package/madwifi/patches/371-wds_sta_separation.patch

   1 --- a/net80211/ieee80211_input.c
   2 +++ b/net80211/ieee80211_input.c
   3 @@ -202,6 +202,7 @@ ieee80211_input(struct ieee80211vap * va
   4         struct ieee80211com *ic;
   5         struct net_device *dev;
   6         struct ieee80211_node *ni_wds = NULL;
   7 +       struct net_device_stats *stats;
   8         struct ieee80211_frame *wh;
   9         struct ieee80211_key *key;
  10         struct ether_header *eh;
  11 @@ -447,7 +448,7 @@ ieee80211_input(struct ieee80211vap * va
  12
  13         switch (type) {
  14         case IEEE80211_FC0_TYPE_DATA:
  15 -               hdrspace = ieee80211_hdrspace(ic, wh);
  16 +               hdrspace = ieee80211_hdrsize(wh);
  17                 if (skb->len < hdrspace) {
  18                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
  19                                 wh, "data", "too short: len %u, expecting %u",
  20 @@ -457,16 +458,24 @@ ieee80211_input(struct ieee80211vap * va
  21                 }
  22                 switch (vap->iv_opmode) {
  23                 case IEEE80211_M_STA:
  24 -                       if ((dir != IEEE80211_FC1_DIR_FROMDS) &&
  25 -                           (!((vap->iv_flags_ext & IEEE80211_FEXT_WDS) &&
  26 -                           (dir == IEEE80211_FC1_DIR_DSTODS)))) {
  27 +                       switch(dir) {
  28 +                       case IEEE80211_FC1_DIR_FROMDS:
  29 +                               break;
  30 +                       case IEEE80211_FC1_DIR_DSTODS:
  31 +                               if (vap->iv_flags_ext & IEEE80211_FEXT_WDS)
  32 +                                       break;
  33 +                       default:
  34                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
  35                                         wh, "data", "invalid dir 0x%x", dir);
  36                                 vap->iv_stats.is_rx_wrongdir++;
  37                                 goto out;
  38                         }
  39
  40 -                       if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
  41 +                       if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
  42 +                               /* ignore 3-addr mcast if we're WDS STA */
  43 +                               if (vap->iv_flags_ext & IEEE80211_FEXT_WDS)
  44 +                                       goto out;
  45 +
  46                                 /* Discard multicast if IFF_MULTICAST not set */
  47                                 if ((0 != memcmp(wh->i_addr3, dev->broadcast, ETH_ALEN)) &&
  48                                         (0 == (dev->flags & IFF_MULTICAST))) {
  49 @@ -494,24 +503,10 @@ ieee80211_input(struct ieee80211vap * va
  50                                         vap->iv_stats.is_rx_mcastecho++;
  51                                         goto out;
  52                                 }
  53 -                               /*
  54 -                                * if it is brodcasted by me on behalf of
  55 -                                * a station behind me, drop it.
  56 -                                */
  57 -                               if (vap->iv_flags_ext & IEEE80211_FEXT_WDS) {
  58 -                                       struct ieee80211_node_table *nt;
  59 -                                       struct ieee80211_node *ni_wds;
  60 -                                       nt = &ic->ic_sta;
  61 -                                       ni_wds = ieee80211_find_wds_node(nt, wh->i_addr3);
  62 -                                       if (ni_wds) {
  63 -                                               ieee80211_unref_node(&ni_wds);
  64 -                                               IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  65 -                                                       wh, NULL, "%s",
  66 -                                                       "multicast echo originated from node behind me");
  67 -                                               vap->iv_stats.is_rx_mcastecho++;
  68 -                                               goto out;
  69 -                                       }
  70 -                               }
  71 +                       } else {
  72 +                               /* Same BSSID, but not meant for us to receive */
  73 +                               if (!IEEE80211_ADDR_EQ(wh->i_addr1, vap->iv_myaddr))
  74 +                                       goto out;
  75                         }
  76                         break;
  77                 case IEEE80211_M_IBSS:
  78 @@ -553,14 +548,30 @@ ieee80211_input(struct ieee80211vap * va
  79                                 vap->iv_stats.is_rx_notassoc++;
  80                                 goto err;
  81                         }
  82 +
  83 +                       /* subif isn't fully set up yet, drop the frame */
  84 +                       if (ni->ni_subif == ni->ni_vap)
  85 +                               goto err;
  86 +
  87                         /*
  88                          * If we're a 4 address packet, make sure we have an entry in
  89                          * the node table for the packet source address (addr4).
  90                          * If not, add one.
  91                          */
  92 +                       /* check for wds link first */
  93 +                       if ((dir == IEEE80211_FC1_DIR_DSTODS) && !ni->ni_subif) {
  94 +                               if (vap->iv_flags_ext & IEEE80211_FEXT_WDSSEP) {
  95 +                                       ieee80211_wds_addif(ni);
  96 +                                       /* we must drop frames here until the interface has
  97 +                                        * been fully separated, otherwise a bridge might get
  98 +                                        * confused */
  99 +                                       goto err;
 100 +                               }
 101 +                       }
 102
 103                         /* XXX: Useless node mgmt API; make better */
 104 -                       if ((dir == IEEE80211_FC1_DIR_DSTODS) && !vap->iv_wdsnode && !ni_wds) {
 105 +                       if ((dir == IEEE80211_FC1_DIR_DSTODS) && !vap->iv_wdsnode &&
 106 +                                       !ni_wds && !ni->ni_subif) {
 107                                 struct ieee80211_node_table *nt = &ic->ic_sta;
 108                                 struct ieee80211_frame_addr4 *wh4;
 109
 110 @@ -620,6 +631,11 @@ ieee80211_input(struct ieee80211vap * va
 111                         goto out;
 112                 }
 113
 114 +               /* check if there is any data left */
 115 +               hdrspace = ieee80211_hdrspace(ic, wh);
 116 +               if (skb->len < hdrspace)
 117 +                       goto out;
 118 +
 119                 /*
 120                  * Handle privacy requirements.  Note that we
 121                  * must not be preempted from here until after
 122 @@ -692,8 +708,12 @@ ieee80211_input(struct ieee80211vap * va
 123                 if (! accept_data_frame(vap, ni, key, skb, eh))
 124                         goto out;
 125
 126 -               vap->iv_devstats.rx_packets++;
 127 -               vap->iv_devstats.rx_bytes += skb->len;
 128 +               if (ni->ni_subif && ((eh)->ether_type != __constant_htons(ETHERTYPE_PAE)))
 129 +                       stats = &ni->ni_subif->iv_devstats;
 130 +               else
 131 +                       stats = &vap->iv_devstats;
 132 +               stats->rx_packets++;
 133 +               stats->rx_bytes += skb->len;
 134                 IEEE80211_NODE_STAT(ni, rx_data);
 135                 IEEE80211_NODE_STAT_ADD(ni, rx_bytes, skb->len);
 136                 ic->ic_lastdata = jiffies;
 137 @@ -1126,6 +1146,13 @@ ieee80211_deliver_data(struct ieee80211_
 138                 dev = vap->iv_xrvap->iv_dev;
 139  #endif
 140
 141 +       /* if the node has a wds subif, move data frames there,
 142 +        * but keep EAP traffic on the master */
 143 +       if (ni->ni_subif && ((eh)->ether_type != __constant_htons(ETHERTYPE_PAE))) {
 144 +               vap = ni->ni_subif;
 145 +               dev = vap->iv_dev;
 146 +       }
 147 +
 148         /* perform as a bridge within the vap */
 149         /* XXX intra-vap bridging only */
 150         if (vap->iv_opmode == IEEE80211_M_HOSTAP &&
 151 @@ -1151,7 +1178,16 @@ ieee80211_deliver_data(struct ieee80211_
 152                         if (ni1 != NULL) {
 153                                 if (ni1->ni_vap == vap &&
 154                                     ieee80211_node_is_authorized(ni1) &&
 155 +                                       !ni1->ni_subif &&
 156                                     ni1 != vap->iv_bss) {
 157 +
 158 +                                       /* tried to bridge to a subif, drop the packet */
 159 +                                       if (ni->ni_subif) {
 160 +                                               ieee80211_unref_node(&ni1);
 161 +                                               ieee80211_dev_kfree_skb(&skb);
 162 +                                               return;
 163 +                                       }
 164 +
 165                                         skb1 = skb;
 166                                         skb = NULL;
 167                                 }
 168 --- a/net80211/ieee80211_ioctl.h
 169 +++ b/net80211/ieee80211_ioctl.h
 170 @@ -649,6 +649,7 @@ enum {
 171         IEEE80211_PARAM_BGSCAN_THRESH           = 79,   /* bg scan rssi threshold */
 172         IEEE80211_PARAM_RSSI_DIS_THR    = 80,   /* rssi threshold for disconnection */
 173         IEEE80211_PARAM_RSSI_DIS_COUNT  = 81,   /* counter for rssi threshold */
 174 +       IEEE80211_PARAM_WDS_SEP                 = 82,   /* move wds stations into separate interfaces */
 175  };
 176
 177  #define        SIOCG80211STATS                 (SIOCDEVPRIVATE+2)
 178 --- a/net80211/ieee80211_node.h
 179 +++ b/net80211/ieee80211_node.h
 180 @@ -92,11 +92,13 @@ struct ath_softc;
 181   * the ieee80211com structure.
 182   */
 183  struct ieee80211_node {
 184 -       struct ieee80211vap *ni_vap;
 185 +       struct ieee80211vap *ni_vap, *ni_subif;
 186         struct ieee80211com *ni_ic;
 187         struct ieee80211_node_table *ni_table;
 188         TAILQ_ENTRY(ieee80211_node) ni_list;
 189         LIST_ENTRY(ieee80211_node) ni_hash;
 190 +       struct work_struct ni_create;   /* task for creating a subif */
 191 +       struct work_struct ni_destroy;  /* task for destroying a subif */
 192         atomic_t ni_refcnt;
 193         u_int ni_scangen;                       /* gen# for timeout scan */
 194         u_int8_t ni_authmode;                   /* authentication algorithm */
 195 @@ -430,5 +432,6 @@ void ieee80211_node_join(struct ieee8021
 196  void ieee80211_node_leave(struct ieee80211_node *);
 197  u_int8_t ieee80211_getrssi(struct ieee80211com *);
 198  int32_t ieee80211_get_node_count(struct ieee80211com *);
 199 +void ieee80211_wds_addif(struct ieee80211_node *ni);
 200  #endif /* _NET80211_IEEE80211_NODE_H_ */
 201
 202 --- a/net80211/ieee80211_var.h
 203 +++ b/net80211/ieee80211_var.h
 204 @@ -322,6 +322,7 @@ struct ieee80211com {
 205         u_int8_t ic_myaddr[IEEE80211_ADDR_LEN];
 206         struct timer_list ic_inact;             /* mgmt/inactivity timer */
 207
 208 +       unsigned int ic_subifs;
 209         u_int32_t ic_flags;                     /* state flags */
 210         u_int32_t ic_flags_ext;                 /* extension of state flags */
 211         u_int32_t ic_caps;                      /* capabilities */
 212 @@ -625,6 +626,7 @@ MALLOC_DECLARE(M_80211_VAP);
 213  #define IEEE80211_FEXT_DROPUNENC_EAPOL 0x00000800      /* CONF: drop unencrypted eapol frames */
 214  #define IEEE80211_FEXT_APPIE_UPDATE    0x00001000      /* STATE: beacon APP IE updated */
 215  #define IEEE80211_FEXT_BGSCAN_THR      0x00002000      /* bgscan due to low rssi */
 216 +#define IEEE80211_FEXT_WDSSEP          0x00004000      /* move wds clients into separate interfaces */
 217
 218  #define IEEE80211_COM_UAPSD_ENABLE(_ic)                ((_ic)->ic_flags_ext |= IEEE80211_FEXT_UAPSD)
 219  #define IEEE80211_COM_UAPSD_DISABLE(_ic)       ((_ic)->ic_flags_ext &= ~IEEE80211_FEXT_UAPSD)
 220 --- a/net80211/ieee80211_wireless.c
 221 +++ b/net80211/ieee80211_wireless.c
 222 @@ -2867,6 +2867,14 @@ ieee80211_ioctl_setparam(struct net_devi
 223                 else
 224                         vap->iv_minrateindex = 0;
 225                 break;
 226 +       case IEEE80211_PARAM_WDS_SEP:
 227 +               if (vap->iv_opmode != IEEE80211_M_HOSTAP)
 228 +                       retv = -EINVAL;
 229 +               else if (value)
 230 +                       vap->iv_flags_ext |= IEEE80211_FEXT_WDSSEP;
 231 +               else
 232 +                       vap->iv_flags_ext &= ~IEEE80211_FEXT_WDSSEP;
 233 +               break;
 234  #ifdef ATH_REVERSE_ENGINEERING
 235         case IEEE80211_PARAM_DUMPREGS:
 236                 ieee80211_dump_registers(dev, info, w, extra);
 237 @@ -3223,6 +3231,9 @@ ieee80211_ioctl_getparam(struct net_devi
 238         case IEEE80211_PARAM_MINRATE:
 239                 param[0] = vap->iv_minrateindex;
 240                 break;
 241 +       case IEEE80211_PARAM_WDS_SEP:
 242 +               param[0] = !!(vap->iv_flags_ext & IEEE80211_FEXT_WDSSEP);
 243 +               break;
 244         default:
 245                 return -EOPNOTSUPP;
 246         }
 247 @@ -4450,6 +4461,8 @@ get_sta_space(void *arg, struct ieee8021
 248         struct ieee80211vap *vap = ni->ni_vap;
 249         size_t ielen;
 250
 251 +       if (req->vap->iv_wdsnode && ni->ni_subif)
 252 +               vap = ni->ni_subif;
 253         if (vap != req->vap && vap != req->vap->iv_xrvap)       /* only entries for this vap */
 254                 return;
 255         if ((vap->iv_opmode == IEEE80211_M_HOSTAP ||
 256 @@ -4469,6 +4482,8 @@ get_sta_info(void *arg, struct ieee80211
 257         size_t ielen, len;
 258         u_int8_t *cp;
 259
 260 +       if (req->vap->iv_wdsnode && ni->ni_subif)
 261 +               vap = ni->ni_subif;
 262         if (vap != req->vap && vap != req->vap->iv_xrvap)       /* only entries for this vap (or) xrvap */
 263                 return;
 264         if ((vap->iv_opmode == IEEE80211_M_HOSTAP ||
 265 @@ -5770,6 +5785,10 @@ static const struct iw_priv_args ieee802
 266          0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "get_minrate"},
 267         { IEEE80211_IOCTL_SETSCANLIST,
 268          IW_PRIV_TYPE_CHAR | 255, 0, "setscanlist"},
 269 +       { IEEE80211_PARAM_WDS_SEP,
 270 +        IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "wdssep"},
 271 +       { IEEE80211_PARAM_WDS_SEP,
 272 +        0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "get_wdssep"},
 273
 274  #ifdef ATH_REVERSE_ENGINEERING
 275         /*
 276 @@ -5893,6 +5912,8 @@ static int
 277  ieee80211_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 278  {
 279         struct ieee80211vap *vap = dev->priv;
 280 +       struct ieee80211com *ic = vap->iv_ic;
 281 +       struct ieee80211_node *ni;
 282
 283         switch (cmd) {
 284         case SIOCG80211STATS:
 285 @@ -5901,8 +5922,20 @@ ieee80211_ioctl(struct net_device *dev,
 286         case SIOC80211IFDESTROY:
 287                 if (!capable(CAP_NET_ADMIN))
 288                         return -EPERM;
 289 +               /* drop all node subifs */
 290 +               TAILQ_FOREACH(ni, &ic->ic_sta.nt_node, ni_list) {
 291 +                       struct ieee80211vap *avp = ni->ni_subif;
 292 +
 293 +                       if (ni->ni_vap != vap)
 294 +                               continue;
 295 +                       if (!avp)
 296 +                               continue;
 297 +                       ni->ni_subif = NULL;
 298 +                       ieee80211_stop(avp->iv_dev);
 299 +                       ic->ic_vap_delete(avp);
 300 +               }
 301                 ieee80211_stop(vap->iv_dev);    /* force state before cleanup */
 302 -               vap->iv_ic->ic_vap_delete(vap);
 303 +               ic->ic_vap_delete(vap);
 304                 return 0;
 305         case IEEE80211_IOCTL_GETKEY:
 306                 return ieee80211_ioctl_getkey(dev, (struct iwreq *) ifr);
 307 --- a/net80211/ieee80211_node.c
 308 +++ b/net80211/ieee80211_node.c
 309 @@ -47,6 +47,7 @@
 310  #include <linux/netdevice.h>
 311  #include <linux/etherdevice.h>
 312  #include <linux/random.h>
 313 +#include <linux/rtnetlink.h>
 314
 315  #include "if_media.h"
 316
 317 @@ -236,7 +237,11 @@ void
 318  ieee80211_node_vdetach(struct ieee80211vap *vap)
 319  {
 320         struct ieee80211com *ic = vap->iv_ic;
 321 +       struct ieee80211_node *ni;
 322
 323 +       ni = vap->iv_wdsnode;
 324 +       if (ni)
 325 +               ni->ni_subif = NULL;
 326         ieee80211_node_table_reset(&ic->ic_sta, vap);
 327         if (vap->iv_bss != NULL) {
 328                 ieee80211_unref_node(&vap->iv_bss);
 329 @@ -1140,6 +1145,57 @@ ieee80211_alloc_node(struct ieee80211vap
 330         return ni;
 331  }
 332
 333 +#define WDSIFNAME ".sta%d"
 334 +static void
 335 +ieee80211_wds_do_addif(struct work_struct *work)
 336 +{
 337 +       struct ieee80211_node *ni = container_of(work, struct ieee80211_node, ni_create);
 338 +       struct ieee80211vap *vap = ni->ni_vap;
 339 +       struct ieee80211com *ic = vap->iv_ic;
 340 +       struct ieee80211vap *avp;
 341 +       char *name;
 342 +
 343 +       rtnl_lock();
 344 +       /* did we get cancelled by the destroy call? */
 345 +       if (!ni->ni_subif)
 346 +               goto done;
 347 +
 348 +       ni->ni_subif = NULL;
 349 +       name = kmalloc(strlen(vap->iv_dev->name) + sizeof(WDSIFNAME) + 1, GFP_KERNEL);
 350 +       if (!name)
 351 +               goto done;
 352 +
 353 +       strcpy(name, vap->iv_dev->name);
 354 +       strcat(name, WDSIFNAME);
 355 +       avp = ieee80211_create_vap(ic, name, ic->ic_dev, IEEE80211_M_WDS, 0, vap);
 356 +       kfree(name);
 357 +       if (!avp)
 358 +               goto done;
 359 +
 360 +       memcpy(avp->wds_mac, ni->ni_bssid, IEEE80211_ADDR_LEN);
 361 +       avp->iv_wdsnode = ieee80211_ref_node(ni);
 362 +       ni->ni_subif = avp;
 363 +       ic->ic_subifs++;
 364 +
 365 +done:
 366 +       rtnl_unlock();
 367 +       ieee80211_unref_node(&ni);
 368 +}
 369 +#undef WDSIFNAME
 370 +
 371 +void ieee80211_wds_addif(struct ieee80211_node *ni)
 372 +{
 373 +       /* check if the node is split out already,
 374 +        * or if we're in progress of setting up a new interface already */
 375 +       if (ni->ni_subif)
 376 +               return;
 377 +
 378 +       ieee80211_ref_node(ni);
 379 +       ni->ni_subif = ni->ni_vap;
 380 +       IEEE80211_INIT_WORK(&ni->ni_create, ieee80211_wds_do_addif);
 381 +       schedule_work(&ni->ni_create);
 382 +}
 383 +
 384  /* Add wds address to the node table */
 385  int
 386  #ifdef IEEE80211_DEBUG_REFCNT
 387 @@ -2285,6 +2341,36 @@ ieee80211_node_leave_11g(struct ieee8021
 388         }
 389  }
 390
 391 +static void
 392 +ieee80211_subif_destroy(struct work_struct *work)
 393 +{
 394 +       struct ieee80211_node *ni = container_of(work, struct ieee80211_node, ni_destroy);
 395 +       struct ieee80211vap *vap;
 396 +       struct ieee80211com *ic;
 397 +
 398 +       rtnl_lock();
 399 +       vap = ni->ni_subif;
 400 +
 401 +       /* if addif is waiting for the timer to fire, cancel! */
 402 +       if (vap == ni->ni_vap) {
 403 +               ni->ni_subif = NULL;
 404 +               goto done;
 405 +       }
 406 +
 407 +       if (!vap)
 408 +               goto done;
 409 +
 410 +       ic = vap->iv_ic;
 411 +       ni->ni_subif = NULL;
 412 +       ieee80211_stop(vap->iv_dev);
 413 +       ic->ic_vap_delete(vap);
 414 +       ic->ic_subifs--;
 415 +
 416 +done:
 417 +       ieee80211_unref_node(&ni);
 418 +       rtnl_unlock();
 419 +}
 420 +
 421  /*
 422   * Handle bookkeeping for a station/neighbor leaving
 423   * the bss when operating in ap or adhoc modes.
 424 @@ -2301,6 +2387,12 @@ ieee80211_node_leave(struct ieee80211_no
 425                         ni, "station with aid %d leaves (refcnt %u)",
 426                         IEEE80211_NODE_AID(ni), atomic_read(&ni->ni_refcnt));
 427
 428 +       if (ni->ni_subif) {
 429 +               ieee80211_ref_node(ni);
 430 +               IEEE80211_INIT_WORK(&ni->ni_destroy, ieee80211_subif_destroy);
 431 +               schedule_work(&ni->ni_destroy);
 432 +       }
 433 +
 434         /* From this point onwards we can no longer find the node,
 435          * so no more references are generated
 436          */
 437 --- a/net80211/ieee80211_linux.h
 438 +++ b/net80211/ieee80211_linux.h
 439 @@ -81,6 +81,12 @@ set_quality(struct iw_quality *iq, u_int
 440  #endif
 441  }
 442
 443 +#ifndef container_of
 444 +#define container_of(ptr, type, member) ({          \
 445 +    const typeof( ((type *)0)->member ) *__mptr = (ptr);    \
 446 +           (type *)( (char *)__mptr - offsetof(type,member) );})
 447 +#endif
 448 +
 449  /*
 450   * Task deferral
 451   *
 452 @@ -113,6 +119,29 @@ typedef void *IEEE80211_TQUEUE_ARG;
 453
 454  #define        IEEE80211_RESCHEDULE    schedule
 455
 456 +#include <linux/sched.h>
 457 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,41)
 458 +#include <linux/tqueue.h>
 459 +#define work_struct                    tq_struct
 460 +#define schedule_work(t)               schedule_task((t))
 461 +#define flush_scheduled_work()         flush_scheduled_tasks()
 462 +#define IEEE80211_INIT_WORK(t, f) do {                         \
 463 +       memset((t), 0, sizeof(struct tq_struct)); \
 464 +       (t)->routine = (void (*)(void*)) (f);   \
 465 +       (t)->data=(void *) (t);                 \
 466 +} while (0)
 467 +#else
 468 +#include <linux/workqueue.h>
 469 +
 470 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20)
 471 +#define IEEE80211_INIT_WORK(_t, _f)    INIT_WORK((_t), (void (*)(void *))(_f), (_t));
 472 +#else
 473 +#define IEEE80211_INIT_WORK(_t, _f)    INIT_WORK((_t), (_f));
 474 +#endif
 475 +
 476 +#endif /* KERNEL_VERSION < 2.5.41 */
 477 +
 478 +
 479  /* Locking */
 480  /* NB: beware, spin_is_locked() is not usefully defined for !(DEBUG || SMP)
 481   * because spinlocks do not exist in this configuration. Instead IRQs
 482 --- a/net80211/ieee80211_proto.c
 483 +++ b/net80211/ieee80211_proto.c
 484 @@ -1081,6 +1081,8 @@ ieee80211_init(struct net_device *dev, i
 485  int
 486  ieee80211_open(struct net_device *dev)
 487  {
 488 +       struct ieee80211vap *vap = dev->priv;
 489 +
 490         return ieee80211_init(dev, 0);
 491  }
 492
 493 @@ -1123,6 +1125,7 @@ ieee80211_stop(struct net_device *dev)
 494         struct ieee80211vap *vap = dev->priv;
 495         struct ieee80211com *ic = vap->iv_ic;
 496         struct net_device *parent = ic->ic_dev;
 497 +       struct ieee80211_node *tni, *ni;
 498         struct ieee80211vap *avp;
 499
 500         IEEE80211_DPRINTF(vap,
 501 @@ -1138,6 +1141,27 @@ ieee80211_stop(struct net_device *dev)
 502                         ieee80211_stop(avp->iv_dev);
 503         }
 504
 505 +       /* get rid of all wds nodes while we're still locked */
 506 +       do {
 507 +               ni = NULL;
 508 +
 509 +               IEEE80211_NODE_TABLE_LOCK_IRQ(&ic->ic_sta);
 510 +               TAILQ_FOREACH(tni, &ic->ic_sta.nt_node, ni_list) {
 511 +                       if (tni->ni_vap != vap)
 512 +                               continue;
 513 +                       if (!tni->ni_subif)
 514 +                               continue;
 515 +                       ni = tni;
 516 +                       break;
 517 +               }
 518 +               IEEE80211_NODE_TABLE_UNLOCK_IRQ(&ic->ic_sta);
 519 +
 520 +               if (!ni)
 521 +                       break;
 522 +
 523 +               ieee80211_node_leave(ni);
 524 +       } while (1);
 525 +
 526         ieee80211_new_state(vap, IEEE80211_S_INIT, -1);
 527         if (dev->flags & IFF_RUNNING) {
 528                 dev->flags &= ~IFF_RUNNING;             /* mark us stopped */
 529 @@ -1653,6 +1677,7 @@ __ieee80211_newstate(struct ieee80211vap
 530                  */
 531                 if (ni->ni_authmode != IEEE80211_AUTH_8021X)
 532                         ieee80211_node_authorize(ni);
 533 +
 534  #ifdef ATH_SUPERG_XR
 535                 /*
 536                  * fire a timer to bring up XR vap if configured.
 537 @@ -1912,8 +1937,15 @@ ieee80211_newstate(struct ieee80211vap *
 538                 if (ostate == IEEE80211_S_SCAN ||
 539                     ostate == IEEE80211_S_AUTH ||
 540                     ostate == IEEE80211_S_ASSOC) {
 541 +
 542                         /* Transition (S_SCAN|S_AUTH|S_ASSOC) -> S_RUN */
 543                         __ieee80211_newstate(vap, nstate, arg);
 544 +
 545 +                       /* if we're in wds, let the ap know that we're doing this */
 546 +                       if ((vap->iv_opmode == IEEE80211_M_STA) &&
 547 +                               (vap->iv_flags_ext & IEEE80211_FEXT_WDS))
 548 +                                       ieee80211_send_nulldata(ieee80211_ref_node(vap->iv_bss));
 549 +
 550                         /* Then bring up all other vaps pending on the scan */
 551                         dstate = get_dominant_state(ic);
 552                         if (dstate == IEEE80211_S_RUN) {
 553 --- a/net80211/ieee80211.c
 554 +++ b/net80211/ieee80211.c
 555 @@ -373,10 +373,25 @@ void
 556  ieee80211_ifdetach(struct ieee80211com *ic)
 557  {
 558         struct ieee80211vap *vap;
 559 +       int count;
 560 +
 561 +       /* bring down all vaps */
 562 +       TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
 563 +               ieee80211_stop(vap->iv_dev);
 564 +       }
 565 +
 566 +       /* wait for all subifs to disappear */
 567 +       do {
 568 +               schedule();
 569 +               rtnl_lock();
 570 +               count = ic->ic_subifs;
 571 +               rtnl_unlock();
 572 +       } while (count > 0);
 573
 574         rtnl_lock();
 575 -       while ((vap = TAILQ_FIRST(&ic->ic_vaps)) != NULL)
 576 +       while ((vap = TAILQ_FIRST(&ic->ic_vaps)) != NULL) {
 577                 ic->ic_vap_delete(vap);
 578 +       }
 579         rtnl_unlock();
 580
 581         del_timer(&ic->ic_dfs_excl_timer);
 582 @@ -600,8 +615,10 @@ ieee80211_vap_detach(struct ieee80211vap
 583
 584         IEEE80211_CANCEL_TQUEUE(&vap->iv_stajoin1tq);
 585         IEEE80211_LOCK_IRQ(ic);
 586 -       if (vap->iv_wdsnode)
 587 +       if (vap->iv_wdsnode) {
 588 +               vap->iv_wdsnode->ni_subif = NULL;
 589                 ieee80211_unref_node(&vap->iv_wdsnode);
 590 +       }
 591         if ((vap->iv_opmode == IEEE80211_M_WDS) &&
 592                 (vap->iv_master != NULL))
 593                 TAILQ_REMOVE(&vap->iv_master->iv_wdslinks, vap, iv_wdsnext);
 594 --- a/ath/if_athvar.h
 595 +++ b/ath/if_athvar.h
 596 @@ -79,28 +79,6 @@ typedef void *TQUEUE_ARG;
 597  #define        tasklet_enable(t)       do { (void) t; local_bh_enable(); } while (0)
 598  #endif /* !DECLARE_TASKLET */
 599
 600 -#include <linux/sched.h>
 601 -#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,41)
 602 -#include <linux/tqueue.h>
 603 -#define work_struct                    tq_struct
 604 -#define schedule_work(t)               schedule_task((t))
 605 -#define flush_scheduled_work()         flush_scheduled_tasks()
 606 -#define ATH_INIT_WORK(t, f) do {                       \
 607 -       memset((t), 0, sizeof(struct tq_struct)); \
 608 -       (t)->routine = (void (*)(void*)) (f);   \
 609 -       (t)->data=(void *) (t);                 \
 610 -} while (0)
 611 -#else
 612 -#include <linux/workqueue.h>
 613 -
 614 -#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20)
 615 -#define ATH_INIT_WORK(_t, _f)  INIT_WORK((_t), (void (*)(void *))(_f), (_t));
 616 -#else
 617 -#define ATH_INIT_WORK(_t, _f)  INIT_WORK((_t), (_f));
 618 -#endif
 619 -
 620 -#endif /* KERNEL_VERSION < 2.5.41 */
 621 -
 622  /*
 623   * Guess how the interrupt handler should work.
 624   */
 625 --- a/net80211/ieee80211_output.c
 626 +++ b/net80211/ieee80211_output.c
 627 @@ -252,6 +252,10 @@ ieee80211_hardstart(struct sk_buff *skb,
 628                 goto bad;
 629         }
 630
 631 +       if (ni->ni_subif && (vap != ni->ni_subif) &&
 632 +               ((eh)->ether_type != __constant_htons(ETHERTYPE_PAE)))
 633 +               goto bad;
 634 +
 635         /* calculate priority so drivers can find the TX queue */
 636         if (ieee80211_classify(ni, skb)) {
 637                 IEEE80211_NOTE(vap, IEEE80211_MSG_OUTPUT, ni,
 638 @@ -331,20 +335,33 @@ void ieee80211_parent_queue_xmit(struct
 639   * constructing a frame as it sets i_fc[1]; other bits can
 640   * then be or'd in.
 641   */
 642 -static void
 643 +static struct ieee80211_frame *
 644  ieee80211_send_setup(struct ieee80211vap *vap,
 645         struct ieee80211_node *ni,
 646 -       struct ieee80211_frame *wh,
 647 +       struct sk_buff *skb,
 648         int type,
 649         const u_int8_t sa[IEEE80211_ADDR_LEN],
 650         const u_int8_t da[IEEE80211_ADDR_LEN],
 651         const u_int8_t bssid[IEEE80211_ADDR_LEN])
 652  {
 653  #define        WH4(wh) ((struct ieee80211_frame_addr4 *)wh)
 654 +       struct ieee80211_frame *wh;
 655 +       int len = sizeof(struct ieee80211_frame);
 656 +       int opmode = vap->iv_opmode;
 657 +
 658 +       if ((type & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_DATA) {
 659 +               if ((opmode == IEEE80211_M_STA) &&
 660 +                       (vap->iv_flags_ext & IEEE80211_FEXT_WDS))
 661 +                       opmode = IEEE80211_M_WDS;
 662 +
 663 +               if (opmode == IEEE80211_M_WDS)
 664 +                       len = sizeof(struct ieee80211_frame_addr4);
 665 +       }
 666
 667 +       wh = (struct ieee80211_frame *)skb_push(skb, len);
 668         wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | type;
 669         if ((type & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_DATA) {
 670 -               switch (vap->iv_opmode) {
 671 +               switch (opmode) {
 672                 case IEEE80211_M_STA:
 673                         wh->i_fc[1] = IEEE80211_FC1_DIR_TODS;
 674                         IEEE80211_ADDR_COPY(wh->i_addr1, bssid);
 675 @@ -386,6 +403,8 @@ ieee80211_send_setup(struct ieee80211vap
 676         *(__le16 *)&wh->i_seq[0] =
 677             htole16(ni->ni_txseqs[0] << IEEE80211_SEQ_SEQ_SHIFT);
 678         ni->ni_txseqs[0]++;
 679 +
 680 +       return wh;
 681  #undef WH4
 682  }
 683
 684 @@ -407,9 +426,7 @@ ieee80211_mgmt_output(struct ieee80211_n
 685
 686         SKB_CB(skb)->ni = ni;
 687
 688 -       wh = (struct ieee80211_frame *)
 689 -               skb_push(skb, sizeof(struct ieee80211_frame));
 690 -       ieee80211_send_setup(vap, ni, wh,
 691 +       wh = ieee80211_send_setup(vap, ni, skb,
 692                 IEEE80211_FC0_TYPE_MGT | type,
 693                 vap->iv_myaddr, ni->ni_macaddr, vap->iv_bssid);
 694         /* XXX power management */
 695 @@ -455,6 +472,9 @@ ieee80211_send_nulldata(struct ieee80211
 696         struct ieee80211_frame *wh;
 697         u_int8_t *frm;
 698
 699 +       if (ni->ni_subif)
 700 +               vap = ni->ni_subif;
 701 +
 702         skb = ieee80211_getmgtframe(&frm, 0);
 703         if (skb == NULL) {
 704                 /* XXX debug msg */
 705 @@ -463,9 +483,7 @@ ieee80211_send_nulldata(struct ieee80211
 706                 return -ENOMEM;
 707         }
 708
 709 -       wh = (struct ieee80211_frame *)
 710 -               skb_push(skb, sizeof(struct ieee80211_frame));
 711 -       ieee80211_send_setup(vap, ni, wh,
 712 +       wh = ieee80211_send_setup(vap, ni, skb,
 713                 IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_NODATA,
 714                 vap->iv_myaddr, ni->ni_macaddr, vap->iv_bssid);
 715         /* NB: power management bit is never sent by an AP */
 716 @@ -503,6 +521,7 @@ ieee80211_send_qosnulldata(struct ieee80
 717         struct sk_buff *skb;
 718         struct ieee80211_qosframe *qwh;
 719         u_int8_t *frm;
 720 +       u_int8_t *i_qos;
 721         int tid;
 722
 723         skb = ieee80211_getmgtframe(&frm, 2);
 724 @@ -514,11 +533,12 @@ ieee80211_send_qosnulldata(struct ieee80
 725         SKB_CB(skb)->ni = ieee80211_ref_node(ni);
 726
 727         skb->priority = ac;
 728 -       qwh = (struct ieee80211_qosframe *)skb_push(skb, sizeof(struct ieee80211_qosframe));
 729
 730 -       qwh = (struct ieee80211_qosframe *)skb->data;
 731 +       /* grab a pointer to QoS control and also compensate for the header length
 732 +        * difference between QoS and non-QoS frame */
 733 +       i_qos = skb_push(skb, sizeof(struct ieee80211_qosframe) - sizeof(struct ieee80211_frame));
 734
 735 -       ieee80211_send_setup(vap, ni, (struct ieee80211_frame *)qwh,
 736 +       qwh = (struct ieee80211_qosframe *) ieee80211_send_setup(vap, ni, skb,
 737                 IEEE80211_FC0_TYPE_DATA,
 738                 vap->iv_myaddr, /* SA */
 739                 ni->ni_macaddr, /* DA */
 740 @@ -532,10 +552,10 @@ ieee80211_send_qosnulldata(struct ieee80
 741
 742         /* map from access class/queue to 11e header priority value */
 743         tid = WME_AC_TO_TID(ac);
 744 -       qwh->i_qos[0] = tid & IEEE80211_QOS_TID;
 745 +       i_qos[0] = tid & IEEE80211_QOS_TID;
 746         if (ic->ic_wme.wme_wmeChanParams.cap_wmeParams[ac].wmep_noackPolicy)
 747                 qwh->i_qos[0] |= (1 << IEEE80211_QOS_ACKPOLICY_S) & IEEE80211_QOS_ACKPOLICY;
 748 -       qwh->i_qos[1] = 0;
 749 +       i_qos[1] = 0;
 750
 751         IEEE80211_NODE_STAT(ni, tx_data);
 752
 753 @@ -777,6 +797,8 @@ ieee80211_encap(struct ieee80211_node *n
 754                 hdrsize = sizeof(struct ieee80211_frame);
 755
 756         SKB_CB(skb)->auth_pkt = (eh.ether_type == __constant_htons(ETHERTYPE_PAE));
 757 +       if (ni->ni_subif)
 758 +               vap = ni->ni_subif;
 759
 760         switch (vap->iv_opmode) {
 761         case IEEE80211_M_IBSS:
 762 @@ -796,20 +818,9 @@ ieee80211_encap(struct ieee80211_node *n
 763                         ismulticast = IEEE80211_IS_MULTICAST(eh.ether_dhost);
 764                 break;
 765         case IEEE80211_M_STA:
 766 -               if ((vap->iv_flags_ext & IEEE80211_FEXT_WDS) &&
 767 -                   !IEEE80211_ADDR_EQ(eh.ether_shost, vap->iv_myaddr)) {
 768 +               if (vap->iv_flags_ext & IEEE80211_FEXT_WDS) {
 769                         use4addr = 1;
 770 -                       ismulticast = IEEE80211_IS_MULTICAST(ni->ni_macaddr);
 771 -                       /* Add a WDS entry to the station VAP */
 772 -                       if (IEEE80211_IS_MULTICAST(eh.ether_dhost)) {
 773 -                               struct ieee80211_node_table *nt = &ic->ic_sta;
 774 -                               struct ieee80211_node *ni_wds
 775 -                                       = ieee80211_find_wds_node(nt, eh.ether_shost);
 776 -                               if (ni_wds)
 777 -                                       ieee80211_unref_node(&ni_wds);
 778 -                               else
 779 -                                       ieee80211_add_wds_addr(nt, ni, eh.ether_shost, 0);
 780 -                       }
 781 +                       ismulticast = 0;
 782                 } else
 783                         ismulticast = IEEE80211_IS_MULTICAST(vap->iv_bssid);
 784                 break;
 785 @@ -1680,9 +1691,7 @@ ieee80211_send_probereq(struct ieee80211
 786
 787         SKB_CB(skb)->ni = ieee80211_ref_node(ni);
 788
 789 -       wh = (struct ieee80211_frame *)
 790 -               skb_push(skb, sizeof(struct ieee80211_frame));
 791 -       ieee80211_send_setup(vap, ni, wh,
 792 +       wh = ieee80211_send_setup(vap, ni, skb,
 793                 IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_REQ,
 794                 sa, da, bssid);
 795         /* XXX power management? */
 796 --- a/net80211/ieee80211_linux.c
 797 +++ b/net80211/ieee80211_linux.c
 798 @@ -145,7 +145,7 @@ ieee80211_getmgtframe(u_int8_t **frm, u_
 799         struct sk_buff *skb;
 800         u_int len;
 801
 802 -       len = roundup(sizeof(struct ieee80211_frame) + pktlen, 4);
 803 +       len = roundup(sizeof(struct ieee80211_frame_addr4) + pktlen, 4);
 804  #ifdef IEEE80211_DEBUG_REFCNT
 805         skb = ieee80211_dev_alloc_skb_debug(len + align - 1, func, line);
 806  #else
 807 @@ -161,7 +161,7 @@ ieee80211_getmgtframe(u_int8_t **frm, u_
 808                 SKB_CB(skb)->flags = 0;
 809                 SKB_CB(skb)->next = NULL;
 810
 811 -               skb_reserve(skb, sizeof(struct ieee80211_frame));
 812 +               skb_reserve(skb, sizeof(struct ieee80211_frame_addr4));
 813                 *frm = skb_put(skb, pktlen);
 814         }
 815         return skb;