diff --git a/src/libs/compat/freebsd_wlan/net80211/_ieee80211.h b/src/libs/compat/freebsd_wlan/net80211/_ieee80211.h
index 1ac9328714..5c7e611002 100644
--- a/src/libs/compat/freebsd_wlan/net80211/_ieee80211.h
+++ b/src/libs/compat/freebsd_wlan/net80211/_ieee80211.h
@@ -536,6 +536,27 @@ struct ieee80211_mimo_info {
 	"\21AMPDU\22AMSDU\23HT\24SMPS\25RIFS\32TXLDPC\33RXAMSDUAMPDU" \
 	"\34TXAMSDUAMPDU"
 
+/*
+ * AKM (key management) suite capability list.
+ *
+ * These represent what's in 802.11-2016 - Table 9-133 - AKM Suite Selectors.
+ * Note that they do not match what the table values are, in case other key
+ * management suites want to be added with different OUIs.
+ */
+#define	IEEE80211_KEYMGMT_RSN_UNSPEC_802_1X		0x00000001 /* RSN suite 1 */
+#define	IEEE80211_KEYMGMT_RSN_PSK_OVER_802_1X		0x00000002 /* RSN suite 2 */
+#define	IEEE80211_KEYMGMT_RSN_FT_OVER_802_1X		0x00000004 /* RSN suite 3 */
+#define	IEEE80211_KEYMGMT_RSN_FT_PSK			0x00000008 /* RSN suite 4 */
+#define	IEEE80211_KEYMGMT_RSN_802_1X_SHA256		0x00000010 /* RSN suite 5 */
+#define	IEEE80211_KEYMGMT_RSN_PSK_SHA256		0x00000020 /* RSN suite 6 */
+#define	IEEE80211_KEYMGMT_RSN_TPK_HANDSHAKE		0x00000040 /* RSN suite 7 */
+#define	IEEE80211_KEYMGMT_RSN_SAE			0x00000080 /* RSN suite 8 */
+#define	IEEE80211_KEYMGMT_RSN_FT_SAE			0x00000100 /* RSN suite 9 */
+#define	IEEE80211_KEYMGMT_RSN_APPEERKEY_SHA256		0x00000200 /* RSN suite 10 */
+#define	IEEE80211_KEYMGMT_RSN_802_1X_SUITE_B		0x00000400 /* RSN suite 11 */
+#define	IEEE80211_KEYMGMT_RSN_802_1X_SUITE_B_192	0x00000800 /* RSN suite 12 */
+#define	IEEE80211_KEYMGMT_RSN_FT_802_1X_SHA384		0x00001000 /* RSN suite 13 */
+
 /*
  * RX status notification - which fields are valid.
  */
diff --git a/src/libs/compat/freebsd_wlan/net80211/ieee80211.c b/src/libs/compat/freebsd_wlan/net80211/ieee80211.c
index 38a8708583..b10c4a3d44 100644
--- a/src/libs/compat/freebsd_wlan/net80211/ieee80211.c
+++ b/src/libs/compat/freebsd_wlan/net80211/ieee80211.c
@@ -438,6 +438,40 @@ ieee80211_ifdetach(struct ieee80211com *ic)
 	IEEE80211_LOCK_DESTROY(ic);
 }
 
+/*
+ * Called by drivers during attach to set the supported
+ * cipher set for software encryption.
+ */
+void
+ieee80211_set_software_ciphers(struct ieee80211com *ic,
+    uint32_t cipher_suite)
+{
+	ieee80211_crypto_set_supported_software_ciphers(ic, cipher_suite);
+}
+
+/*
+ * Called by drivers during attach to set the supported
+ * cipher set for hardware encryption.
+ */
+void
+ieee80211_set_hardware_ciphers(struct ieee80211com *ic,
+    uint32_t cipher_suite)
+{
+	ieee80211_crypto_set_supported_hardware_ciphers(ic, cipher_suite);
+}
+
+/*
+ * Called by drivers during attach to set the supported
+ * key management suites by the driver/hardware.
+ */
+void
+ieee80211_set_driver_keymgmt_suites(struct ieee80211com *ic,
+    uint32_t keymgmt_set)
+{
+	ieee80211_crypto_set_supported_driver_keymgmt(ic,
+	    keymgmt_set);
+}
+
 struct ieee80211com *
 ieee80211_find_com(const char *name)
 {
@@ -2653,3 +2687,34 @@ ieee80211_channel_type_char(const struct ieee80211_channel *c)
 		return 'b';
 	return 'f';
 }
+
+/*
+ * Determine whether the given key in the given VAP is a global key.
+ * (key index 0..3, shared between all stations on a VAP.)
+ *
+ * This is either a WEP key or a GROUP key.
+ *
+ * Note this will NOT return true if it is a IGTK key.
+ */
+bool
+ieee80211_is_key_global(const struct ieee80211vap *vap,
+    const struct ieee80211_key *key)
+{
+	return (&vap->iv_nw_keys[0] <= key &&
+	    key < &vap->iv_nw_keys[IEEE80211_WEP_NKID]);
+}
+
+/*
+ * Determine whether the given key in the given VAP is a unicast key.
+ */
+bool
+ieee80211_is_key_unicast(const struct ieee80211vap *vap,
+    const struct ieee80211_key *key)
+{
+	/*
+	 * This is a short-cut for now; eventually we will need
+	 * to support multiple unicast keys, IGTK, etc) so we
+	 * will absolutely need to fix the key flags.
+	 */
+	return (!ieee80211_is_key_global(vap, key));
+}
diff --git a/src/libs/compat/freebsd_wlan/net80211/ieee80211.h b/src/libs/compat/freebsd_wlan/net80211/ieee80211.h
index 47e496bf42..e62b8c16d6 100644
--- a/src/libs/compat/freebsd_wlan/net80211/ieee80211.h
+++ b/src/libs/compat/freebsd_wlan/net80211/ieee80211.h
@@ -161,6 +161,7 @@ struct ieee80211_qosframe_addr4 {
 /* 0001-0011 Reserved				0x10-0x30 */	/* Were: CF_ACK, CF_POLL, CF_ACPL */
 #define	IEEE80211_FC0_SUBTYPE_NODATA		0x40	/* Null */
 /* 0101-0111 Reserved				0x50-0x70 */	/* Were: CFACK, CFPOLL, CF_ACK_CF_ACK */
+#define	IEEE80211_FC0_SUBTYPE_QOS_MASK_ANY	0x80	/* QoS mask - matching any subtypes 8..15 */
 #define	IEEE80211_FC0_SUBTYPE_QOS_DATA		0x80	/* QoS Data */
 #define	IEEE80211_FC0_SUBTYPE_QOS_DATA_CFACK	0x90	/* QoS Data +CF-Ack */
 #define	IEEE80211_FC0_SUBTYPE_QOS_DATA_CFPOLL	0xa0	/* QoS Data +CF-Poll */
@@ -190,24 +191,98 @@ struct ieee80211_qosframe_addr4 {
 #define	IEEE80211_CTL_EXT_TDD_BF		0x0b	/* TDD Beamforming, 80211ay-2021 */
 /* 1100-1111 Reserved				0xc-0xf */
 
-#define	IEEE80211_IS_MGMT(wh)					\
-	(!! (((wh)->i_fc[0] & IEEE80211_FC0_TYPE_MASK)		\
-	    == IEEE80211_FC0_TYPE_MGT))
+/* Check the version field */
+#define	IEEE80211_IS_FC0_CHECK_VER(wh, v)			\
+	(((wh)->i_fc[0] & IEEE80211_FC0_VERSION_MASK) == (v))
+
+/* Check the version and type field */
+#define	IEEE80211_IS_FC0_CHECK_VER_TYPE(wh, v, t)			\
+	(((((wh)->i_fc[0] & IEEE80211_FC0_VERSION_MASK) == (v))) &&	\
+	  (((wh)->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == (t)))
+
+/* Check the version, type and subtype field */
+#define	IEEE80211_IS_FC0_CHECK_VER_TYPE_SUBTYPE(wh, v, t, st)		\
+	(((((wh)->i_fc[0] & IEEE80211_FC0_VERSION_MASK) == (v))) &&	\
+	  (((wh)->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == (t)) &&		\
+	  (((wh)->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == (st)))
+
+#define	IEEE80211_IS_MGMT(wh)						\
+	(IEEE80211_IS_FC0_CHECK_VER_TYPE(wh, IEEE80211_FC0_VERSION_0,	\
+	 IEEE80211_FC0_TYPE_MGT))
 #define	IEEE80211_IS_CTL(wh)					\
-	(!! (((wh)->i_fc[0] & IEEE80211_FC0_TYPE_MASK)		\
-	    == IEEE80211_FC0_TYPE_CTL))
+	(IEEE80211_IS_FC0_CHECK_VER_TYPE(wh, IEEE80211_FC0_VERSION_0,	\
+	 IEEE80211_FC0_TYPE_CTL))
 #define	IEEE80211_IS_DATA(wh)					\
-	(!! (((wh)->i_fc[0] & IEEE80211_FC0_TYPE_MASK)		\
-	    == IEEE80211_FC0_TYPE_DATA))
+	(IEEE80211_IS_FC0_CHECK_VER_TYPE(wh, IEEE80211_FC0_VERSION_0,	\
+	 IEEE80211_FC0_TYPE_DATA))
 #define	IEEE80211_IS_EXT(wh)					\
-	(!! (((wh)->i_fc[0] & IEEE80211_FC0_TYPE_MASK)		\
-	    == IEEE80211_FC0_TYPE_EXT))
+	(IEEE80211_IS_FC0_CHECK_VER_TYPE(wh, IEEE80211_FC0_VERSION_0,	\
+	 IEEE80211_FC0_TYPE_EXT))
 
-#define	IEEE80211_FC0_QOSDATA \
-	(IEEE80211_FC0_TYPE_DATA|IEEE80211_FC0_SUBTYPE_QOS_DATA|IEEE80211_FC0_VERSION_0)
+/* Management frame types */
+
+#define	IEEE80211_IS_MGMT_BEACON(wh)			\
+	(IEEE80211_IS_FC0_CHECK_VER_TYPE_SUBTYPE(wh,	\
+	 IEEE80211_FC0_VERSION_0,			\
+	 IEEE80211_FC0_TYPE_MGT,			\
+	 IEEE80211_FC0_SUBTYPE_BEACON))
+
+#define	IEEE80211_IS_MGMT_PROBE_RESP(wh)		\
+	(IEEE80211_IS_FC0_CHECK_VER_TYPE_SUBTYPE(wh,	\
+	 IEEE80211_FC0_VERSION_0,			\
+	 IEEE80211_FC0_TYPE_MGT,			\
+	 IEEE80211_FC0_SUBTYPE_PROBE_RESP))
+
+#define	IEEE80211_IS_MGMT_ACTION(wh)		\
+	(IEEE80211_IS_FC0_CHECK_VER_TYPE_SUBTYPE(wh,	\
+	 IEEE80211_FC0_VERSION_0,			\
+	 IEEE80211_FC0_TYPE_MGT,			\
+	 IEEE80211_FC0_SUBTYPE_ACTION))
+
+/* Control frame types */
+
+#define	IEEE80211_IS_CTL_PS_POLL(wh)			\
+	(IEEE80211_IS_FC0_CHECK_VER_TYPE_SUBTYPE(wh,	\
+	 IEEE80211_FC0_VERSION_0,			\
+	 IEEE80211_FC0_TYPE_CTL,			\
+	 IEEE80211_FC0_SUBTYPE_PS_POLL))
+
+#define	IEEE80211_IS_CTL_BAR(wh)			\
+	(IEEE80211_IS_FC0_CHECK_VER_TYPE_SUBTYPE(wh,	\
+	 IEEE80211_FC0_VERSION_0,			\
+	 IEEE80211_FC0_TYPE_CTL,			\
+	 IEEE80211_FC0_SUBTYPE_BAR))
+
+/* Data frame types */
+
+/*
+ * Return true if the frame is any of the QOS frame types, not just
+ * data frames.  Matching on the IEEE80211_FC0_SUBTYPE_QOS_ANY bit
+ * being set also matches on subtypes 8..15.
+ */
+#define	IEEE80211_IS_QOS_ANY(wh)					\
+	((IEEE80211_IS_FC0_CHECK_VER_TYPE(wh, IEEE80211_FC0_VERSION_0,	\
+	 IEEE80211_FC0_TYPE_DATA)) &&					\
+	 ((wh)->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS_MASK_ANY))
+
+/*
+ * Return true if this frame is QOS data, and only QOS data.
+ */
+#define	IEEE80211_IS_QOSDATA(wh)			\
+	(IEEE80211_IS_FC0_CHECK_VER_TYPE_SUBTYPE(wh,	\
+	 IEEE80211_FC0_VERSION_0,			\
+	 IEEE80211_FC0_TYPE_DATA,			\
+	 IEEE80211_FC0_SUBTYPE_QOS_DATA))
+
+/*
+ * Return true if this frame is a QoS NULL data frame.
+ */
+#define	IEEE80211_IS_QOS_NULL(wh)			\
+	(IEEE80211_IS_FC0_CHECK_VER_TYPE_SUBTYPE(wh,	\
+	 IEEE80211_FC0_VERSION_0,			\
+	 IEEE80211_FC0_TYPE_DATA,			\
+	 IEEE80211_FC0_SUBTYPE_QOS_NULL))
 
-#define	IEEE80211_IS_QOSDATA(wh) \
-	((wh)->i_fc[0] == IEEE80211_FC0_QOSDATA)
 
 #define	IEEE80211_FC1_DIR_MASK			0x03
 #define	IEEE80211_FC1_DIR_NODS			0x00	/* STA->STA */
@@ -421,7 +496,7 @@ struct ieee80211_action {
 #define	IEEE80211_ACTION_CAT_BA			3	/* 9.6.4 Block Ack */
 #define	IEEE80211_ACTION_CAT_PUBLIC		4	/* 9.6.7 Public */
 #define	IEEE80211_ACTION_CAT_RADIO_MEASUREMENT	5	/* 9.6.6 Radio Measurement */
-#define	IEEE80211_ACTION_CAT_FAST_BBS_TRANSITION 6	/* 9.6.8 Fast BSS Transition */
+#define	IEEE80211_ACTION_CAT_FAST_BSS_TRANSITION 6	/* 9.6.8 Fast BSS Transition */
 #define	IEEE80211_ACTION_CAT_HT			7	/* 9.6.11 HT */
 #define	IEEE80211_ACTION_CAT_SA_QUERY		8	/* 9.6.9 SA Query */
 #define	IEEE80211_ACTION_CAT_PROTECTED_DUAL_OF_PUBLIC_ACTION 9 /* 9.6.10 Protected Dual of Public Action */
@@ -1017,6 +1092,8 @@ struct ieee80211_ie_vht_txpwrenv {
 
 /*
  * Management information element payloads.
+ *
+ * 802.11-2016 Table 9-77 (Element IDs).
  */
 
 enum {
@@ -1058,6 +1135,7 @@ enum {
 	IEEE80211_ELEMID_COEX_2040	= 72,
 	IEEE80211_ELEMID_INTOL_CHN_REPORT	= 73,
 	IEEE80211_ELEMID_OVERLAP_BSS_SCAN_PARAM = 74,
+	IEEE80211_ELEMID_MMIC		= 76,
 	IEEE80211_ELEMID_TSF_REQ	= 91,
 	IEEE80211_ELEMID_TSF_RESP	= 92,
 	IEEE80211_ELEMID_WNM_SLEEP_MODE	= 93,
@@ -1266,7 +1344,7 @@ struct ieee80211_csa_ie {
 #define	WPA_CSE_NULL		0x00
 #define	WPA_CSE_WEP40		0x01
 #define	WPA_CSE_TKIP		0x02
-#define	WPA_CSE_CCMP		0x04
+#define	WPA_CSE_CCMP		0x04		/* CCMP 128-bit */
 #define	WPA_CSE_WEP104		0x05
 
 #define	WPA_ASE_NONE		0x00
@@ -1275,21 +1353,62 @@ struct ieee80211_csa_ie {
 
 #define	WPS_OUI_TYPE		0x04
 
+/* 802.11-2016 Table 9-131 - Cipher Suite Selectors */
 #define	RSN_OUI			0xac0f00
 #define	RSN_VERSION		1		/* current supported version */
 
-#define	RSN_CSE_NULL		0x00
-#define	RSN_CSE_WEP40		0x01
-#define	RSN_CSE_TKIP		0x02
-#define	RSN_CSE_WRAP		0x03
-#define	RSN_CSE_CCMP		0x04
-#define	RSN_CSE_WEP104		0x05
+/* RSN cipher suite element */
+#define	RSN_CSE_NULL		0
+#define	RSN_CSE_WEP40		1
+#define	RSN_CSE_TKIP		2
+#define	RSN_CSE_WRAP		3		/* Reserved in the 802.11-2016 */
+#define	RSN_CSE_CCMP		4		/* CCMP 128 bit */
+#define	RSN_CSE_WEP104		5
+#define	RSN_CSE_BIP_CMAC_128	6
+/* 7 - "Group addressed traffic not allowed" */
+#define	RSN_CSE_GCMP_128	8
+#define	RSN_CSE_GCMP_256	9
+#define	RSN_CSE_CCMP_256	10
+#define	RSN_CSE_BIP_GMAC_128	11
+#define	RSN_CSE_BIP_GMAC_256	12
+#define	RSN_CSE_BIP_CMAC_256	13
 
-#define	RSN_ASE_NONE		0x00
-#define	RSN_ASE_8021X_UNSPEC	0x01
-#define	RSN_ASE_8021X_PSK	0x02
+/* 802.11-2016 Table 9-133 - AKM suite selectors */
+/* RSN AKM suite element */
+#define	RSN_ASE_NONE		0
+#define	RSN_ASE_8021X_UNSPEC	1
+#define	RSN_ASE_8021X_PSK	2
+#define	RSN_ASE_FT_8021X	3		/* SHA-256 */
+#define	RSN_ASE_FT_PSK		4		/* SHA-256 */
+#define	RSN_ASE_8021X_UNSPEC_SHA256	5
+#define	RSN_ASE_8021X_PSK_SHA256	6
+#define	RSN_ASE_8021X_TDLS	7		/* SHA-256 */
+#define	RSN_ASE_SAE_UNSPEC	8		/* SHA-256 */
+#define	RSN_ASE_FT_SAE		9		/* SHA-256 */
+#define	RSN_ASE_AP_PEERKEY	10		/* SHA-256 */
+#define	RSN_ASE_8021X_SUITE_B_SHA256	11
+#define	RSN_ASE_8021X_SUITE_B_SHA384	12
+#define	RSN_ASE_FT_8021X_SHA384	13
 
-#define	RSN_CAP_PREAUTH		0x01
+/* 802.11-2016 Figure 9-257 - RSN Capabilities (2 byte field) */
+#define	RSN_CAP_PREAUTH		0x0001
+#define	RSN_CAP_NO_PAIRWISE	0x0002
+#define	RSN_CAP_PTKSA_REPLAY_COUNTER	0x000c	/* 2 bit field */
+#define	RSN_CAP_GTKSA_REPLAY_COUNTER	0x0030	/* 2 bit field */
+#define	RSN_CAP_MFP_REQUIRED	0x0040
+#define	RSN_CAP_MFP_CAPABLE	0x0080
+#define	RSN_CAP_JOINT_MULTIBAND_RSNA		0x0100
+#define	RSN_CAP_PEERKEY_ENABLED	0x0200
+#define	RSN_CAP_SPP_AMSDU_CAPABLE	0x0400
+#define	RSN_CAP_SPP_AMSDU_REQUIRED	0x0800
+#define	RSN_CAP_PBAC_CAPABLE	0x1000
+#define	RSN_CAP_EXT_KEYID_CAPABLE	0x0200
+
+/* 802.11-2016 Table 9-134 PTKSA/GTKSA/STKSA replay counters usage */
+#define		RSN_CAP_REPLAY_COUNTER_1_PER	0
+#define		RSN_CAP_REPLAY_COUNTER_2_PER	1
+#define		RSN_CAP_REPLAY_COUNTER_4_PER	2
+#define		RSN_CAP_REPLAY_COUNTER_16_PER	3
 
 #define	WME_OUI			0xf25000
 #define	WME_OUI_TYPE		0x02
diff --git a/src/libs/compat/freebsd_wlan/net80211/ieee80211_action.c b/src/libs/compat/freebsd_wlan/net80211/ieee80211_action.c
index 5dcb2438a6..35b57322d5 100644
--- a/src/libs/compat/freebsd_wlan/net80211/ieee80211_action.c
+++ b/src/libs/compat/freebsd_wlan/net80211/ieee80211_action.c
@@ -25,10 +25,6 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include <sys/cdefs.h>
-#ifdef __FreeBSD__
-#endif
-
 /*
  * IEEE 802.11 send/recv action frame support.
  */
diff --git a/src/libs/compat/freebsd_wlan/net80211/ieee80211_adhoc.c b/src/libs/compat/freebsd_wlan/net80211/ieee80211_adhoc.c
index 7455500a91..d252b75899 100644
--- a/src/libs/compat/freebsd_wlan/net80211/ieee80211_adhoc.c
+++ b/src/libs/compat/freebsd_wlan/net80211/ieee80211_adhoc.c
@@ -25,10 +25,6 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include <sys/cdefs.h>
-#ifdef __FreeBSD__
-#endif
-
 /*
  * IEEE 802.11 IBSS mode support.
  */
@@ -366,8 +362,7 @@ adhoc_input(struct ieee80211_node *ni, struct mbuf *m,
 	 */
 	wh = mtod(m, struct ieee80211_frame *);
 
-	if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
-	    IEEE80211_FC0_VERSION_0) {
+	if (!IEEE80211_IS_FC0_CHECK_VER(wh, IEEE80211_FC0_VERSION_0)) {
 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
 		    ni->ni_macaddr, NULL, "wrong version, fc %02x:%02x",
 		    wh->i_fc[0], wh->i_fc[1]);
@@ -767,7 +762,7 @@ adhoc_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0,
 				 * XXX check if the beacon we recv'd gives
 				 * us what we need and suppress the probe req
 				 */
-				ieee80211_probe_curchan(vap, 1);
+				ieee80211_probe_curchan(vap, true);
 				ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
 			}
 			ieee80211_add_scan(vap, rxchan, &scan, wh,
diff --git a/src/libs/compat/freebsd_wlan/net80211/ieee80211_alq.c b/src/libs/compat/freebsd_wlan/net80211/ieee80211_alq.c
index 4a714bb51a..c25ef11163 100644
--- a/src/libs/compat/freebsd_wlan/net80211/ieee80211_alq.c
+++ b/src/libs/compat/freebsd_wlan/net80211/ieee80211_alq.c
@@ -25,10 +25,6 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include <sys/cdefs.h>
-#ifdef __FreeBSD__
-#endif
-
 /*
  * net80211 fast-logging support, primarily for debugging.
  *
diff --git a/src/libs/compat/freebsd_wlan/net80211/ieee80211_crypto.c b/src/libs/compat/freebsd_wlan/net80211/ieee80211_crypto.c
index 6a1182b524..d70b3aa4a2 100644
--- a/src/libs/compat/freebsd_wlan/net80211/ieee80211_crypto.c
+++ b/src/libs/compat/freebsd_wlan/net80211/ieee80211_crypto.c
@@ -62,8 +62,8 @@ static int
 null_key_alloc(struct ieee80211vap *vap, struct ieee80211_key *k,
 	ieee80211_keyix *keyix, ieee80211_keyix *rxkeyix)
 {
-	if (!(&vap->iv_nw_keys[0] <= k &&
-	     k < &vap->iv_nw_keys[IEEE80211_WEP_NKID])) {
+
+	if (!ieee80211_is_key_global(vap, k)) {
 		/*
 		 * Not in the global key table, the driver should handle this
 		 * by allocating a slot in the h/w key table/cache.  In
@@ -142,6 +142,37 @@ ieee80211_crypto_attach(struct ieee80211com *ic)
 {
 	/* NB: we assume everything is pre-zero'd */
 	ciphers[IEEE80211_CIPHER_NONE] = &ieee80211_cipher_none;
+
+	/*
+	 * Default set of net80211 supported ciphers.
+	 *
+	 * These are the default set that all drivers are expected to
+	 * support, either/or in hardware and software.
+	 *
+	 * Drivers can add their own support to this and the
+	 * hardware cipher list (ic_cryptocaps.)
+	 */
+	ic->ic_sw_cryptocaps = IEEE80211_CRYPTO_WEP |
+	    IEEE80211_CRYPTO_TKIP | IEEE80211_CRYPTO_AES_CCM;
+
+	/*
+	 * Default set of key management types supported by net80211.
+	 *
+	 * These are supported by software net80211 and announced/
+	 * driven by hostapd + wpa_supplicant.
+	 *
+	 * Drivers doing full supplicant offload must not set
+	 * anything here.
+	 *
+	 * Note that IEEE80211_C_WPA1 and IEEE80211_C_WPA2 are the
+	 * "old" style way of drivers announcing key management
+	 * capabilities.  There are many, many more key management
+	 * suites in 802.11-2016 (see 9.4.2.25.3 - AKM suites.)
+	 * For now they still need to be set - these flags are checked
+	 * when assembling a beacon to reserve space for the WPA
+	 * vendor IE (WPA 1) and RSN IE (WPA 2).
+	 */
+	ic->ic_sw_keymgmtcaps = 0;
 }
 
 /*
@@ -152,6 +183,43 @@ ieee80211_crypto_detach(struct ieee80211com *ic)
 {
 }
 
+/*
+ * Set the supported ciphers for software encryption.
+ */
+void
+ieee80211_crypto_set_supported_software_ciphers(struct ieee80211com *ic,
+    uint32_t cipher_set)
+{
+	ic->ic_sw_cryptocaps = cipher_set;
+}
+
+/*
+ * Set the supported ciphers for hardware encryption.
+ */
+void
+ieee80211_crypto_set_supported_hardware_ciphers(struct ieee80211com *ic,
+    uint32_t cipher_set)
+{
+	ic->ic_cryptocaps = cipher_set;
+}
+
+/*
+ * Set the supported software key management by the driver.
+ *
+ * These are the key management suites that are supported via
+ * the driver via hostapd/wpa_supplicant.
+ *
+ * Key management which is completely offloaded (ie, the supplicant
+ * runs in hardware/firmware) must not be set here.
+ */
+void
+ieee80211_crypto_set_supported_driver_keymgmt(struct ieee80211com *ic,
+    uint32_t keymgmt_set)
+{
+
+	ic->ic_sw_keymgmtcaps = keymgmt_set;
+}
+
 /*
  * Setup crypto support for a vap.
  */
@@ -241,6 +309,13 @@ static const char *cipher_modnames[IEEE80211_CIPHER_MAX] = {
 	[IEEE80211_CIPHER_TKIPMIC] = "#4",	/* NB: reserved */
 	[IEEE80211_CIPHER_CKIP]	   = "wlan_ckip",
 	[IEEE80211_CIPHER_NONE]	   = "wlan_none",
+	[IEEE80211_CIPHER_AES_CCM_256] = "wlan_ccmp",
+	[IEEE80211_CIPHER_BIP_CMAC_128] = "wlan_bip_cmac",
+	[IEEE80211_CIPHER_BIP_CMAC_256] = "wlan_bip_cmac",
+	[IEEE80211_CIPHER_BIP_GMAC_128] = "wlan_bip_gmac",
+	[IEEE80211_CIPHER_BIP_GMAC_256] = "wlan_bip_gmac",
+	[IEEE80211_CIPHER_AES_GCM_128]  = "wlan_gcmp",
+	[IEEE80211_CIPHER_AES_GCM_256]  = "wlan_gcmp",
 };
 
 /* NB: there must be no overlap between user-supplied and device-owned flags */
@@ -531,9 +606,9 @@ ieee80211_crypto_get_key_wepidx(const struct ieee80211vap *vap,
     const struct ieee80211_key *k)
 {
 
-	if (k >= &vap->iv_nw_keys[0] &&
-	    k <  &vap->iv_nw_keys[IEEE80211_WEP_NKID])
+	if (ieee80211_is_key_global(vap, k)) {
 		return (k - vap->iv_nw_keys);
+	}
 	return (-1);
 }
 
@@ -543,11 +618,11 @@ ieee80211_crypto_get_key_wepidx(const struct ieee80211vap *vap,
 uint8_t
 ieee80211_crypto_get_keyid(struct ieee80211vap *vap, struct ieee80211_key *k)
 {
-	if (k >= &vap->iv_nw_keys[0] &&
-	    k <  &vap->iv_nw_keys[IEEE80211_WEP_NKID])
+	if (ieee80211_is_key_global(vap, k)) {
 		return (k - vap->iv_nw_keys);
-	else
-		return (0);
+	}
+
+	return (0);
 }
 
 struct ieee80211_key *
diff --git a/src/libs/compat/freebsd_wlan/net80211/ieee80211_crypto.h b/src/libs/compat/freebsd_wlan/net80211/ieee80211_crypto.h
index fc7c13cfdf..b69df0cff3 100644
--- a/src/libs/compat/freebsd_wlan/net80211/ieee80211_crypto.h
+++ b/src/libs/compat/freebsd_wlan/net80211/ieee80211_crypto.h
@@ -137,8 +137,17 @@ struct ieee80211_key {
 #define	IEEE80211_CIPHER_TKIPMIC	4	/* TKIP MIC capability */
 #define	IEEE80211_CIPHER_CKIP		5
 #define	IEEE80211_CIPHER_NONE		6	/* pseudo value */
+#define	IEEE80211_CIPHER_AES_CCM_256	7
+#define	IEEE80211_CIPHER_BIP_CMAC_128	8
+#define	IEEE80211_CIPHER_BIP_CMAC_256	9
+#define	IEEE80211_CIPHER_BIP_GMAC_128	10
+#define	IEEE80211_CIPHER_BIP_GMAC_256	11
+#define	IEEE80211_CIPHER_AES_GCM_128	12
+#define	IEEE80211_CIPHER_AES_GCM_256	13
 
-#define	IEEE80211_CIPHER_MAX		(IEEE80211_CIPHER_NONE+1)
+#define	IEEE80211_CIPHER_LAST		13
+
+#define	IEEE80211_CIPHER_MAX		(IEEE80211_CIPHER_LAST+1)
 
 /* capability bits in ic_cryptocaps/iv_cryptocaps */
 #define	IEEE80211_CRYPTO_WEP		(1<<IEEE80211_CIPHER_WEP)
@@ -147,9 +156,18 @@ struct ieee80211_key {
 #define	IEEE80211_CRYPTO_AES_CCM	(1<<IEEE80211_CIPHER_AES_CCM)
 #define	IEEE80211_CRYPTO_TKIPMIC	(1<<IEEE80211_CIPHER_TKIPMIC)
 #define	IEEE80211_CRYPTO_CKIP		(1<<IEEE80211_CIPHER_CKIP)
+#define	IEEE80211_CRYPTO_AES_CCM_256	(1<<IEEE80211_CIPHER_AES_CCM_256)
+#define	IEEE80211_CRYPTO_BIP_CMAC_128	(1<<IEEE80211_CIPHER_BIP_CMAC_128)
+#define	IEEE80211_CRYPTO_BIP_CMAC_256	(1<<IEEE80211_CIPHER_BIP_CMAC_256)
+#define	IEEE80211_CRYPTO_BIP_GMAC_128	(1<<IEEE80211_CIPHER_BIP_GMAC_128)
+#define	IEEE80211_CRYPTO_BIP_GMAC_256	(1<<IEEE80211_CIPHER_BIP_GMAC_256)
+#define	IEEE80211_CRYPTO_AES_GCM_128	(1<<IEEE80211_CIPHER_AES_GCM_128)
+#define	IEEE80211_CRYPTO_AES_GCM_256	(1<<IEEE80211_CIPHER_AES_GCM_256)
 
 #define	IEEE80211_CRYPTO_BITS \
-	"\20\1WEP\2TKIP\3AES\4AES_CCM\5TKIPMIC\6CKIP"
+	"\20\1WEP\2TKIP\3AES\4AES_CCM\5TKIPMIC\6CKIP\10AES_CCM_256" \
+	"\11BIP_CMAC_128\12BIP_CMAC_256\13BIP_GMAC_128\14BIP_CMAC_256" \
+	"\15AES_GCM_128\16AES_GCM_256"
 
 #if defined(__KERNEL__) || defined(_KERNEL)
 
@@ -162,6 +180,12 @@ MALLOC_DECLARE(M_80211_CRYPTO);
 
 void	ieee80211_crypto_attach(struct ieee80211com *);
 void	ieee80211_crypto_detach(struct ieee80211com *);
+void	ieee80211_crypto_set_supported_software_ciphers(struct ieee80211com *,
+	    uint32_t cipher_set);
+void	ieee80211_crypto_set_supported_hardware_ciphers(struct ieee80211com *,
+	    uint32_t cipher_set);
+void	ieee80211_crypto_set_supported_driver_keymgmt(struct ieee80211com *,
+	    uint32_t keymgmt_set);
 void	ieee80211_crypto_vattach(struct ieee80211vap *);
 void	ieee80211_crypto_vdetach(struct ieee80211vap *);
 int	ieee80211_crypto_newkey(struct ieee80211vap *,
diff --git a/src/libs/compat/freebsd_wlan/net80211/ieee80211_crypto_tkip.c b/src/libs/compat/freebsd_wlan/net80211/ieee80211_crypto_tkip.c
index d2bc281f15..4cfb7542f8 100644
--- a/src/libs/compat/freebsd_wlan/net80211/ieee80211_crypto_tkip.c
+++ b/src/libs/compat/freebsd_wlan/net80211/ieee80211_crypto_tkip.c
@@ -860,7 +860,8 @@ michael_mic_hdr(const struct ieee80211_frame *wh0, uint8_t hdr[16])
 		break;
 	}
 
-	if (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS_DATA) {
+	/* Match on any QOS frame, not just data */
+	if (IEEE80211_IS_QOS_ANY(wh)) {
 		const struct ieee80211_qosframe *qwh =
 			(const struct ieee80211_qosframe *) wh;
 		hdr[12] = qwh->i_qos[0] & IEEE80211_QOS_TID;
diff --git a/src/libs/compat/freebsd_wlan/net80211/ieee80211_dfs.c b/src/libs/compat/freebsd_wlan/net80211/ieee80211_dfs.c
index fed9e98c72..bce7c2fa5e 100644
--- a/src/libs/compat/freebsd_wlan/net80211/ieee80211_dfs.c
+++ b/src/libs/compat/freebsd_wlan/net80211/ieee80211_dfs.c
@@ -25,10 +25,6 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include <sys/cdefs.h>
-#ifdef __FreeBSD__
-#endif
-
 /*
  * IEEE 802.11 DFS/Radar support.
  */
diff --git a/src/libs/compat/freebsd_wlan/net80211/ieee80211_hostap.c b/src/libs/compat/freebsd_wlan/net80211/ieee80211_hostap.c
index b30dd8715b..cdacdaf43e 100644
--- a/src/libs/compat/freebsd_wlan/net80211/ieee80211_hostap.c
+++ b/src/libs/compat/freebsd_wlan/net80211/ieee80211_hostap.c
@@ -25,10 +25,6 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include <sys/cdefs.h>
-#ifdef __FreeBSD__
-#endif
-
 /*
  * IEEE 802.11 HOSTAP mode support.
  */
@@ -537,8 +533,7 @@ hostap_input(struct ieee80211_node *ni, struct mbuf *m,
 	 */
 	wh = mtod(m, struct ieee80211_frame *);
 
-	if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
-	    IEEE80211_FC0_VERSION_0) {
+	if (!IEEE80211_IS_FC0_CHECK_VER(wh, IEEE80211_FC0_VERSION_0)) {
 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
 		    ni->ni_macaddr, NULL, "wrong version, fc %02x:%02x",
 		    wh->i_fc[0], wh->i_fc[1]);
@@ -1544,9 +1539,14 @@ ieee80211_parse_rsn(struct ieee80211vap *vap, const uint8_t *frm,
 		rsn->rsn_keymgmt = RSN_ASE_8021X_PSK;
 
 	/* optional RSN capabilities */
-	if (len > 2)
+	if (len >= 2) {
 		rsn->rsn_caps = le16dec(frm);
-	/* XXXPMKID */
+		frm += 2, len -= 2;
+	}
+
+	/* XXX PMK Count / PMKID */
+
+	/* XXX Group Cipher Management Suite */
 
 	return 0;
 }
@@ -1817,7 +1817,7 @@ hostap_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0,
 				 * XXX check if the beacon we recv'd gives
 				 * us what we need and suppress the probe req
 				 */
-				ieee80211_probe_curchan(vap, 1);
+				ieee80211_probe_curchan(vap, true);
 				ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
 			}
 			ieee80211_add_scan(vap, ic->ic_curchan, &scan, wh,
diff --git a/src/libs/compat/freebsd_wlan/net80211/ieee80211_ht.c b/src/libs/compat/freebsd_wlan/net80211/ieee80211_ht.c
index cb981014fd..28c329ce3d 100644
--- a/src/libs/compat/freebsd_wlan/net80211/ieee80211_ht.c
+++ b/src/libs/compat/freebsd_wlan/net80211/ieee80211_ht.c
@@ -25,10 +25,6 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include <sys/cdefs.h>
-#ifdef __FreeBSD__
-#endif
-
 /*
  * IEEE 802.11n protocol support.
  */
@@ -1018,7 +1014,7 @@ ieee80211_ampdu_reorder(struct ieee80211_node *ni, struct mbuf *m,
 
 	/* NB: m_len known to be sufficient */
 	wh = mtod(m, struct ieee80211_qosframe *);
-	if (wh->i_fc[0] != IEEE80211_FC0_QOSDATA) {
+	if (!IEEE80211_IS_QOSDATA(wh)) {
 		/*
 		 * Not QoS data, shouldn't get here but just
 		 * return it to the caller for processing.
diff --git a/src/libs/compat/freebsd_wlan/net80211/ieee80211_hwmp.c b/src/libs/compat/freebsd_wlan/net80211/ieee80211_hwmp.c
index 1dea4ec301..c47e845bb8 100644
--- a/src/libs/compat/freebsd_wlan/net80211/ieee80211_hwmp.c
+++ b/src/libs/compat/freebsd_wlan/net80211/ieee80211_hwmp.c
@@ -27,9 +27,6 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
-#include <sys/cdefs.h>
-#ifdef __FreeBSD__
-#endif
 
 /*
  * IEEE 802.11s Hybrid Wireless Mesh Protocol, HWMP.
diff --git a/src/libs/compat/freebsd_wlan/net80211/ieee80211_ioctl.c b/src/libs/compat/freebsd_wlan/net80211/ieee80211_ioctl.c
index 00b7437c3b..7ba257b0d1 100644
--- a/src/libs/compat/freebsd_wlan/net80211/ieee80211_ioctl.c
+++ b/src/libs/compat/freebsd_wlan/net80211/ieee80211_ioctl.c
@@ -710,7 +710,11 @@ ieee80211_ioctl_getdevcaps(struct ieee80211com *ic,
 	if (dc == NULL)
 		return ENOMEM;
 	dc->dc_drivercaps = ic->ic_caps;
-	dc->dc_cryptocaps = ic->ic_cryptocaps;
+	/*
+	 * Announce the set of both hardware and software supported
+	 * ciphers.
+	 */
+	dc->dc_cryptocaps = ic->ic_cryptocaps | ic->ic_sw_cryptocaps;
 	dc->dc_htcaps = ic->ic_htcaps;
 	dc->dc_vhtcaps = ic->ic_vht_cap.vht_cap_info;
 	ci = &dc->dc_chaninfo;
diff --git a/src/libs/compat/freebsd_wlan/net80211/ieee80211_ioctl.h b/src/libs/compat/freebsd_wlan/net80211/ieee80211_ioctl.h
index e28bcd98b0..25b88c7018 100644
--- a/src/libs/compat/freebsd_wlan/net80211/ieee80211_ioctl.h
+++ b/src/libs/compat/freebsd_wlan/net80211/ieee80211_ioctl.h
@@ -560,13 +560,13 @@ struct ieee80211_regdomain_req {
 	IEEE80211_REGDOMAIN_SIZE((_req)->chaninfo.ic_nchans)
 
 /*
- * Get driver capabilities.  Driver, hardware crypto, and
+ * Get driver capabilities.  Driver, hardware/software crypto, and
  * HT/802.11n capabilities, and a table that describes what
  * the radio can do.
  */
 struct ieee80211_devcaps_req {
 	uint32_t	dc_drivercaps;		/* general driver caps */
-	uint32_t	dc_cryptocaps;		/* hardware crypto support */
+	uint32_t	dc_cryptocaps;		/* software + hardware crypto support */
 	uint32_t	dc_htcaps;		/* HT/802.11n support */
 	uint32_t	dc_vhtcaps;		/* VHT/802.11ac capabilities */
 	struct ieee80211req_chaninfo dc_chaninfo;
diff --git a/src/libs/compat/freebsd_wlan/net80211/ieee80211_mesh.c b/src/libs/compat/freebsd_wlan/net80211/ieee80211_mesh.c
index 477527b345..c52122ebeb 100644
--- a/src/libs/compat/freebsd_wlan/net80211/ieee80211_mesh.c
+++ b/src/libs/compat/freebsd_wlan/net80211/ieee80211_mesh.c
@@ -27,9 +27,6 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
  * SUCH DAMAGE. 
  */ 
-#include <sys/cdefs.h>
-#ifdef __FreeBSD__
-#endif
 
 /*
  * IEEE 802.11s Mesh Point (MBSS) support.
@@ -1567,8 +1564,7 @@ mesh_input(struct ieee80211_node *ni, struct mbuf *m,
 	*/
 	wh = mtod(m, struct ieee80211_frame *);
 
-	if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
-	    IEEE80211_FC0_VERSION_0) {
+	if (!IEEE80211_IS_FC0_CHECK_VER(wh, IEEE80211_FC0_VERSION_0)) {
 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
 		    ni->ni_macaddr, NULL, "wrong version %x", wh->i_fc[0]);
 		vap->iv_stats.is_rx_badversion++;
@@ -1881,7 +1877,7 @@ mesh_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0, int subtype,
 				 * XXX check if the beacon we recv'd gives
 				 * us what we need and suppress the probe req
 				 */
-				ieee80211_probe_curchan(vap, 1);
+				ieee80211_probe_curchan(vap, true);
 				ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
 			}
 			ieee80211_add_scan(vap, rxchan, &scan, wh,
diff --git a/src/libs/compat/freebsd_wlan/net80211/ieee80211_monitor.c b/src/libs/compat/freebsd_wlan/net80211/ieee80211_monitor.c
index 5dd11c2052..fc262f172f 100644
--- a/src/libs/compat/freebsd_wlan/net80211/ieee80211_monitor.c
+++ b/src/libs/compat/freebsd_wlan/net80211/ieee80211_monitor.c
@@ -25,10 +25,6 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include <sys/cdefs.h>
-#ifdef __FreeBSD__
-#endif
-
 /*
  * IEEE 802.11 Monitor mode support.
  */
diff --git a/src/libs/compat/freebsd_wlan/net80211/ieee80211_output.c b/src/libs/compat/freebsd_wlan/net80211/ieee80211_output.c
index 08354fc8f5..94a349453d 100644
--- a/src/libs/compat/freebsd_wlan/net80211/ieee80211_output.c
+++ b/src/libs/compat/freebsd_wlan/net80211/ieee80211_output.c
@@ -603,8 +603,7 @@ ieee80211_validate_frame(struct mbuf *m,
 		return (EINVAL);
 
 	wh = mtod(m, struct ieee80211_frame *);
-	if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
-	    IEEE80211_FC0_VERSION_0)
+	if (!IEEE80211_IS_FC0_CHECK_VER(wh, IEEE80211_FC0_VERSION_0))
 		return (EINVAL);
 
 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
diff --git a/src/libs/compat/freebsd_wlan/net80211/ieee80211_radiotap.c b/src/libs/compat/freebsd_wlan/net80211/ieee80211_radiotap.c
index 34e27b323f..79e00106a7 100644
--- a/src/libs/compat/freebsd_wlan/net80211/ieee80211_radiotap.c
+++ b/src/libs/compat/freebsd_wlan/net80211/ieee80211_radiotap.c
@@ -125,7 +125,7 @@ ieee80211_radiotap_vattach(struct ieee80211vap *vap)
 void
 ieee80211_radiotap_vdetach(struct ieee80211vap *vap)
 {
-	/* NB: bpfattach is called by ether_ifdetach and claims all taps */
+	/* NB: bpfdetach is called by ether_ifdetach and claims all taps */
 }
 
 static void
diff --git a/src/libs/compat/freebsd_wlan/net80211/ieee80211_ratectl.c b/src/libs/compat/freebsd_wlan/net80211/ieee80211_ratectl.c
index 2783c23fb9..6628cb54f7 100644
--- a/src/libs/compat/freebsd_wlan/net80211/ieee80211_ratectl.c
+++ b/src/libs/compat/freebsd_wlan/net80211/ieee80211_ratectl.c
@@ -25,7 +25,6 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include <sys/cdefs.h>
 #include <sys/param.h>
 #include <sys/kernel.h>
 #include <sys/sbuf.h>
diff --git a/src/libs/compat/freebsd_wlan/net80211/ieee80211_scan.c b/src/libs/compat/freebsd_wlan/net80211/ieee80211_scan.c
index 1feb7f6ce7..cd225896a6 100644
--- a/src/libs/compat/freebsd_wlan/net80211/ieee80211_scan.c
+++ b/src/libs/compat/freebsd_wlan/net80211/ieee80211_scan.c
@@ -522,7 +522,7 @@ ieee80211_scan_done(struct ieee80211vap *vap)
  * then we'll transmit a probe request.
  */
 void
-ieee80211_probe_curchan(struct ieee80211vap *vap, int force)
+ieee80211_probe_curchan(struct ieee80211vap *vap, bool force)
 {
 	struct ieee80211com *ic = vap->iv_ic;
 
diff --git a/src/libs/compat/freebsd_wlan/net80211/ieee80211_scan.h b/src/libs/compat/freebsd_wlan/net80211/ieee80211_scan.h
index a33864b102..1afe767ef0 100644
--- a/src/libs/compat/freebsd_wlan/net80211/ieee80211_scan.h
+++ b/src/libs/compat/freebsd_wlan/net80211/ieee80211_scan.h
@@ -104,7 +104,7 @@ struct ieee80211_scan_methods {
 	void (*sc_cancel_anyscan)(struct ieee80211vap *);
 	void (*sc_scan_next)(struct ieee80211vap *);
 	void (*sc_scan_done)(struct ieee80211vap *);
-	void (*sc_scan_probe_curchan)(struct ieee80211vap *, int);
+	void (*sc_scan_probe_curchan)(struct ieee80211vap *, bool);
 	void (*sc_add_scan)(struct ieee80211vap *,
 	    struct ieee80211_channel *,
 	    const struct ieee80211_scanparams *,
@@ -179,7 +179,7 @@ void	ieee80211_cancel_scan(struct ieee80211vap *);
 void	ieee80211_cancel_anyscan(struct ieee80211vap *);
 void	ieee80211_scan_next(struct ieee80211vap *);
 void	ieee80211_scan_done(struct ieee80211vap *);
-void	ieee80211_probe_curchan(struct ieee80211vap *, int);
+void	ieee80211_probe_curchan(struct ieee80211vap *, bool);
 struct ieee80211_channel *ieee80211_scan_pickchannel(struct ieee80211com *, int);
 
 struct ieee80211_scanparams;
diff --git a/src/libs/compat/freebsd_wlan/net80211/ieee80211_scan_sw.c b/src/libs/compat/freebsd_wlan/net80211/ieee80211_scan_sw.c
index 62f6bf24d4..e1d6b2779c 100644
--- a/src/libs/compat/freebsd_wlan/net80211/ieee80211_scan_sw.c
+++ b/src/libs/compat/freebsd_wlan/net80211/ieee80211_scan_sw.c
@@ -522,7 +522,7 @@ ieee80211_swscan_scan_done(struct ieee80211vap *vap)
  * then we'll transmit a probe request.
  */
 static void
-ieee80211_swscan_probe_curchan(struct ieee80211vap *vap, int force)
+ieee80211_swscan_probe_curchan(struct ieee80211vap *vap, bool force __unused)
 {
 	struct ieee80211com *ic = vap->iv_ic;
 	struct ieee80211_scan_state *ss = ic->ic_scan;
@@ -569,7 +569,7 @@ scan_curchan(struct ieee80211_scan_state *ss, unsigned long maxdwell)
 	    maxdwell);
 	IEEE80211_LOCK(ic);
 	if (ss->ss_flags & IEEE80211_SCAN_ACTIVE)
-		ieee80211_probe_curchan(vap, 0);
+		ieee80211_probe_curchan(vap, false);
 	taskqueue_enqueue_timeout(ic->ic_tq,
 	    &SCAN_PRIVATE(ss)->ss_scan_curchan, maxdwell);
 	IEEE80211_UNLOCK(ic);
diff --git a/src/libs/compat/freebsd_wlan/net80211/ieee80211_sta.c b/src/libs/compat/freebsd_wlan/net80211/ieee80211_sta.c
index 042f5636be..97ed52295d 100644
--- a/src/libs/compat/freebsd_wlan/net80211/ieee80211_sta.c
+++ b/src/libs/compat/freebsd_wlan/net80211/ieee80211_sta.c
@@ -25,10 +25,6 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include <sys/cdefs.h>
-#ifdef __FreeBSD__
-#endif
-
 /*
  * IEEE 802.11 Station mode support.
  */
@@ -572,8 +568,7 @@ sta_input(struct ieee80211_node *ni, struct mbuf *m,
 		vap->iv_stats.is_rx_tooshort++;
 		goto err;
 	}
-	if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
-	    IEEE80211_FC0_VERSION_0) {
+	if (!IEEE80211_IS_FC0_CHECK_VER(wh, IEEE80211_FC0_VERSION_0)) {
 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
 		    ni->ni_macaddr, NULL, "wrong version, fc %02x:%02x",
 		    wh->i_fc[0], wh->i_fc[1]);
@@ -1694,7 +1689,7 @@ sta_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0, int subtype,
 				 * XXX check if the beacon we recv'd gives
 				 * us what we need and suppress the probe req
 				 */
-				ieee80211_probe_curchan(vap, 1);
+				ieee80211_probe_curchan(vap, true);
 				ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
 			}
 			ieee80211_add_scan(vap, rxchan, &scan, wh,
diff --git a/src/libs/compat/freebsd_wlan/net80211/ieee80211_tdma.c b/src/libs/compat/freebsd_wlan/net80211/ieee80211_tdma.c
index b9c204af40..90ab2525e4 100644
--- a/src/libs/compat/freebsd_wlan/net80211/ieee80211_tdma.c
+++ b/src/libs/compat/freebsd_wlan/net80211/ieee80211_tdma.c
@@ -26,10 +26,6 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include <sys/cdefs.h>
-#ifdef __FreeBSD__
-#endif
-
 /*
  * IEEE 802.11 TDMA mode support.
  */
diff --git a/src/libs/compat/freebsd_wlan/net80211/ieee80211_var.h b/src/libs/compat/freebsd_wlan/net80211/ieee80211_var.h
index 2eda121b8d..db4813bd39 100644
--- a/src/libs/compat/freebsd_wlan/net80211/ieee80211_var.h
+++ b/src/libs/compat/freebsd_wlan/net80211/ieee80211_var.h
@@ -165,8 +165,12 @@ struct ieee80211com {
 	uint32_t		ic_caps;	/* capabilities */
 	uint32_t		ic_htcaps;	/* HT capabilities */
 	uint32_t		ic_htextcaps;	/* HT extended capabilities */
-	uint32_t		ic_cryptocaps;	/* crypto capabilities */
+				/* driver-supported software crypto caps */
+	uint32_t		ic_sw_cryptocaps;
+	uint32_t		ic_cryptocaps;	/* hardware crypto caps */
 						/* set of mode capabilities */
+				/* driver/net80211 sw KEYMGMT capabilities */
+	uint32_t		ic_sw_keymgmtcaps;
 	uint8_t			ic_modecaps[IEEE80211_MODE_BYTES];
 	uint8_t			ic_promisc;	/* vap's needing promisc mode */
 	uint8_t			ic_allmulti;	/* vap's needing all multicast*/
@@ -724,7 +728,7 @@ MALLOC_DECLARE(M_80211_VAP);
 
 #define	IEEE80211_FHT_BITS \
 	"\20\1NONHT_PR" \
-	"\23GF\24HT\25AMPDU_TX\26AMPDU_TX" \
+	"\21LDPC_TX\22LDPC_RX\23GF\24HT\25AMPDU_TX\26AMPDU_RX" \
 	"\27AMSDU_TX\30AMSDU_RX\31USEHT40\32PUREN\33SHORTGI20\34SHORTGI40" \
 	"\35HTCOMPAT\36RIFS\37STBC_TX\40STBC_RX"
 
@@ -751,6 +755,12 @@ MALLOC_DECLARE(M_80211_VAP);
 int	ic_printf(struct ieee80211com *, const char *, ...) __printflike(2, 3);
 void	ieee80211_ifattach(struct ieee80211com *);
 void	ieee80211_ifdetach(struct ieee80211com *);
+void	ieee80211_set_software_ciphers(struct ieee80211com *,
+	    uint32_t cipher_suite);
+void	ieee80211_set_hardware_ciphers(struct ieee80211com *,
+	    uint32_t cipher_suite);
+void	ieee80211_set_driver_keymgmt_suites(struct ieee80211com *ic,
+	    uint32_t keymgmt_set);
 int	ieee80211_vap_setup(struct ieee80211com *, struct ieee80211vap *,
 		const char name[IFNAMSIZ], int unit,
 		enum ieee80211_opmode opmode, int flags,
@@ -816,6 +826,11 @@ char	ieee80211_channel_type_char(const struct ieee80211_channel *c);
 #define	ieee80211_get_home_channel(_ic)		((_ic)->ic_bsschan)
 #define	ieee80211_get_vap_desired_channel(_iv)	((_iv)->iv_des_chan)
 
+bool	ieee80211_is_key_global(const struct ieee80211vap *vap,
+	    const struct ieee80211_key *key);
+bool	ieee80211_is_key_unicast(const struct ieee80211vap *vap,
+	    const struct ieee80211_key *key);
+
 void	ieee80211_radiotap_attach(struct ieee80211com *,
 	    struct ieee80211_radiotap_header *th, int tlen,
 		uint32_t tx_radiotap,
diff --git a/src/libs/compat/freebsd_wlan/net80211/ieee80211_vht.c b/src/libs/compat/freebsd_wlan/net80211/ieee80211_vht.c
index 77a36a395d..0839f426e0 100644
--- a/src/libs/compat/freebsd_wlan/net80211/ieee80211_vht.c
+++ b/src/libs/compat/freebsd_wlan/net80211/ieee80211_vht.c
@@ -23,10 +23,6 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include <sys/cdefs.h>
-#ifdef __FreeBSD__
-#endif
-
 /*
  * IEEE 802.11ac-2013 protocol support.
  */
diff --git a/src/libs/compat/freebsd_wlan/net80211/ieee80211_wds.c b/src/libs/compat/freebsd_wlan/net80211/ieee80211_wds.c
index 3051eb303c..03e9096f4f 100644
--- a/src/libs/compat/freebsd_wlan/net80211/ieee80211_wds.c
+++ b/src/libs/compat/freebsd_wlan/net80211/ieee80211_wds.c
@@ -25,10 +25,6 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include <sys/cdefs.h>
-#ifdef __FreeBSD__
-#endif
-
 /*
  * IEEE 802.11 WDS mode support.
  */
@@ -469,8 +465,7 @@ wds_input(struct ieee80211_node *ni, struct mbuf *m,
 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1))
 		ni->ni_inact = ni->ni_inact_reload;
 
-	if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
-	    IEEE80211_FC0_VERSION_0) {
+	if (!IEEE80211_IS_FC0_CHECK_VER(wh, IEEE80211_FC0_VERSION_0)) {
 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
 		    ni->ni_macaddr, NULL, "wrong version, fc %02x:%02x",
 		    wh->i_fc[0], wh->i_fc[1]);