package/madwifi/patches/371-wds_sta_separation.patch

   1 --- a/net80211/ieee80211_input.c
   2 +++ b/net80211/ieee80211_input.c
   3 @@ -202,6 +202,7 @@
   4         struct ieee80211com *ic = vap->iv_ic;
   5         struct net_device *dev = vap->iv_dev;
   6         struct ieee80211_node *ni_wds = NULL;
   7 +       struct net_device_stats *stats;
   8         struct ieee80211_frame *wh;
   9         struct ieee80211_key *key;
  10         struct ether_header *eh;
  11 @@ -435,7 +436,7 @@
  12
  13         switch (type) {
  14         case IEEE80211_FC0_TYPE_DATA:
  15 -               hdrspace = ieee80211_hdrspace(ic, wh);
  16 +               hdrspace = ieee80211_hdrsize(wh);
  17                 if (skb->len < hdrspace) {
  18                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
  19                                 wh, "data", "too short: len %u, expecting %u",
  20 @@ -445,16 +446,26 @@
  21                 }
  22                 switch (vap->iv_opmode) {
  23                 case IEEE80211_M_STA:
  24 -                       if ((dir != IEEE80211_FC1_DIR_FROMDS) &&
  25 -                           (!((vap->iv_flags_ext & IEEE80211_FEXT_WDS) &&
  26 -                           (dir == IEEE80211_FC1_DIR_DSTODS)))) {
  27 -                               IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
  28 -                                       wh, "data", "invalid dir 0x%x", dir);
  29 -                               vap->iv_stats.is_rx_wrongdir++;
  30 -                               goto out;
  31 +                       {
  32 +                               int accept;
  33 +
  34 +                               if (vap->iv_flags_ext & IEEE80211_FEXT_WDS)
  35 +                                       accept = IEEE80211_FC1_DIR_DSTODS;
  36 +                               else
  37 +                                       accept = IEEE80211_FC1_DIR_FROMDS;
  38 +                               if (dir != accept) {
  39 +                                       IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
  40 +                                               wh, "data", "invalid dir 0x%x", dir);
  41 +                                       vap->iv_stats.is_rx_wrongdir++;
  42 +                                       goto out;
  43 +                               }
  44                         }
  45
  46 -                       if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
  47 +                       if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
  48 +                               /* ignore 3-addr mcast if we're WDS STA */
  49 +                               if (vap->iv_flags_ext & IEEE80211_FEXT_WDS)
  50 +                                       goto out;
  51 +
  52                                 /* Discard multicast if IFF_MULTICAST not set */
  53                                 if ((0 != memcmp(wh->i_addr3, dev->broadcast, ETH_ALEN)) &&
  54                                         (0 == (dev->flags & IFF_MULTICAST))) {
  55 @@ -482,24 +493,10 @@
  56                                         vap->iv_stats.is_rx_mcastecho++;
  57                                         goto out;
  58                                 }
  59 -                               /*
  60 -                                * if it is brodcasted by me on behalf of
  61 -                                * a station behind me, drop it.
  62 -                                */
  63 -                               if (vap->iv_flags_ext & IEEE80211_FEXT_WDS) {
  64 -                                       struct ieee80211_node_table *nt;
  65 -                                       struct ieee80211_node *ni_wds;
  66 -                                       nt = &ic->ic_sta;
  67 -                                       ni_wds = ieee80211_find_wds_node(nt, wh->i_addr3);
  68 -                                       if (ni_wds) {
  69 -                                               ieee80211_unref_node(&ni_wds);
  70 -                                               IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  71 -                                                       wh, NULL, "%s",
  72 -                                                       "multicast echo originated from node behind me");
  73 -                                               vap->iv_stats.is_rx_mcastecho++;
  74 -                                               goto out;
  75 -                                       }
  76 -                               }
  77 +                       } else {
  78 +                               /* Same BSSID, but not meant for us to receive */
  79 +                               if (!IEEE80211_ADDR_EQ(wh->i_addr1, vap->iv_myaddr))
  80 +                                       goto out;
  81                         }
  82                         break;
  83                 case IEEE80211_M_IBSS:
  84 @@ -541,6 +538,11 @@
  85                                 vap->iv_stats.is_rx_notassoc++;
  86                                 goto err;
  87                         }
  88 +
  89 +                       /* subif isn't fully set up yet, drop the frame */
  90 +                       if (ni->ni_subif == ni->ni_vap)
  91 +                               goto err;
  92 +
  93                         /*
  94                          * If we're a 4 address packet, make sure we have an entry in
  95                          * the node table for the packet source address (addr4).
  96 @@ -548,9 +550,16 @@
  97                          */
  98
  99                         /* check for wds link first */
 100 -                       if (dir == IEEE80211_FC1_DIR_DSTODS) {
 101 +                       if ((dir == IEEE80211_FC1_DIR_DSTODS) && !ni->ni_subif) {
 102                                 struct ieee80211vap *avp;
 103
 104 +                               if (vap->iv_flags_ext & IEEE80211_FEXT_WDSSEP) {
 105 +                                       ieee80211_wds_addif(ni);
 106 +                                       /* we must drop frames here until the interface has
 107 +                                        * been fully separated, otherwise a bridge might get
 108 +                                        * confused */
 109 +                                       goto err;
 110 +                               }
 111                                 TAILQ_FOREACH(avp, &vap->iv_wdslinks, iv_wdsnext) {
 112                                         if (!memcmp(avp->wds_mac, wh->i_addr2, IEEE80211_ADDR_LEN)) {
 113                                                 IEEE80211_LOCK_IRQ(ni->ni_ic);
 114 @@ -566,7 +575,7 @@
 115                         }
 116
 117                         /* XXX: Useless node mgmt API; make better */
 118 -                       if ((dir == IEEE80211_FC1_DIR_DSTODS) && !ni_wds) {
 119 +                       if ((dir == IEEE80211_FC1_DIR_DSTODS) && !ni_wds && !ni->ni_subif) {
 120                                 struct ieee80211_node_table *nt = &ic->ic_sta;
 121                                 struct ieee80211_frame_addr4 *wh4;
 122
 123 @@ -626,6 +635,11 @@
 124                         goto out;
 125                 }
 126
 127 +               /* check if there is any data left */
 128 +               hdrspace = ieee80211_hdrspace(ic, wh);
 129 +               if (skb->len < hdrspace)
 130 +                       goto out;
 131 +
 132                 /*
 133                  * Handle privacy requirements.  Note that we
 134                  * must not be preempted from here until after
 135 @@ -698,8 +712,12 @@
 136                 if (! accept_data_frame(vap, ni, key, skb, eh))
 137                         goto out;
 138
 139 -               vap->iv_devstats.rx_packets++;
 140 -               vap->iv_devstats.rx_bytes += skb->len;
 141 +               if (ni->ni_subif && ((eh)->ether_type != __constant_htons(ETHERTYPE_PAE)))
 142 +                       stats = &ni->ni_subif->iv_devstats;
 143 +               else
 144 +                       stats = &vap->iv_devstats;
 145 +               stats->rx_packets++;
 146 +               stats->rx_bytes += skb->len;
 147                 IEEE80211_NODE_STAT(ni, rx_data);
 148                 IEEE80211_NODE_STAT_ADD(ni, rx_bytes, skb->len);
 149                 ic->ic_lastdata = jiffies;
 150 @@ -1132,6 +1150,13 @@
 151                 dev = vap->iv_xrvap->iv_dev;
 152  #endif
 153
 154 +       /* if the node has a wds subif, move data frames there,
 155 +        * but keep EAP traffic on the master */
 156 +       if (ni->ni_subif && ((eh)->ether_type != __constant_htons(ETHERTYPE_PAE))) {
 157 +               vap = ni->ni_subif;
 158 +               dev = vap->iv_dev;
 159 +       }
 160 +
 161         /* perform as a bridge within the vap */
 162         /* XXX intra-vap bridging only */
 163         if (vap->iv_opmode == IEEE80211_M_HOSTAP &&
 164 @@ -1157,7 +1182,16 @@
 165                         if (ni1 != NULL) {
 166                                 if (ni1->ni_vap == vap &&
 167                                     ieee80211_node_is_authorized(ni1) &&
 168 +                                       !ni1->ni_subif &&
 169                                     ni1 != vap->iv_bss) {
 170 +
 171 +                                       /* tried to bridge to a subif, drop the packet */
 172 +                                       if (ni->ni_subif) {
 173 +                                               ieee80211_unref_node(&ni1);
 174 +                                               ieee80211_dev_kfree_skb(&skb);
 175 +                                               return;
 176 +                                       }
 177 +
 178                                         skb1 = skb;
 179                                         skb = NULL;
 180                                 }
 181 --- a/net80211/ieee80211_ioctl.h
 182 +++ b/net80211/ieee80211_ioctl.h
 183 @@ -649,6 +649,7 @@
 184         IEEE80211_PARAM_BGSCAN_THRESH           = 79,   /* bg scan rssi threshold */
 185         IEEE80211_PARAM_RSSI_DIS_THR    = 80,   /* rssi threshold for disconnection */
 186         IEEE80211_PARAM_RSSI_DIS_COUNT  = 81,   /* counter for rssi threshold */
 187 +       IEEE80211_PARAM_WDS_SEP                 = 82,   /* move wds stations into separate interfaces */
 188  };
 189
 190  #define        SIOCG80211STATS                 (SIOCDEVPRIVATE+2)
 191 --- a/net80211/ieee80211_node.h
 192 +++ b/net80211/ieee80211_node.h
 193 @@ -92,11 +92,13 @@
 194   * the ieee80211com structure.
 195   */
 196  struct ieee80211_node {
 197 -       struct ieee80211vap *ni_vap;
 198 +       struct ieee80211vap *ni_vap, *ni_subif;
 199         struct ieee80211com *ni_ic;
 200         struct ieee80211_node_table *ni_table;
 201         TAILQ_ENTRY(ieee80211_node) ni_list;
 202         LIST_ENTRY(ieee80211_node) ni_hash;
 203 +       struct work_struct ni_create;   /* task for creating a subif */
 204 +       struct work_struct ni_destroy;  /* task for destroying a subif */
 205         atomic_t ni_refcnt;
 206         u_int ni_scangen;                       /* gen# for timeout scan */
 207         u_int8_t ni_authmode;                   /* authentication algorithm */
 208 @@ -430,5 +432,6 @@
 209  void ieee80211_node_leave(struct ieee80211_node *);
 210  u_int8_t ieee80211_getrssi(struct ieee80211com *);
 211  int32_t ieee80211_get_node_count(struct ieee80211com *);
 212 +void ieee80211_wds_addif(struct ieee80211_node *ni);
 213  #endif /* _NET80211_IEEE80211_NODE_H_ */
 214
 215 --- a/net80211/ieee80211_var.h
 216 +++ b/net80211/ieee80211_var.h
 217 @@ -322,6 +322,7 @@
 218         u_int8_t ic_myaddr[IEEE80211_ADDR_LEN];
 219         struct timer_list ic_inact;             /* mgmt/inactivity timer */
 220
 221 +       unsigned int ic_subifs;
 222         u_int32_t ic_flags;                     /* state flags */
 223         u_int32_t ic_flags_ext;                 /* extension of state flags */
 224         u_int32_t ic_caps;                      /* capabilities */
 225 @@ -625,6 +626,7 @@
 226  #define IEEE80211_FEXT_DROPUNENC_EAPOL 0x00000800      /* CONF: drop unencrypted eapol frames */
 227  #define IEEE80211_FEXT_APPIE_UPDATE    0x00001000      /* STATE: beacon APP IE updated */
 228  #define IEEE80211_FEXT_BGSCAN_THR      0x00002000      /* bgscan due to low rssi */
 229 +#define IEEE80211_FEXT_WDSSEP          0x00004000      /* move wds clients into separate interfaces */
 230
 231  #define IEEE80211_COM_UAPSD_ENABLE(_ic)                ((_ic)->ic_flags_ext |= IEEE80211_FEXT_UAPSD)
 232  #define IEEE80211_COM_UAPSD_DISABLE(_ic)       ((_ic)->ic_flags_ext &= ~IEEE80211_FEXT_UAPSD)
 233 --- a/net80211/ieee80211_wireless.c
 234 +++ b/net80211/ieee80211_wireless.c
 235 @@ -2867,6 +2867,14 @@
 236                 else
 237                         vap->iv_minrateindex = 0;
 238                 break;
 239 +       case IEEE80211_PARAM_WDS_SEP:
 240 +               if (vap->iv_opmode != IEEE80211_M_HOSTAP)
 241 +                       retv = -EINVAL;
 242 +               else if (value)
 243 +                       vap->iv_flags_ext |= IEEE80211_FEXT_WDSSEP;
 244 +               else
 245 +                       vap->iv_flags_ext &= ~IEEE80211_FEXT_WDSSEP;
 246 +               break;
 247  #ifdef ATH_REVERSE_ENGINEERING
 248         case IEEE80211_PARAM_DUMPREGS:
 249                 ieee80211_dump_registers(dev, info, w, extra);
 250 @@ -3223,6 +3231,9 @@
 251         case IEEE80211_PARAM_MINRATE:
 252                 param[0] = vap->iv_minrateindex;
 253                 break;
 254 +       case IEEE80211_PARAM_WDS_SEP:
 255 +               param[0] = !!(vap->iv_flags_ext & IEEE80211_FEXT_WDSSEP);
 256 +               break;
 257         default:
 258                 return -EOPNOTSUPP;
 259         }
 260 @@ -4447,6 +4458,8 @@
 261         struct ieee80211vap *vap = ni->ni_vap;
 262         size_t ielen;
 263
 264 +       if (req->vap->iv_wdsnode && ni->ni_subif)
 265 +               vap = ni->ni_subif;
 266         if (vap != req->vap && vap != req->vap->iv_xrvap)       /* only entries for this vap */
 267                 return;
 268         if ((vap->iv_opmode == IEEE80211_M_HOSTAP ||
 269 @@ -4466,6 +4479,8 @@
 270         size_t ielen, len;
 271         u_int8_t *cp;
 272
 273 +       if (req->vap->iv_wdsnode && ni->ni_subif)
 274 +               vap = ni->ni_subif;
 275         if (vap != req->vap && vap != req->vap->iv_xrvap)       /* only entries for this vap (or) xrvap */
 276                 return;
 277         if ((vap->iv_opmode == IEEE80211_M_HOSTAP ||
 278 @@ -5767,6 +5782,10 @@
 279          0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "get_minrate"},
 280         { IEEE80211_IOCTL_SETSCANLIST,
 281          IW_PRIV_TYPE_CHAR | 255, 0, "setscanlist"},
 282 +       { IEEE80211_PARAM_WDS_SEP,
 283 +        IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "wdssep"},
 284 +       { IEEE80211_PARAM_WDS_SEP,
 285 +        0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "get_wdssep"},
 286
 287  #ifdef ATH_REVERSE_ENGINEERING
 288         /*
 289 @@ -5890,6 +5909,8 @@
 290  ieee80211_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 291  {
 292         struct ieee80211vap *vap = dev->priv;
 293 +       struct ieee80211com *ic = vap->iv_ic;
 294 +       struct ieee80211_node *ni;
 295
 296         switch (cmd) {
 297         case SIOCG80211STATS:
 298 @@ -5898,8 +5919,20 @@
 299         case SIOC80211IFDESTROY:
 300                 if (!capable(CAP_NET_ADMIN))
 301                         return -EPERM;
 302 +               /* drop all node subifs */
 303 +               TAILQ_FOREACH(ni, &ic->ic_sta.nt_node, ni_list) {
 304 +                       struct ieee80211vap *avp = ni->ni_subif;
 305 +
 306 +                       if (ni->ni_vap != vap)
 307 +                               continue;
 308 +                       if (!avp)
 309 +                               continue;
 310 +                       ni->ni_subif = NULL;
 311 +                       ieee80211_stop(avp->iv_dev);
 312 +                       ic->ic_vap_delete(avp);
 313 +               }
 314                 ieee80211_stop(vap->iv_dev);    /* force state before cleanup */
 315 -               vap->iv_ic->ic_vap_delete(vap);
 316 +               ic->ic_vap_delete(vap);
 317                 return 0;
 318         case IEEE80211_IOCTL_GETKEY:
 319                 return ieee80211_ioctl_getkey(dev, (struct iwreq *) ifr);
 320 --- a/net80211/ieee80211_node.c
 321 +++ b/net80211/ieee80211_node.c
 322 @@ -47,6 +47,7 @@
 323  #include <linux/netdevice.h>
 324  #include <linux/etherdevice.h>
 325  #include <linux/random.h>
 326 +#include <linux/rtnetlink.h>
 327
 328  #include "if_media.h"
 329
 330 @@ -236,7 +237,11 @@
 331  ieee80211_node_vdetach(struct ieee80211vap *vap)
 332  {
 333         struct ieee80211com *ic = vap->iv_ic;
 334 +       struct ieee80211_node *ni;
 335
 336 +       ni = vap->iv_wdsnode;
 337 +       if (ni)
 338 +               ni->ni_subif = NULL;
 339         ieee80211_node_table_reset(&ic->ic_sta, vap);
 340         if (vap->iv_bss != NULL) {
 341                 ieee80211_unref_node(&vap->iv_bss);
 342 @@ -1134,6 +1139,57 @@
 343         return ni;
 344  }
 345
 346 +#define WDSIFNAME ".sta%d"
 347 +static void
 348 +ieee80211_wds_do_addif(struct work_struct *work)
 349 +{
 350 +       struct ieee80211_node *ni = container_of(work, struct ieee80211_node, ni_create);
 351 +       struct ieee80211vap *vap = ni->ni_vap;
 352 +       struct ieee80211com *ic = vap->iv_ic;
 353 +       struct ieee80211vap *avp;
 354 +       char *name;
 355 +
 356 +       rtnl_lock();
 357 +       /* did we get cancelled by the destroy call? */
 358 +       if (!ni->ni_subif)
 359 +               goto done;
 360 +
 361 +       ni->ni_subif = NULL;
 362 +       name = kmalloc(strlen(vap->iv_dev->name) + sizeof(WDSIFNAME) + 1, GFP_KERNEL);
 363 +       if (!name)
 364 +               goto done;
 365 +
 366 +       strcpy(name, vap->iv_dev->name);
 367 +       strcat(name, WDSIFNAME);
 368 +       avp = ieee80211_create_vap(ic, name, ic->ic_dev, IEEE80211_M_WDS, 0, vap);
 369 +       kfree(name);
 370 +       if (!avp)
 371 +               goto done;
 372 +
 373 +       memcpy(avp->wds_mac, ni->ni_bssid, IEEE80211_ADDR_LEN);
 374 +       avp->iv_wdsnode = ieee80211_ref_node(ni);
 375 +       ni->ni_subif = avp;
 376 +       ic->ic_subifs++;
 377 +
 378 +done:
 379 +       rtnl_unlock();
 380 +       ieee80211_unref_node(&ni);
 381 +}
 382 +#undef WDSIFNAME
 383 +
 384 +void ieee80211_wds_addif(struct ieee80211_node *ni)
 385 +{
 386 +       /* check if the node is split out already,
 387 +        * or if we're in progress of setting up a new interface already */
 388 +       if (ni->ni_subif)
 389 +               return;
 390 +
 391 +       ieee80211_ref_node(ni);
 392 +       ni->ni_subif = ni->ni_vap;
 393 +       IEEE80211_INIT_WORK(&ni->ni_create, ieee80211_wds_do_addif);
 394 +       schedule_work(&ni->ni_create);
 395 +}
 396 +
 397  /* Add wds address to the node table */
 398  int
 399  #ifdef IEEE80211_DEBUG_REFCNT
 400 @@ -2254,6 +2310,36 @@
 401         }
 402  }
 403
 404 +static void
 405 +ieee80211_subif_destroy(struct work_struct *work)
 406 +{
 407 +       struct ieee80211_node *ni = container_of(work, struct ieee80211_node, ni_destroy);
 408 +       struct ieee80211vap *vap;
 409 +       struct ieee80211com *ic;
 410 +
 411 +       rtnl_lock();
 412 +       vap = ni->ni_subif;
 413 +
 414 +       /* if addif is waiting for the timer to fire, cancel! */
 415 +       if (vap == ni->ni_vap) {
 416 +               ni->ni_subif = NULL;
 417 +               goto done;
 418 +       }
 419 +
 420 +       if (!vap)
 421 +               goto done;
 422 +
 423 +       ic = vap->iv_ic;
 424 +       ni->ni_subif = NULL;
 425 +       ieee80211_stop(vap->iv_dev);
 426 +       ic->ic_vap_delete(vap);
 427 +       ic->ic_subifs--;
 428 +
 429 +done:
 430 +       ieee80211_unref_node(&ni);
 431 +       rtnl_unlock();
 432 +}
 433 +
 434  /*
 435   * Handle bookkeeping for a station/neighbor leaving
 436   * the bss when operating in ap or adhoc modes.
 437 @@ -2270,6 +2356,12 @@
 438                         ni, "station with aid %d leaves (refcnt %u)",
 439                         IEEE80211_NODE_AID(ni), atomic_read(&ni->ni_refcnt));
 440
 441 +       if (ni->ni_subif) {
 442 +               ieee80211_ref_node(ni);
 443 +               IEEE80211_INIT_WORK(&ni->ni_destroy, ieee80211_subif_destroy);
 444 +               schedule_work(&ni->ni_destroy);
 445 +       }
 446 +
 447         /* From this point onwards we can no longer find the node,
 448          * so no more references are generated
 449          */
 450 --- a/net80211/ieee80211_linux.h
 451 +++ b/net80211/ieee80211_linux.h
 452 @@ -81,6 +81,12 @@
 453  #endif
 454  }
 455
 456 +#ifndef container_of
 457 +#define container_of(ptr, type, member) ({          \
 458 +    const typeof( ((type *)0)->member ) *__mptr = (ptr);    \
 459 +           (type *)( (char *)__mptr - offsetof(type,member) );})
 460 +#endif
 461 +
 462  /*
 463   * Task deferral
 464   *
 465 @@ -113,6 +119,29 @@
 466
 467  #define        IEEE80211_RESCHEDULE    schedule
 468
 469 +#include <linux/sched.h>
 470 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,41)
 471 +#include <linux/tqueue.h>
 472 +#define work_struct                    tq_struct
 473 +#define schedule_work(t)               schedule_task((t))
 474 +#define flush_scheduled_work()         flush_scheduled_tasks()
 475 +#define IEEE80211_INIT_WORK(t, f) do {                         \
 476 +       memset((t), 0, sizeof(struct tq_struct)); \
 477 +       (t)->routine = (void (*)(void*)) (f);   \
 478 +       (t)->data=(void *) (t);                 \
 479 +} while (0)
 480 +#else
 481 +#include <linux/workqueue.h>
 482 +
 483 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20)
 484 +#define IEEE80211_INIT_WORK(_t, _f)    INIT_WORK((_t), (void (*)(void *))(_f), (_t));
 485 +#else
 486 +#define IEEE80211_INIT_WORK(_t, _f)    INIT_WORK((_t), (_f));
 487 +#endif
 488 +
 489 +#endif /* KERNEL_VERSION < 2.5.41 */
 490 +
 491 +
 492  /* Locking */
 493  /* NB: beware, spin_is_locked() is not usefully defined for !(DEBUG || SMP)
 494   * because spinlocks do not exist in this configuration. Instead IRQs
 495 @@ -167,6 +196,18 @@
 496         IEEE80211_VAPS_LOCK_ASSERT(_ic);                \
 497         spin_unlock_bh(&(_ic)->ic_vapslock);            \
 498  } while (0)
 499 +#define        IEEE80211_VAPS_LOCK_IRQ(_ic) do {                                       \
 500 +       unsigned long __vlockflags;                                     \
 501 +       IEEE80211_VAPS_LOCK_CHECK(_ic);                                 \
 502 +       spin_lock_irqsave(&(_ic)->ic_vapslock, __vlockflags);
 503 +#define        IEEE80211_VAPS_UNLOCK_IRQ(_ic)                                  \
 504 +       IEEE80211_VAPS_LOCK_ASSERT(_ic);                                        \
 505 +       spin_unlock_irqrestore(&(_ic)->ic_vapslock, __vlockflags);      \
 506 +} while (0)
 507 +#define        IEEE80211_VAPS_UNLOCK_IRQ_EARLY(_ic)                                    \
 508 +       IEEE80211_VAPS_LOCK_ASSERT(_ic);                                        \
 509 +       spin_unlock_irqrestore(&(_ic)->ic_vapslock, __vlockflags);
 510 +
 511
 512  #if (defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)) && defined(spin_is_locked)
 513  #define IEEE80211_VAPS_LOCK_ASSERT(_ic) \
 514 --- a/net80211/ieee80211_proto.c
 515 +++ b/net80211/ieee80211_proto.c
 516 @@ -1081,6 +1081,8 @@
 517  int
 518  ieee80211_open(struct net_device *dev)
 519  {
 520 +       struct ieee80211vap *vap = dev->priv;
 521 +
 522         return ieee80211_init(dev, 0);
 523  }
 524
 525 @@ -1116,11 +1118,33 @@
 526         struct ieee80211vap *vap = dev->priv;
 527         struct ieee80211com *ic = vap->iv_ic;
 528         struct net_device *parent = ic->ic_dev;
 529 +       struct ieee80211_node *tni, *ni;
 530
 531         IEEE80211_DPRINTF(vap,
 532                 IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
 533                 "%s\n", "stop running");
 534
 535 +       /* get rid of all wds nodes while we're still locked */
 536 +       do {
 537 +               ni = NULL;
 538 +
 539 +               IEEE80211_NODE_TABLE_LOCK_IRQ(&ic->ic_sta);
 540 +               TAILQ_FOREACH(tni, &ic->ic_sta.nt_node, ni_list) {
 541 +                       if (tni->ni_vap != vap)
 542 +                               continue;
 543 +                       if (!tni->ni_subif)
 544 +                               continue;
 545 +                       ni = tni;
 546 +                       break;
 547 +               }
 548 +               IEEE80211_NODE_TABLE_UNLOCK_IRQ(&ic->ic_sta);
 549 +
 550 +               if (!ni)
 551 +                       break;
 552 +
 553 +               ieee80211_node_leave(ni);
 554 +       } while (1);
 555 +
 556         ieee80211_new_state(vap, IEEE80211_S_INIT, -1);
 557         if (dev->flags & IFF_RUNNING) {
 558                 dev->flags &= ~IFF_RUNNING;             /* mark us stopped */
 559 @@ -1342,9 +1366,9 @@
 560         struct ieee80211com *ic = vap->iv_ic;
 561         int rc;
 562
 563 -       IEEE80211_VAPS_LOCK_BH(ic);
 564 +       IEEE80211_VAPS_LOCK_IRQ(ic);
 565         rc = vap->iv_newstate(vap, nstate, arg);
 566 -       IEEE80211_VAPS_UNLOCK_BH(ic);
 567 +       IEEE80211_VAPS_UNLOCK_IRQ(ic);
 568         return rc;
 569  }
 570
 571 @@ -1630,6 +1654,7 @@
 572                  */
 573                 if (ni->ni_authmode != IEEE80211_AUTH_8021X)
 574                         ieee80211_node_authorize(ni);
 575 +
 576  #ifdef ATH_SUPERG_XR
 577                 /*
 578                  * fire a timer to bring up XR vap if configured.
 579 @@ -1885,8 +1910,15 @@
 580                 if (ostate == IEEE80211_S_SCAN ||
 581                     ostate == IEEE80211_S_AUTH ||
 582                     ostate == IEEE80211_S_ASSOC) {
 583 +
 584                         /* Transition (S_SCAN|S_AUTH|S_ASSOC) -> S_RUN */
 585                         __ieee80211_newstate(vap, nstate, arg);
 586 +
 587 +                       /* if we're in wds, let the ap know that we're doing this */
 588 +                       if ((vap->iv_opmode == IEEE80211_M_STA) &&
 589 +                               (vap->iv_flags_ext & IEEE80211_FEXT_WDS))
 590 +                                       ieee80211_send_nulldata(ieee80211_ref_node(vap->iv_bss));
 591 +
 592                         /* Then bring up all other vaps pending on the scan */
 593                         dstate = get_dominant_state(ic);
 594                         if (dstate == IEEE80211_S_RUN) {
 595 --- a/net80211/ieee80211.c
 596 +++ b/net80211/ieee80211.c
 597 @@ -373,10 +373,25 @@
 598  ieee80211_ifdetach(struct ieee80211com *ic)
 599  {
 600         struct ieee80211vap *vap;
 601 +       int count;
 602 +
 603 +       /* bring down all vaps */
 604 +       TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
 605 +               ieee80211_stop(vap->iv_dev);
 606 +       }
 607 +
 608 +       /* wait for all subifs to disappear */
 609 +       do {
 610 +               schedule();
 611 +               rtnl_lock();
 612 +               count = ic->ic_subifs;
 613 +               rtnl_unlock();
 614 +       } while (count > 0);
 615
 616         rtnl_lock();
 617 -       while ((vap = TAILQ_FIRST(&ic->ic_vaps)) != NULL)
 618 +       while ((vap = TAILQ_FIRST(&ic->ic_vaps)) != NULL) {
 619                 ic->ic_vap_delete(vap);
 620 +       }
 621         rtnl_unlock();
 622
 623         del_timer(&ic->ic_dfs_excl_timer);
 624 @@ -599,8 +614,10 @@
 625
 626         IEEE80211_CANCEL_TQUEUE(&vap->iv_stajoin1tq);
 627         IEEE80211_LOCK_IRQ(ic);
 628 -       if (vap->iv_wdsnode)
 629 +       if (vap->iv_wdsnode) {
 630 +               vap->iv_wdsnode->ni_subif = NULL;
 631                 ieee80211_unref_node(&vap->iv_wdsnode);
 632 +       }
 633         if ((vap->iv_opmode == IEEE80211_M_WDS) &&
 634                 (vap->iv_master != NULL))
 635                 TAILQ_REMOVE(&vap->iv_master->iv_wdslinks, vap, iv_wdsnext);
 636 --- a/ath/if_athvar.h
 637 +++ b/ath/if_athvar.h
 638 @@ -79,28 +79,6 @@
 639  #define        tasklet_enable(t)       do { (void) t; local_bh_enable(); } while (0)
 640  #endif /* !DECLARE_TASKLET */
 641
 642 -#include <linux/sched.h>
 643 -#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,41)
 644 -#include <linux/tqueue.h>
 645 -#define work_struct                    tq_struct
 646 -#define schedule_work(t)               schedule_task((t))
 647 -#define flush_scheduled_work()         flush_scheduled_tasks()
 648 -#define ATH_INIT_WORK(t, f) do {                       \
 649 -       memset((t), 0, sizeof(struct tq_struct)); \
 650 -       (t)->routine = (void (*)(void*)) (f);   \
 651 -       (t)->data=(void *) (t);                 \
 652 -} while (0)
 653 -#else
 654 -#include <linux/workqueue.h>
 655 -
 656 -#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20)
 657 -#define ATH_INIT_WORK(_t, _f)  INIT_WORK((_t), (void (*)(void *))(_f), (_t));
 658 -#else
 659 -#define ATH_INIT_WORK(_t, _f)  INIT_WORK((_t), (_f));
 660 -#endif
 661 -
 662 -#endif /* KERNEL_VERSION < 2.5.41 */
 663 -
 664  /*
 665   * Guess how the interrupt handler should work.
 666   */
 667 --- a/net80211/ieee80211_output.c
 668 +++ b/net80211/ieee80211_output.c
 669 @@ -261,6 +261,10 @@
 670                 goto bad;
 671         }
 672
 673 +       if (ni->ni_subif && (vap != ni->ni_subif) &&
 674 +               ((eh)->ether_type != __constant_htons(ETHERTYPE_PAE)))
 675 +               goto bad;
 676 +
 677         /* calculate priority so drivers can find the TX queue */
 678         if (ieee80211_classify(ni, skb)) {
 679                 IEEE80211_NOTE(vap, IEEE80211_MSG_OUTPUT, ni,
 680 @@ -340,20 +344,33 @@
 681   * constructing a frame as it sets i_fc[1]; other bits can
 682   * then be or'd in.
 683   */
 684 -static void
 685 +static struct ieee80211_frame *
 686  ieee80211_send_setup(struct ieee80211vap *vap,
 687         struct ieee80211_node *ni,
 688 -       struct ieee80211_frame *wh,
 689 +       struct sk_buff *skb,
 690         int type,
 691         const u_int8_t sa[IEEE80211_ADDR_LEN],
 692         const u_int8_t da[IEEE80211_ADDR_LEN],
 693         const u_int8_t bssid[IEEE80211_ADDR_LEN])
 694  {
 695  #define        WH4(wh) ((struct ieee80211_frame_addr4 *)wh)
 696 +       struct ieee80211_frame *wh;
 697 +       int len = sizeof(struct ieee80211_frame);
 698 +       int opmode = vap->iv_opmode;
 699 +
 700 +       if ((type & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_DATA) {
 701 +               if ((opmode == IEEE80211_M_STA) &&
 702 +                       (vap->iv_flags_ext & IEEE80211_FEXT_WDS))
 703 +                       opmode = IEEE80211_M_WDS;
 704 +
 705 +               if (opmode == IEEE80211_M_WDS)
 706 +                       len = sizeof(struct ieee80211_frame_addr4);
 707 +       }
 708
 709 +       wh = (struct ieee80211_frame *)skb_push(skb, len);
 710         wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | type;
 711         if ((type & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_DATA) {
 712 -               switch (vap->iv_opmode) {
 713 +               switch (opmode) {
 714                 case IEEE80211_M_STA:
 715                         wh->i_fc[1] = IEEE80211_FC1_DIR_TODS;
 716                         IEEE80211_ADDR_COPY(wh->i_addr1, bssid);
 717 @@ -395,6 +412,8 @@
 718         *(__le16 *)&wh->i_seq[0] =
 719             htole16(ni->ni_txseqs[0] << IEEE80211_SEQ_SEQ_SHIFT);
 720         ni->ni_txseqs[0]++;
 721 +
 722 +       return wh;
 723  #undef WH4
 724  }
 725
 726 @@ -416,9 +435,7 @@
 727
 728         SKB_CB(skb)->ni = ni;
 729
 730 -       wh = (struct ieee80211_frame *)
 731 -               skb_push(skb, sizeof(struct ieee80211_frame));
 732 -       ieee80211_send_setup(vap, ni, wh,
 733 +       wh = ieee80211_send_setup(vap, ni, skb,
 734                 IEEE80211_FC0_TYPE_MGT | type,
 735                 vap->iv_myaddr, ni->ni_macaddr, vap->iv_bssid);
 736         /* XXX power management */
 737 @@ -464,6 +481,9 @@
 738         struct ieee80211_frame *wh;
 739         u_int8_t *frm;
 740
 741 +       if (ni->ni_subif)
 742 +               vap = ni->ni_subif;
 743 +
 744         skb = ieee80211_getmgtframe(&frm, 0);
 745         if (skb == NULL) {
 746                 /* XXX debug msg */
 747 @@ -472,9 +492,7 @@
 748                 return -ENOMEM;
 749         }
 750
 751 -       wh = (struct ieee80211_frame *)
 752 -               skb_push(skb, sizeof(struct ieee80211_frame));
 753 -       ieee80211_send_setup(vap, ni, wh,
 754 +       wh = ieee80211_send_setup(vap, ni, skb,
 755                 IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_NODATA,
 756                 vap->iv_myaddr, ni->ni_macaddr, vap->iv_bssid);
 757         /* NB: power management bit is never sent by an AP */
 758 @@ -512,6 +530,7 @@
 759         struct sk_buff *skb;
 760         struct ieee80211_qosframe *qwh;
 761         u_int8_t *frm;
 762 +       u_int8_t *i_qos;
 763         int tid;
 764
 765         skb = ieee80211_getmgtframe(&frm, 2);
 766 @@ -523,11 +542,12 @@
 767         SKB_CB(skb)->ni = ieee80211_ref_node(ni);
 768
 769         skb->priority = ac;
 770 -       qwh = (struct ieee80211_qosframe *)skb_push(skb, sizeof(struct ieee80211_qosframe));
 771
 772 -       qwh = (struct ieee80211_qosframe *)skb->data;
 773 +       /* grab a pointer to QoS control and also compensate for the header length
 774 +        * difference between QoS and non-QoS frame */
 775 +       i_qos = skb_push(skb, sizeof(struct ieee80211_qosframe) - sizeof(struct ieee80211_frame));
 776
 777 -       ieee80211_send_setup(vap, ni, (struct ieee80211_frame *)qwh,
 778 +       qwh = (struct ieee80211_qosframe *) ieee80211_send_setup(vap, ni, skb,
 779                 IEEE80211_FC0_TYPE_DATA,
 780                 vap->iv_myaddr, /* SA */
 781                 ni->ni_macaddr, /* DA */
 782 @@ -541,10 +561,10 @@
 783
 784         /* map from access class/queue to 11e header priority value */
 785         tid = WME_AC_TO_TID(ac);
 786 -       qwh->i_qos[0] = tid & IEEE80211_QOS_TID;
 787 +       i_qos[0] = tid & IEEE80211_QOS_TID;
 788         if (ic->ic_wme.wme_wmeChanParams.cap_wmeParams[ac].wmep_noackPolicy)
 789                 qwh->i_qos[0] |= (1 << IEEE80211_QOS_ACKPOLICY_S) & IEEE80211_QOS_ACKPOLICY;
 790 -       qwh->i_qos[1] = 0;
 791 +       i_qos[1] = 0;
 792
 793         IEEE80211_NODE_STAT(ni, tx_data);
 794
 795 @@ -786,6 +806,8 @@
 796                 hdrsize = sizeof(struct ieee80211_frame);
 797
 798         SKB_CB(skb)->auth_pkt = (eh.ether_type == __constant_htons(ETHERTYPE_PAE));
 799 +       if (ni->ni_subif)
 800 +               vap = ni->ni_subif;
 801
 802         switch (vap->iv_opmode) {
 803         case IEEE80211_M_IBSS:
 804 @@ -805,20 +827,9 @@
 805                         ismulticast = IEEE80211_IS_MULTICAST(eh.ether_dhost);
 806                 break;
 807         case IEEE80211_M_STA:
 808 -               if ((vap->iv_flags_ext & IEEE80211_FEXT_WDS) &&
 809 -                   !IEEE80211_ADDR_EQ(eh.ether_shost, vap->iv_myaddr)) {
 810 +               if (vap->iv_flags_ext & IEEE80211_FEXT_WDS) {
 811                         use4addr = 1;
 812 -                       ismulticast = IEEE80211_IS_MULTICAST(ni->ni_macaddr);
 813 -                       /* Add a WDS entry to the station VAP */
 814 -                       if (IEEE80211_IS_MULTICAST(eh.ether_dhost)) {
 815 -                               struct ieee80211_node_table *nt = &ic->ic_sta;
 816 -                               struct ieee80211_node *ni_wds
 817 -                                       = ieee80211_find_wds_node(nt, eh.ether_shost);
 818 -                               if (ni_wds)
 819 -                                       ieee80211_unref_node(&ni_wds);
 820 -                               else
 821 -                                       ieee80211_add_wds_addr(nt, ni, eh.ether_shost, 0);
 822 -                       }
 823 +                       ismulticast = 0;
 824                 } else
 825                         ismulticast = IEEE80211_IS_MULTICAST(vap->iv_bssid);
 826                 break;
 827 @@ -1689,9 +1700,7 @@
 828
 829         SKB_CB(skb)->ni = ieee80211_ref_node(ni);
 830
 831 -       wh = (struct ieee80211_frame *)
 832 -               skb_push(skb, sizeof(struct ieee80211_frame));
 833 -       ieee80211_send_setup(vap, ni, wh,
 834 +       wh = ieee80211_send_setup(vap, ni, skb,
 835                 IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_REQ,
 836                 sa, da, bssid);
 837         /* XXX power management? */
 838 --- a/net80211/ieee80211_linux.c
 839 +++ b/net80211/ieee80211_linux.c
 840 @@ -145,7 +145,7 @@
 841         struct sk_buff *skb;
 842         u_int len;
 843
 844 -       len = roundup(sizeof(struct ieee80211_frame) + pktlen, 4);
 845 +       len = roundup(sizeof(struct ieee80211_frame_addr4) + pktlen, 4);
 846  #ifdef IEEE80211_DEBUG_REFCNT
 847         skb = ieee80211_dev_alloc_skb_debug(len + align - 1, func, line);
 848  #else
 849 @@ -161,7 +161,7 @@
 850                 SKB_CB(skb)->flags = 0;
 851                 SKB_CB(skb)->next = NULL;
 852
 853 -               skb_reserve(skb, sizeof(struct ieee80211_frame));
 854 +               skb_reserve(skb, sizeof(struct ieee80211_frame_addr4));
 855                 *frm = skb_put(skb, pktlen);
 856         }
 857         return skb;