package/madwifi/patches/371-wds_sta_separation.patch

   1 --- a/net80211/ieee80211_input.c
   2 +++ b/net80211/ieee80211_input.c
   3 @@ -202,6 +202,7 @@
   4         struct ieee80211com *ic = vap->iv_ic;
   5         struct net_device *dev = vap->iv_dev;
   6         struct ieee80211_node *ni_wds = NULL;
   7 +       struct net_device_stats *stats;
   8         struct ieee80211_frame *wh;
   9         struct ieee80211_key *key;
  10         struct ether_header *eh;
  11 @@ -435,7 +436,7 @@
  12
  13         switch (type) {
  14         case IEEE80211_FC0_TYPE_DATA:
  15 -               hdrspace = ieee80211_hdrspace(ic, wh);
  16 +               hdrspace = ieee80211_hdrsize(wh);
  17                 if (skb->len < hdrspace) {
  18                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
  19                                 wh, "data", "too short: len %u, expecting %u",
  20 @@ -445,16 +446,24 @@
  21                 }
  22                 switch (vap->iv_opmode) {
  23                 case IEEE80211_M_STA:
  24 -                       if ((dir != IEEE80211_FC1_DIR_FROMDS) &&
  25 -                           (!((vap->iv_flags_ext & IEEE80211_FEXT_WDS) &&
  26 -                           (dir == IEEE80211_FC1_DIR_DSTODS)))) {
  27 +                       switch(dir) {
  28 +                       case IEEE80211_FC1_DIR_FROMDS:
  29 +                               break;
  30 +                       case IEEE80211_FC1_DIR_DSTODS:
  31 +                               if (vap->iv_flags_ext & IEEE80211_FEXT_WDS)
  32 +                                       break;
  33 +                       default:
  34                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
  35                                         wh, "data", "invalid dir 0x%x", dir);
  36                                 vap->iv_stats.is_rx_wrongdir++;
  37                                 goto out;
  38                         }
  39
  40 -                       if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
  41 +                       if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
  42 +                               /* ignore 3-addr mcast if we're WDS STA */
  43 +                               if (vap->iv_flags_ext & IEEE80211_FEXT_WDS)
  44 +                                       goto out;
  45 +
  46                                 /* Discard multicast if IFF_MULTICAST not set */
  47                                 if ((0 != memcmp(wh->i_addr3, dev->broadcast, ETH_ALEN)) &&
  48                                         (0 == (dev->flags & IFF_MULTICAST))) {
  49 @@ -482,24 +491,10 @@
  50                                         vap->iv_stats.is_rx_mcastecho++;
  51                                         goto out;
  52                                 }
  53 -                               /*
  54 -                                * if it is brodcasted by me on behalf of
  55 -                                * a station behind me, drop it.
  56 -                                */
  57 -                               if (vap->iv_flags_ext & IEEE80211_FEXT_WDS) {
  58 -                                       struct ieee80211_node_table *nt;
  59 -                                       struct ieee80211_node *ni_wds;
  60 -                                       nt = &ic->ic_sta;
  61 -                                       ni_wds = ieee80211_find_wds_node(nt, wh->i_addr3);
  62 -                                       if (ni_wds) {
  63 -                                               ieee80211_unref_node(&ni_wds);
  64 -                                               IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  65 -                                                       wh, NULL, "%s",
  66 -                                                       "multicast echo originated from node behind me");
  67 -                                               vap->iv_stats.is_rx_mcastecho++;
  68 -                                               goto out;
  69 -                                       }
  70 -                               }
  71 +                       } else {
  72 +                               /* Same BSSID, but not meant for us to receive */
  73 +                               if (!IEEE80211_ADDR_EQ(wh->i_addr1, vap->iv_myaddr))
  74 +                                       goto out;
  75                         }
  76                         break;
  77                 case IEEE80211_M_IBSS:
  78 @@ -541,6 +536,11 @@
  79                                 vap->iv_stats.is_rx_notassoc++;
  80                                 goto err;
  81                         }
  82 +
  83 +                       /* subif isn't fully set up yet, drop the frame */
  84 +                       if (ni->ni_subif == ni->ni_vap)
  85 +                               goto err;
  86 +
  87                         /*
  88                          * If we're a 4 address packet, make sure we have an entry in
  89                          * the node table for the packet source address (addr4).
  90 @@ -548,9 +548,16 @@
  91                          */
  92
  93                         /* check for wds link first */
  94 -                       if (dir == IEEE80211_FC1_DIR_DSTODS) {
  95 +                       if ((dir == IEEE80211_FC1_DIR_DSTODS) && !ni->ni_subif) {
  96                                 struct ieee80211vap *avp;
  97
  98 +                               if (vap->iv_flags_ext & IEEE80211_FEXT_WDSSEP) {
  99 +                                       ieee80211_wds_addif(ni);
 100 +                                       /* we must drop frames here until the interface has
 101 +                                        * been fully separated, otherwise a bridge might get
 102 +                                        * confused */
 103 +                                       goto err;
 104 +                               }
 105                                 TAILQ_FOREACH(avp, &vap->iv_wdslinks, iv_wdsnext) {
 106                                         if (!memcmp(avp->wds_mac, wh->i_addr2, IEEE80211_ADDR_LEN)) {
 107                                                 IEEE80211_LOCK_IRQ(ni->ni_ic);
 108 @@ -566,7 +573,7 @@
 109                         }
 110
 111                         /* XXX: Useless node mgmt API; make better */
 112 -                       if ((dir == IEEE80211_FC1_DIR_DSTODS) && !ni_wds) {
 113 +                       if ((dir == IEEE80211_FC1_DIR_DSTODS) && !ni_wds && !ni->ni_subif) {
 114                                 struct ieee80211_node_table *nt = &ic->ic_sta;
 115                                 struct ieee80211_frame_addr4 *wh4;
 116
 117 @@ -626,6 +633,11 @@
 118                         goto out;
 119                 }
 120
 121 +               /* check if there is any data left */
 122 +               hdrspace = ieee80211_hdrspace(ic, wh);
 123 +               if (skb->len < hdrspace)
 124 +                       goto out;
 125 +
 126                 /*
 127                  * Handle privacy requirements.  Note that we
 128                  * must not be preempted from here until after
 129 @@ -698,8 +710,12 @@
 130                 if (! accept_data_frame(vap, ni, key, skb, eh))
 131                         goto out;
 132
 133 -               vap->iv_devstats.rx_packets++;
 134 -               vap->iv_devstats.rx_bytes += skb->len;
 135 +               if (ni->ni_subif && ((eh)->ether_type != __constant_htons(ETHERTYPE_PAE)))
 136 +                       stats = &ni->ni_subif->iv_devstats;
 137 +               else
 138 +                       stats = &vap->iv_devstats;
 139 +               stats->rx_packets++;
 140 +               stats->rx_bytes += skb->len;
 141                 IEEE80211_NODE_STAT(ni, rx_data);
 142                 IEEE80211_NODE_STAT_ADD(ni, rx_bytes, skb->len);
 143                 ic->ic_lastdata = jiffies;
 144 @@ -1132,6 +1148,13 @@
 145                 dev = vap->iv_xrvap->iv_dev;
 146  #endif
 147
 148 +       /* if the node has a wds subif, move data frames there,
 149 +        * but keep EAP traffic on the master */
 150 +       if (ni->ni_subif && ((eh)->ether_type != __constant_htons(ETHERTYPE_PAE))) {
 151 +               vap = ni->ni_subif;
 152 +               dev = vap->iv_dev;
 153 +       }
 154 +
 155         /* perform as a bridge within the vap */
 156         /* XXX intra-vap bridging only */
 157         if (vap->iv_opmode == IEEE80211_M_HOSTAP &&
 158 @@ -1157,7 +1180,16 @@
 159                         if (ni1 != NULL) {
 160                                 if (ni1->ni_vap == vap &&
 161                                     ieee80211_node_is_authorized(ni1) &&
 162 +                                       !ni1->ni_subif &&
 163                                     ni1 != vap->iv_bss) {
 164 +
 165 +                                       /* tried to bridge to a subif, drop the packet */
 166 +                                       if (ni->ni_subif) {
 167 +                                               ieee80211_unref_node(&ni1);
 168 +                                               ieee80211_dev_kfree_skb(&skb);
 169 +                                               return;
 170 +                                       }
 171 +
 172                                         skb1 = skb;
 173                                         skb = NULL;
 174                                 }
 175 --- a/net80211/ieee80211_ioctl.h
 176 +++ b/net80211/ieee80211_ioctl.h
 177 @@ -649,6 +649,7 @@
 178         IEEE80211_PARAM_BGSCAN_THRESH           = 79,   /* bg scan rssi threshold */
 179         IEEE80211_PARAM_RSSI_DIS_THR    = 80,   /* rssi threshold for disconnection */
 180         IEEE80211_PARAM_RSSI_DIS_COUNT  = 81,   /* counter for rssi threshold */
 181 +       IEEE80211_PARAM_WDS_SEP                 = 82,   /* move wds stations into separate interfaces */
 182  };
 183
 184  #define        SIOCG80211STATS                 (SIOCDEVPRIVATE+2)
 185 --- a/net80211/ieee80211_node.h
 186 +++ b/net80211/ieee80211_node.h
 187 @@ -92,11 +92,13 @@
 188   * the ieee80211com structure.
 189   */
 190  struct ieee80211_node {
 191 -       struct ieee80211vap *ni_vap;
 192 +       struct ieee80211vap *ni_vap, *ni_subif;
 193         struct ieee80211com *ni_ic;
 194         struct ieee80211_node_table *ni_table;
 195         TAILQ_ENTRY(ieee80211_node) ni_list;
 196         LIST_ENTRY(ieee80211_node) ni_hash;
 197 +       struct work_struct ni_create;   /* task for creating a subif */
 198 +       struct work_struct ni_destroy;  /* task for destroying a subif */
 199         atomic_t ni_refcnt;
 200         u_int ni_scangen;                       /* gen# for timeout scan */
 201         u_int8_t ni_authmode;                   /* authentication algorithm */
 202 @@ -430,5 +432,6 @@
 203  void ieee80211_node_leave(struct ieee80211_node *);
 204  u_int8_t ieee80211_getrssi(struct ieee80211com *);
 205  int32_t ieee80211_get_node_count(struct ieee80211com *);
 206 +void ieee80211_wds_addif(struct ieee80211_node *ni);
 207  #endif /* _NET80211_IEEE80211_NODE_H_ */
 208
 209 --- a/net80211/ieee80211_var.h
 210 +++ b/net80211/ieee80211_var.h
 211 @@ -322,6 +322,7 @@
 212         u_int8_t ic_myaddr[IEEE80211_ADDR_LEN];
 213         struct timer_list ic_inact;             /* mgmt/inactivity timer */
 214
 215 +       unsigned int ic_subifs;
 216         u_int32_t ic_flags;                     /* state flags */
 217         u_int32_t ic_flags_ext;                 /* extension of state flags */
 218         u_int32_t ic_caps;                      /* capabilities */
 219 @@ -625,6 +626,7 @@
 220  #define IEEE80211_FEXT_DROPUNENC_EAPOL 0x00000800      /* CONF: drop unencrypted eapol frames */
 221  #define IEEE80211_FEXT_APPIE_UPDATE    0x00001000      /* STATE: beacon APP IE updated */
 222  #define IEEE80211_FEXT_BGSCAN_THR      0x00002000      /* bgscan due to low rssi */
 223 +#define IEEE80211_FEXT_WDSSEP          0x00004000      /* move wds clients into separate interfaces */
 224
 225  #define IEEE80211_COM_UAPSD_ENABLE(_ic)                ((_ic)->ic_flags_ext |= IEEE80211_FEXT_UAPSD)
 226  #define IEEE80211_COM_UAPSD_DISABLE(_ic)       ((_ic)->ic_flags_ext &= ~IEEE80211_FEXT_UAPSD)
 227 --- a/net80211/ieee80211_wireless.c
 228 +++ b/net80211/ieee80211_wireless.c
 229 @@ -2867,6 +2867,14 @@
 230                 else
 231                         vap->iv_minrateindex = 0;
 232                 break;
 233 +       case IEEE80211_PARAM_WDS_SEP:
 234 +               if (vap->iv_opmode != IEEE80211_M_HOSTAP)
 235 +                       retv = -EINVAL;
 236 +               else if (value)
 237 +                       vap->iv_flags_ext |= IEEE80211_FEXT_WDSSEP;
 238 +               else
 239 +                       vap->iv_flags_ext &= ~IEEE80211_FEXT_WDSSEP;
 240 +               break;
 241  #ifdef ATH_REVERSE_ENGINEERING
 242         case IEEE80211_PARAM_DUMPREGS:
 243                 ieee80211_dump_registers(dev, info, w, extra);
 244 @@ -3223,6 +3231,9 @@
 245         case IEEE80211_PARAM_MINRATE:
 246                 param[0] = vap->iv_minrateindex;
 247                 break;
 248 +       case IEEE80211_PARAM_WDS_SEP:
 249 +               param[0] = !!(vap->iv_flags_ext & IEEE80211_FEXT_WDSSEP);
 250 +               break;
 251         default:
 252                 return -EOPNOTSUPP;
 253         }
 254 @@ -4447,6 +4458,8 @@
 255         struct ieee80211vap *vap = ni->ni_vap;
 256         size_t ielen;
 257
 258 +       if (req->vap->iv_wdsnode && ni->ni_subif)
 259 +               vap = ni->ni_subif;
 260         if (vap != req->vap && vap != req->vap->iv_xrvap)       /* only entries for this vap */
 261                 return;
 262         if ((vap->iv_opmode == IEEE80211_M_HOSTAP ||
 263 @@ -4466,6 +4479,8 @@
 264         size_t ielen, len;
 265         u_int8_t *cp;
 266
 267 +       if (req->vap->iv_wdsnode && ni->ni_subif)
 268 +               vap = ni->ni_subif;
 269         if (vap != req->vap && vap != req->vap->iv_xrvap)       /* only entries for this vap (or) xrvap */
 270                 return;
 271         if ((vap->iv_opmode == IEEE80211_M_HOSTAP ||
 272 @@ -5767,6 +5782,10 @@
 273          0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "get_minrate"},
 274         { IEEE80211_IOCTL_SETSCANLIST,
 275          IW_PRIV_TYPE_CHAR | 255, 0, "setscanlist"},
 276 +       { IEEE80211_PARAM_WDS_SEP,
 277 +        IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "wdssep"},
 278 +       { IEEE80211_PARAM_WDS_SEP,
 279 +        0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "get_wdssep"},
 280
 281  #ifdef ATH_REVERSE_ENGINEERING
 282         /*
 283 @@ -5890,6 +5909,8 @@
 284  ieee80211_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 285  {
 286         struct ieee80211vap *vap = dev->priv;
 287 +       struct ieee80211com *ic = vap->iv_ic;
 288 +       struct ieee80211_node *ni;
 289
 290         switch (cmd) {
 291         case SIOCG80211STATS:
 292 @@ -5898,8 +5919,20 @@
 293         case SIOC80211IFDESTROY:
 294                 if (!capable(CAP_NET_ADMIN))
 295                         return -EPERM;
 296 +               /* drop all node subifs */
 297 +               TAILQ_FOREACH(ni, &ic->ic_sta.nt_node, ni_list) {
 298 +                       struct ieee80211vap *avp = ni->ni_subif;
 299 +
 300 +                       if (ni->ni_vap != vap)
 301 +                               continue;
 302 +                       if (!avp)
 303 +                               continue;
 304 +                       ni->ni_subif = NULL;
 305 +                       ieee80211_stop(avp->iv_dev);
 306 +                       ic->ic_vap_delete(avp);
 307 +               }
 308                 ieee80211_stop(vap->iv_dev);    /* force state before cleanup */
 309 -               vap->iv_ic->ic_vap_delete(vap);
 310 +               ic->ic_vap_delete(vap);
 311                 return 0;
 312         case IEEE80211_IOCTL_GETKEY:
 313                 return ieee80211_ioctl_getkey(dev, (struct iwreq *) ifr);
 314 --- a/net80211/ieee80211_node.c
 315 +++ b/net80211/ieee80211_node.c
 316 @@ -47,6 +47,7 @@
 317  #include <linux/netdevice.h>
 318  #include <linux/etherdevice.h>
 319  #include <linux/random.h>
 320 +#include <linux/rtnetlink.h>
 321
 322  #include "if_media.h"
 323
 324 @@ -236,7 +237,11 @@
 325  ieee80211_node_vdetach(struct ieee80211vap *vap)
 326  {
 327         struct ieee80211com *ic = vap->iv_ic;
 328 +       struct ieee80211_node *ni;
 329
 330 +       ni = vap->iv_wdsnode;
 331 +       if (ni)
 332 +               ni->ni_subif = NULL;
 333         ieee80211_node_table_reset(&ic->ic_sta, vap);
 334         if (vap->iv_bss != NULL) {
 335                 ieee80211_unref_node(&vap->iv_bss);
 336 @@ -1134,6 +1139,57 @@
 337         return ni;
 338  }
 339
 340 +#define WDSIFNAME ".sta%d"
 341 +static void
 342 +ieee80211_wds_do_addif(struct work_struct *work)
 343 +{
 344 +       struct ieee80211_node *ni = container_of(work, struct ieee80211_node, ni_create);
 345 +       struct ieee80211vap *vap = ni->ni_vap;
 346 +       struct ieee80211com *ic = vap->iv_ic;
 347 +       struct ieee80211vap *avp;
 348 +       char *name;
 349 +
 350 +       rtnl_lock();
 351 +       /* did we get cancelled by the destroy call? */
 352 +       if (!ni->ni_subif)
 353 +               goto done;
 354 +
 355 +       ni->ni_subif = NULL;
 356 +       name = kmalloc(strlen(vap->iv_dev->name) + sizeof(WDSIFNAME) + 1, GFP_KERNEL);
 357 +       if (!name)
 358 +               goto done;
 359 +
 360 +       strcpy(name, vap->iv_dev->name);
 361 +       strcat(name, WDSIFNAME);
 362 +       avp = ieee80211_create_vap(ic, name, ic->ic_dev, IEEE80211_M_WDS, 0, vap);
 363 +       kfree(name);
 364 +       if (!avp)
 365 +               goto done;
 366 +
 367 +       memcpy(avp->wds_mac, ni->ni_bssid, IEEE80211_ADDR_LEN);
 368 +       avp->iv_wdsnode = ieee80211_ref_node(ni);
 369 +       ni->ni_subif = avp;
 370 +       ic->ic_subifs++;
 371 +
 372 +done:
 373 +       rtnl_unlock();
 374 +       ieee80211_unref_node(&ni);
 375 +}
 376 +#undef WDSIFNAME
 377 +
 378 +void ieee80211_wds_addif(struct ieee80211_node *ni)
 379 +{
 380 +       /* check if the node is split out already,
 381 +        * or if we're in progress of setting up a new interface already */
 382 +       if (ni->ni_subif)
 383 +               return;
 384 +
 385 +       ieee80211_ref_node(ni);
 386 +       ni->ni_subif = ni->ni_vap;
 387 +       IEEE80211_INIT_WORK(&ni->ni_create, ieee80211_wds_do_addif);
 388 +       schedule_work(&ni->ni_create);
 389 +}
 390 +
 391  /* Add wds address to the node table */
 392  int
 393  #ifdef IEEE80211_DEBUG_REFCNT
 394 @@ -2254,6 +2310,36 @@
 395         }
 396  }
 397
 398 +static void
 399 +ieee80211_subif_destroy(struct work_struct *work)
 400 +{
 401 +       struct ieee80211_node *ni = container_of(work, struct ieee80211_node, ni_destroy);
 402 +       struct ieee80211vap *vap;
 403 +       struct ieee80211com *ic;
 404 +
 405 +       rtnl_lock();
 406 +       vap = ni->ni_subif;
 407 +
 408 +       /* if addif is waiting for the timer to fire, cancel! */
 409 +       if (vap == ni->ni_vap) {
 410 +               ni->ni_subif = NULL;
 411 +               goto done;
 412 +       }
 413 +
 414 +       if (!vap)
 415 +               goto done;
 416 +
 417 +       ic = vap->iv_ic;
 418 +       ni->ni_subif = NULL;
 419 +       ieee80211_stop(vap->iv_dev);
 420 +       ic->ic_vap_delete(vap);
 421 +       ic->ic_subifs--;
 422 +
 423 +done:
 424 +       ieee80211_unref_node(&ni);
 425 +       rtnl_unlock();
 426 +}
 427 +
 428  /*
 429   * Handle bookkeeping for a station/neighbor leaving
 430   * the bss when operating in ap or adhoc modes.
 431 @@ -2270,6 +2356,12 @@
 432                         ni, "station with aid %d leaves (refcnt %u)",
 433                         IEEE80211_NODE_AID(ni), atomic_read(&ni->ni_refcnt));
 434
 435 +       if (ni->ni_subif) {
 436 +               ieee80211_ref_node(ni);
 437 +               IEEE80211_INIT_WORK(&ni->ni_destroy, ieee80211_subif_destroy);
 438 +               schedule_work(&ni->ni_destroy);
 439 +       }
 440 +
 441         /* From this point onwards we can no longer find the node,
 442          * so no more references are generated
 443          */
 444 --- a/net80211/ieee80211_linux.h
 445 +++ b/net80211/ieee80211_linux.h
 446 @@ -81,6 +81,12 @@
 447  #endif
 448  }
 449
 450 +#ifndef container_of
 451 +#define container_of(ptr, type, member) ({          \
 452 +    const typeof( ((type *)0)->member ) *__mptr = (ptr);    \
 453 +           (type *)( (char *)__mptr - offsetof(type,member) );})
 454 +#endif
 455 +
 456  /*
 457   * Task deferral
 458   *
 459 @@ -113,6 +119,29 @@
 460
 461  #define        IEEE80211_RESCHEDULE    schedule
 462
 463 +#include <linux/sched.h>
 464 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,41)
 465 +#include <linux/tqueue.h>
 466 +#define work_struct                    tq_struct
 467 +#define schedule_work(t)               schedule_task((t))
 468 +#define flush_scheduled_work()         flush_scheduled_tasks()
 469 +#define IEEE80211_INIT_WORK(t, f) do {                         \
 470 +       memset((t), 0, sizeof(struct tq_struct)); \
 471 +       (t)->routine = (void (*)(void*)) (f);   \
 472 +       (t)->data=(void *) (t);                 \
 473 +} while (0)
 474 +#else
 475 +#include <linux/workqueue.h>
 476 +
 477 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20)
 478 +#define IEEE80211_INIT_WORK(_t, _f)    INIT_WORK((_t), (void (*)(void *))(_f), (_t));
 479 +#else
 480 +#define IEEE80211_INIT_WORK(_t, _f)    INIT_WORK((_t), (_f));
 481 +#endif
 482 +
 483 +#endif /* KERNEL_VERSION < 2.5.41 */
 484 +
 485 +
 486  /* Locking */
 487  /* NB: beware, spin_is_locked() is not usefully defined for !(DEBUG || SMP)
 488   * because spinlocks do not exist in this configuration. Instead IRQs
 489 --- a/net80211/ieee80211_proto.c
 490 +++ b/net80211/ieee80211_proto.c
 491 @@ -1081,6 +1081,8 @@
 492  int
 493  ieee80211_open(struct net_device *dev)
 494  {
 495 +       struct ieee80211vap *vap = dev->priv;
 496 +
 497         return ieee80211_init(dev, 0);
 498  }
 499
 500 @@ -1116,11 +1118,33 @@
 501         struct ieee80211vap *vap = dev->priv;
 502         struct ieee80211com *ic = vap->iv_ic;
 503         struct net_device *parent = ic->ic_dev;
 504 +       struct ieee80211_node *tni, *ni;
 505
 506         IEEE80211_DPRINTF(vap,
 507                 IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
 508                 "%s\n", "stop running");
 509
 510 +       /* get rid of all wds nodes while we're still locked */
 511 +       do {
 512 +               ni = NULL;
 513 +
 514 +               IEEE80211_NODE_TABLE_LOCK_IRQ(&ic->ic_sta);
 515 +               TAILQ_FOREACH(tni, &ic->ic_sta.nt_node, ni_list) {
 516 +                       if (tni->ni_vap != vap)
 517 +                               continue;
 518 +                       if (!tni->ni_subif)
 519 +                               continue;
 520 +                       ni = tni;
 521 +                       break;
 522 +               }
 523 +               IEEE80211_NODE_TABLE_UNLOCK_IRQ(&ic->ic_sta);
 524 +
 525 +               if (!ni)
 526 +                       break;
 527 +
 528 +               ieee80211_node_leave(ni);
 529 +       } while (1);
 530 +
 531         ieee80211_new_state(vap, IEEE80211_S_INIT, -1);
 532         if (dev->flags & IFF_RUNNING) {
 533                 dev->flags &= ~IFF_RUNNING;             /* mark us stopped */
 534 @@ -1630,6 +1654,7 @@
 535                  */
 536                 if (ni->ni_authmode != IEEE80211_AUTH_8021X)
 537                         ieee80211_node_authorize(ni);
 538 +
 539  #ifdef ATH_SUPERG_XR
 540                 /*
 541                  * fire a timer to bring up XR vap if configured.
 542 @@ -1885,8 +1910,15 @@
 543                 if (ostate == IEEE80211_S_SCAN ||
 544                     ostate == IEEE80211_S_AUTH ||
 545                     ostate == IEEE80211_S_ASSOC) {
 546 +
 547                         /* Transition (S_SCAN|S_AUTH|S_ASSOC) -> S_RUN */
 548                         __ieee80211_newstate(vap, nstate, arg);
 549 +
 550 +                       /* if we're in wds, let the ap know that we're doing this */
 551 +                       if ((vap->iv_opmode == IEEE80211_M_STA) &&
 552 +                               (vap->iv_flags_ext & IEEE80211_FEXT_WDS))
 553 +                                       ieee80211_send_nulldata(ieee80211_ref_node(vap->iv_bss));
 554 +
 555                         /* Then bring up all other vaps pending on the scan */
 556                         dstate = get_dominant_state(ic);
 557                         if (dstate == IEEE80211_S_RUN) {
 558 --- a/net80211/ieee80211.c
 559 +++ b/net80211/ieee80211.c
 560 @@ -373,10 +373,25 @@
 561  ieee80211_ifdetach(struct ieee80211com *ic)
 562  {
 563         struct ieee80211vap *vap;
 564 +       int count;
 565 +
 566 +       /* bring down all vaps */
 567 +       TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
 568 +               ieee80211_stop(vap->iv_dev);
 569 +       }
 570 +
 571 +       /* wait for all subifs to disappear */
 572 +       do {
 573 +               schedule();
 574 +               rtnl_lock();
 575 +               count = ic->ic_subifs;
 576 +               rtnl_unlock();
 577 +       } while (count > 0);
 578
 579         rtnl_lock();
 580 -       while ((vap = TAILQ_FIRST(&ic->ic_vaps)) != NULL)
 581 +       while ((vap = TAILQ_FIRST(&ic->ic_vaps)) != NULL) {
 582                 ic->ic_vap_delete(vap);
 583 +       }
 584         rtnl_unlock();
 585
 586         del_timer(&ic->ic_dfs_excl_timer);
 587 @@ -599,8 +614,10 @@
 588
 589         IEEE80211_CANCEL_TQUEUE(&vap->iv_stajoin1tq);
 590         IEEE80211_LOCK_IRQ(ic);
 591 -       if (vap->iv_wdsnode)
 592 +       if (vap->iv_wdsnode) {
 593 +               vap->iv_wdsnode->ni_subif = NULL;
 594                 ieee80211_unref_node(&vap->iv_wdsnode);
 595 +       }
 596         if ((vap->iv_opmode == IEEE80211_M_WDS) &&
 597                 (vap->iv_master != NULL))
 598                 TAILQ_REMOVE(&vap->iv_master->iv_wdslinks, vap, iv_wdsnext);
 599 --- a/ath/if_athvar.h
 600 +++ b/ath/if_athvar.h
 601 @@ -79,28 +79,6 @@
 602  #define        tasklet_enable(t)       do { (void) t; local_bh_enable(); } while (0)
 603  #endif /* !DECLARE_TASKLET */
 604
 605 -#include <linux/sched.h>
 606 -#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,41)
 607 -#include <linux/tqueue.h>
 608 -#define work_struct                    tq_struct
 609 -#define schedule_work(t)               schedule_task((t))
 610 -#define flush_scheduled_work()         flush_scheduled_tasks()
 611 -#define ATH_INIT_WORK(t, f) do {                       \
 612 -       memset((t), 0, sizeof(struct tq_struct)); \
 613 -       (t)->routine = (void (*)(void*)) (f);   \
 614 -       (t)->data=(void *) (t);                 \
 615 -} while (0)
 616 -#else
 617 -#include <linux/workqueue.h>
 618 -
 619 -#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,20)
 620 -#define ATH_INIT_WORK(_t, _f)  INIT_WORK((_t), (void (*)(void *))(_f), (_t));
 621 -#else
 622 -#define ATH_INIT_WORK(_t, _f)  INIT_WORK((_t), (_f));
 623 -#endif
 624 -
 625 -#endif /* KERNEL_VERSION < 2.5.41 */
 626 -
 627  /*
 628   * Guess how the interrupt handler should work.
 629   */
 630 --- a/net80211/ieee80211_output.c
 631 +++ b/net80211/ieee80211_output.c
 632 @@ -261,6 +261,10 @@
 633                 goto bad;
 634         }
 635
 636 +       if (ni->ni_subif && (vap != ni->ni_subif) &&
 637 +               ((eh)->ether_type != __constant_htons(ETHERTYPE_PAE)))
 638 +               goto bad;
 639 +
 640         /* calculate priority so drivers can find the TX queue */
 641         if (ieee80211_classify(ni, skb)) {
 642                 IEEE80211_NOTE(vap, IEEE80211_MSG_OUTPUT, ni,
 643 @@ -340,20 +344,33 @@
 644   * constructing a frame as it sets i_fc[1]; other bits can
 645   * then be or'd in.
 646   */
 647 -static void
 648 +static struct ieee80211_frame *
 649  ieee80211_send_setup(struct ieee80211vap *vap,
 650         struct ieee80211_node *ni,
 651 -       struct ieee80211_frame *wh,
 652 +       struct sk_buff *skb,
 653         int type,
 654         const u_int8_t sa[IEEE80211_ADDR_LEN],
 655         const u_int8_t da[IEEE80211_ADDR_LEN],
 656         const u_int8_t bssid[IEEE80211_ADDR_LEN])
 657  {
 658  #define        WH4(wh) ((struct ieee80211_frame_addr4 *)wh)
 659 +       struct ieee80211_frame *wh;
 660 +       int len = sizeof(struct ieee80211_frame);
 661 +       int opmode = vap->iv_opmode;
 662 +
 663 +       if ((type & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_DATA) {
 664 +               if ((opmode == IEEE80211_M_STA) &&
 665 +                       (vap->iv_flags_ext & IEEE80211_FEXT_WDS))
 666 +                       opmode = IEEE80211_M_WDS;
 667 +
 668 +               if (opmode == IEEE80211_M_WDS)
 669 +                       len = sizeof(struct ieee80211_frame_addr4);
 670 +       }
 671
 672 +       wh = (struct ieee80211_frame *)skb_push(skb, len);
 673         wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | type;
 674         if ((type & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_DATA) {
 675 -               switch (vap->iv_opmode) {
 676 +               switch (opmode) {
 677                 case IEEE80211_M_STA:
 678                         wh->i_fc[1] = IEEE80211_FC1_DIR_TODS;
 679                         IEEE80211_ADDR_COPY(wh->i_addr1, bssid);
 680 @@ -395,6 +412,8 @@
 681         *(__le16 *)&wh->i_seq[0] =
 682             htole16(ni->ni_txseqs[0] << IEEE80211_SEQ_SEQ_SHIFT);
 683         ni->ni_txseqs[0]++;
 684 +
 685 +       return wh;
 686  #undef WH4
 687  }
 688
 689 @@ -416,9 +435,7 @@
 690
 691         SKB_CB(skb)->ni = ni;
 692
 693 -       wh = (struct ieee80211_frame *)
 694 -               skb_push(skb, sizeof(struct ieee80211_frame));
 695 -       ieee80211_send_setup(vap, ni, wh,
 696 +       wh = ieee80211_send_setup(vap, ni, skb,
 697                 IEEE80211_FC0_TYPE_MGT | type,
 698                 vap->iv_myaddr, ni->ni_macaddr, vap->iv_bssid);
 699         /* XXX power management */
 700 @@ -464,6 +481,9 @@
 701         struct ieee80211_frame *wh;
 702         u_int8_t *frm;
 703
 704 +       if (ni->ni_subif)
 705 +               vap = ni->ni_subif;
 706 +
 707         skb = ieee80211_getmgtframe(&frm, 0);
 708         if (skb == NULL) {
 709                 /* XXX debug msg */
 710 @@ -472,9 +492,7 @@
 711                 return -ENOMEM;
 712         }
 713
 714 -       wh = (struct ieee80211_frame *)
 715 -               skb_push(skb, sizeof(struct ieee80211_frame));
 716 -       ieee80211_send_setup(vap, ni, wh,
 717 +       wh = ieee80211_send_setup(vap, ni, skb,
 718                 IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_NODATA,
 719                 vap->iv_myaddr, ni->ni_macaddr, vap->iv_bssid);
 720         /* NB: power management bit is never sent by an AP */
 721 @@ -512,6 +530,7 @@
 722         struct sk_buff *skb;
 723         struct ieee80211_qosframe *qwh;
 724         u_int8_t *frm;
 725 +       u_int8_t *i_qos;
 726         int tid;
 727
 728         skb = ieee80211_getmgtframe(&frm, 2);
 729 @@ -523,11 +542,12 @@
 730         SKB_CB(skb)->ni = ieee80211_ref_node(ni);
 731
 732         skb->priority = ac;
 733 -       qwh = (struct ieee80211_qosframe *)skb_push(skb, sizeof(struct ieee80211_qosframe));
 734
 735 -       qwh = (struct ieee80211_qosframe *)skb->data;
 736 +       /* grab a pointer to QoS control and also compensate for the header length
 737 +        * difference between QoS and non-QoS frame */
 738 +       i_qos = skb_push(skb, sizeof(struct ieee80211_qosframe) - sizeof(struct ieee80211_frame));
 739
 740 -       ieee80211_send_setup(vap, ni, (struct ieee80211_frame *)qwh,
 741 +       qwh = (struct ieee80211_qosframe *) ieee80211_send_setup(vap, ni, skb,
 742                 IEEE80211_FC0_TYPE_DATA,
 743                 vap->iv_myaddr, /* SA */
 744                 ni->ni_macaddr, /* DA */
 745 @@ -541,10 +561,10 @@
 746
 747         /* map from access class/queue to 11e header priority value */
 748         tid = WME_AC_TO_TID(ac);
 749 -       qwh->i_qos[0] = tid & IEEE80211_QOS_TID;
 750 +       i_qos[0] = tid & IEEE80211_QOS_TID;
 751         if (ic->ic_wme.wme_wmeChanParams.cap_wmeParams[ac].wmep_noackPolicy)
 752                 qwh->i_qos[0] |= (1 << IEEE80211_QOS_ACKPOLICY_S) & IEEE80211_QOS_ACKPOLICY;
 753 -       qwh->i_qos[1] = 0;
 754 +       i_qos[1] = 0;
 755
 756         IEEE80211_NODE_STAT(ni, tx_data);
 757
 758 @@ -786,6 +806,8 @@
 759                 hdrsize = sizeof(struct ieee80211_frame);
 760
 761         SKB_CB(skb)->auth_pkt = (eh.ether_type == __constant_htons(ETHERTYPE_PAE));
 762 +       if (ni->ni_subif)
 763 +               vap = ni->ni_subif;
 764
 765         switch (vap->iv_opmode) {
 766         case IEEE80211_M_IBSS:
 767 @@ -805,20 +827,9 @@
 768                         ismulticast = IEEE80211_IS_MULTICAST(eh.ether_dhost);
 769                 break;
 770         case IEEE80211_M_STA:
 771 -               if ((vap->iv_flags_ext & IEEE80211_FEXT_WDS) &&
 772 -                   !IEEE80211_ADDR_EQ(eh.ether_shost, vap->iv_myaddr)) {
 773 +               if (vap->iv_flags_ext & IEEE80211_FEXT_WDS) {
 774                         use4addr = 1;
 775 -                       ismulticast = IEEE80211_IS_MULTICAST(ni->ni_macaddr);
 776 -                       /* Add a WDS entry to the station VAP */
 777 -                       if (IEEE80211_IS_MULTICAST(eh.ether_dhost)) {
 778 -                               struct ieee80211_node_table *nt = &ic->ic_sta;
 779 -                               struct ieee80211_node *ni_wds
 780 -                                       = ieee80211_find_wds_node(nt, eh.ether_shost);
 781 -                               if (ni_wds)
 782 -                                       ieee80211_unref_node(&ni_wds);
 783 -                               else
 784 -                                       ieee80211_add_wds_addr(nt, ni, eh.ether_shost, 0);
 785 -                       }
 786 +                       ismulticast = 0;
 787                 } else
 788                         ismulticast = IEEE80211_IS_MULTICAST(vap->iv_bssid);
 789                 break;
 790 @@ -1689,9 +1700,7 @@
 791
 792         SKB_CB(skb)->ni = ieee80211_ref_node(ni);
 793
 794 -       wh = (struct ieee80211_frame *)
 795 -               skb_push(skb, sizeof(struct ieee80211_frame));
 796 -       ieee80211_send_setup(vap, ni, wh,
 797 +       wh = ieee80211_send_setup(vap, ni, skb,
 798                 IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_REQ,
 799                 sa, da, bssid);
 800         /* XXX power management? */
 801 --- a/net80211/ieee80211_linux.c
 802 +++ b/net80211/ieee80211_linux.c
 803 @@ -145,7 +145,7 @@
 804         struct sk_buff *skb;
 805         u_int len;
 806
 807 -       len = roundup(sizeof(struct ieee80211_frame) + pktlen, 4);
 808 +       len = roundup(sizeof(struct ieee80211_frame_addr4) + pktlen, 4);
 809  #ifdef IEEE80211_DEBUG_REFCNT
 810         skb = ieee80211_dev_alloc_skb_debug(len + align - 1, func, line);
 811  #else
 812 @@ -161,7 +161,7 @@
 813                 SKB_CB(skb)->flags = 0;
 814                 SKB_CB(skb)->next = NULL;
 815
 816 -               skb_reserve(skb, sizeof(struct ieee80211_frame));
 817 +               skb_reserve(skb, sizeof(struct ieee80211_frame_addr4));
 818                 *frm = skb_put(skb, pktlen);
 819         }
 820         return skb;