package/madwifi/patches/371-wds_sta_separation.patch

   1 --- a/net80211/ieee80211_input.c
   2 +++ b/net80211/ieee80211_input.c
   3 @@ -202,6 +202,7 @@
   4         struct ieee80211com *ic = vap->iv_ic;
   5         struct net_device *dev = vap->iv_dev;
   6         struct ieee80211_node *ni_wds = NULL;
   7 +       struct net_device_stats *stats;
   8         struct ieee80211_frame *wh;
   9         struct ieee80211_key *key;
  10         struct ether_header *eh;
  11 @@ -435,7 +436,7 @@
  12
  13         switch (type) {
  14         case IEEE80211_FC0_TYPE_DATA:
  15 -               hdrspace = ieee80211_hdrspace(ic, wh);
  16 +               hdrspace = ieee80211_hdrsize(wh);
  17                 if (skb->len < hdrspace) {
  18                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
  19                                 wh, "data", "too short: len %u, expecting %u",
  20 @@ -445,16 +446,24 @@
  21                 }
  22                 switch (vap->iv_opmode) {
  23                 case IEEE80211_M_STA:
  24 -                       if ((dir != IEEE80211_FC1_DIR_FROMDS) &&
  25 -                           (!((vap->iv_flags_ext & IEEE80211_FEXT_WDS) &&
  26 -                           (dir == IEEE80211_FC1_DIR_DSTODS)))) {
  27 +                       switch(dir) {
  28 +                       case IEEE80211_FC1_DIR_FROMDS:
  29 +                               break;
  30 +                       case IEEE80211_FC1_DIR_DSTODS:
  31 +                               if (vap->iv_flags_ext & IEEE80211_FEXT_WDS)
  32 +                                       break;
  33 +                       default:
  34                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
  35                                         wh, "data", "invalid dir 0x%x", dir);
  36                                 vap->iv_stats.is_rx_wrongdir++;
  37                                 goto out;
  38                         }
  39
  40 -                       if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
  41 +                       if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
  42 +                               /* ignore 3-addr mcast if we're WDS STA */
  43 +                               if (vap->iv_flags_ext & IEEE80211_FEXT_WDS)
  44 +                                       goto out;
  45 +
  46                                 /* Discard multicast if IFF_MULTICAST not set */
  47                                 if ((0 != memcmp(wh->i_addr3, dev->broadcast, ETH_ALEN)) &&
  48                                         (0 == (dev->flags & IFF_MULTICAST))) {
  49 @@ -482,24 +491,10 @@
  50                                         vap->iv_stats.is_rx_mcastecho++;
  51                                         goto out;
  52                                 }
  53 -                               /*
  54 -                                * if it is brodcasted by me on behalf of
  55 -                                * a station behind me, drop it.
  56 -                                */
  57 -                               if (vap->iv_flags_ext & IEEE80211_FEXT_WDS) {
  58 -                                       struct ieee80211_node_table *nt;
  59 -                                       struct ieee80211_node *ni_wds;
  60 -                                       nt = &ic->ic_sta;
  61 -                                       ni_wds = ieee80211_find_wds_node(nt, wh->i_addr3);
  62 -                                       if (ni_wds) {
  63 -                                               ieee80211_unref_node(&ni_wds);
  64 -                                               IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  65 -                                                       wh, NULL, "%s",
  66 -                                                       "multicast echo originated from node behind me");
  67 -                                               vap->iv_stats.is_rx_mcastecho++;
  68 -                                               goto out;
  69 -                                       }
  70 -                               }
  71 +                       } else {
  72 +                               /* Same BSSID, but not meant for us to receive */
  73 +                               if (!IEEE80211_ADDR_EQ(wh->i_addr1, vap->iv_myaddr))
  74 +                                       goto out;
  75                         }
  76                         break;
  77                 case IEEE80211_M_IBSS:
  78 @@ -541,6 +536,11 @@
  79                                 vap->iv_stats.is_rx_notassoc++;
  80                                 goto err;
  81                         }
  82 +
  83 +                       /* subif isn't fully set up yet, drop the frame */
  84 +                       if (ni->ni_subif == ni->ni_vap)
  85 +                               goto err;
  86 +
  87                         /*
  88                          * If we're a 4 address packet, make sure we have an entry in
  89                          * the node table for the packet source address (addr4).
  90 @@ -548,9 +548,16 @@
  91                          */
  92
  93                         /* check for wds link first */
  94 -                       if (dir == IEEE80211_FC1_DIR_DSTODS) {
  95 +                       if ((dir == IEEE80211_FC1_DIR_DSTODS) && !ni->ni_subif) {
  96                                 struct ieee80211vap *avp;
  97
  98 +                               if (vap->iv_flags_ext & IEEE80211_FEXT_WDSSEP) {
  99 +                                       ieee80211_wds_addif(ni);
 100 +                                       /* we must drop frames here until the interface has
 101 +                                        * been fully separated, otherwise a bridge might get
 102 +                                        * confused */
 103 +                                       goto err;
 104 +                               }
 105                                 TAILQ_FOREACH(avp, &vap->iv_wdslinks, iv_wdsnext) {
 106                                         if (!memcmp(avp->wds_mac, wh->i_addr2, IEEE80211_ADDR_LEN)) {
 107                                                 IEEE80211_LOCK_IRQ(ni->ni_ic);
 108 @@ -566,7 +573,7 @@
 109                         }
 110
 111                         /* XXX: Useless node mgmt API; make better */
 112 -                       if ((dir == IEEE80211_FC1_DIR_DSTODS) && !ni_wds) {
 113 +                       if ((dir == IEEE80211_FC1_DIR_DSTODS) && !ni_wds && !ni->ni_subif) {
 114                                 struct ieee80211_node_table *nt = &ic->ic_sta;
 115                                 struct ieee80211_frame_addr4 *wh4;
 116
 117 @@ -626,6 +633,11 @@
 118                         goto out;
 119                 }
 120
 121 +               /* check if there is any data left */
 122 +               hdrspace = ieee80211_hdrspace(ic, wh);
 123 +               if (skb->len < hdrspace)
 124 +                       goto out;
 125 +
 126                 /*
 127                  * Handle privacy requirements.  Note that we
 128                  * must not be preempted from here until after
 129 @@ -698,8 +710,12 @@
 130                 if (! accept_data_frame(vap, ni, key, skb, eh))
 131                         goto out;
 132
 133 -               vap->iv_devstats.rx_packets++;
 134 -               vap->iv_devstats.rx_bytes += skb->len;
 135 +               if (ni->ni_subif && ((eh)->ether_type != __constant_htons(ETHERTYPE_PAE)))
 136 +                       stats = &ni->ni_subif->iv_devstats;
 137 +               else
 138 +                       stats = &vap->iv_devstats;
 139 +               stats->rx_packets++;
 140 +               stats->rx_bytes += skb->len;
 141                 IEEE80211_NODE_STAT(ni, rx_data);
 142                 IEEE80211_NODE_STAT_ADD(ni, rx_bytes, skb->len);
 143                 ic->ic_lastdata = jiffies;
 144 @@ -1132,6 +1148,13 @@
 145                 dev = vap->iv_xrvap->iv_dev;
 146  #endif
 147
 148 +       /* if the node has a wds subif, move data frames there,
 149 +        * but keep EAP traffic on the master */
 150 +       if (ni->ni_subif && ((eh)->ether_type != __constant_htons(ETHERTYPE_PAE))) {
 151 +               vap = ni->ni_subif;
 152 +               dev = vap->iv_dev;
 153 +       }
 154 +
 155         /* perform as a bridge within the vap */
 156         /* XXX intra-vap bridging only */
 157         if (vap->iv_opmode == IEEE80211_M_HOSTAP &&
 158 @@ -1157,7 +1180,16 @@
 159                         if (ni1 != NULL) {
 160                                 if (ni1->ni_vap == vap &&
 161                                     ieee80211_node_is_authorized(ni1) &&
 162 +                                       !ni1->ni_subif &&
 163                                     ni1 != vap->iv_bss) {
 164 +
 165 +                                       /* tried to bridge to a subif, drop the packet */
 166 +                                       if (ni->ni_subif) {
 167 +                                               ieee80211_unref_node(&ni1);
 168 +                                               ieee80211_dev_kfree_skb(&skb);
 169 +                                               return;
 170 +                                       }
 171 +
 172                                         skb1 = skb;
 173                                         skb = NULL;
 174                                 }
 175 --- a/net80211/ieee80211_ioctl.h
 176 +++ b/net80211/ieee80211_ioctl.h
 177 @@ -649,6 +649,7 @@
 178         IEEE80211_PARAM_BGSCAN_THRESH           = 79,   /* bg scan rssi threshold */
 179         IEEE80211_PARAM_RSSI_DIS_THR    = 80,   /* rssi threshold for disconnection */
 180         IEEE80211_PARAM_RSSI_DIS_COUNT  = 81,   /* counter for rssi threshold */
 181 +       IEEE80211_PARAM_WDS_SEP                 = 82,   /* move wds stations into separate interfaces */
 182  };
 183
 184  #define        SIOCG80211STATS                 (SIOCDEVPRIVATE+2)
 185 --- a/net80211/ieee80211_node.h
 186 +++ b/net80211/ieee80211_node.h
 187 @@ -92,11 +92,13 @@
 188   * the ieee80211com structure.
 189   */
 190  struct ieee80211_node {
 191 -       struct ieee80211vap *ni_vap;
 192 +       struct ieee80211vap *ni_vap, *ni_subif;
 193         struct ieee80211com *ni_ic;
 194         struct ieee80211_node_table *ni_table;
 195         TAILQ_ENTRY(ieee80211_node) ni_list;
 196         LIST_ENTRY(ieee80211_node) ni_hash;
 197 +       struct work_struct ni_create;   /* task for creating a subif */
 198 +       struct work_struct ni_destroy;  /* task for destroying a subif */
 199         atomic_t ni_refcnt;
 200         u_int ni_scangen;                       /* gen# for timeout scan */
 201         u_int8_t ni_authmode;                   /* authentication algorithm */
 202 @@ -430,5 +432,6 @@
 203  void ieee80211_node_leave(struct ieee80211_node *);
 204  u_int8_t ieee80211_getrssi(struct ieee80211com *);
 205  int32_t ieee80211_get_node_count(struct ieee80211com *);
 206 +void ieee80211_wds_addif(struct ieee80211_node *ni);
 207  #endif /* _NET80211_IEEE80211_NODE_H_ */
 208
 209 --- a/net80211/ieee80211_var.h
 210 +++ b/net80211/ieee80211_var.h
 211 @@ -322,6 +322,7 @@
 212         u_int8_t ic_myaddr[IEEE80211_ADDR_LEN];
 213         struct timer_list ic_inact;             /* mgmt/inactivity timer */
 214
 215 +       unsigned int ic_subifs;
 216         u_int32_t ic_flags;                     /* state flags */
 217         u_int32_t ic_flags_ext;                 /* extension of state flags */
 218         u_int32_t ic_caps;                      /* capabilities */
 219 @@ -625,6 +626,7 @@
 220  #define IEEE80211_FEXT_DROPUNENC_EAPOL 0x00000800      /* CONF: drop unencrypted eapol frames */
 221  #define IEEE80211_FEXT_APPIE_UPDATE    0x00001000      /* STATE: beacon APP IE updated */
 222  #define IEEE80211_FEXT_BGSCAN_THR      0x00002000      /* bgscan due to low rssi */
 223 +#define IEEE80211_FEXT_WDSSEP          0x00004000      /* move wds clients into separate interfaces */
 224
 225  #define IEEE80211_COM_UAPSD_ENABLE(_ic)                ((_ic)->ic_flags_ext |= IEEE80211_FEXT_UAPSD)
 226  #define IEEE80211_COM_UAPSD_DISABLE(_ic)       ((_ic)->ic_flags_ext &= ~IEEE80211_FEXT_UAPSD)
 227 --- a/net80211/ieee80211_wireless.c
 228 +++ b/net80211/ieee80211_wireless.c
 229 @@ -2867,6 +2867,14 @@
 230                 else
 231                         vap->iv_minrateindex = 0;
 232                 break;
 233 +       case IEEE80211_PARAM_WDS_SEP:
 234 +               if (vap->iv_opmode != IEEE80211_M_HOSTAP)
 235 +                       retv = -EINVAL;
 236 +               else if (value)
 237 +                       vap->iv_flags_ext |= IEEE80211_FEXT_WDSSEP;
 238 +               else
 239 +                       vap->iv_flags_ext &= ~IEEE80211_FEXT_WDSSEP;
 240 +               break;
 241  #ifdef ATH_REVERSE_ENGINEERING
 242         case IEEE80211_PARAM_DUMPREGS:
 243                 ieee80211_dump_registers(dev, info, w, extra);
 244 @@ -3223,6 +3231,9 @@
 245         case IEEE80211_PARAM_MINRATE:
 246                 param[0] = vap->iv_minrateindex;
 247                 break;
 248 +       case IEEE80211_PARAM_WDS_SEP:
 249 +               param[0] = !!(vap->iv_flags_ext & IEEE80211_FEXT_WDSSEP);
 250 +               break;
 251         default:
 252                 return -EOPNOTSUPP;
 253         }
 254 @@ -4447,6 +4458,8 @@
 255         struct ieee80211vap *vap = ni->ni_vap;
 256         size_t ielen;
 257
 258 +       if (req->vap->iv_wdsnode && ni->ni_subif)
 259 +               vap = ni->ni_subif;
 260         if (vap != req->vap && vap != req->vap->iv_xrvap)       /* only entries for this vap */
 261                 return;
 262         if ((vap->iv_opmode == IEEE80211_M_HOSTAP ||
 263 @@ -4466,6 +4479,8 @@
 264         size_t ielen, len;
 265         u_int8_t *cp;
 266
 267 +       if (req->vap->iv_wdsnode && ni->ni_subif)
 268 +               vap = ni->ni_subif;
 269         if (vap != req->vap && vap != req->vap->iv_xrvap)       /* only entries for this vap (or) xrvap */
 270                 return;
 271         if ((vap->iv_opmode == IEEE80211_M_HOSTAP ||
 272 @@ -5767,6 +5782,10 @@
 273          0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "get_minrate"},
 274         { IEEE80211_IOCTL_SETSCANLIST,
 275          IW_PRIV_TYPE_CHAR | 255, 0, "setscanlist"},
 276 +       { IEEE80211_PARAM_WDS_SEP,
 277 +        IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "wdssep"},
 278 +       { IEEE80211_PARAM_WDS_SEP,
 279 +        0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "get_wdssep"},
 280
 281  #ifdef ATH_REVERSE_ENGINEERING
 282         /*
 283 @@ -5890,6 +5909,8 @@
 284  ieee80211_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 285  {
 286         struct ieee80211vap *vap = dev->priv;
 287 +       struct ieee80211com *ic = vap->iv_ic;
 288 +       struct ieee80211_node *ni;
 289
 290         switch (cmd) {
 291         case SIOCG80211STATS:
 292 @@ -5898,8 +5919,20 @@
 293         case SIOC80211IFDESTROY:
 294                 if (!capable(CAP_NET_ADMIN))
 295                         return -EPERM;
 296 +               /* drop all node subifs */
 297 +               TAILQ_FOREACH(ni, &ic->ic_sta.nt_node, ni_list) {
 298 +                       struct ieee80211vap *avp = ni->ni_subif;
 299 +
 300 +                       if (ni->ni_vap != vap)
 301 +                               continue;
 302 +                       if (!avp)
 303 +                               continue;
 304 +                       ni->ni_subif = NULL;
 305 +                       ieee80211_stop(avp->iv_dev);
 306 +                       ic->ic_vap_delete(avp);
 307 +               }
 308                 ieee80211_stop(vap->iv_dev);    /* force state before cleanup */
 309 -               vap->iv_ic->ic_vap_delete(vap);
 310 +               ic->ic_vap_delete(vap);
 311                 return 0;
 312         case IEEE80211_IOCTL_GETKEY:
 313                 return ieee80211_ioctl_getkey(dev, (struct iwreq *) ifr);
 314 --- a/net80211/ieee80211_node.c
 315 +++ b/net80211/ieee80211_node.c
 316 @@ -47,6 +47,7 @@
 317  #include <linux/netdevice.h>
 318  #include <linux/etherdevice.h>
 319  #include <linux/random.h>
 320 +#include <linux/rtnetlink.h>
 321
 322  #include "if_media.h"
 323
 324 @@ -236,7 +237,11 @@
 325  ieee80211_node_vdetach(struct ieee80211vap *vap)
 326  {
 327         struct ieee80211com *ic = vap->iv_ic;
 328 +       struct ieee80211_node *ni;
 329
 330 +       ni = vap->iv_wdsnode;
 331 +       if (ni)
 332 +               ni->ni_subif = NULL;
 333         ieee80211_node_table_reset(&ic->ic_sta, vap);
 334         if (vap->iv_bss != NULL) {
 335                 ieee80211_unref_node(&vap->iv_bss);
 336 @@ -1134,6 +1139,57 @@
 337         return ni;
 338  }
 339
 340 +#define WDSIFNAME ".sta%d"
 341 +static void
 342 +ieee80211_wds_do_addif(struct work_struct *work)
 343 +{
 344 +       struct ieee80211_node *ni = container_of(work, struct ieee80211_node, ni_create);
 345 +       struct ieee80211vap *vap = ni->ni_vap;
 346 +       struct ieee80211com *ic = vap->iv_ic;
 347 +       struct ieee80211vap *avp;
 348 +       char *name;
 349 +
 350 +       rtnl_lock();
 351 +       /* did we get cancelled by the destroy call? */
 352 +       if (!ni->ni_subif)
 353 +               goto done;
 354 +
 355 +       ni->ni_subif = NULL;
 356 +       name = kmalloc(strlen(vap->iv_dev->name) + sizeof(WDSIFNAME) + 1, GFP_KERNEL);
 357 +       if (!name)
 358 +               goto done;
 359 +
 360 +       strcpy(name, vap->iv_dev->name);
 361 +       strcat(name, WDSIFNAME);
 362 +       avp = ieee80211_create_vap(ic, name, ic->ic_dev, IEEE80211_M_WDS, 0, vap);
 363 +       kfree(name);
 364 +       if (!avp)
 365 +               goto done;
 366 +
 367 +       memcpy(avp->wds_mac, ni->ni_bssid, IEEE80211_ADDR_LEN);
 368 +       avp->iv_wdsnode = ieee80211_ref_node(ni);
 369 +       ni->ni_subif = avp;
 370 +       ic->ic_subifs++;
 371 +
 372 +done:
 373 +       rtnl_unlock();
 374 +       ieee80211_unref_node(&ni);
 375 +}
 376 +#undef WDSIFNAME
 377 +
 378 +void ieee80211_wds_addif(struct ieee80211_node *ni)
 379 +{
 380 +       /* check if the node is split out already,
 381 +        * or if we're in progress of setting up a new interface already */
 382 +       if (ni->ni_subif)
 383 +               return;
 384 +
 385 +       ieee80211_ref_node(ni);
 386 +       ni->ni_subif = ni->ni_vap;
 387 +       IEEE80211_INIT_WORK(&ni->ni_create, ieee80211_wds_do_addif);
 388 +       schedule_work(&ni->ni_create);
 389 +}
 390 +
 391  /* Add wds address to the node table */
 392  int
 393  #ifdef IEEE80211_DEBUG_REFCNT
 394 @@ -2254,6 +2310,36 @@
 395         }
 396  }
 397
 398 +static void
 399 +ieee80211_subif_destroy(struct work_struct *work)
 400 +{
 401 +       struct ieee80211_node *ni = container_of(work, struct ieee80211_node, ni_destroy);
 402 +       struct ieee80211vap *vap;
 403 +       struct ieee80211com *ic;
 404 +
 405 +       rtnl_lock();
 406 +       vap = ni->ni_subif;
 407 +
 408 +       /* if addif is waiting for the timer to fire, cancel! */
 409 +       if (vap == ni->ni_vap) {
 410 +               ni->ni_subif = NULL;
 411 +               goto done;
 412 +       }
 413 +
 414 +       if (!vap)
 415 +               goto done;
 416 +
 417 +       ic = vap->iv_ic;
 418 +       ni->ni_subif = NULL;
 419 +       ieee80211_stop(vap->iv_dev);
 420 +       ic->ic_vap_delete(vap);
 421 +       ic->ic_subifs--;
 422 +
 423 +done:
 424 +       ieee80211_unref_node(&ni);
 425 +       rtnl_unlock();
 426 +}
 427 +
 428  /*
 429   * Handle bookkeeping for a station/neighbor leaving
 430   * the bss when operating in ap or adhoc modes.
 431 @@ -2270,6 +2356,12 @@
 432                         ni, "station with aid %d leaves (refcnt %u)",
 433                         IEEE80211_NODE_AID(ni), atomic_read(&ni->ni_refcnt));
 434
 435 +       if (ni->ni_subif) {
 436 +               ieee80211_ref_node(ni);
 437 +               IEEE80211_INIT_WORK(&ni->ni_destroy, ieee80211_subif_destroy);
 438 +               schedule_work(&ni->ni_destroy);
 439 +       }
 440 +
 441         /* From this point onwards we can no longer find the node,
 442          * so no more references are generated
 443          */
 444 --- a/net80211/ieee80211_linux.h
 445 +++ b/net80211/ieee80211_linux.h
 446 @@ -81,6 +81,12 @@
 447  #endif
 448  }
 449
 450 +#ifndef container_of
 451 +#define container_of(ptr, type, member) ({          \
 452 +    const typeof( ((type *)0)->member ) *__mptr = (ptr);    \
 453 +           (type *)( (char *)__mptr - offsetof(type,member) );})
 454 +#endif
 455 +
 456  /*
 457   * Task deferral
 458   *
 459 @@ -113,6 +119,29 @@
 460
 461  #define        IEEE80211_RESCHEDULE    schedule
 462
 463 +#include <linux/sched.h>
 464 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,41)
 465 +#include <linux/tqueue.h>
 466 +#define work_struct                    tq_struct
 467 +#define schedule_work(t)               schedule_task((t))
 468 +#define flush_scheduled_work()         flush_scheduled_tasks()
 469 +#define IEEE80211_INIT_WORK(t, f) do {                         \
 470 +       memset((t), 0, sizeof(struct tq_struct)); \
 471 +       (t)->routine = (void (*)(void*)) (f);   \
 472 +       (t)->data=(void *) (t);                 \
 473 +} while (0)
 474 +#else
 475 +#include <linux/workqueue.h>
 476 +
 477 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20)
 478 +#define IEEE80211_INIT_WORK(_t, _f)    INIT_WORK((_t), (void (*)(void *))(_f), (_t));
 479 +#else
 480 +#define IEEE80211_INIT_WORK(_t, _f)    INIT_WORK((_t), (_f));
 481 +#endif
 482 +
 483 +#endif /* KERNEL_VERSION < 2.5.41 */
 484 +
 485 +
 486  /* Locking */
 487  /* NB: beware, spin_is_locked() is not usefully defined for !(DEBUG || SMP)
 488   * because spinlocks do not exist in this configuration. Instead IRQs
 489 @@ -167,6 +196,18 @@
 490         IEEE80211_VAPS_LOCK_ASSERT(_ic);                \
 491         spin_unlock_bh(&(_ic)->ic_vapslock);            \
 492  } while (0)
 493 +#define        IEEE80211_VAPS_LOCK_IRQ(_ic) do {                                       \
 494 +       unsigned long __vlockflags;                                     \
 495 +       IEEE80211_VAPS_LOCK_CHECK(_ic);                                 \
 496 +       spin_lock_irqsave(&(_ic)->ic_vapslock, __vlockflags);
 497 +#define        IEEE80211_VAPS_UNLOCK_IRQ(_ic)                                  \
 498 +       IEEE80211_VAPS_LOCK_ASSERT(_ic);                                        \
 499 +       spin_unlock_irqrestore(&(_ic)->ic_vapslock, __vlockflags);      \
 500 +} while (0)
 501 +#define        IEEE80211_VAPS_UNLOCK_IRQ_EARLY(_ic)                                    \
 502 +       IEEE80211_VAPS_LOCK_ASSERT(_ic);                                        \
 503 +       spin_unlock_irqrestore(&(_ic)->ic_vapslock, __vlockflags);
 504 +
 505
 506  #if (defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)) && defined(spin_is_locked)
 507  #define IEEE80211_VAPS_LOCK_ASSERT(_ic) \
 508 --- a/net80211/ieee80211_proto.c
 509 +++ b/net80211/ieee80211_proto.c
 510 @@ -1081,6 +1081,8 @@
 511  int
 512  ieee80211_open(struct net_device *dev)
 513  {
 514 +       struct ieee80211vap *vap = dev->priv;
 515 +
 516         return ieee80211_init(dev, 0);
 517  }
 518
 519 @@ -1116,11 +1118,33 @@
 520         struct ieee80211vap *vap = dev->priv;
 521         struct ieee80211com *ic = vap->iv_ic;
 522         struct net_device *parent = ic->ic_dev;
 523 +       struct ieee80211_node *tni, *ni;
 524
 525         IEEE80211_DPRINTF(vap,
 526                 IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
 527                 "%s\n", "stop running");
 528
 529 +       /* get rid of all wds nodes while we're still locked */
 530 +       do {
 531 +               ni = NULL;
 532 +
 533 +               IEEE80211_NODE_TABLE_LOCK_IRQ(&ic->ic_sta);
 534 +               TAILQ_FOREACH(tni, &ic->ic_sta.nt_node, ni_list) {
 535 +                       if (tni->ni_vap != vap)
 536 +                               continue;
 537 +                       if (!tni->ni_subif)
 538 +                               continue;
 539 +                       ni = tni;
 540 +                       break;
 541 +               }
 542 +               IEEE80211_NODE_TABLE_UNLOCK_IRQ(&ic->ic_sta);
 543 +
 544 +               if (!ni)
 545 +                       break;
 546 +
 547 +               ieee80211_node_leave(ni);
 548 +       } while (1);
 549 +
 550         ieee80211_new_state(vap, IEEE80211_S_INIT, -1);
 551         if (dev->flags & IFF_RUNNING) {
 552                 dev->flags &= ~IFF_RUNNING;             /* mark us stopped */
 553 @@ -1342,9 +1366,9 @@
 554         struct ieee80211com *ic = vap->iv_ic;
 555         int rc;
 556
 557 -       IEEE80211_VAPS_LOCK_BH(ic);
 558 +       IEEE80211_VAPS_LOCK_IRQ(ic);
 559         rc = vap->iv_newstate(vap, nstate, arg);
 560 -       IEEE80211_VAPS_UNLOCK_BH(ic);
 561 +       IEEE80211_VAPS_UNLOCK_IRQ(ic);
 562         return rc;
 563  }
 564
 565 @@ -1630,6 +1654,7 @@
 566                  */
 567                 if (ni->ni_authmode != IEEE80211_AUTH_8021X)
 568                         ieee80211_node_authorize(ni);
 569 +
 570  #ifdef ATH_SUPERG_XR
 571                 /*
 572                  * fire a timer to bring up XR vap if configured.
 573 @@ -1885,8 +1910,15 @@
 574                 if (ostate == IEEE80211_S_SCAN ||
 575                     ostate == IEEE80211_S_AUTH ||
 576                     ostate == IEEE80211_S_ASSOC) {
 577 +
 578                         /* Transition (S_SCAN|S_AUTH|S_ASSOC) -> S_RUN */
 579                         __ieee80211_newstate(vap, nstate, arg);
 580 +
 581 +                       /* if we're in wds, let the ap know that we're doing this */
 582 +                       if ((vap->iv_opmode == IEEE80211_M_STA) &&
 583 +                               (vap->iv_flags_ext & IEEE80211_FEXT_WDS))
 584 +                                       ieee80211_send_nulldata(ieee80211_ref_node(vap->iv_bss));
 585 +
 586                         /* Then bring up all other vaps pending on the scan */
 587                         dstate = get_dominant_state(ic);
 588                         if (dstate == IEEE80211_S_RUN) {
 589 --- a/net80211/ieee80211.c
 590 +++ b/net80211/ieee80211.c
 591 @@ -373,10 +373,25 @@
 592  ieee80211_ifdetach(struct ieee80211com *ic)
 593  {
 594         struct ieee80211vap *vap;
 595 +       int count;
 596 +
 597 +       /* bring down all vaps */
 598 +       TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
 599 +               ieee80211_stop(vap->iv_dev);
 600 +       }
 601 +
 602 +       /* wait for all subifs to disappear */
 603 +       do {
 604 +               schedule();
 605 +               rtnl_lock();
 606 +               count = ic->ic_subifs;
 607 +               rtnl_unlock();
 608 +       } while (count > 0);
 609
 610         rtnl_lock();
 611 -       while ((vap = TAILQ_FIRST(&ic->ic_vaps)) != NULL)
 612 +       while ((vap = TAILQ_FIRST(&ic->ic_vaps)) != NULL) {
 613                 ic->ic_vap_delete(vap);
 614 +       }
 615         rtnl_unlock();
 616
 617         del_timer(&ic->ic_dfs_excl_timer);
 618 @@ -599,8 +614,10 @@
 619
 620         IEEE80211_CANCEL_TQUEUE(&vap->iv_stajoin1tq);
 621         IEEE80211_LOCK_IRQ(ic);
 622 -       if (vap->iv_wdsnode)
 623 +       if (vap->iv_wdsnode) {
 624 +               vap->iv_wdsnode->ni_subif = NULL;
 625                 ieee80211_unref_node(&vap->iv_wdsnode);
 626 +       }
 627         if ((vap->iv_opmode == IEEE80211_M_WDS) &&
 628                 (vap->iv_master != NULL))
 629                 TAILQ_REMOVE(&vap->iv_master->iv_wdslinks, vap, iv_wdsnext);
 630 --- a/ath/if_athvar.h
 631 +++ b/ath/if_athvar.h
 632 @@ -79,28 +79,6 @@
 633  #define        tasklet_enable(t)       do { (void) t; local_bh_enable(); } while (0)
 634  #endif /* !DECLARE_TASKLET */
 635
 636 -#include <linux/sched.h>
 637 -#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,41)
 638 -#include <linux/tqueue.h>
 639 -#define work_struct                    tq_struct
 640 -#define schedule_work(t)               schedule_task((t))
 641 -#define flush_scheduled_work()         flush_scheduled_tasks()
 642 -#define ATH_INIT_WORK(t, f) do {                       \
 643 -       memset((t), 0, sizeof(struct tq_struct)); \
 644 -       (t)->routine = (void (*)(void*)) (f);   \
 645 -       (t)->data=(void *) (t);                 \
 646 -} while (0)
 647 -#else
 648 -#include <linux/workqueue.h>
 649 -
 650 -#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20)
 651 -#define ATH_INIT_WORK(_t, _f)  INIT_WORK((_t), (void (*)(void *))(_f), (_t));
 652 -#else
 653 -#define ATH_INIT_WORK(_t, _f)  INIT_WORK((_t), (_f));
 654 -#endif
 655 -
 656 -#endif /* KERNEL_VERSION < 2.5.41 */
 657 -
 658  /*
 659   * Guess how the interrupt handler should work.
 660   */
 661 --- a/net80211/ieee80211_output.c
 662 +++ b/net80211/ieee80211_output.c
 663 @@ -261,6 +261,10 @@
 664                 goto bad;
 665         }
 666
 667 +       if (ni->ni_subif && (vap != ni->ni_subif) &&
 668 +               ((eh)->ether_type != __constant_htons(ETHERTYPE_PAE)))
 669 +               goto bad;
 670 +
 671         /* calculate priority so drivers can find the TX queue */
 672         if (ieee80211_classify(ni, skb)) {
 673                 IEEE80211_NOTE(vap, IEEE80211_MSG_OUTPUT, ni,
 674 @@ -340,20 +344,33 @@
 675   * constructing a frame as it sets i_fc[1]; other bits can
 676   * then be or'd in.
 677   */
 678 -static void
 679 +static struct ieee80211_frame *
 680  ieee80211_send_setup(struct ieee80211vap *vap,
 681         struct ieee80211_node *ni,
 682 -       struct ieee80211_frame *wh,
 683 +       struct sk_buff *skb,
 684         int type,
 685         const u_int8_t sa[IEEE80211_ADDR_LEN],
 686         const u_int8_t da[IEEE80211_ADDR_LEN],
 687         const u_int8_t bssid[IEEE80211_ADDR_LEN])
 688  {
 689  #define        WH4(wh) ((struct ieee80211_frame_addr4 *)wh)
 690 +       struct ieee80211_frame *wh;
 691 +       int len = sizeof(struct ieee80211_frame);
 692 +       int opmode = vap->iv_opmode;
 693 +
 694 +       if ((type & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_DATA) {
 695 +               if ((opmode == IEEE80211_M_STA) &&
 696 +                       (vap->iv_flags_ext & IEEE80211_FEXT_WDS))
 697 +                       opmode = IEEE80211_M_WDS;
 698 +
 699 +               if (opmode == IEEE80211_M_WDS)
 700 +                       len = sizeof(struct ieee80211_frame_addr4);
 701 +       }
 702
 703 +       wh = (struct ieee80211_frame *)skb_push(skb, len);
 704         wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | type;
 705         if ((type & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_DATA) {
 706 -               switch (vap->iv_opmode) {
 707 +               switch (opmode) {
 708                 case IEEE80211_M_STA:
 709                         wh->i_fc[1] = IEEE80211_FC1_DIR_TODS;
 710                         IEEE80211_ADDR_COPY(wh->i_addr1, bssid);
 711 @@ -395,6 +412,8 @@
 712         *(__le16 *)&wh->i_seq[0] =
 713             htole16(ni->ni_txseqs[0] << IEEE80211_SEQ_SEQ_SHIFT);
 714         ni->ni_txseqs[0]++;
 715 +
 716 +       return wh;
 717  #undef WH4
 718  }
 719
 720 @@ -416,9 +435,7 @@
 721
 722         SKB_CB(skb)->ni = ni;
 723
 724 -       wh = (struct ieee80211_frame *)
 725 -               skb_push(skb, sizeof(struct ieee80211_frame));
 726 -       ieee80211_send_setup(vap, ni, wh,
 727 +       wh = ieee80211_send_setup(vap, ni, skb,
 728                 IEEE80211_FC0_TYPE_MGT | type,
 729                 vap->iv_myaddr, ni->ni_macaddr, vap->iv_bssid);
 730         /* XXX power management */
 731 @@ -464,6 +481,9 @@
 732         struct ieee80211_frame *wh;
 733         u_int8_t *frm;
 734
 735 +       if (ni->ni_subif)
 736 +               vap = ni->ni_subif;
 737 +
 738         skb = ieee80211_getmgtframe(&frm, 0);
 739         if (skb == NULL) {
 740                 /* XXX debug msg */
 741 @@ -472,9 +492,7 @@
 742                 return -ENOMEM;
 743         }
 744
 745 -       wh = (struct ieee80211_frame *)
 746 -               skb_push(skb, sizeof(struct ieee80211_frame));
 747 -       ieee80211_send_setup(vap, ni, wh,
 748 +       wh = ieee80211_send_setup(vap, ni, skb,
 749                 IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_NODATA,
 750                 vap->iv_myaddr, ni->ni_macaddr, vap->iv_bssid);
 751         /* NB: power management bit is never sent by an AP */
 752 @@ -512,6 +530,7 @@
 753         struct sk_buff *skb;
 754         struct ieee80211_qosframe *qwh;
 755         u_int8_t *frm;
 756 +       u_int8_t *i_qos;
 757         int tid;
 758
 759         skb = ieee80211_getmgtframe(&frm, 2);
 760 @@ -523,11 +542,12 @@
 761         SKB_CB(skb)->ni = ieee80211_ref_node(ni);
 762
 763         skb->priority = ac;
 764 -       qwh = (struct ieee80211_qosframe *)skb_push(skb, sizeof(struct ieee80211_qosframe));
 765
 766 -       qwh = (struct ieee80211_qosframe *)skb->data;
 767 +       /* grab a pointer to QoS control and also compensate for the header length
 768 +        * difference between QoS and non-QoS frame */
 769 +       i_qos = skb_push(skb, sizeof(struct ieee80211_qosframe) - sizeof(struct ieee80211_frame));
 770
 771 -       ieee80211_send_setup(vap, ni, (struct ieee80211_frame *)qwh,
 772 +       qwh = (struct ieee80211_qosframe *) ieee80211_send_setup(vap, ni, skb,
 773                 IEEE80211_FC0_TYPE_DATA,
 774                 vap->iv_myaddr, /* SA */
 775                 ni->ni_macaddr, /* DA */
 776 @@ -541,10 +561,10 @@
 777
 778         /* map from access class/queue to 11e header priority value */
 779         tid = WME_AC_TO_TID(ac);
 780 -       qwh->i_qos[0] = tid & IEEE80211_QOS_TID;
 781 +       i_qos[0] = tid & IEEE80211_QOS_TID;
 782         if (ic->ic_wme.wme_wmeChanParams.cap_wmeParams[ac].wmep_noackPolicy)
 783                 qwh->i_qos[0] |= (1 << IEEE80211_QOS_ACKPOLICY_S) & IEEE80211_QOS_ACKPOLICY;
 784 -       qwh->i_qos[1] = 0;
 785 +       i_qos[1] = 0;
 786
 787         IEEE80211_NODE_STAT(ni, tx_data);
 788
 789 @@ -786,6 +806,8 @@
 790                 hdrsize = sizeof(struct ieee80211_frame);
 791
 792         SKB_CB(skb)->auth_pkt = (eh.ether_type == __constant_htons(ETHERTYPE_PAE));
 793 +       if (ni->ni_subif)
 794 +               vap = ni->ni_subif;
 795
 796         switch (vap->iv_opmode) {
 797         case IEEE80211_M_IBSS:
 798 @@ -805,20 +827,9 @@
 799                         ismulticast = IEEE80211_IS_MULTICAST(eh.ether_dhost);
 800                 break;
 801         case IEEE80211_M_STA:
 802 -               if ((vap->iv_flags_ext & IEEE80211_FEXT_WDS) &&
 803 -                   !IEEE80211_ADDR_EQ(eh.ether_shost, vap->iv_myaddr)) {
 804 +               if (vap->iv_flags_ext & IEEE80211_FEXT_WDS) {
 805                         use4addr = 1;
 806 -                       ismulticast = IEEE80211_IS_MULTICAST(ni->ni_macaddr);
 807 -                       /* Add a WDS entry to the station VAP */
 808 -                       if (IEEE80211_IS_MULTICAST(eh.ether_dhost)) {
 809 -                               struct ieee80211_node_table *nt = &ic->ic_sta;
 810 -                               struct ieee80211_node *ni_wds
 811 -                                       = ieee80211_find_wds_node(nt, eh.ether_shost);
 812 -                               if (ni_wds)
 813 -                                       ieee80211_unref_node(&ni_wds);
 814 -                               else
 815 -                                       ieee80211_add_wds_addr(nt, ni, eh.ether_shost, 0);
 816 -                       }
 817 +                       ismulticast = 0;
 818                 } else
 819                         ismulticast = IEEE80211_IS_MULTICAST(vap->iv_bssid);
 820                 break;
 821 @@ -1689,9 +1700,7 @@
 822
 823         SKB_CB(skb)->ni = ieee80211_ref_node(ni);
 824
 825 -       wh = (struct ieee80211_frame *)
 826 -               skb_push(skb, sizeof(struct ieee80211_frame));
 827 -       ieee80211_send_setup(vap, ni, wh,
 828 +       wh = ieee80211_send_setup(vap, ni, skb,
 829                 IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_REQ,
 830                 sa, da, bssid);
 831         /* XXX power management? */
 832 --- a/net80211/ieee80211_linux.c
 833 +++ b/net80211/ieee80211_linux.c
 834 @@ -145,7 +145,7 @@
 835         struct sk_buff *skb;
 836         u_int len;
 837
 838 -       len = roundup(sizeof(struct ieee80211_frame) + pktlen, 4);
 839 +       len = roundup(sizeof(struct ieee80211_frame_addr4) + pktlen, 4);
 840  #ifdef IEEE80211_DEBUG_REFCNT
 841         skb = ieee80211_dev_alloc_skb_debug(len + align - 1, func, line);
 842  #else
 843 @@ -161,7 +161,7 @@
 844                 SKB_CB(skb)->flags = 0;
 845                 SKB_CB(skb)->next = NULL;
 846
 847 -               skb_reserve(skb, sizeof(struct ieee80211_frame));
 848 +               skb_reserve(skb, sizeof(struct ieee80211_frame_addr4));
 849                 *frm = skb_put(skb, pktlen);
 850         }
 851         return skb;