main.c revision ad81b2f97d42e13ef78bb3798e046cd5f0492980
1/*
2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2005-2006, Devicescape Software, Inc.
4 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
9 */
10
11#include <net/mac80211.h>
12#include <net/ieee80211_radiotap.h>
13#include <linux/module.h>
14#include <linux/init.h>
15#include <linux/netdevice.h>
16#include <linux/types.h>
17#include <linux/slab.h>
18#include <linux/skbuff.h>
19#include <linux/etherdevice.h>
20#include <linux/if_arp.h>
21#include <linux/wireless.h>
22#include <linux/rtnetlink.h>
23#include <linux/bitmap.h>
24#include <net/net_namespace.h>
25#include <net/cfg80211.h>
26
27#include "ieee80211_i.h"
28#include "rate.h"
29#include "mesh.h"
30#include "wep.h"
31#include "wme.h"
32#include "aes_ccm.h"
33#include "led.h"
34#include "cfg.h"
35#include "debugfs.h"
36#include "debugfs_netdev.h"
37
38#define SUPP_MCS_SET_LEN 16
39
40/*
41 * For seeing transmitted packets on monitor interfaces
42 * we have a radiotap header too.
43 */
44struct ieee80211_tx_status_rtap_hdr {
45	struct ieee80211_radiotap_header hdr;
46	__le16 tx_flags;
47	u8 data_retries;
48} __attribute__ ((packed));
49
50/* common interface routines */
51
52static int header_parse_80211(const struct sk_buff *skb, unsigned char *haddr)
53{
54	memcpy(haddr, skb_mac_header(skb) + 10, ETH_ALEN); /* addr2 */
55	return ETH_ALEN;
56}
57
58/* must be called under mdev tx lock */
59static void ieee80211_configure_filter(struct ieee80211_local *local)
60{
61	unsigned int changed_flags;
62	unsigned int new_flags = 0;
63
64	if (atomic_read(&local->iff_promiscs))
65		new_flags |= FIF_PROMISC_IN_BSS;
66
67	if (atomic_read(&local->iff_allmultis))
68		new_flags |= FIF_ALLMULTI;
69
70	if (local->monitors)
71		new_flags |= FIF_BCN_PRBRESP_PROMISC;
72
73	if (local->fif_fcsfail)
74		new_flags |= FIF_FCSFAIL;
75
76	if (local->fif_plcpfail)
77		new_flags |= FIF_PLCPFAIL;
78
79	if (local->fif_control)
80		new_flags |= FIF_CONTROL;
81
82	if (local->fif_other_bss)
83		new_flags |= FIF_OTHER_BSS;
84
85	changed_flags = local->filter_flags ^ new_flags;
86
87	/* be a bit nasty */
88	new_flags |= (1<<31);
89
90	local->ops->configure_filter(local_to_hw(local),
91				     changed_flags, &new_flags,
92				     local->mdev->mc_count,
93				     local->mdev->mc_list);
94
95	WARN_ON(new_flags & (1<<31));
96
97	local->filter_flags = new_flags & ~(1<<31);
98}
99
100/* master interface */
101
102static int ieee80211_master_open(struct net_device *dev)
103{
104	struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
105	struct ieee80211_sub_if_data *sdata;
106	int res = -EOPNOTSUPP;
107
108	/* we hold the RTNL here so can safely walk the list */
109	list_for_each_entry(sdata, &local->interfaces, list) {
110		if (sdata->dev != dev && netif_running(sdata->dev)) {
111			res = 0;
112			break;
113		}
114	}
115	return res;
116}
117
118static int ieee80211_master_stop(struct net_device *dev)
119{
120	struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
121	struct ieee80211_sub_if_data *sdata;
122
123	/* we hold the RTNL here so can safely walk the list */
124	list_for_each_entry(sdata, &local->interfaces, list)
125		if (sdata->dev != dev && netif_running(sdata->dev))
126			dev_close(sdata->dev);
127
128	return 0;
129}
130
131static void ieee80211_master_set_multicast_list(struct net_device *dev)
132{
133	struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
134
135	ieee80211_configure_filter(local);
136}
137
138/* regular interfaces */
139
140static int ieee80211_change_mtu(struct net_device *dev, int new_mtu)
141{
142	int meshhdrlen;
143	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
144
145	meshhdrlen = (sdata->vif.type == IEEE80211_IF_TYPE_MESH_POINT) ? 5 : 0;
146
147	/* FIX: what would be proper limits for MTU?
148	 * This interface uses 802.3 frames. */
149	if (new_mtu < 256 ||
150		new_mtu > IEEE80211_MAX_DATA_LEN - 24 - 6 - meshhdrlen) {
151		printk(KERN_WARNING "%s: invalid MTU %d\n",
152		       dev->name, new_mtu);
153		return -EINVAL;
154	}
155
156#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
157	printk(KERN_DEBUG "%s: setting MTU %d\n", dev->name, new_mtu);
158#endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
159	dev->mtu = new_mtu;
160	return 0;
161}
162
163static inline int identical_mac_addr_allowed(int type1, int type2)
164{
165	return (type1 == IEEE80211_IF_TYPE_MNTR ||
166		type2 == IEEE80211_IF_TYPE_MNTR ||
167		(type1 == IEEE80211_IF_TYPE_AP &&
168		 type2 == IEEE80211_IF_TYPE_WDS) ||
169		(type1 == IEEE80211_IF_TYPE_WDS &&
170		 (type2 == IEEE80211_IF_TYPE_WDS ||
171		  type2 == IEEE80211_IF_TYPE_AP)) ||
172		(type1 == IEEE80211_IF_TYPE_AP &&
173		 type2 == IEEE80211_IF_TYPE_VLAN) ||
174		(type1 == IEEE80211_IF_TYPE_VLAN &&
175		 (type2 == IEEE80211_IF_TYPE_AP ||
176		  type2 == IEEE80211_IF_TYPE_VLAN)));
177}
178
179static int ieee80211_open(struct net_device *dev)
180{
181	struct ieee80211_sub_if_data *sdata, *nsdata;
182	struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
183	struct ieee80211_if_init_conf conf;
184	int res;
185	bool need_hw_reconfig = 0;
186	struct sta_info *sta;
187
188	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
189
190	/* we hold the RTNL here so can safely walk the list */
191	list_for_each_entry(nsdata, &local->interfaces, list) {
192		struct net_device *ndev = nsdata->dev;
193
194		if (ndev != dev && ndev != local->mdev && netif_running(ndev)) {
195			/*
196			 * Allow only a single IBSS interface to be up at any
197			 * time. This is restricted because beacon distribution
198			 * cannot work properly if both are in the same IBSS.
199			 *
200			 * To remove this restriction we'd have to disallow them
201			 * from setting the same SSID on different IBSS interfaces
202			 * belonging to the same hardware. Then, however, we're
203			 * faced with having to adopt two different TSF timers...
204			 */
205			if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS &&
206			    nsdata->vif.type == IEEE80211_IF_TYPE_IBSS)
207				return -EBUSY;
208
209			/*
210			 * Disallow multiple IBSS/STA mode interfaces.
211			 *
212			 * This is a technical restriction, it is possible although
213			 * most likely not IEEE 802.11 compliant to have multiple
214			 * STAs with just a single hardware (the TSF timer will not
215			 * be adjusted properly.)
216			 *
217			 * However, because mac80211 uses the master device's BSS
218			 * information for each STA/IBSS interface, doing this will
219			 * currently corrupt that BSS information completely, unless,
220			 * a not very useful case, both STAs are associated to the
221			 * same BSS.
222			 *
223			 * To remove this restriction, the BSS information needs to
224			 * be embedded in the STA/IBSS mode sdata instead of using
225			 * the master device's BSS structure.
226			 */
227			if ((sdata->vif.type == IEEE80211_IF_TYPE_STA ||
228			     sdata->vif.type == IEEE80211_IF_TYPE_IBSS) &&
229			    (nsdata->vif.type == IEEE80211_IF_TYPE_STA ||
230			     nsdata->vif.type == IEEE80211_IF_TYPE_IBSS))
231				return -EBUSY;
232
233			/*
234			 * The remaining checks are only performed for interfaces
235			 * with the same MAC address.
236			 */
237			if (compare_ether_addr(dev->dev_addr, ndev->dev_addr))
238				continue;
239
240			/*
241			 * check whether it may have the same address
242			 */
243			if (!identical_mac_addr_allowed(sdata->vif.type,
244							nsdata->vif.type))
245				return -ENOTUNIQ;
246
247			/*
248			 * can only add VLANs to enabled APs
249			 */
250			if (sdata->vif.type == IEEE80211_IF_TYPE_VLAN &&
251			    nsdata->vif.type == IEEE80211_IF_TYPE_AP)
252				sdata->u.vlan.ap = nsdata;
253		}
254	}
255
256	switch (sdata->vif.type) {
257	case IEEE80211_IF_TYPE_WDS:
258		if (!is_valid_ether_addr(sdata->u.wds.remote_addr))
259			return -ENOLINK;
260		break;
261	case IEEE80211_IF_TYPE_VLAN:
262		if (!sdata->u.vlan.ap)
263			return -ENOLINK;
264		break;
265	case IEEE80211_IF_TYPE_AP:
266	case IEEE80211_IF_TYPE_STA:
267	case IEEE80211_IF_TYPE_MNTR:
268	case IEEE80211_IF_TYPE_IBSS:
269	case IEEE80211_IF_TYPE_MESH_POINT:
270		/* no special treatment */
271		break;
272	case IEEE80211_IF_TYPE_INVALID:
273		/* cannot happen */
274		WARN_ON(1);
275		break;
276	}
277
278	if (local->open_count == 0) {
279		res = 0;
280		if (local->ops->start)
281			res = local->ops->start(local_to_hw(local));
282		if (res)
283			return res;
284		need_hw_reconfig = 1;
285		ieee80211_led_radio(local, local->hw.conf.radio_enabled);
286	}
287
288	switch (sdata->vif.type) {
289	case IEEE80211_IF_TYPE_VLAN:
290		list_add(&sdata->u.vlan.list, &sdata->u.vlan.ap->u.ap.vlans);
291		/* no need to tell driver */
292		break;
293	case IEEE80211_IF_TYPE_MNTR:
294		if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES) {
295			local->cooked_mntrs++;
296			break;
297		}
298
299		/* must be before the call to ieee80211_configure_filter */
300		local->monitors++;
301		if (local->monitors == 1)
302			local->hw.conf.flags |= IEEE80211_CONF_RADIOTAP;
303
304		if (sdata->u.mntr_flags & MONITOR_FLAG_FCSFAIL)
305			local->fif_fcsfail++;
306		if (sdata->u.mntr_flags & MONITOR_FLAG_PLCPFAIL)
307			local->fif_plcpfail++;
308		if (sdata->u.mntr_flags & MONITOR_FLAG_CONTROL)
309			local->fif_control++;
310		if (sdata->u.mntr_flags & MONITOR_FLAG_OTHER_BSS)
311			local->fif_other_bss++;
312
313		netif_tx_lock_bh(local->mdev);
314		ieee80211_configure_filter(local);
315		netif_tx_unlock_bh(local->mdev);
316		break;
317	case IEEE80211_IF_TYPE_STA:
318	case IEEE80211_IF_TYPE_IBSS:
319		sdata->u.sta.flags &= ~IEEE80211_STA_PREV_BSSID_SET;
320		/* fall through */
321	default:
322		conf.vif = &sdata->vif;
323		conf.type = sdata->vif.type;
324		conf.mac_addr = dev->dev_addr;
325		res = local->ops->add_interface(local_to_hw(local), &conf);
326		if (res)
327			goto err_stop;
328
329		ieee80211_if_config(dev);
330		ieee80211_reset_erp_info(dev);
331		ieee80211_enable_keys(sdata);
332
333		if (sdata->vif.type == IEEE80211_IF_TYPE_STA &&
334		    !(sdata->flags & IEEE80211_SDATA_USERSPACE_MLME))
335			netif_carrier_off(dev);
336		else
337			netif_carrier_on(dev);
338	}
339
340	if (sdata->vif.type == IEEE80211_IF_TYPE_WDS) {
341		/* Create STA entry for the WDS peer */
342		sta = sta_info_alloc(sdata, sdata->u.wds.remote_addr,
343				     GFP_KERNEL);
344		if (!sta) {
345			res = -ENOMEM;
346			goto err_del_interface;
347		}
348
349		sta->flags |= WLAN_STA_AUTHORIZED;
350
351		res = sta_info_insert(sta);
352		if (res) {
353			/* STA has been freed */
354			goto err_del_interface;
355		}
356	}
357
358	if (local->open_count == 0) {
359		res = dev_open(local->mdev);
360		WARN_ON(res);
361		if (res)
362			goto err_del_interface;
363		tasklet_enable(&local->tx_pending_tasklet);
364		tasklet_enable(&local->tasklet);
365	}
366
367	/*
368	 * set_multicast_list will be invoked by the networking core
369	 * which will check whether any increments here were done in
370	 * error and sync them down to the hardware as filter flags.
371	 */
372	if (sdata->flags & IEEE80211_SDATA_ALLMULTI)
373		atomic_inc(&local->iff_allmultis);
374
375	if (sdata->flags & IEEE80211_SDATA_PROMISC)
376		atomic_inc(&local->iff_promiscs);
377
378	local->open_count++;
379	if (need_hw_reconfig)
380		ieee80211_hw_config(local);
381
382	/*
383	 * ieee80211_sta_work is disabled while network interface
384	 * is down. Therefore, some configuration changes may not
385	 * yet be effective. Trigger execution of ieee80211_sta_work
386	 * to fix this.
387	 */
388	if(sdata->vif.type == IEEE80211_IF_TYPE_STA ||
389	   sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
390		struct ieee80211_if_sta *ifsta = &sdata->u.sta;
391		queue_work(local->hw.workqueue, &ifsta->work);
392	}
393
394	netif_start_queue(dev);
395
396	return 0;
397 err_del_interface:
398	local->ops->remove_interface(local_to_hw(local), &conf);
399 err_stop:
400	if (!local->open_count && local->ops->stop)
401		local->ops->stop(local_to_hw(local));
402	return res;
403}
404
405static int ieee80211_stop(struct net_device *dev)
406{
407	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
408	struct ieee80211_local *local = sdata->local;
409	struct ieee80211_if_init_conf conf;
410	struct sta_info *sta;
411
412	/*
413	 * Stop TX on this interface first.
414	 */
415	netif_stop_queue(dev);
416
417	/*
418	 * Now delete all active aggregation sessions.
419	 */
420	rcu_read_lock();
421
422	list_for_each_entry_rcu(sta, &local->sta_list, list) {
423		if (sta->sdata == sdata)
424			ieee80211_sta_tear_down_BA_sessions(dev, sta->addr);
425	}
426
427	rcu_read_unlock();
428
429	/*
430	 * Remove all stations associated with this interface.
431	 *
432	 * This must be done before calling ops->remove_interface()
433	 * because otherwise we can later invoke ops->sta_notify()
434	 * whenever the STAs are removed, and that invalidates driver
435	 * assumptions about always getting a vif pointer that is valid
436	 * (because if we remove a STA after ops->remove_interface()
437	 * the driver will have removed the vif info already!)
438	 *
439	 * We could relax this and only unlink the stations from the
440	 * hash table and list but keep them on a per-sdata list that
441	 * will be inserted back again when the interface is brought
442	 * up again, but I don't currently see a use case for that,
443	 * except with WDS which gets a STA entry created when it is
444	 * brought up.
445	 */
446	sta_info_flush(local, sdata);
447
448	/*
449	 * Don't count this interface for promisc/allmulti while it
450	 * is down. dev_mc_unsync() will invoke set_multicast_list
451	 * on the master interface which will sync these down to the
452	 * hardware as filter flags.
453	 */
454	if (sdata->flags & IEEE80211_SDATA_ALLMULTI)
455		atomic_dec(&local->iff_allmultis);
456
457	if (sdata->flags & IEEE80211_SDATA_PROMISC)
458		atomic_dec(&local->iff_promiscs);
459
460	dev_mc_unsync(local->mdev, dev);
461
462	/* APs need special treatment */
463	if (sdata->vif.type == IEEE80211_IF_TYPE_AP) {
464		struct ieee80211_sub_if_data *vlan, *tmp;
465		struct beacon_data *old_beacon = sdata->u.ap.beacon;
466
467		/* remove beacon */
468		rcu_assign_pointer(sdata->u.ap.beacon, NULL);
469		synchronize_rcu();
470		kfree(old_beacon);
471
472		/* down all dependent devices, that is VLANs */
473		list_for_each_entry_safe(vlan, tmp, &sdata->u.ap.vlans,
474					 u.vlan.list)
475			dev_close(vlan->dev);
476		WARN_ON(!list_empty(&sdata->u.ap.vlans));
477	}
478
479	local->open_count--;
480
481	switch (sdata->vif.type) {
482	case IEEE80211_IF_TYPE_VLAN:
483		list_del(&sdata->u.vlan.list);
484		sdata->u.vlan.ap = NULL;
485		/* no need to tell driver */
486		break;
487	case IEEE80211_IF_TYPE_MNTR:
488		if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES) {
489			local->cooked_mntrs--;
490			break;
491		}
492
493		local->monitors--;
494		if (local->monitors == 0)
495			local->hw.conf.flags &= ~IEEE80211_CONF_RADIOTAP;
496
497		if (sdata->u.mntr_flags & MONITOR_FLAG_FCSFAIL)
498			local->fif_fcsfail--;
499		if (sdata->u.mntr_flags & MONITOR_FLAG_PLCPFAIL)
500			local->fif_plcpfail--;
501		if (sdata->u.mntr_flags & MONITOR_FLAG_CONTROL)
502			local->fif_control--;
503		if (sdata->u.mntr_flags & MONITOR_FLAG_OTHER_BSS)
504			local->fif_other_bss--;
505
506		netif_tx_lock_bh(local->mdev);
507		ieee80211_configure_filter(local);
508		netif_tx_unlock_bh(local->mdev);
509		break;
510	case IEEE80211_IF_TYPE_MESH_POINT:
511	case IEEE80211_IF_TYPE_STA:
512	case IEEE80211_IF_TYPE_IBSS:
513		sdata->u.sta.state = IEEE80211_DISABLED;
514		memset(sdata->u.sta.bssid, 0, ETH_ALEN);
515		del_timer_sync(&sdata->u.sta.timer);
516		/*
517		 * When we get here, the interface is marked down.
518		 * Call synchronize_rcu() to wait for the RX path
519		 * should it be using the interface and enqueuing
520		 * frames at this very time on another CPU.
521		 */
522		synchronize_rcu();
523		skb_queue_purge(&sdata->u.sta.skb_queue);
524
525		if (local->scan_dev == sdata->dev) {
526			if (!local->ops->hw_scan) {
527				local->sta_sw_scanning = 0;
528				cancel_delayed_work(&local->scan_work);
529			} else
530				local->sta_hw_scanning = 0;
531		}
532
533		flush_workqueue(local->hw.workqueue);
534
535		sdata->u.sta.flags &= ~IEEE80211_STA_PRIVACY_INVOKED;
536		kfree(sdata->u.sta.extra_ie);
537		sdata->u.sta.extra_ie = NULL;
538		sdata->u.sta.extra_ie_len = 0;
539		/* fall through */
540	default:
541		conf.vif = &sdata->vif;
542		conf.type = sdata->vif.type;
543		conf.mac_addr = dev->dev_addr;
544		/* disable all keys for as long as this netdev is down */
545		ieee80211_disable_keys(sdata);
546		local->ops->remove_interface(local_to_hw(local), &conf);
547	}
548
549	if (local->open_count == 0) {
550		if (netif_running(local->mdev))
551			dev_close(local->mdev);
552
553		if (local->ops->stop)
554			local->ops->stop(local_to_hw(local));
555
556		ieee80211_led_radio(local, 0);
557
558		tasklet_disable(&local->tx_pending_tasklet);
559		tasklet_disable(&local->tasklet);
560	}
561
562	return 0;
563}
564
565int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
566{
567	struct ieee80211_local *local = hw_to_local(hw);
568	struct sta_info *sta;
569	struct ieee80211_sub_if_data *sdata;
570	u16 start_seq_num = 0;
571	u8 *state;
572	int ret;
573	DECLARE_MAC_BUF(mac);
574
575	if (tid >= STA_TID_NUM)
576		return -EINVAL;
577
578#ifdef CONFIG_MAC80211_HT_DEBUG
579	printk(KERN_DEBUG "Open BA session requested for %s tid %u\n",
580				print_mac(mac, ra), tid);
581#endif /* CONFIG_MAC80211_HT_DEBUG */
582
583	rcu_read_lock();
584
585	sta = sta_info_get(local, ra);
586	if (!sta) {
587		printk(KERN_DEBUG "Could not find the station\n");
588		rcu_read_unlock();
589		return -ENOENT;
590	}
591
592	spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
593
594	/* we have tried too many times, receiver does not want A-MPDU */
595	if (sta->ampdu_mlme.addba_req_num[tid] > HT_AGG_MAX_RETRIES) {
596		ret = -EBUSY;
597		goto start_ba_exit;
598	}
599
600	state = &sta->ampdu_mlme.tid_state_tx[tid];
601	/* check if the TID is not in aggregation flow already */
602	if (*state != HT_AGG_STATE_IDLE) {
603#ifdef CONFIG_MAC80211_HT_DEBUG
604		printk(KERN_DEBUG "BA request denied - session is not "
605				 "idle on tid %u\n", tid);
606#endif /* CONFIG_MAC80211_HT_DEBUG */
607		ret = -EAGAIN;
608		goto start_ba_exit;
609	}
610
611	/* prepare A-MPDU MLME for Tx aggregation */
612	sta->ampdu_mlme.tid_tx[tid] =
613			kmalloc(sizeof(struct tid_ampdu_tx), GFP_ATOMIC);
614	if (!sta->ampdu_mlme.tid_tx[tid]) {
615		if (net_ratelimit())
616			printk(KERN_ERR "allocate tx mlme to tid %d failed\n",
617					tid);
618		ret = -ENOMEM;
619		goto start_ba_exit;
620	}
621	/* Tx timer */
622	sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.function =
623			sta_addba_resp_timer_expired;
624	sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.data =
625			(unsigned long)&sta->timer_to_tid[tid];
626	init_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
627
628	/* ensure that TX flow won't interrupt us
629	 * until the end of the call to requeue function */
630	spin_lock_bh(&local->mdev->queue_lock);
631
632	/* create a new queue for this aggregation */
633	ret = ieee80211_ht_agg_queue_add(local, sta, tid);
634
635	/* case no queue is available to aggregation
636	 * don't switch to aggregation */
637	if (ret) {
638#ifdef CONFIG_MAC80211_HT_DEBUG
639		printk(KERN_DEBUG "BA request denied - queue unavailable for"
640					" tid %d\n", tid);
641#endif /* CONFIG_MAC80211_HT_DEBUG */
642		goto start_ba_err;
643	}
644	sdata = sta->sdata;
645
646	/* Ok, the Addba frame hasn't been sent yet, but if the driver calls the
647	 * call back right away, it must see that the flow has begun */
648	*state |= HT_ADDBA_REQUESTED_MSK;
649
650	if (local->ops->ampdu_action)
651		ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_TX_START,
652						ra, tid, &start_seq_num);
653
654	if (ret) {
655		/* No need to requeue the packets in the agg queue, since we
656		 * held the tx lock: no packet could be enqueued to the newly
657		 * allocated queue */
658		 ieee80211_ht_agg_queue_remove(local, sta, tid, 0);
659#ifdef CONFIG_MAC80211_HT_DEBUG
660		printk(KERN_DEBUG "BA request denied - HW unavailable for"
661					" tid %d\n", tid);
662#endif /* CONFIG_MAC80211_HT_DEBUG */
663		*state = HT_AGG_STATE_IDLE;
664		goto start_ba_err;
665	}
666
667	/* Will put all the packets in the new SW queue */
668	ieee80211_requeue(local, ieee802_1d_to_ac[tid]);
669	spin_unlock_bh(&local->mdev->queue_lock);
670
671	/* send an addBA request */
672	sta->ampdu_mlme.dialog_token_allocator++;
673	sta->ampdu_mlme.tid_tx[tid]->dialog_token =
674			sta->ampdu_mlme.dialog_token_allocator;
675	sta->ampdu_mlme.tid_tx[tid]->ssn = start_seq_num;
676
677	ieee80211_send_addba_request(sta->sdata->dev, ra, tid,
678			 sta->ampdu_mlme.tid_tx[tid]->dialog_token,
679			 sta->ampdu_mlme.tid_tx[tid]->ssn,
680			 0x40, 5000);
681
682	/* activate the timer for the recipient's addBA response */
683	sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.expires =
684				jiffies + ADDBA_RESP_INTERVAL;
685	add_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
686	printk(KERN_DEBUG "activated addBA response timer on tid %d\n", tid);
687	goto start_ba_exit;
688
689start_ba_err:
690	kfree(sta->ampdu_mlme.tid_tx[tid]);
691	sta->ampdu_mlme.tid_tx[tid] = NULL;
692	spin_unlock_bh(&local->mdev->queue_lock);
693	ret = -EBUSY;
694start_ba_exit:
695	spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
696	rcu_read_unlock();
697	return ret;
698}
699EXPORT_SYMBOL(ieee80211_start_tx_ba_session);
700
701int ieee80211_stop_tx_ba_session(struct ieee80211_hw *hw,
702				 u8 *ra, u16 tid,
703				 enum ieee80211_back_parties initiator)
704{
705	struct ieee80211_local *local = hw_to_local(hw);
706	struct sta_info *sta;
707	u8 *state;
708	int ret = 0;
709	DECLARE_MAC_BUF(mac);
710
711	if (tid >= STA_TID_NUM)
712		return -EINVAL;
713
714	rcu_read_lock();
715	sta = sta_info_get(local, ra);
716	if (!sta) {
717		rcu_read_unlock();
718		return -ENOENT;
719	}
720
721	/* check if the TID is in aggregation */
722	state = &sta->ampdu_mlme.tid_state_tx[tid];
723	spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
724
725	if (*state != HT_AGG_STATE_OPERATIONAL) {
726		ret = -ENOENT;
727		goto stop_BA_exit;
728	}
729
730#ifdef CONFIG_MAC80211_HT_DEBUG
731	printk(KERN_DEBUG "Tx BA session stop requested for %s tid %u\n",
732				print_mac(mac, ra), tid);
733#endif /* CONFIG_MAC80211_HT_DEBUG */
734
735	ieee80211_stop_queue(hw, sta->tid_to_tx_q[tid]);
736
737	*state = HT_AGG_STATE_REQ_STOP_BA_MSK |
738		(initiator << HT_AGG_STATE_INITIATOR_SHIFT);
739
740	if (local->ops->ampdu_action)
741		ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_TX_STOP,
742						ra, tid, NULL);
743
744	/* case HW denied going back to legacy */
745	if (ret) {
746		WARN_ON(ret != -EBUSY);
747		*state = HT_AGG_STATE_OPERATIONAL;
748		ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
749		goto stop_BA_exit;
750	}
751
752stop_BA_exit:
753	spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
754	rcu_read_unlock();
755	return ret;
756}
757EXPORT_SYMBOL(ieee80211_stop_tx_ba_session);
758
759void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
760{
761	struct ieee80211_local *local = hw_to_local(hw);
762	struct sta_info *sta;
763	u8 *state;
764	DECLARE_MAC_BUF(mac);
765
766	if (tid >= STA_TID_NUM) {
767		printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
768				tid, STA_TID_NUM);
769		return;
770	}
771
772	rcu_read_lock();
773	sta = sta_info_get(local, ra);
774	if (!sta) {
775		rcu_read_unlock();
776		printk(KERN_DEBUG "Could not find station: %s\n",
777				print_mac(mac, ra));
778		return;
779	}
780
781	state = &sta->ampdu_mlme.tid_state_tx[tid];
782	spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
783
784	if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
785		printk(KERN_DEBUG "addBA was not requested yet, state is %d\n",
786				*state);
787		spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
788		rcu_read_unlock();
789		return;
790	}
791
792	WARN_ON_ONCE(*state & HT_ADDBA_DRV_READY_MSK);
793
794	*state |= HT_ADDBA_DRV_READY_MSK;
795
796	if (*state == HT_AGG_STATE_OPERATIONAL) {
797		printk(KERN_DEBUG "Aggregation is on for tid %d \n", tid);
798		ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
799	}
800	spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
801	rcu_read_unlock();
802}
803EXPORT_SYMBOL(ieee80211_start_tx_ba_cb);
804
805void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
806{
807	struct ieee80211_local *local = hw_to_local(hw);
808	struct sta_info *sta;
809	u8 *state;
810	int agg_queue;
811	DECLARE_MAC_BUF(mac);
812
813	if (tid >= STA_TID_NUM) {
814		printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
815				tid, STA_TID_NUM);
816		return;
817	}
818
819#ifdef CONFIG_MAC80211_HT_DEBUG
820	printk(KERN_DEBUG "Stopping Tx BA session for %s tid %d\n",
821				print_mac(mac, ra), tid);
822#endif /* CONFIG_MAC80211_HT_DEBUG */
823
824	rcu_read_lock();
825	sta = sta_info_get(local, ra);
826	if (!sta) {
827		printk(KERN_DEBUG "Could not find station: %s\n",
828				print_mac(mac, ra));
829		rcu_read_unlock();
830		return;
831	}
832	state = &sta->ampdu_mlme.tid_state_tx[tid];
833
834	spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
835	if ((*state & HT_AGG_STATE_REQ_STOP_BA_MSK) == 0) {
836		printk(KERN_DEBUG "unexpected callback to A-MPDU stop\n");
837		spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
838		rcu_read_unlock();
839		return;
840	}
841
842	if (*state & HT_AGG_STATE_INITIATOR_MSK)
843		ieee80211_send_delba(sta->sdata->dev, ra, tid,
844			WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
845
846	agg_queue = sta->tid_to_tx_q[tid];
847
848	/* avoid ordering issues: we are the only one that can modify
849	 * the content of the qdiscs */
850	spin_lock_bh(&local->mdev->queue_lock);
851	/* remove the queue for this aggregation */
852	ieee80211_ht_agg_queue_remove(local, sta, tid, 1);
853	spin_unlock_bh(&local->mdev->queue_lock);
854
855	/* we just requeued the all the frames that were in the removed
856	 * queue, and since we might miss a softirq we do netif_schedule.
857	 * ieee80211_wake_queue is not used here as this queue is not
858	 * necessarily stopped */
859	netif_schedule(local->mdev);
860	*state = HT_AGG_STATE_IDLE;
861	sta->ampdu_mlme.addba_req_num[tid] = 0;
862	kfree(sta->ampdu_mlme.tid_tx[tid]);
863	sta->ampdu_mlme.tid_tx[tid] = NULL;
864	spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
865
866	rcu_read_unlock();
867}
868EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb);
869
870void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_hw *hw,
871				      const u8 *ra, u16 tid)
872{
873	struct ieee80211_local *local = hw_to_local(hw);
874	struct ieee80211_ra_tid *ra_tid;
875	struct sk_buff *skb = dev_alloc_skb(0);
876
877	if (unlikely(!skb)) {
878		if (net_ratelimit())
879			printk(KERN_WARNING "%s: Not enough memory, "
880			       "dropping start BA session", skb->dev->name);
881		return;
882	}
883	ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
884	memcpy(&ra_tid->ra, ra, ETH_ALEN);
885	ra_tid->tid = tid;
886
887	skb->pkt_type = IEEE80211_ADDBA_MSG;
888	skb_queue_tail(&local->skb_queue, skb);
889	tasklet_schedule(&local->tasklet);
890}
891EXPORT_SYMBOL(ieee80211_start_tx_ba_cb_irqsafe);
892
893void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_hw *hw,
894				     const u8 *ra, u16 tid)
895{
896	struct ieee80211_local *local = hw_to_local(hw);
897	struct ieee80211_ra_tid *ra_tid;
898	struct sk_buff *skb = dev_alloc_skb(0);
899
900	if (unlikely(!skb)) {
901		if (net_ratelimit())
902			printk(KERN_WARNING "%s: Not enough memory, "
903			       "dropping stop BA session", skb->dev->name);
904		return;
905	}
906	ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
907	memcpy(&ra_tid->ra, ra, ETH_ALEN);
908	ra_tid->tid = tid;
909
910	skb->pkt_type = IEEE80211_DELBA_MSG;
911	skb_queue_tail(&local->skb_queue, skb);
912	tasklet_schedule(&local->tasklet);
913}
914EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb_irqsafe);
915
916static void ieee80211_set_multicast_list(struct net_device *dev)
917{
918	struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
919	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
920	int allmulti, promisc, sdata_allmulti, sdata_promisc;
921
922	allmulti = !!(dev->flags & IFF_ALLMULTI);
923	promisc = !!(dev->flags & IFF_PROMISC);
924	sdata_allmulti = !!(sdata->flags & IEEE80211_SDATA_ALLMULTI);
925	sdata_promisc = !!(sdata->flags & IEEE80211_SDATA_PROMISC);
926
927	if (allmulti != sdata_allmulti) {
928		if (dev->flags & IFF_ALLMULTI)
929			atomic_inc(&local->iff_allmultis);
930		else
931			atomic_dec(&local->iff_allmultis);
932		sdata->flags ^= IEEE80211_SDATA_ALLMULTI;
933	}
934
935	if (promisc != sdata_promisc) {
936		if (dev->flags & IFF_PROMISC)
937			atomic_inc(&local->iff_promiscs);
938		else
939			atomic_dec(&local->iff_promiscs);
940		sdata->flags ^= IEEE80211_SDATA_PROMISC;
941	}
942
943	dev_mc_sync(local->mdev, dev);
944}
945
946static const struct header_ops ieee80211_header_ops = {
947	.create		= eth_header,
948	.parse		= header_parse_80211,
949	.rebuild	= eth_rebuild_header,
950	.cache		= eth_header_cache,
951	.cache_update	= eth_header_cache_update,
952};
953
954/* Must not be called for mdev */
955void ieee80211_if_setup(struct net_device *dev)
956{
957	ether_setup(dev);
958	dev->hard_start_xmit = ieee80211_subif_start_xmit;
959	dev->wireless_handlers = &ieee80211_iw_handler_def;
960	dev->set_multicast_list = ieee80211_set_multicast_list;
961	dev->change_mtu = ieee80211_change_mtu;
962	dev->open = ieee80211_open;
963	dev->stop = ieee80211_stop;
964	dev->destructor = ieee80211_if_free;
965}
966
967/* everything else */
968
969static int __ieee80211_if_config(struct net_device *dev,
970				 struct sk_buff *beacon,
971				 struct ieee80211_tx_control *control)
972{
973	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
974	struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
975	struct ieee80211_if_conf conf;
976
977	if (!local->ops->config_interface || !netif_running(dev))
978		return 0;
979
980	memset(&conf, 0, sizeof(conf));
981	conf.type = sdata->vif.type;
982	if (sdata->vif.type == IEEE80211_IF_TYPE_STA ||
983	    sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
984		conf.bssid = sdata->u.sta.bssid;
985		conf.ssid = sdata->u.sta.ssid;
986		conf.ssid_len = sdata->u.sta.ssid_len;
987	} else if (ieee80211_vif_is_mesh(&sdata->vif)) {
988		conf.beacon = beacon;
989		conf.beacon_control = control;
990		ieee80211_start_mesh(dev);
991	} else if (sdata->vif.type == IEEE80211_IF_TYPE_AP) {
992		conf.ssid = sdata->u.ap.ssid;
993		conf.ssid_len = sdata->u.ap.ssid_len;
994		conf.beacon = beacon;
995		conf.beacon_control = control;
996	}
997	return local->ops->config_interface(local_to_hw(local),
998					    &sdata->vif, &conf);
999}
1000
1001int ieee80211_if_config(struct net_device *dev)
1002{
1003	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1004	struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1005	if (sdata->vif.type == IEEE80211_IF_TYPE_MESH_POINT &&
1006	    (local->hw.flags & IEEE80211_HW_HOST_GEN_BEACON_TEMPLATE))
1007		return ieee80211_if_config_beacon(dev);
1008	return __ieee80211_if_config(dev, NULL, NULL);
1009}
1010
1011int ieee80211_if_config_beacon(struct net_device *dev)
1012{
1013	struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1014	struct ieee80211_tx_control control;
1015	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1016	struct sk_buff *skb;
1017
1018	if (!(local->hw.flags & IEEE80211_HW_HOST_GEN_BEACON_TEMPLATE))
1019		return 0;
1020	skb = ieee80211_beacon_get(local_to_hw(local), &sdata->vif,
1021				   &control);
1022	if (!skb)
1023		return -ENOMEM;
1024	return __ieee80211_if_config(dev, skb, &control);
1025}
1026
1027int ieee80211_hw_config(struct ieee80211_local *local)
1028{
1029	struct ieee80211_channel *chan;
1030	int ret = 0;
1031
1032	if (local->sta_sw_scanning)
1033		chan = local->scan_channel;
1034	else
1035		chan = local->oper_channel;
1036
1037	local->hw.conf.channel = chan;
1038
1039	if (!local->hw.conf.power_level)
1040		local->hw.conf.power_level = chan->max_power;
1041	else
1042		local->hw.conf.power_level = min(chan->max_power,
1043					       local->hw.conf.power_level);
1044
1045	local->hw.conf.max_antenna_gain = chan->max_antenna_gain;
1046
1047#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
1048	printk(KERN_DEBUG "%s: HW CONFIG: freq=%d\n",
1049	       wiphy_name(local->hw.wiphy), chan->center_freq);
1050#endif
1051
1052	if (local->open_count)
1053		ret = local->ops->config(local_to_hw(local), &local->hw.conf);
1054
1055	return ret;
1056}
1057
1058/**
1059 * ieee80211_handle_ht should be used only after legacy configuration
1060 * has been determined namely band, as ht configuration depends upon
1061 * the hardware's HT abilities for a _specific_ band.
1062 */
1063u32 ieee80211_handle_ht(struct ieee80211_local *local, int enable_ht,
1064			   struct ieee80211_ht_info *req_ht_cap,
1065			   struct ieee80211_ht_bss_info *req_bss_cap)
1066{
1067	struct ieee80211_conf *conf = &local->hw.conf;
1068	struct ieee80211_supported_band *sband;
1069	struct ieee80211_ht_info ht_conf;
1070	struct ieee80211_ht_bss_info ht_bss_conf;
1071	int i;
1072	u32 changed = 0;
1073
1074	sband = local->hw.wiphy->bands[conf->channel->band];
1075
1076	/* HT is not supported */
1077	if (!sband->ht_info.ht_supported) {
1078		conf->flags &= ~IEEE80211_CONF_SUPPORT_HT_MODE;
1079		return 0;
1080	}
1081
1082	memset(&ht_conf, 0, sizeof(struct ieee80211_ht_info));
1083	memset(&ht_bss_conf, 0, sizeof(struct ieee80211_ht_bss_info));
1084
1085	if (enable_ht) {
1086		if (!(conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE))
1087			changed |= BSS_CHANGED_HT;
1088
1089		conf->flags |= IEEE80211_CONF_SUPPORT_HT_MODE;
1090		ht_conf.ht_supported = 1;
1091
1092		ht_conf.cap = req_ht_cap->cap & sband->ht_info.cap;
1093		ht_conf.cap &= ~(IEEE80211_HT_CAP_MIMO_PS);
1094		ht_conf.cap |= sband->ht_info.cap & IEEE80211_HT_CAP_MIMO_PS;
1095
1096		for (i = 0; i < SUPP_MCS_SET_LEN; i++)
1097			ht_conf.supp_mcs_set[i] =
1098					sband->ht_info.supp_mcs_set[i] &
1099					req_ht_cap->supp_mcs_set[i];
1100
1101		ht_bss_conf.primary_channel = req_bss_cap->primary_channel;
1102		ht_bss_conf.bss_cap = req_bss_cap->bss_cap;
1103		ht_bss_conf.bss_op_mode = req_bss_cap->bss_op_mode;
1104
1105		ht_conf.ampdu_factor = req_ht_cap->ampdu_factor;
1106		ht_conf.ampdu_density = req_ht_cap->ampdu_density;
1107
1108		/* if bss configuration changed store the new one */
1109		if (memcmp(&conf->ht_conf, &ht_conf, sizeof(ht_conf)) ||
1110		    memcmp(&conf->ht_bss_conf, &ht_bss_conf, sizeof(ht_bss_conf))) {
1111			changed |= BSS_CHANGED_HT;
1112			memcpy(&conf->ht_conf, &ht_conf, sizeof(ht_conf));
1113			memcpy(&conf->ht_bss_conf, &ht_bss_conf, sizeof(ht_bss_conf));
1114		}
1115	} else {
1116		if (conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE)
1117			changed |= BSS_CHANGED_HT;
1118		conf->flags &= ~IEEE80211_CONF_SUPPORT_HT_MODE;
1119	}
1120
1121	return changed;
1122}
1123
1124void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
1125				      u32 changed)
1126{
1127	struct ieee80211_local *local = sdata->local;
1128
1129	if (!changed)
1130		return;
1131
1132	if (local->ops->bss_info_changed)
1133		local->ops->bss_info_changed(local_to_hw(local),
1134					     &sdata->vif,
1135					     &sdata->bss_conf,
1136					     changed);
1137}
1138
1139void ieee80211_reset_erp_info(struct net_device *dev)
1140{
1141	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1142
1143	sdata->bss_conf.use_cts_prot = 0;
1144	sdata->bss_conf.use_short_preamble = 0;
1145	ieee80211_bss_info_change_notify(sdata,
1146					 BSS_CHANGED_ERP_CTS_PROT |
1147					 BSS_CHANGED_ERP_PREAMBLE);
1148}
1149
1150void ieee80211_tx_status_irqsafe(struct ieee80211_hw *hw,
1151				 struct sk_buff *skb,
1152				 struct ieee80211_tx_status *status)
1153{
1154	struct ieee80211_local *local = hw_to_local(hw);
1155	struct ieee80211_tx_status *saved;
1156	int tmp;
1157
1158	skb->dev = local->mdev;
1159	saved = kmalloc(sizeof(struct ieee80211_tx_status), GFP_ATOMIC);
1160	if (unlikely(!saved)) {
1161		if (net_ratelimit())
1162			printk(KERN_WARNING "%s: Not enough memory, "
1163			       "dropping tx status", skb->dev->name);
1164		/* should be dev_kfree_skb_irq, but due to this function being
1165		 * named _irqsafe instead of just _irq we can't be sure that
1166		 * people won't call it from non-irq contexts */
1167		dev_kfree_skb_any(skb);
1168		return;
1169	}
1170	memcpy(saved, status, sizeof(struct ieee80211_tx_status));
1171	/* copy pointer to saved status into skb->cb for use by tasklet */
1172	memcpy(skb->cb, &saved, sizeof(saved));
1173
1174	skb->pkt_type = IEEE80211_TX_STATUS_MSG;
1175	skb_queue_tail(status->control.flags & IEEE80211_TXCTL_REQ_TX_STATUS ?
1176		       &local->skb_queue : &local->skb_queue_unreliable, skb);
1177	tmp = skb_queue_len(&local->skb_queue) +
1178		skb_queue_len(&local->skb_queue_unreliable);
1179	while (tmp > IEEE80211_IRQSAFE_QUEUE_LIMIT &&
1180	       (skb = skb_dequeue(&local->skb_queue_unreliable))) {
1181		memcpy(&saved, skb->cb, sizeof(saved));
1182		kfree(saved);
1183		dev_kfree_skb_irq(skb);
1184		tmp--;
1185		I802_DEBUG_INC(local->tx_status_drop);
1186	}
1187	tasklet_schedule(&local->tasklet);
1188}
1189EXPORT_SYMBOL(ieee80211_tx_status_irqsafe);
1190
1191static void ieee80211_tasklet_handler(unsigned long data)
1192{
1193	struct ieee80211_local *local = (struct ieee80211_local *) data;
1194	struct sk_buff *skb;
1195	struct ieee80211_rx_status rx_status;
1196	struct ieee80211_tx_status *tx_status;
1197	struct ieee80211_ra_tid *ra_tid;
1198
1199	while ((skb = skb_dequeue(&local->skb_queue)) ||
1200	       (skb = skb_dequeue(&local->skb_queue_unreliable))) {
1201		switch (skb->pkt_type) {
1202		case IEEE80211_RX_MSG:
1203			/* status is in skb->cb */
1204			memcpy(&rx_status, skb->cb, sizeof(rx_status));
1205			/* Clear skb->pkt_type in order to not confuse kernel
1206			 * netstack. */
1207			skb->pkt_type = 0;
1208			__ieee80211_rx(local_to_hw(local), skb, &rx_status);
1209			break;
1210		case IEEE80211_TX_STATUS_MSG:
1211			/* get pointer to saved status out of skb->cb */
1212			memcpy(&tx_status, skb->cb, sizeof(tx_status));
1213			skb->pkt_type = 0;
1214			ieee80211_tx_status(local_to_hw(local),
1215					    skb, tx_status);
1216			kfree(tx_status);
1217			break;
1218		case IEEE80211_DELBA_MSG:
1219			ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
1220			ieee80211_stop_tx_ba_cb(local_to_hw(local),
1221						ra_tid->ra, ra_tid->tid);
1222			dev_kfree_skb(skb);
1223			break;
1224		case IEEE80211_ADDBA_MSG:
1225			ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
1226			ieee80211_start_tx_ba_cb(local_to_hw(local),
1227						 ra_tid->ra, ra_tid->tid);
1228			dev_kfree_skb(skb);
1229			break ;
1230		default: /* should never get here! */
1231			printk(KERN_ERR "%s: Unknown message type (%d)\n",
1232			       wiphy_name(local->hw.wiphy), skb->pkt_type);
1233			dev_kfree_skb(skb);
1234			break;
1235		}
1236	}
1237}
1238
1239/* Remove added headers (e.g., QoS control), encryption header/MIC, etc. to
1240 * make a prepared TX frame (one that has been given to hw) to look like brand
1241 * new IEEE 802.11 frame that is ready to go through TX processing again.
1242 * Also, tx_packet_data in cb is restored from tx_control. */
1243static void ieee80211_remove_tx_extra(struct ieee80211_local *local,
1244				      struct ieee80211_key *key,
1245				      struct sk_buff *skb,
1246				      struct ieee80211_tx_control *control)
1247{
1248	int hdrlen, iv_len, mic_len;
1249	struct ieee80211_tx_packet_data *pkt_data;
1250
1251	pkt_data = (struct ieee80211_tx_packet_data *)skb->cb;
1252	pkt_data->ifindex = vif_to_sdata(control->vif)->dev->ifindex;
1253	pkt_data->flags = 0;
1254	if (control->flags & IEEE80211_TXCTL_REQ_TX_STATUS)
1255		pkt_data->flags |= IEEE80211_TXPD_REQ_TX_STATUS;
1256	if (control->flags & IEEE80211_TXCTL_DO_NOT_ENCRYPT)
1257		pkt_data->flags |= IEEE80211_TXPD_DO_NOT_ENCRYPT;
1258	if (control->flags & IEEE80211_TXCTL_REQUEUE)
1259		pkt_data->flags |= IEEE80211_TXPD_REQUEUE;
1260	if (control->flags & IEEE80211_TXCTL_EAPOL_FRAME)
1261		pkt_data->flags |= IEEE80211_TXPD_EAPOL_FRAME;
1262	pkt_data->queue = control->queue;
1263
1264	hdrlen = ieee80211_get_hdrlen_from_skb(skb);
1265
1266	if (!key)
1267		goto no_key;
1268
1269	switch (key->conf.alg) {
1270	case ALG_WEP:
1271		iv_len = WEP_IV_LEN;
1272		mic_len = WEP_ICV_LEN;
1273		break;
1274	case ALG_TKIP:
1275		iv_len = TKIP_IV_LEN;
1276		mic_len = TKIP_ICV_LEN;
1277		break;
1278	case ALG_CCMP:
1279		iv_len = CCMP_HDR_LEN;
1280		mic_len = CCMP_MIC_LEN;
1281		break;
1282	default:
1283		goto no_key;
1284	}
1285
1286	if (skb->len >= mic_len &&
1287	    !(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
1288		skb_trim(skb, skb->len - mic_len);
1289	if (skb->len >= iv_len && skb->len > hdrlen) {
1290		memmove(skb->data + iv_len, skb->data, hdrlen);
1291		skb_pull(skb, iv_len);
1292	}
1293
1294no_key:
1295	{
1296		struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1297		u16 fc = le16_to_cpu(hdr->frame_control);
1298		if ((fc & 0x8C) == 0x88) /* QoS Control Field */ {
1299			fc &= ~IEEE80211_STYPE_QOS_DATA;
1300			hdr->frame_control = cpu_to_le16(fc);
1301			memmove(skb->data + 2, skb->data, hdrlen - 2);
1302			skb_pull(skb, 2);
1303		}
1304	}
1305}
1306
1307static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
1308					    struct sta_info *sta,
1309					    struct sk_buff *skb,
1310					    struct ieee80211_tx_status *status)
1311{
1312	sta->tx_filtered_count++;
1313
1314	/*
1315	 * Clear the TX filter mask for this STA when sending the next
1316	 * packet. If the STA went to power save mode, this will happen
1317	 * when it wakes up for the next time.
1318	 */
1319	sta->flags |= WLAN_STA_CLEAR_PS_FILT;
1320
1321	/*
1322	 * This code races in the following way:
1323	 *
1324	 *  (1) STA sends frame indicating it will go to sleep and does so
1325	 *  (2) hardware/firmware adds STA to filter list, passes frame up
1326	 *  (3) hardware/firmware processes TX fifo and suppresses a frame
1327	 *  (4) we get TX status before having processed the frame and
1328	 *	knowing that the STA has gone to sleep.
1329	 *
1330	 * This is actually quite unlikely even when both those events are
1331	 * processed from interrupts coming in quickly after one another or
1332	 * even at the same time because we queue both TX status events and
1333	 * RX frames to be processed by a tasklet and process them in the
1334	 * same order that they were received or TX status last. Hence, there
1335	 * is no race as long as the frame RX is processed before the next TX
1336	 * status, which drivers can ensure, see below.
1337	 *
1338	 * Note that this can only happen if the hardware or firmware can
1339	 * actually add STAs to the filter list, if this is done by the
1340	 * driver in response to set_tim() (which will only reduce the race
1341	 * this whole filtering tries to solve, not completely solve it)
1342	 * this situation cannot happen.
1343	 *
1344	 * To completely solve this race drivers need to make sure that they
1345	 *  (a) don't mix the irq-safe/not irq-safe TX status/RX processing
1346	 *	functions and
1347	 *  (b) always process RX events before TX status events if ordering
1348	 *      can be unknown, for example with different interrupt status
1349	 *	bits.
1350	 */
1351	if (sta->flags & WLAN_STA_PS &&
1352	    skb_queue_len(&sta->tx_filtered) < STA_MAX_TX_BUFFER) {
1353		ieee80211_remove_tx_extra(local, sta->key, skb,
1354					  &status->control);
1355		skb_queue_tail(&sta->tx_filtered, skb);
1356		return;
1357	}
1358
1359	if (!(sta->flags & WLAN_STA_PS) &&
1360	    !(status->control.flags & IEEE80211_TXCTL_REQUEUE)) {
1361		/* Software retry the packet once */
1362		status->control.flags |= IEEE80211_TXCTL_REQUEUE;
1363		ieee80211_remove_tx_extra(local, sta->key, skb,
1364					  &status->control);
1365		dev_queue_xmit(skb);
1366		return;
1367	}
1368
1369	if (net_ratelimit())
1370		printk(KERN_DEBUG "%s: dropped TX filtered frame, "
1371		       "queue_len=%d PS=%d @%lu\n",
1372		       wiphy_name(local->hw.wiphy),
1373		       skb_queue_len(&sta->tx_filtered),
1374		       !!(sta->flags & WLAN_STA_PS), jiffies);
1375	dev_kfree_skb(skb);
1376}
1377
1378void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
1379			 struct ieee80211_tx_status *status)
1380{
1381	struct sk_buff *skb2;
1382	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1383	struct ieee80211_local *local = hw_to_local(hw);
1384	u16 frag, type;
1385	struct ieee80211_tx_status_rtap_hdr *rthdr;
1386	struct ieee80211_sub_if_data *sdata;
1387	struct net_device *prev_dev = NULL;
1388
1389	if (!status) {
1390		printk(KERN_ERR
1391		       "%s: ieee80211_tx_status called with NULL status\n",
1392		       wiphy_name(local->hw.wiphy));
1393		dev_kfree_skb(skb);
1394		return;
1395	}
1396
1397	rcu_read_lock();
1398
1399	if (status->excessive_retries) {
1400		struct sta_info *sta;
1401		sta = sta_info_get(local, hdr->addr1);
1402		if (sta) {
1403			if (sta->flags & WLAN_STA_PS) {
1404				/*
1405				 * The STA is in power save mode, so assume
1406				 * that this TX packet failed because of that.
1407				 */
1408				status->excessive_retries = 0;
1409				status->flags |= IEEE80211_TX_STATUS_TX_FILTERED;
1410				ieee80211_handle_filtered_frame(local, sta,
1411								skb, status);
1412				rcu_read_unlock();
1413				return;
1414			}
1415		}
1416	}
1417
1418	if (status->flags & IEEE80211_TX_STATUS_TX_FILTERED) {
1419		struct sta_info *sta;
1420		sta = sta_info_get(local, hdr->addr1);
1421		if (sta) {
1422			ieee80211_handle_filtered_frame(local, sta, skb,
1423							status);
1424			rcu_read_unlock();
1425			return;
1426		}
1427	} else
1428		rate_control_tx_status(local->mdev, skb, status);
1429
1430	rcu_read_unlock();
1431
1432	ieee80211_led_tx(local, 0);
1433
1434	/* SNMP counters
1435	 * Fragments are passed to low-level drivers as separate skbs, so these
1436	 * are actually fragments, not frames. Update frame counters only for
1437	 * the first fragment of the frame. */
1438
1439	frag = le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG;
1440	type = le16_to_cpu(hdr->frame_control) & IEEE80211_FCTL_FTYPE;
1441
1442	if (status->flags & IEEE80211_TX_STATUS_ACK) {
1443		if (frag == 0) {
1444			local->dot11TransmittedFrameCount++;
1445			if (is_multicast_ether_addr(hdr->addr1))
1446				local->dot11MulticastTransmittedFrameCount++;
1447			if (status->retry_count > 0)
1448				local->dot11RetryCount++;
1449			if (status->retry_count > 1)
1450				local->dot11MultipleRetryCount++;
1451		}
1452
1453		/* This counter shall be incremented for an acknowledged MPDU
1454		 * with an individual address in the address 1 field or an MPDU
1455		 * with a multicast address in the address 1 field of type Data
1456		 * or Management. */
1457		if (!is_multicast_ether_addr(hdr->addr1) ||
1458		    type == IEEE80211_FTYPE_DATA ||
1459		    type == IEEE80211_FTYPE_MGMT)
1460			local->dot11TransmittedFragmentCount++;
1461	} else {
1462		if (frag == 0)
1463			local->dot11FailedCount++;
1464	}
1465
1466	/* this was a transmitted frame, but now we want to reuse it */
1467	skb_orphan(skb);
1468
1469	/*
1470	 * This is a bit racy but we can avoid a lot of work
1471	 * with this test...
1472	 */
1473	if (!local->monitors && !local->cooked_mntrs) {
1474		dev_kfree_skb(skb);
1475		return;
1476	}
1477
1478	/* send frame to monitor interfaces now */
1479
1480	if (skb_headroom(skb) < sizeof(*rthdr)) {
1481		printk(KERN_ERR "ieee80211_tx_status: headroom too small\n");
1482		dev_kfree_skb(skb);
1483		return;
1484	}
1485
1486	rthdr = (struct ieee80211_tx_status_rtap_hdr*)
1487				skb_push(skb, sizeof(*rthdr));
1488
1489	memset(rthdr, 0, sizeof(*rthdr));
1490	rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
1491	rthdr->hdr.it_present =
1492		cpu_to_le32((1 << IEEE80211_RADIOTAP_TX_FLAGS) |
1493			    (1 << IEEE80211_RADIOTAP_DATA_RETRIES));
1494
1495	if (!(status->flags & IEEE80211_TX_STATUS_ACK) &&
1496	    !is_multicast_ether_addr(hdr->addr1))
1497		rthdr->tx_flags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_FAIL);
1498
1499	if ((status->control.flags & IEEE80211_TXCTL_USE_RTS_CTS) &&
1500	    (status->control.flags & IEEE80211_TXCTL_USE_CTS_PROTECT))
1501		rthdr->tx_flags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_CTS);
1502	else if (status->control.flags & IEEE80211_TXCTL_USE_RTS_CTS)
1503		rthdr->tx_flags |= cpu_to_le16(IEEE80211_RADIOTAP_F_TX_RTS);
1504
1505	rthdr->data_retries = status->retry_count;
1506
1507	/* XXX: is this sufficient for BPF? */
1508	skb_set_mac_header(skb, 0);
1509	skb->ip_summed = CHECKSUM_UNNECESSARY;
1510	skb->pkt_type = PACKET_OTHERHOST;
1511	skb->protocol = htons(ETH_P_802_2);
1512	memset(skb->cb, 0, sizeof(skb->cb));
1513
1514	rcu_read_lock();
1515	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
1516		if (sdata->vif.type == IEEE80211_IF_TYPE_MNTR) {
1517			if (!netif_running(sdata->dev))
1518				continue;
1519
1520			if (prev_dev) {
1521				skb2 = skb_clone(skb, GFP_ATOMIC);
1522				if (skb2) {
1523					skb2->dev = prev_dev;
1524					netif_rx(skb2);
1525				}
1526			}
1527
1528			prev_dev = sdata->dev;
1529		}
1530	}
1531	if (prev_dev) {
1532		skb->dev = prev_dev;
1533		netif_rx(skb);
1534		skb = NULL;
1535	}
1536	rcu_read_unlock();
1537	dev_kfree_skb(skb);
1538}
1539EXPORT_SYMBOL(ieee80211_tx_status);
1540
1541struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
1542					const struct ieee80211_ops *ops)
1543{
1544	struct ieee80211_local *local;
1545	int priv_size;
1546	struct wiphy *wiphy;
1547
1548	/* Ensure 32-byte alignment of our private data and hw private data.
1549	 * We use the wiphy priv data for both our ieee80211_local and for
1550	 * the driver's private data
1551	 *
1552	 * In memory it'll be like this:
1553	 *
1554	 * +-------------------------+
1555	 * | struct wiphy	    |
1556	 * +-------------------------+
1557	 * | struct ieee80211_local  |
1558	 * +-------------------------+
1559	 * | driver's private data   |
1560	 * +-------------------------+
1561	 *
1562	 */
1563	priv_size = ((sizeof(struct ieee80211_local) +
1564		      NETDEV_ALIGN_CONST) & ~NETDEV_ALIGN_CONST) +
1565		    priv_data_len;
1566
1567	wiphy = wiphy_new(&mac80211_config_ops, priv_size);
1568
1569	if (!wiphy)
1570		return NULL;
1571
1572	wiphy->privid = mac80211_wiphy_privid;
1573
1574	local = wiphy_priv(wiphy);
1575	local->hw.wiphy = wiphy;
1576
1577	local->hw.priv = (char *)local +
1578			 ((sizeof(struct ieee80211_local) +
1579			   NETDEV_ALIGN_CONST) & ~NETDEV_ALIGN_CONST);
1580
1581	BUG_ON(!ops->tx);
1582	BUG_ON(!ops->start);
1583	BUG_ON(!ops->stop);
1584	BUG_ON(!ops->config);
1585	BUG_ON(!ops->add_interface);
1586	BUG_ON(!ops->remove_interface);
1587	BUG_ON(!ops->configure_filter);
1588	local->ops = ops;
1589
1590	local->hw.queues = 1; /* default */
1591
1592	local->bridge_packets = 1;
1593
1594	local->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
1595	local->fragmentation_threshold = IEEE80211_MAX_FRAG_THRESHOLD;
1596	local->short_retry_limit = 7;
1597	local->long_retry_limit = 4;
1598	local->hw.conf.radio_enabled = 1;
1599
1600	INIT_LIST_HEAD(&local->interfaces);
1601
1602	spin_lock_init(&local->key_lock);
1603
1604	INIT_DELAYED_WORK(&local->scan_work, ieee80211_sta_scan_work);
1605
1606	sta_info_init(local);
1607
1608	tasklet_init(&local->tx_pending_tasklet, ieee80211_tx_pending,
1609		     (unsigned long)local);
1610	tasklet_disable(&local->tx_pending_tasklet);
1611
1612	tasklet_init(&local->tasklet,
1613		     ieee80211_tasklet_handler,
1614		     (unsigned long) local);
1615	tasklet_disable(&local->tasklet);
1616
1617	skb_queue_head_init(&local->skb_queue);
1618	skb_queue_head_init(&local->skb_queue_unreliable);
1619
1620	return local_to_hw(local);
1621}
1622EXPORT_SYMBOL(ieee80211_alloc_hw);
1623
1624int ieee80211_register_hw(struct ieee80211_hw *hw)
1625{
1626	struct ieee80211_local *local = hw_to_local(hw);
1627	const char *name;
1628	int result;
1629	enum ieee80211_band band;
1630	struct net_device *mdev;
1631	struct ieee80211_sub_if_data *sdata;
1632
1633	/*
1634	 * generic code guarantees at least one band,
1635	 * set this very early because much code assumes
1636	 * that hw.conf.channel is assigned
1637	 */
1638	for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
1639		struct ieee80211_supported_band *sband;
1640
1641		sband = local->hw.wiphy->bands[band];
1642		if (sband) {
1643			/* init channel we're on */
1644			local->hw.conf.channel =
1645			local->oper_channel =
1646			local->scan_channel = &sband->channels[0];
1647			break;
1648		}
1649	}
1650
1651	result = wiphy_register(local->hw.wiphy);
1652	if (result < 0)
1653		return result;
1654
1655	/* for now, mdev needs sub_if_data :/ */
1656	mdev = alloc_netdev(sizeof(struct ieee80211_sub_if_data),
1657			    "wmaster%d", ether_setup);
1658	if (!mdev)
1659		goto fail_mdev_alloc;
1660
1661	sdata = IEEE80211_DEV_TO_SUB_IF(mdev);
1662	mdev->ieee80211_ptr = &sdata->wdev;
1663	sdata->wdev.wiphy = local->hw.wiphy;
1664
1665	local->mdev = mdev;
1666
1667	ieee80211_rx_bss_list_init(mdev);
1668
1669	mdev->hard_start_xmit = ieee80211_master_start_xmit;
1670	mdev->open = ieee80211_master_open;
1671	mdev->stop = ieee80211_master_stop;
1672	mdev->type = ARPHRD_IEEE80211;
1673	mdev->header_ops = &ieee80211_header_ops;
1674	mdev->set_multicast_list = ieee80211_master_set_multicast_list;
1675
1676	sdata->vif.type = IEEE80211_IF_TYPE_AP;
1677	sdata->dev = mdev;
1678	sdata->local = local;
1679	sdata->u.ap.force_unicast_rateidx = -1;
1680	sdata->u.ap.max_ratectrl_rateidx = -1;
1681	ieee80211_if_sdata_init(sdata);
1682
1683	/* no RCU needed since we're still during init phase */
1684	list_add_tail(&sdata->list, &local->interfaces);
1685
1686	name = wiphy_dev(local->hw.wiphy)->driver->name;
1687	local->hw.workqueue = create_singlethread_workqueue(name);
1688	if (!local->hw.workqueue) {
1689		result = -ENOMEM;
1690		goto fail_workqueue;
1691	}
1692
1693	/*
1694	 * The hardware needs headroom for sending the frame,
1695	 * and we need some headroom for passing the frame to monitor
1696	 * interfaces, but never both at the same time.
1697	 */
1698	local->tx_headroom = max_t(unsigned int , local->hw.extra_tx_headroom,
1699				   sizeof(struct ieee80211_tx_status_rtap_hdr));
1700
1701	debugfs_hw_add(local);
1702
1703	local->hw.conf.beacon_int = 1000;
1704
1705	local->wstats_flags |= local->hw.max_rssi ?
1706			       IW_QUAL_LEVEL_UPDATED : IW_QUAL_LEVEL_INVALID;
1707	local->wstats_flags |= local->hw.max_signal ?
1708			       IW_QUAL_QUAL_UPDATED : IW_QUAL_QUAL_INVALID;
1709	local->wstats_flags |= local->hw.max_noise ?
1710			       IW_QUAL_NOISE_UPDATED : IW_QUAL_NOISE_INVALID;
1711	if (local->hw.max_rssi < 0 || local->hw.max_noise < 0)
1712		local->wstats_flags |= IW_QUAL_DBM;
1713
1714	result = sta_info_start(local);
1715	if (result < 0)
1716		goto fail_sta_info;
1717
1718	rtnl_lock();
1719	result = dev_alloc_name(local->mdev, local->mdev->name);
1720	if (result < 0)
1721		goto fail_dev;
1722
1723	memcpy(local->mdev->dev_addr, local->hw.wiphy->perm_addr, ETH_ALEN);
1724	SET_NETDEV_DEV(local->mdev, wiphy_dev(local->hw.wiphy));
1725
1726	result = register_netdevice(local->mdev);
1727	if (result < 0)
1728		goto fail_dev;
1729
1730	ieee80211_debugfs_add_netdev(IEEE80211_DEV_TO_SUB_IF(local->mdev));
1731	ieee80211_if_set_type(local->mdev, IEEE80211_IF_TYPE_AP);
1732
1733	result = ieee80211_init_rate_ctrl_alg(local,
1734					      hw->rate_control_algorithm);
1735	if (result < 0) {
1736		printk(KERN_DEBUG "%s: Failed to initialize rate control "
1737		       "algorithm\n", wiphy_name(local->hw.wiphy));
1738		goto fail_rate;
1739	}
1740
1741	result = ieee80211_wep_init(local);
1742
1743	if (result < 0) {
1744		printk(KERN_DEBUG "%s: Failed to initialize wep\n",
1745		       wiphy_name(local->hw.wiphy));
1746		goto fail_wep;
1747	}
1748
1749	ieee80211_install_qdisc(local->mdev);
1750
1751	/* add one default STA interface */
1752	result = ieee80211_if_add(local->mdev, "wlan%d", NULL,
1753				  IEEE80211_IF_TYPE_STA, NULL);
1754	if (result)
1755		printk(KERN_WARNING "%s: Failed to add default virtual iface\n",
1756		       wiphy_name(local->hw.wiphy));
1757
1758	local->reg_state = IEEE80211_DEV_REGISTERED;
1759	rtnl_unlock();
1760
1761	ieee80211_led_init(local);
1762
1763	return 0;
1764
1765fail_wep:
1766	rate_control_deinitialize(local);
1767fail_rate:
1768	ieee80211_debugfs_remove_netdev(IEEE80211_DEV_TO_SUB_IF(local->mdev));
1769	unregister_netdevice(local->mdev);
1770	local->mdev = NULL;
1771fail_dev:
1772	rtnl_unlock();
1773	sta_info_stop(local);
1774fail_sta_info:
1775	debugfs_hw_del(local);
1776	destroy_workqueue(local->hw.workqueue);
1777fail_workqueue:
1778	if (local->mdev != NULL) {
1779		ieee80211_if_free(local->mdev);
1780		local->mdev = NULL;
1781	}
1782fail_mdev_alloc:
1783	wiphy_unregister(local->hw.wiphy);
1784	return result;
1785}
1786EXPORT_SYMBOL(ieee80211_register_hw);
1787
1788void ieee80211_unregister_hw(struct ieee80211_hw *hw)
1789{
1790	struct ieee80211_local *local = hw_to_local(hw);
1791	struct ieee80211_sub_if_data *sdata, *tmp;
1792
1793	tasklet_kill(&local->tx_pending_tasklet);
1794	tasklet_kill(&local->tasklet);
1795
1796	rtnl_lock();
1797
1798	BUG_ON(local->reg_state != IEEE80211_DEV_REGISTERED);
1799
1800	local->reg_state = IEEE80211_DEV_UNREGISTERED;
1801
1802	/*
1803	 * At this point, interface list manipulations are fine
1804	 * because the driver cannot be handing us frames any
1805	 * more and the tasklet is killed.
1806	 */
1807
1808	/*
1809	 * First, we remove all non-master interfaces. Do this because they
1810	 * may have bss pointer dependency on the master, and when we free
1811	 * the master these would be freed as well, breaking our list
1812	 * iteration completely.
1813	 */
1814	list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) {
1815		if (sdata->dev == local->mdev)
1816			continue;
1817		list_del(&sdata->list);
1818		__ieee80211_if_del(local, sdata);
1819	}
1820
1821	/* then, finally, remove the master interface */
1822	__ieee80211_if_del(local, IEEE80211_DEV_TO_SUB_IF(local->mdev));
1823
1824	rtnl_unlock();
1825
1826	ieee80211_rx_bss_list_deinit(local->mdev);
1827	ieee80211_clear_tx_pending(local);
1828	sta_info_stop(local);
1829	rate_control_deinitialize(local);
1830	debugfs_hw_del(local);
1831
1832	if (skb_queue_len(&local->skb_queue)
1833			|| skb_queue_len(&local->skb_queue_unreliable))
1834		printk(KERN_WARNING "%s: skb_queue not empty\n",
1835		       wiphy_name(local->hw.wiphy));
1836	skb_queue_purge(&local->skb_queue);
1837	skb_queue_purge(&local->skb_queue_unreliable);
1838
1839	destroy_workqueue(local->hw.workqueue);
1840	wiphy_unregister(local->hw.wiphy);
1841	ieee80211_wep_free(local);
1842	ieee80211_led_exit(local);
1843	ieee80211_if_free(local->mdev);
1844	local->mdev = NULL;
1845}
1846EXPORT_SYMBOL(ieee80211_unregister_hw);
1847
1848void ieee80211_free_hw(struct ieee80211_hw *hw)
1849{
1850	struct ieee80211_local *local = hw_to_local(hw);
1851
1852	wiphy_free(local->hw.wiphy);
1853}
1854EXPORT_SYMBOL(ieee80211_free_hw);
1855
1856static int __init ieee80211_init(void)
1857{
1858	struct sk_buff *skb;
1859	int ret;
1860
1861	BUILD_BUG_ON(sizeof(struct ieee80211_tx_packet_data) > sizeof(skb->cb));
1862
1863	ret = rc80211_pid_init();
1864	if (ret)
1865		goto out;
1866
1867	ret = ieee80211_wme_register();
1868	if (ret) {
1869		printk(KERN_DEBUG "ieee80211_init: failed to "
1870		       "initialize WME (err=%d)\n", ret);
1871		goto out_cleanup_pid;
1872	}
1873
1874	ieee80211_debugfs_netdev_init();
1875
1876	return 0;
1877
1878 out_cleanup_pid:
1879	rc80211_pid_exit();
1880 out:
1881	return ret;
1882}
1883
1884static void __exit ieee80211_exit(void)
1885{
1886	rc80211_pid_exit();
1887
1888	/*
1889	 * For key todo, it'll be empty by now but the work
1890	 * might still be scheduled.
1891	 */
1892	flush_scheduled_work();
1893
1894	if (mesh_allocated)
1895		ieee80211s_stop();
1896
1897	ieee80211_wme_unregister();
1898	ieee80211_debugfs_netdev_exit();
1899}
1900
1901
1902subsys_initcall(ieee80211_init);
1903module_exit(ieee80211_exit);
1904
1905MODULE_DESCRIPTION("IEEE 802.11 subsystem");
1906MODULE_LICENSE("GPL");
1907