEE80211_WPS_CONFIG_DISPLAY		0x0008
+#define IEEE80211_WPS_CONFIG_EXT_NFC_TOKEN	0x0010
+#define IEEE80211_WPS_CONFIG_INT_NFC_TOKEN	0x0020
+#define IEEE80211_WPS_CONFIG_NFC_INTERFACE	0x0040
+#define IEEE80211_WPS_CONFIG_PUSHBUTTON		0x0080
+#define IEEE80211_WPS_CONFIG_KEYPAD		0x0100
+#define IEEE80211_WPS_CONFIG_VIRT_PUSHBUTTON	0x0200
+#define IEEE80211_WPS_CONFIG_PHY_PUSHBUTTON	0x0400
+#define IEEE80211_WPS_CONFIG_P2PS		0x1000
+#define IEEE80211_WPS_CONFIG_VIRT_DISPLAY	0x2000
+#define IEEE80211_WPS_CONFIG_PHY_DISPLAY	0x4000
+
+/* Wi-Fi Protected Setup state */
+#define IEEE80211_WPS_STATE_NOT_CONFIGURED	0x01
+#define IEEE80211_WPS_STATE_CONFIGURED		0x02
+#endif /* _NET80211_IEEE80211_WPS_H_ */
diff --git a/freebsd/sys/netpfil/ipfw/ip_fw_private.h b/freebsd/sys/netpfil/ipfw/ip_fw_private.h
index 7e966d0a..dcd38eb8 100644
--- a/freebsd/sys/netpfil/ipfw/ip_fw_private.h
+++ b/freebsd/sys/netpfil/ipfw/ip_fw_private.h
@@ -83,11 +83,13 @@ struct _ip6dn_args {
  * efficient to pass variables around and extend the interface.
  */
 struct ip_fw_args {
-	struct mbuf	*m;		/* the mbuf chain		*/
-	struct ifnet	*oif;		/* output interface		*/
-	struct sockaddr_in *next_hop;	/* forward address		*/
-	struct sockaddr_in6 *next_hop6; /* ipv6 forward address		*/
-
+	uint32_t		flags;
+#define	IPFW_ARGS_ETHER		0x0001	/* has valid ethernet header	*/
+#define	IPFW_ARGS_NH4		0x0002	/* has IPv4 next hop in hopstore */
+#define	IPFW_ARGS_NH6		0x0004	/* has IPv6 next hop in hopstore */
+#define	IPFW_ARGS_NH4PTR	0x0008	/* has IPv4 next hop in next_hop */
+#define	IPFW_ARGS_NH6PTR	0x0010	/* has IPv6 next hop in next_hop6 */
+#define	IPFW_ARGS_REF		0x0020	/* has valid ipfw_rule_ref	*/
 	/*
 	 * On return, it points to the matching rule.
 	 * On entry, rule.slot > 0 means the info is valid and
@@ -95,19 +97,33 @@ struct ip_fw_args {
 	 * If chain_id == chain->id && slot >0 then jump to that slot.
 	 * Otherwise, we locate the first rule >= rulenum:rule_id
 	 */
-	struct ipfw_rule_ref rule;	/* match/restart info		*/
-
-	struct ether_header *eh;	/* for bridged packets		*/
-
-	struct ipfw_flow_id f_id;	/* grabbed from IP header	*/
-	//uint32_t	cookie;		/* a cookie depending on rule action */
-	struct inpcb	*inp;
-
-	struct _ip6dn_args	dummypar; /* dummynet->ip6_output */
-	union {		/* store here if cannot use a pointer */
-		struct sockaddr_in hopstore;
-		struct sockaddr_in6 hopstore6;
+	struct ipfw_rule_ref	rule;	/* match/restart info		*/
+
+	struct ifnet		*oif;	/* output interface		*/
+	struct inpcb		*inp;
+	union {
+		/*
+		 * We don't support forwarding on layer2, thus we can
+		 * keep eh pointer in this union.
+		 * next_hop[6] pointers can be used to point to next hop
+		 * stored in rule's opcode to avoid copying into hopstore.
+		 * Also, it is expected that all 0x1-0x10 flags are mutually
+		 * exclusive.
+		 */
+		struct ether_header	*eh;	/* for bridged packets	*/
+		struct sockaddr_in	*next_hop;
+		struct sockaddr_in6	*next_hop6;
+		/* ipfw next hop storage */
+		struct sockaddr_in	hopstore;
+		struct ip_fw_nh6 {
+			struct in6_addr sin6_addr;
+			uint32_t	sin6_scope_id;
+			uint16_t	sin6_port;
+		} hopstore6;
 	};
+
+	struct mbuf		*m;	/* the mbuf chain		*/
+	struct ipfw_flow_id	f_id;	/* grabbed from IP header	*/
 };
 
 MALLOC_DECLARE(M_IPFW);
diff --git a/freebsd/sys/vm/uma_core.c b/freebsd/sys/vm/uma_core.c
index bad12385..740dea48 100644
--- a/freebsd/sys/vm/uma_core.c
+++ b/freebsd/sys/vm/uma_core.c
@@ -695,7 +695,7 @@ static int
 hash_alloc(struct uma_hash *hash)
 {
 	int oldsize;
-	int alloc;
+	size_t alloc;
 
 	oldsize = hash->uh_hashsize;