Doug / smarc-fsl-linux-kernel | Embedian Git Server

Commit 3cfcf6ac6d69dc290e96416731eea5c88ac7d426

Authored by Jouni Malinen 2009-01-08 19:32:02 +0800

Committed by John W. Linville 2009-01-30 05:00:03 +0800

Exists in master and in 7 other branches

mac80211: 802.11w - Use BIP (AES-128-CMAC)

Add mechanism for managing BIP keys (IGTK) and integrate BIP into the
TX/RX paths.

Signed-off-by: Jouni Malinen <j@w1.fi>
Acked-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Showing 14 changed files with 317 additions and 21 deletions Inline Diff

drivers/net/wireless/ath5k/pcu.c
include/linux/ieee80211.h
include/linux/nl80211.h
include/net/cfg80211.h
include/net/mac80211.h
net/mac80211/cfg.c
net/mac80211/debugfs_key.c
net/mac80211/debugfs_key.h
net/mac80211/ieee80211_i.h
net/mac80211/key.c
net/mac80211/key.h
net/mac80211/rx.c
net/mac80211/tx.c
net/wireless/nl80211.c

drivers/net/wireless/ath5k/pcu.c

Diff comments View file @ 3cfcf6a

 /*
  * Copyright (c) 2004-2008 Reyk Floeter <reyk@openbsd.org>
  * Copyright (c) 2006-2008 Nick Kossifidis <mickflemm@gmail.com>
  * Copyright (c) 2007-2008 Matthew W. S. Bell  <mentor@madwifi.org>
  * Copyright (c) 2007-2008 Luis Rodriguez <mcgrof@winlab.rutgers.edu>
  * Copyright (c) 2007-2008 Pavel Roskin <proski@gnu.org>
  * Copyright (c) 2007-2008 Jiri Slaby <jirislaby@gmail.com>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
  */
 /*********************************\
 * Protocol Control Unit Functions *
 \*********************************/
 #include "ath5k.h"
 #include "reg.h"
 #include "debug.h"
 #include "base.h"
 /*******************\
 * Generic functions *
 \*******************/
 /**
  * ath5k_hw_set_opmode - Set PCU operating mode
  *
  * @ah: The &struct ath5k_hw
  *
  * Initialize PCU for the various operating modes (AP/STA etc)
  *
  * NOTE: ah->ah_op_mode must be set before calling this.
  */
 int ath5k_hw_set_opmode(struct ath5k_hw *ah)
 {
 	u32 pcu_reg, beacon_reg, low_id, high_id;
 	/* Preserve rest settings */
 	pcu_reg = ath5k_hw_reg_read(ah, AR5K_STA_ID1) & 0xffff0000;
 	pcu_reg &= ~(AR5K_STA_ID1_ADHOC | AR5K_STA_ID1_AP
 			| AR5K_STA_ID1_KEYSRCH_MODE
 			| (ah->ah_version == AR5K_AR5210 ?
 			(AR5K_STA_ID1_PWR_SV | AR5K_STA_ID1_NO_PSPOLL) : 0));
 	beacon_reg = 0;
 	ATH5K_TRACE(ah->ah_sc);
 	switch (ah->ah_op_mode) {
 	case NL80211_IFTYPE_ADHOC:
 		pcu_reg |= AR5K_STA_ID1_ADHOC | AR5K_STA_ID1_KEYSRCH_MODE;
 		beacon_reg |= AR5K_BCR_ADHOC;
 		if (ah->ah_version == AR5K_AR5210)
 			pcu_reg |= AR5K_STA_ID1_NO_PSPOLL;
 		else
 			AR5K_REG_ENABLE_BITS(ah, AR5K_CFG, AR5K_CFG_IBSS);
 		break;
 	case NL80211_IFTYPE_AP:
 	case NL80211_IFTYPE_MESH_POINT:
 		pcu_reg |= AR5K_STA_ID1_AP | AR5K_STA_ID1_KEYSRCH_MODE;
 		beacon_reg |= AR5K_BCR_AP;
 		if (ah->ah_version == AR5K_AR5210)
 			pcu_reg |= AR5K_STA_ID1_NO_PSPOLL;
 		else
 			AR5K_REG_DISABLE_BITS(ah, AR5K_CFG, AR5K_CFG_IBSS);
 		break;
 	case NL80211_IFTYPE_STATION:
 		pcu_reg |= AR5K_STA_ID1_KEYSRCH_MODE
 			| (ah->ah_version == AR5K_AR5210 ?
 				AR5K_STA_ID1_PWR_SV : 0);
 	case NL80211_IFTYPE_MONITOR:
 		pcu_reg |= AR5K_STA_ID1_KEYSRCH_MODE
 			| (ah->ah_version == AR5K_AR5210 ?
 				AR5K_STA_ID1_NO_PSPOLL : 0);
 		break;
 	default:
 		return -EINVAL;
 	}
 	/*
 	 * Set PCU registers
 	 */
 	low_id = AR5K_LOW_ID(ah->ah_sta_id);
 	high_id = AR5K_HIGH_ID(ah->ah_sta_id);
 	ath5k_hw_reg_write(ah, low_id, AR5K_STA_ID0);
 	ath5k_hw_reg_write(ah, pcu_reg | high_id, AR5K_STA_ID1);
 	/*
 	 * Set Beacon Control Register on 5210
 	 */
 	if (ah->ah_version == AR5K_AR5210)
 		ath5k_hw_reg_write(ah, beacon_reg, AR5K_BCR);
 	return 0;
 }
 /**
  * ath5k_hw_update - Update mib counters (mac layer statistics)
  *
  * @ah: The &struct ath5k_hw
  * @stats: The &struct ieee80211_low_level_stats we use to track
  * statistics on the driver
  *
  * Reads MIB counters from PCU and updates sw statistics. Must be
  * called after a MIB interrupt.
  */
 void ath5k_hw_update_mib_counters(struct ath5k_hw *ah,
 		struct ieee80211_low_level_stats  *stats)
 {
 	ATH5K_TRACE(ah->ah_sc);
 	/* Read-And-Clear */
 	stats->dot11ACKFailureCount += ath5k_hw_reg_read(ah, AR5K_ACK_FAIL);
 	stats->dot11RTSFailureCount += ath5k_hw_reg_read(ah, AR5K_RTS_FAIL);
 	stats->dot11RTSSuccessCount += ath5k_hw_reg_read(ah, AR5K_RTS_OK);
 	stats->dot11FCSErrorCount += ath5k_hw_reg_read(ah, AR5K_FCS_FAIL);
 	/* XXX: Should we use this to track beacon count ?
 	 * -we read it anyway to clear the register */
 	ath5k_hw_reg_read(ah, AR5K_BEACON_CNT);
 	/* Reset profile count registers on 5212*/
 	if (ah->ah_version == AR5K_AR5212) {
 		ath5k_hw_reg_write(ah, 0, AR5K_PROFCNT_TX);
 		ath5k_hw_reg_write(ah, 0, AR5K_PROFCNT_RX);
 		ath5k_hw_reg_write(ah, 0, AR5K_PROFCNT_RXCLR);
 		ath5k_hw_reg_write(ah, 0, AR5K_PROFCNT_CYCLE);
 	}
 	/* TODO: Handle ANI stats */
 }
 /**
  * ath5k_hw_set_ack_bitrate - set bitrate for ACKs
  *
  * @ah: The &struct ath5k_hw
  * @high: Flag to determine if we want to use high transmition rate
  * for ACKs or not
  *
  * If high flag is set, we tell hw to use a set of control rates based on
  * the current transmition rate (check out control_rates array inside reset.c).
  * If not hw just uses the lowest rate available for the current modulation
  * scheme being used (1Mbit for CCK and 6Mbits for OFDM).
  */
 void ath5k_hw_set_ack_bitrate_high(struct ath5k_hw *ah, bool high)
 {
 	if (ah->ah_version != AR5K_AR5212)
 		return;
 	else {
 		u32 val = AR5K_STA_ID1_BASE_RATE_11B | AR5K_STA_ID1_ACKCTS_6MB;
 		if (high)
 			AR5K_REG_ENABLE_BITS(ah, AR5K_STA_ID1, val);
 		else
 			AR5K_REG_DISABLE_BITS(ah, AR5K_STA_ID1, val);
 	}
 }
 /******************\
 * ACK/CTS Timeouts *
 \******************/
 /**
  * ath5k_hw_het_ack_timeout - Get ACK timeout from PCU in usec
  *
  * @ah: The &struct ath5k_hw
  */
 unsigned int ath5k_hw_get_ack_timeout(struct ath5k_hw *ah)
 {
 	ATH5K_TRACE(ah->ah_sc);
 	return ath5k_hw_clocktoh(AR5K_REG_MS(ath5k_hw_reg_read(ah,
 			AR5K_TIME_OUT), AR5K_TIME_OUT_ACK), ah->ah_turbo);
 }
 /**
  * ath5k_hw_set_ack_timeout - Set ACK timeout on PCU
  *
  * @ah: The &struct ath5k_hw
  * @timeout: Timeout in usec
  */
 int ath5k_hw_set_ack_timeout(struct ath5k_hw *ah, unsigned int timeout)
 {
 	ATH5K_TRACE(ah->ah_sc);
 	if (ath5k_hw_clocktoh(AR5K_REG_MS(0xffffffff, AR5K_TIME_OUT_ACK),
 			ah->ah_turbo) <= timeout)
 		return -EINVAL;
 	AR5K_REG_WRITE_BITS(ah, AR5K_TIME_OUT, AR5K_TIME_OUT_ACK,
 		ath5k_hw_htoclock(timeout, ah->ah_turbo));
 	return 0;
 }
 /**
  * ath5k_hw_get_cts_timeout - Get CTS timeout from PCU in usec
  *
  * @ah: The &struct ath5k_hw
  */
 unsigned int ath5k_hw_get_cts_timeout(struct ath5k_hw *ah)
 {
 	ATH5K_TRACE(ah->ah_sc);
 	return ath5k_hw_clocktoh(AR5K_REG_MS(ath5k_hw_reg_read(ah,
 			AR5K_TIME_OUT), AR5K_TIME_OUT_CTS), ah->ah_turbo);
 }
 /**
  * ath5k_hw_set_cts_timeout - Set CTS timeout on PCU
  *
  * @ah: The &struct ath5k_hw
  * @timeout: Timeout in usec
  */
 int ath5k_hw_set_cts_timeout(struct ath5k_hw *ah, unsigned int timeout)
 {
 	ATH5K_TRACE(ah->ah_sc);
 	if (ath5k_hw_clocktoh(AR5K_REG_MS(0xffffffff, AR5K_TIME_OUT_CTS),
 			ah->ah_turbo) <= timeout)
 		return -EINVAL;
 	AR5K_REG_WRITE_BITS(ah, AR5K_TIME_OUT, AR5K_TIME_OUT_CTS,
 			ath5k_hw_htoclock(timeout, ah->ah_turbo));
 	return 0;
 }
 /****************\
 * BSSID handling *
 \****************/
 /**
  * ath5k_hw_get_lladdr - Get station id
  *
  * @ah: The &struct ath5k_hw
  * @mac: The card's mac address
  *
  * Initialize ah->ah_sta_id using the mac address provided
  * (just a memcpy).
  *
  * TODO: Remove it once we merge ath5k_softc and ath5k_hw
  */
 void ath5k_hw_get_lladdr(struct ath5k_hw *ah, u8 *mac)
 {
 	ATH5K_TRACE(ah->ah_sc);
 	memcpy(mac, ah->ah_sta_id, ETH_ALEN);
 }
 /**
  * ath5k_hw_set_lladdr - Set station id
  *
  * @ah: The &struct ath5k_hw
  * @mac: The card's mac address
  *
  * Set station id on hw using the provided mac address
  */
 int ath5k_hw_set_lladdr(struct ath5k_hw *ah, const u8 *mac)
 {
 	u32 low_id, high_id;
 	u32 pcu_reg;
 	ATH5K_TRACE(ah->ah_sc);
 	/* Set new station ID */
 	memcpy(ah->ah_sta_id, mac, ETH_ALEN);
 	pcu_reg = ath5k_hw_reg_read(ah, AR5K_STA_ID1) & 0xffff0000;
 	low_id = AR5K_LOW_ID(mac);
 	high_id = AR5K_HIGH_ID(mac);
 	ath5k_hw_reg_write(ah, low_id, AR5K_STA_ID0);
 	ath5k_hw_reg_write(ah, pcu_reg | high_id, AR5K_STA_ID1);
 	return 0;
 }
 /**
  * ath5k_hw_set_associd - Set BSSID for association
  *
  * @ah: The &struct ath5k_hw
  * @bssid: BSSID
  * @assoc_id: Assoc id
  *
  * Sets the BSSID which trigers the "SME Join" operation
  */
 void ath5k_hw_set_associd(struct ath5k_hw *ah, const u8 *bssid, u16 assoc_id)
 {
 	u32 low_id, high_id;
 	u16 tim_offset = 0;
 	/*
 	 * Set simple BSSID mask on 5212
 	 */
 	if (ah->ah_version == AR5K_AR5212) {
 		ath5k_hw_reg_write(ah, AR5K_LOW_ID(ah->ah_bssid_mask),
 							AR5K_BSS_IDM0);
 		ath5k_hw_reg_write(ah, AR5K_HIGH_ID(ah->ah_bssid_mask),
 							AR5K_BSS_IDM1);
 	}
 	/*
 	 * Set BSSID which triggers the "SME Join" operation
 	 */
 	low_id = AR5K_LOW_ID(bssid);
 	high_id = AR5K_HIGH_ID(bssid);
 	ath5k_hw_reg_write(ah, low_id, AR5K_BSS_ID0);
 	ath5k_hw_reg_write(ah, high_id | ((assoc_id & 0x3fff) <<
 				AR5K_BSS_ID1_AID_S), AR5K_BSS_ID1);
 	if (assoc_id == 0) {
 		ath5k_hw_disable_pspoll(ah);
 		return;
 	}
 	AR5K_REG_WRITE_BITS(ah, AR5K_BEACON, AR5K_BEACON_TIM,
 			tim_offset ? tim_offset + 4 : 0);
 	ath5k_hw_enable_pspoll(ah, NULL, 0);
 }
 /**
  * ath5k_hw_set_bssid_mask - filter out bssids we listen
  *
  * @ah: the &struct ath5k_hw
  * @mask: the bssid_mask, a u8 array of size ETH_ALEN
  *
  * BSSID masking is a method used by AR5212 and newer hardware to inform PCU
  * which bits of the interface's MAC address should be looked at when trying
  * to decide which packets to ACK. In station mode and AP mode with a single
  * BSS every bit matters since we lock to only one BSS. In AP mode with
  * multiple BSSes (virtual interfaces) not every bit matters because hw must
  * accept frames for all BSSes and so we tweak some bits of our mac address
  * in order to have multiple BSSes.
  *
  * NOTE: This is a simple filter and does *not* filter out all
  * relevant frames. Some frames that are not for us might get ACKed from us
  * by PCU because they just match the mask.
  *
  * When handling multiple BSSes you can get the BSSID mask by computing the
  * set of  ~ ( MAC XOR BSSID ) for all bssids we handle.
  *
  * When you do this you are essentially computing the common bits of all your
  * BSSes. Later it is assumed the harware will "and" (&) the BSSID mask with
  * the MAC address to obtain the relevant bits and compare the result with
  * (frame's BSSID & mask) to see if they match.
  */
 /*
  * Simple example: on your card you have have two BSSes you have created with
  * BSSID-01 and BSSID-02. Lets assume BSSID-01 will not use the MAC address.
  * There is another BSSID-03 but you are not part of it. For simplicity's sake,
  * assuming only 4 bits for a mac address and for BSSIDs you can then have:
  *
  *                  \
  * MAC:                0001 |
  * BSSID-01:   0100 | --> Belongs to us
  * BSSID-02:   1001 |
  *                  /
  * -------------------
  * BSSID-03:   0110  | --> External
  * -------------------
  *
  * Our bssid_mask would then be:
  *
  *             On loop iteration for BSSID-01:
  *             ~(0001 ^ 0100)  -> ~(0101)
  *                             ->   1010
  *             bssid_mask      =    1010
  *
  *             On loop iteration for BSSID-02:
  *             bssid_mask &= ~(0001   ^   1001)
  *             bssid_mask =   (1010)  & ~(0001 ^ 1001)
  *             bssid_mask =   (1010)  & ~(1001)
  *             bssid_mask =   (1010)  &  (0110)
  *             bssid_mask =   0010
  *
  * A bssid_mask of 0010 means "only pay attention to the second least
  * significant bit". This is because its the only bit common
  * amongst the MAC and all BSSIDs we support. To findout what the real
  * common bit is we can simply "&" the bssid_mask now with any BSSID we have
  * or our MAC address (we assume the hardware uses the MAC address).
  *
  * Now, suppose there's an incoming frame for BSSID-03:
  *
  * IFRAME-01:  0110
  *
  * An easy eye-inspeciton of this already should tell you that this frame
  * will not pass our check. This is beacuse the bssid_mask tells the
  * hardware to only look at the second least significant bit and the
  * common bit amongst the MAC and BSSIDs is 0, this frame has the 2nd LSB
  * as 1, which does not match 0.
  *
  * So with IFRAME-01 we *assume* the hardware will do:
  *
  *     allow = (IFRAME-01 & bssid_mask) == (bssid_mask & MAC) ? 1 : 0;
  *  --> allow = (0110 & 0010) == (0010 & 0001) ? 1 : 0;
  *  --> allow = (0010) == 0000 ? 1 : 0;
  *  --> allow = 0
  *
  *  Lets now test a frame that should work:
  *
  * IFRAME-02:  0001 (we should allow)
  *
  *     allow = (0001 & 1010) == 1010
  *
  *     allow = (IFRAME-02 & bssid_mask) == (bssid_mask & MAC) ? 1 : 0;
  *  --> allow = (0001 & 0010) ==  (0010 & 0001) ? 1 :0;
  *  --> allow = (0010) == (0010)
  *  --> allow = 1
  *
  * Other examples:
  *
  * IFRAME-03:  0100 --> allowed
  * IFRAME-04:  1001 --> allowed
  * IFRAME-05:  1101 --> allowed but its not for us!!!
  *
  */
 int ath5k_hw_set_bssid_mask(struct ath5k_hw *ah, const u8 *mask)
 {
 	u32 low_id, high_id;
 	ATH5K_TRACE(ah->ah_sc);
 	/* Cache bssid mask so that we can restore it
 	 * on reset */
 	memcpy(ah->ah_bssid_mask, mask, ETH_ALEN);
 	if (ah->ah_version == AR5K_AR5212) {
 		low_id = AR5K_LOW_ID(mask);
 		high_id = AR5K_HIGH_ID(mask);
 		ath5k_hw_reg_write(ah, low_id, AR5K_BSS_IDM0);
 		ath5k_hw_reg_write(ah, high_id, AR5K_BSS_IDM1);
 		return 0;
 	}
 	return -EIO;
 }
 /************\
 * RX Control *
 \************/
 /**
  * ath5k_hw_start_rx_pcu - Start RX engine
  *
  * @ah: The &struct ath5k_hw
  *
  * Starts RX engine on PCU so that hw can process RXed frames
  * (ACK etc).
  *
  * NOTE: RX DMA should be already enabled using ath5k_hw_start_rx_dma
  * TODO: Init ANI here
  */
 void ath5k_hw_start_rx_pcu(struct ath5k_hw *ah)
 {
 	ATH5K_TRACE(ah->ah_sc);
 	AR5K_REG_DISABLE_BITS(ah, AR5K_DIAG_SW, AR5K_DIAG_SW_DIS_RX);
 }
 /**
  * at5k_hw_stop_rx_pcu - Stop RX engine
  *
  * @ah: The &struct ath5k_hw
  *
  * Stops RX engine on PCU
  *
  * TODO: Detach ANI here
  */
 void ath5k_hw_stop_rx_pcu(struct ath5k_hw *ah)
 {
 	ATH5K_TRACE(ah->ah_sc);
 	AR5K_REG_ENABLE_BITS(ah, AR5K_DIAG_SW, AR5K_DIAG_SW_DIS_RX);
 }
 /*
  * Set multicast filter
  */
 void ath5k_hw_set_mcast_filter(struct ath5k_hw *ah, u32 filter0, u32 filter1)
 {
 	ATH5K_TRACE(ah->ah_sc);
 	/* Set the multicat filter */
 	ath5k_hw_reg_write(ah, filter0, AR5K_MCAST_FILTER0);
 	ath5k_hw_reg_write(ah, filter1, AR5K_MCAST_FILTER1);
 }
 /*
  * Set multicast filter by index
  */
 int ath5k_hw_set_mcast_filter_idx(struct ath5k_hw *ah, u32 index)
 {
 	ATH5K_TRACE(ah->ah_sc);
 	if (index >= 64)
 		return -EINVAL;
 	else if (index >= 32)
 		AR5K_REG_ENABLE_BITS(ah, AR5K_MCAST_FILTER1,
 				(1 << (index - 32)));
 	else
 		AR5K_REG_ENABLE_BITS(ah, AR5K_MCAST_FILTER0, (1 << index));
 	return 0;
 }
 /*
  * Clear Multicast filter by index
  */
 int ath5k_hw_clear_mcast_filter_idx(struct ath5k_hw *ah, u32 index)
 {
 	ATH5K_TRACE(ah->ah_sc);
 	if (index >= 64)
 		return -EINVAL;
 	else if (index >= 32)
 		AR5K_REG_DISABLE_BITS(ah, AR5K_MCAST_FILTER1,
 				(1 << (index - 32)));
 	else
 		AR5K_REG_DISABLE_BITS(ah, AR5K_MCAST_FILTER0, (1 << index));
 	return 0;
 }
 /**
  * ath5k_hw_get_rx_filter - Get current rx filter
  *
  * @ah: The &struct ath5k_hw
  *
  * Returns the RX filter by reading rx filter and
  * phy error filter registers. RX filter is used
  * to set the allowed frame types that PCU will accept
  * and pass to the driver. For a list of frame types
  * check out reg.h.
  */
 u32 ath5k_hw_get_rx_filter(struct ath5k_hw *ah)
 {
 	u32 data, filter = 0;
 	ATH5K_TRACE(ah->ah_sc);
 	filter = ath5k_hw_reg_read(ah, AR5K_RX_FILTER);
 	/*Radar detection for 5212*/
 	if (ah->ah_version == AR5K_AR5212) {
 		data = ath5k_hw_reg_read(ah, AR5K_PHY_ERR_FIL);
 		if (data & AR5K_PHY_ERR_FIL_RADAR)
 			filter |= AR5K_RX_FILTER_RADARERR;
 		if (data & (AR5K_PHY_ERR_FIL_OFDM | AR5K_PHY_ERR_FIL_CCK))
 			filter |= AR5K_RX_FILTER_PHYERR;
 	}
 	return filter;
 }
 /**
  * ath5k_hw_set_rx_filter - Set rx filter
  *
  * @ah: The &struct ath5k_hw
  * @filter: RX filter mask (see reg.h)
  *
  * Sets RX filter register and also handles PHY error filter
  * register on 5212 and newer chips so that we have proper PHY
  * error reporting.
  */
 void ath5k_hw_set_rx_filter(struct ath5k_hw *ah, u32 filter)
 {
 	u32 data = 0;
 	ATH5K_TRACE(ah->ah_sc);
 	/* Set PHY error filter register on 5212*/
 	if (ah->ah_version == AR5K_AR5212) {
 		if (filter & AR5K_RX_FILTER_RADARERR)
 			data |= AR5K_PHY_ERR_FIL_RADAR;
 		if (filter & AR5K_RX_FILTER_PHYERR)
 			data |= AR5K_PHY_ERR_FIL_OFDM | AR5K_PHY_ERR_FIL_CCK;
 	}
 	/*
 	 * The AR5210 uses promiscous mode to detect radar activity
 	 */
 	if (ah->ah_version == AR5K_AR5210 &&
 			(filter & AR5K_RX_FILTER_RADARERR)) {
 		filter &= ~AR5K_RX_FILTER_RADARERR;
 		filter |= AR5K_RX_FILTER_PROM;
 	}
 	/*Zero length DMA (phy error reporting) */
 	if (data)
 		AR5K_REG_ENABLE_BITS(ah, AR5K_RXCFG, AR5K_RXCFG_ZLFDMA);
 	else
 		AR5K_REG_DISABLE_BITS(ah, AR5K_RXCFG, AR5K_RXCFG_ZLFDMA);
 	/*Write RX Filter register*/
 	ath5k_hw_reg_write(ah, filter & 0xff, AR5K_RX_FILTER);
 	/*Write PHY error filter register on 5212*/
 	if (ah->ah_version == AR5K_AR5212)
 		ath5k_hw_reg_write(ah, data, AR5K_PHY_ERR_FIL);
 }
 /****************\
 * Beacon control *
 \****************/
 /**
  * ath5k_hw_get_tsf32 - Get a 32bit TSF
  *
  * @ah: The &struct ath5k_hw
  *
  * Returns lower 32 bits of current TSF
  */
 u32 ath5k_hw_get_tsf32(struct ath5k_hw *ah)
 {
 	ATH5K_TRACE(ah->ah_sc);
 	return ath5k_hw_reg_read(ah, AR5K_TSF_L32);
 }
 /**
  * ath5k_hw_get_tsf64 - Get the full 64bit TSF
  *
  * @ah: The &struct ath5k_hw
  *
  * Returns the current TSF
  */
 u64 ath5k_hw_get_tsf64(struct ath5k_hw *ah)
 {
 	u64 tsf = ath5k_hw_reg_read(ah, AR5K_TSF_U32);
 	ATH5K_TRACE(ah->ah_sc);
 	return ath5k_hw_reg_read(ah, AR5K_TSF_L32) | (tsf << 32);
 }
 /**
  * ath5k_hw_reset_tsf - Force a TSF reset
  *
  * @ah: The &struct ath5k_hw
  *
  * Forces a TSF reset on PCU
  */
 void ath5k_hw_reset_tsf(struct ath5k_hw *ah)
 {
 	u32 val;
 	ATH5K_TRACE(ah->ah_sc);
 	val = ath5k_hw_reg_read(ah, AR5K_BEACON) | AR5K_BEACON_RESET_TSF;
 	/*
 	 * Each write to the RESET_TSF bit toggles a hardware internal
 	 * signal to reset TSF, but if left high it will cause a TSF reset
 	 * on the next chip reset as well.  Thus we always write the value
 	 * twice to clear the signal.
 	 */
 	ath5k_hw_reg_write(ah, val, AR5K_BEACON);
 	ath5k_hw_reg_write(ah, val, AR5K_BEACON);
 }
 /*
  * Initialize beacon timers
  */
 void ath5k_hw_init_beacon(struct ath5k_hw *ah, u32 next_beacon, u32 interval)
 {
 	u32 timer1, timer2, timer3;
 	ATH5K_TRACE(ah->ah_sc);
 	/*
 	 * Set the additional timers by mode
 	 */
 	switch (ah->ah_op_mode) {
 	case NL80211_IFTYPE_MONITOR:
 	case NL80211_IFTYPE_STATION:
 		/* In STA mode timer1 is used as next wakeup
 		 * timer and timer2 as next CFP duration start
 		 * timer. Both in 1/8TUs. */
 		/* TODO: PCF handling */
 		if (ah->ah_version == AR5K_AR5210) {
 			timer1 = 0xffffffff;
 			timer2 = 0xffffffff;
 		} else {
 			timer1 = 0x0000ffff;
 			timer2 = 0x0007ffff;
 		}
 		/* Mark associated AP as PCF incapable for now */
 		AR5K_REG_DISABLE_BITS(ah, AR5K_STA_ID1, AR5K_STA_ID1_PCF);
 		break;
 	case NL80211_IFTYPE_ADHOC:
 		AR5K_REG_ENABLE_BITS(ah, AR5K_TXCFG, AR5K_TXCFG_ADHOC_BCN_ATIM);
 	default:
 		/* On non-STA modes timer1 is used as next DMA
 		 * beacon alert (DBA) timer and timer2 as next
 		 * software beacon alert. Both in 1/8TUs. */
 		timer1 = (next_beacon - AR5K_TUNE_DMA_BEACON_RESP) << 3;
 		timer2 = (next_beacon - AR5K_TUNE_SW_BEACON_RESP) << 3;
 		break;
 	}
 	/* Timer3 marks the end of our ATIM window
 	 * a zero length window is not allowed because
 	 * we 'll get no beacons */
 	timer3 = next_beacon + (ah->ah_atim_window ? ah->ah_atim_window : 1);
 	/*
 	 * Set the beacon register and enable all timers.
 	 */
 	/* When in AP mode zero timer0 to start TSF */
 	if (ah->ah_op_mode == NL80211_IFTYPE_AP)
 		ath5k_hw_reg_write(ah, 0, AR5K_TIMER0);
 	else
 		ath5k_hw_reg_write(ah, next_beacon, AR5K_TIMER0);
 	ath5k_hw_reg_write(ah, timer1, AR5K_TIMER1);
 	ath5k_hw_reg_write(ah, timer2, AR5K_TIMER2);
 	ath5k_hw_reg_write(ah, timer3, AR5K_TIMER3);
 	/* Force a TSF reset if requested and enable beacons */
 	if (interval & AR5K_BEACON_RESET_TSF)
 		ath5k_hw_reset_tsf(ah);
 	ath5k_hw_reg_write(ah, interval & (AR5K_BEACON_PERIOD |
 					AR5K_BEACON_ENABLE),
 						AR5K_BEACON);
 	/* Flush any pending BMISS interrupts on ISR by
 	 * performing a clear-on-write operation on PISR
 	 * register for the BMISS bit (writing a bit on
 	 * ISR togles a reset for that bit and leaves
 	 * the rest bits intact) */
 	if (ah->ah_version == AR5K_AR5210)
 		ath5k_hw_reg_write(ah, AR5K_ISR_BMISS, AR5K_ISR);
 	else
 		ath5k_hw_reg_write(ah, AR5K_ISR_BMISS, AR5K_PISR);
 	/* TODO: Set enchanced sleep registers on AR5212
 	 * based on vif->bss_conf params, until then
 	 * disable power save reporting.*/
 	AR5K_REG_DISABLE_BITS(ah, AR5K_STA_ID1, AR5K_STA_ID1_PWR_SV);
 }
 #if 0
 /*
  * Set beacon timers
  */
 int ath5k_hw_set_beacon_timers(struct ath5k_hw *ah,
 		const struct ath5k_beacon_state *state)
 {
 	u32 cfp_period, next_cfp, dtim, interval, next_beacon;
 	/*
 	 * TODO: should be changed through *state
 	 * review struct ath5k_beacon_state struct
 	 *
 	 * XXX: These are used for cfp period bellow, are they
 	 * ok ? Is it O.K. for tsf here to be 0 or should we use
 	 * get_tsf ?
 	 */
 	u32 dtim_count = 0; /* XXX */
 	u32 cfp_count = 0; /* XXX */
 	u32 tsf = 0; /* XXX */
 	ATH5K_TRACE(ah->ah_sc);
 	/* Return on an invalid beacon state */
 	if (state->bs_interval < 1)
 		return -EINVAL;
 	interval = state->bs_interval;
 	dtim = state->bs_dtim_period;
 	/*
 	 * PCF support?
 	 */
 	if (state->bs_cfp_period > 0) {
 		/*
 		 * Enable PCF mode and set the CFP
 		 * (Contention Free Period) and timer registers
 		 */
 		cfp_period = state->bs_cfp_period * state->bs_dtim_period *
 			state->bs_interval;
 		next_cfp = (cfp_count * state->bs_dtim_period + dtim_count) *
 			state->bs_interval;
 		AR5K_REG_ENABLE_BITS(ah, AR5K_STA_ID1,
 				AR5K_STA_ID1_DEFAULT_ANTENNA |
 				AR5K_STA_ID1_PCF);
 		ath5k_hw_reg_write(ah, cfp_period, AR5K_CFP_PERIOD);
 		ath5k_hw_reg_write(ah, state->bs_cfp_max_duration,
 				AR5K_CFP_DUR);
 		ath5k_hw_reg_write(ah, (tsf + (next_cfp == 0 ? cfp_period :
 						next_cfp)) << 3, AR5K_TIMER2);
 	} else {
 		/* Disable PCF mode */
 		AR5K_REG_DISABLE_BITS(ah, AR5K_STA_ID1,
 				AR5K_STA_ID1_DEFAULT_ANTENNA |
 				AR5K_STA_ID1_PCF);
 	}
 	/*
 	 * Enable the beacon timer register
 	 */
 	ath5k_hw_reg_write(ah, state->bs_next_beacon, AR5K_TIMER0);
 	/*
 	 * Start the beacon timers
 	 */
 	ath5k_hw_reg_write(ah, (ath5k_hw_reg_read(ah, AR5K_BEACON) &
 		~(AR5K_BEACON_PERIOD | AR5K_BEACON_TIM)) |
 		AR5K_REG_SM(state->bs_tim_offset ? state->bs_tim_offset + 4 : 0,
 		AR5K_BEACON_TIM) | AR5K_REG_SM(state->bs_interval,
 		AR5K_BEACON_PERIOD), AR5K_BEACON);
 	/*
 	 * Write new beacon miss threshold, if it appears to be valid
 	 * XXX: Figure out right values for min <= bs_bmiss_threshold <= max
 	 * and return if its not in range. We can test this by reading value and
 	 * setting value to a largest value and seeing which values register.
 	 */
 	AR5K_REG_WRITE_BITS(ah, AR5K_RSSI_THR, AR5K_RSSI_THR_BMISS,
 			state->bs_bmiss_threshold);
 	/*
 	 * Set sleep control register
 	 * XXX: Didn't find this in 5210 code but since this register
 	 * exists also in ar5k's 5210 headers i leave it as common code.
 	 */
 	AR5K_REG_WRITE_BITS(ah, AR5K_SLEEP_CTL, AR5K_SLEEP_CTL_SLDUR,
 			(state->bs_sleep_duration - 3) << 3);
 	/*
 	 * Set enhanced sleep registers on 5212
 	 */
 	if (ah->ah_version == AR5K_AR5212) {
 		if (state->bs_sleep_duration > state->bs_interval &&
 				roundup(state->bs_sleep_duration, interval) ==
 				state->bs_sleep_duration)
 			interval = state->bs_sleep_duration;
 		if (state->bs_sleep_duration > dtim && (dtim == 0 ||
 				roundup(state->bs_sleep_duration, dtim) ==
 				state->bs_sleep_duration))
 			dtim = state->bs_sleep_duration;
 		if (interval > dtim)
 			return -EINVAL;
 		next_beacon = interval == dtim ? state->bs_next_dtim :
 			state->bs_next_beacon;
 		ath5k_hw_reg_write(ah,
 			AR5K_REG_SM((state->bs_next_dtim - 3) << 3,
 			AR5K_SLEEP0_NEXT_DTIM) |
 			AR5K_REG_SM(10, AR5K_SLEEP0_CABTO) |
 			AR5K_SLEEP0_ENH_SLEEP_EN |
 			AR5K_SLEEP0_ASSUME_DTIM, AR5K_SLEEP0);
 		ath5k_hw_reg_write(ah, AR5K_REG_SM((next_beacon - 3) << 3,
 			AR5K_SLEEP1_NEXT_TIM) |
 			AR5K_REG_SM(10, AR5K_SLEEP1_BEACON_TO), AR5K_SLEEP1);
 		ath5k_hw_reg_write(ah,
 			AR5K_REG_SM(interval, AR5K_SLEEP2_TIM_PER) |
 			AR5K_REG_SM(dtim, AR5K_SLEEP2_DTIM_PER), AR5K_SLEEP2);
 	}
 	return 0;
 }
 /*
  * Reset beacon timers
  */
 void ath5k_hw_reset_beacon(struct ath5k_hw *ah)
 {
 	ATH5K_TRACE(ah->ah_sc);
 	/*
 	 * Disable beacon timer
 	 */
 	ath5k_hw_reg_write(ah, 0, AR5K_TIMER0);
 	/*
 	 * Disable some beacon register values
 	 */
 	AR5K_REG_DISABLE_BITS(ah, AR5K_STA_ID1,
 			AR5K_STA_ID1_DEFAULT_ANTENNA | AR5K_STA_ID1_PCF);
 	ath5k_hw_reg_write(ah, AR5K_BEACON_PERIOD, AR5K_BEACON);
 }
 /*
  * Wait for beacon queue to finish
  */
 int ath5k_hw_beaconq_finish(struct ath5k_hw *ah, unsigned long phys_addr)
 {
 	unsigned int i;
 	int ret;
 	ATH5K_TRACE(ah->ah_sc);
 	/* 5210 doesn't have QCU*/
 	if (ah->ah_version == AR5K_AR5210) {
 		/*
 		 * Wait for beaconn queue to finish by checking
 		 * Control Register and Beacon Status Register.
 		 */
 		for (i = AR5K_TUNE_BEACON_INTERVAL / 2; i > 0; i--) {
 			if (!(ath5k_hw_reg_read(ah, AR5K_BSR) & AR5K_BSR_TXQ1F)
 					||
 			    !(ath5k_hw_reg_read(ah, AR5K_CR) & AR5K_BSR_TXQ1F))
 				break;
 			udelay(10);
 		}
 		/* Timeout... */
 		if (i <= 0) {
 			/*
 			 * Re-schedule the beacon queue
 			 */
 			ath5k_hw_reg_write(ah, phys_addr, AR5K_NOQCU_TXDP1);
 			ath5k_hw_reg_write(ah, AR5K_BCR_TQ1V | AR5K_BCR_BDMAE,
 					AR5K_BCR);
 			return -EIO;
 		}
 		ret = 0;
 	} else {
 	/*5211/5212*/
 		ret = ath5k_hw_register_timeout(ah,
 			AR5K_QUEUE_STATUS(AR5K_TX_QUEUE_ID_BEACON),
 			AR5K_QCU_STS_FRMPENDCNT, 0, false);
 		if (AR5K_REG_READ_Q(ah, AR5K_QCU_TXE, AR5K_TX_QUEUE_ID_BEACON))
 			return -EIO;
 	}
 	return ret;
 }
 #endif
 /*********************\
 * Key table functions *
 \*********************/
 /*
  * Reset a key entry on the table
  */
 int ath5k_hw_reset_key(struct ath5k_hw *ah, u16 entry)
 {
 	unsigned int i, type;
 	u16 micentry = entry + AR5K_KEYTABLE_MIC_OFFSET;
 	ATH5K_TRACE(ah->ah_sc);
 	AR5K_ASSERT_ENTRY(entry, AR5K_KEYTABLE_SIZE);
 	type = ath5k_hw_reg_read(ah, AR5K_KEYTABLE_TYPE(entry));
 	for (i = 0; i < AR5K_KEYCACHE_SIZE; i++)
 		ath5k_hw_reg_write(ah, 0, AR5K_KEYTABLE_OFF(entry, i));
 	/* Reset associated MIC entry if TKIP
 	 * is enabled located at offset (entry + 64) */
 	if (type == AR5K_KEYTABLE_TYPE_TKIP) {
 		AR5K_ASSERT_ENTRY(micentry, AR5K_KEYTABLE_SIZE);
 		for (i = 0; i < AR5K_KEYCACHE_SIZE / 2 ; i++)
 			ath5k_hw_reg_write(ah, 0,
 				AR5K_KEYTABLE_OFF(micentry, i));
 	}
 	/*
 	 * Set NULL encryption on AR5212+
 	 *
 	 * Note: AR5K_KEYTABLE_TYPE -> AR5K_KEYTABLE_OFF(entry, 5)
 	 *       AR5K_KEYTABLE_TYPE_NULL -> 0x00000007
 	 *
 	 * Note2: Windows driver (ndiswrapper) sets this to
 	 *        0x00000714 instead of 0x00000007
 	 */
 	if (ah->ah_version > AR5K_AR5211) {
 		ath5k_hw_reg_write(ah, AR5K_KEYTABLE_TYPE_NULL,
 				AR5K_KEYTABLE_TYPE(entry));
 		if (type == AR5K_KEYTABLE_TYPE_TKIP) {
 			ath5k_hw_reg_write(ah, AR5K_KEYTABLE_TYPE_NULL,
 				AR5K_KEYTABLE_TYPE(micentry));
 		}
 	}
 	return 0;
 }
 /*
  * Check if a table entry is valid
  */
 int ath5k_hw_is_key_valid(struct ath5k_hw *ah, u16 entry)
 {
 	ATH5K_TRACE(ah->ah_sc);
 	AR5K_ASSERT_ENTRY(entry, AR5K_KEYTABLE_SIZE);
 	/* Check the validation flag at the end of the entry */
 	return ath5k_hw_reg_read(ah, AR5K_KEYTABLE_MAC1(entry)) &
 		AR5K_KEYTABLE_VALID;
 }
 static
 int ath5k_keycache_type(const struct ieee80211_key_conf *key)
 {
 	switch (key->alg) {
 	case ALG_TKIP:
 		return AR5K_KEYTABLE_TYPE_TKIP;
 	case ALG_CCMP:
 		return AR5K_KEYTABLE_TYPE_CCM;
 	case ALG_WEP:
 		if (key->keylen == LEN_WEP40)
 			return AR5K_KEYTABLE_TYPE_40;
 		else if (key->keylen == LEN_WEP104)
 			return AR5K_KEYTABLE_TYPE_104;
+		return -EINVAL;
+	default:
+		return -EINVAL;
 	}
 	return -EINVAL;
 }
 /*
  * Set a key entry on the table
  */
 int ath5k_hw_set_key(struct ath5k_hw *ah, u16 entry,
 		const struct ieee80211_key_conf *key, const u8 *mac)
 {
 	unsigned int i;
 	int keylen;
 	__le32 key_v[5] = {};
 	__le32 key0 = 0, key1 = 0;
 	__le32 *rxmic, *txmic;
 	u32 keytype;
 	u16 micentry = entry + AR5K_KEYTABLE_MIC_OFFSET;
 	bool is_tkip;
 	const u8 *key_ptr;
 	ATH5K_TRACE(ah->ah_sc);
 	is_tkip = (key->alg == ALG_TKIP);
 	/*
 	 * key->keylen comes in from mac80211 in bytes.
 	 * TKIP is 128 bit + 128 bit mic
 	 */
 	keylen = (is_tkip) ? (128 / 8) : key->keylen;
 	if (entry > AR5K_KEYTABLE_SIZE ||
 		(is_tkip && micentry > AR5K_KEYTABLE_SIZE))
 		return -EOPNOTSUPP;
 	if (unlikely(keylen > 16))
 		return -EOPNOTSUPP;
 	keytype = ath5k_keycache_type(key);
 	if (keytype < 0)
 		return keytype;
 	/*
 	 * each key block is 6 bytes wide, written as pairs of
 	 * alternating 32 and 16 bit le values.
 	 */
 	key_ptr = key->key;
 	for (i = 0; keylen >= 6; keylen -= 6) {
 		memcpy(&key_v[i], key_ptr, 6);
 		i += 2;
 		key_ptr += 6;
 	}
 	if (keylen)
 		memcpy(&key_v[i], key_ptr, keylen);
 	/* intentionally corrupt key until mic is installed */
 	if (is_tkip) {
 		key0 = key_v[0] = ~key_v[0];
 		key1 = key_v[1] = ~key_v[1];
 	}
 	for (i = 0; i < ARRAY_SIZE(key_v); i++)
 		ath5k_hw_reg_write(ah, le32_to_cpu(key_v[i]),
 				AR5K_KEYTABLE_OFF(entry, i));
 	ath5k_hw_reg_write(ah, keytype, AR5K_KEYTABLE_TYPE(entry));
 	if (is_tkip) {
 		/* Install rx/tx MIC */
 		rxmic = (__le32 *) &key->key[16];
 		txmic = (__le32 *) &key->key[24];
 		if (ah->ah_combined_mic) {
 			key_v[0] = rxmic[0];
 			key_v[1] = cpu_to_le32(le32_to_cpu(txmic[0]) >> 16);
 			key_v[2] = rxmic[1];
 			key_v[3] = cpu_to_le32(le32_to_cpu(txmic[0]) & 0xffff);
 			key_v[4] = txmic[1];
 		} else {
 			key_v[0] = rxmic[0];
 			key_v[1] = 0;
 			key_v[2] = rxmic[1];
 			key_v[3] = 0;
 			key_v[4] = 0;
 		}
 		for (i = 0; i < ARRAY_SIZE(key_v); i++)
 			ath5k_hw_reg_write(ah, le32_to_cpu(key_v[i]),
 				AR5K_KEYTABLE_OFF(micentry, i));
 		ath5k_hw_reg_write(ah, AR5K_KEYTABLE_TYPE_NULL,
 			AR5K_KEYTABLE_TYPE(micentry));
 		ath5k_hw_reg_write(ah, 0, AR5K_KEYTABLE_MAC0(micentry));
 		ath5k_hw_reg_write(ah, 0, AR5K_KEYTABLE_MAC1(micentry));
 		/* restore first 2 words of key */
 		ath5k_hw_reg_write(ah, le32_to_cpu(~key0),
 			AR5K_KEYTABLE_OFF(entry, 0));
 		ath5k_hw_reg_write(ah, le32_to_cpu(~key1),
 			AR5K_KEYTABLE_OFF(entry, 1));
 	}
 	return ath5k_hw_set_key_lladdr(ah, entry, mac);
 }
 int ath5k_hw_set_key_lladdr(struct ath5k_hw *ah, u16 entry, const u8 *mac)
 {
 	u32 low_id, high_id;
 	ATH5K_TRACE(ah->ah_sc);
 	 /* Invalid entry (key table overflow) */
 	AR5K_ASSERT_ENTRY(entry, AR5K_KEYTABLE_SIZE);
 	/* MAC may be NULL if it's a broadcast key. In this case no need to
 	 * to compute AR5K_LOW_ID and AR5K_HIGH_ID as we already know it. */
 	if (!mac) {
 		low_id = 0xffffffff;
 		high_id = 0xffff | AR5K_KEYTABLE_VALID;
 	} else {
 		low_id = AR5K_LOW_ID(mac);
 		high_id = AR5K_HIGH_ID(mac) | AR5K_KEYTABLE_VALID;
 	}
 	ath5k_hw_reg_write(ah, low_id, AR5K_KEYTABLE_MAC0(entry));
 	ath5k_hw_reg_write(ah, high_id, AR5K_KEYTABLE_MAC1(entry));
 	return 0;
 }

include/linux/ieee80211.h

Diff comments View file @ 3cfcf6a

 /*
  * IEEE 802.11 defines
  *
  * Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
  * <jkmaline@cc.hut.fi>
  * Copyright (c) 2002-2003, Jouni Malinen <jkmaline@cc.hut.fi>
  * Copyright (c) 2005, Devicescape Software, Inc.
  * Copyright (c) 2006, Michael Wu <flamingice@sourmilk.net>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
 #ifndef LINUX_IEEE80211_H
 #define LINUX_IEEE80211_H
 #include <linux/types.h>
 #include <asm/byteorder.h>
 #define FCS_LEN 4
 #define IEEE80211_FCTL_VERS		0x0003
 #define IEEE80211_FCTL_FTYPE		0x000c
 #define IEEE80211_FCTL_STYPE		0x00f0
 #define IEEE80211_FCTL_TODS		0x0100
 #define IEEE80211_FCTL_FROMDS		0x0200
 #define IEEE80211_FCTL_MOREFRAGS	0x0400
 #define IEEE80211_FCTL_RETRY		0x0800
 #define IEEE80211_FCTL_PM		0x1000
 #define IEEE80211_FCTL_MOREDATA		0x2000
 #define IEEE80211_FCTL_PROTECTED	0x4000
 #define IEEE80211_FCTL_ORDER		0x8000
 #define IEEE80211_SCTL_FRAG		0x000F
 #define IEEE80211_SCTL_SEQ		0xFFF0
 #define IEEE80211_FTYPE_MGMT		0x0000
 #define IEEE80211_FTYPE_CTL		0x0004
 #define IEEE80211_FTYPE_DATA		0x0008
 /* management */
 #define IEEE80211_STYPE_ASSOC_REQ	0x0000
 #define IEEE80211_STYPE_ASSOC_RESP	0x0010
 #define IEEE80211_STYPE_REASSOC_REQ	0x0020
 #define IEEE80211_STYPE_REASSOC_RESP	0x0030
 #define IEEE80211_STYPE_PROBE_REQ	0x0040
 #define IEEE80211_STYPE_PROBE_RESP	0x0050
 #define IEEE80211_STYPE_BEACON		0x0080
 #define IEEE80211_STYPE_ATIM		0x0090
 #define IEEE80211_STYPE_DISASSOC	0x00A0
 #define IEEE80211_STYPE_AUTH		0x00B0
 #define IEEE80211_STYPE_DEAUTH		0x00C0
 #define IEEE80211_STYPE_ACTION		0x00D0
 /* control */
 #define IEEE80211_STYPE_BACK_REQ	0x0080
 #define IEEE80211_STYPE_BACK		0x0090
 #define IEEE80211_STYPE_PSPOLL		0x00A0
 #define IEEE80211_STYPE_RTS		0x00B0
 #define IEEE80211_STYPE_CTS		0x00C0
 #define IEEE80211_STYPE_ACK		0x00D0
 #define IEEE80211_STYPE_CFEND		0x00E0
 #define IEEE80211_STYPE_CFENDACK	0x00F0
 /* data */
 #define IEEE80211_STYPE_DATA			0x0000
 #define IEEE80211_STYPE_DATA_CFACK		0x0010
 #define IEEE80211_STYPE_DATA_CFPOLL		0x0020
 #define IEEE80211_STYPE_DATA_CFACKPOLL		0x0030
 #define IEEE80211_STYPE_NULLFUNC		0x0040
 #define IEEE80211_STYPE_CFACK			0x0050
 #define IEEE80211_STYPE_CFPOLL			0x0060
 #define IEEE80211_STYPE_CFACKPOLL		0x0070
 #define IEEE80211_STYPE_QOS_DATA		0x0080
 #define IEEE80211_STYPE_QOS_DATA_CFACK		0x0090
 #define IEEE80211_STYPE_QOS_DATA_CFPOLL		0x00A0
 #define IEEE80211_STYPE_QOS_DATA_CFACKPOLL	0x00B0
 #define IEEE80211_STYPE_QOS_NULLFUNC		0x00C0
 #define IEEE80211_STYPE_QOS_CFACK		0x00D0
 #define IEEE80211_STYPE_QOS_CFPOLL		0x00E0
 #define IEEE80211_STYPE_QOS_CFACKPOLL		0x00F0
 /* miscellaneous IEEE 802.11 constants */
 #define IEEE80211_MAX_FRAG_THRESHOLD	2352
 #define IEEE80211_MAX_RTS_THRESHOLD	2353
 #define IEEE80211_MAX_AID		2007
 #define IEEE80211_MAX_TIM_LEN		251
 /* Maximum size for the MA-UNITDATA primitive, 802.11 standard section
    6.2.1.1.2.
    802.11e clarifies the figure in section 7.1.2. The frame body is
    up to 2304 octets long (maximum MSDU size) plus any crypt overhead. */
 #define IEEE80211_MAX_DATA_LEN		2304
 /* 30 byte 4 addr hdr, 2 byte QoS, 2304 byte MSDU, 12 byte crypt, 4 byte FCS */
 #define IEEE80211_MAX_FRAME_LEN		2352
 #define IEEE80211_MAX_SSID_LEN		32
 #define IEEE80211_MAX_MESH_ID_LEN	32
 #define IEEE80211_MESH_CONFIG_LEN	19
 #define IEEE80211_QOS_CTL_LEN		2
 #define IEEE80211_QOS_CTL_TID_MASK	0x000F
 #define IEEE80211_QOS_CTL_TAG1D_MASK	0x0007
 struct ieee80211_hdr {
 	__le16 frame_control;
 	__le16 duration_id;
 	u8 addr1[6];
 	u8 addr2[6];
 	u8 addr3[6];
 	__le16 seq_ctrl;
 	u8 addr4[6];
 } __attribute__ ((packed));
 /**
  * ieee80211_has_tods - check if IEEE80211_FCTL_TODS is set
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_has_tods(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_TODS)) != 0;
 }
 /**
  * ieee80211_has_fromds - check if IEEE80211_FCTL_FROMDS is set
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_has_fromds(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_FROMDS)) != 0;
 }
 /**
  * ieee80211_has_a4 - check if IEEE80211_FCTL_TODS and IEEE80211_FCTL_FROMDS are set
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_has_a4(__le16 fc)
 {
 	__le16 tmp = cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS);
 	return (fc & tmp) == tmp;
 }
 /**
  * ieee80211_has_morefrags - check if IEEE80211_FCTL_MOREFRAGS is set
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_has_morefrags(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_MOREFRAGS)) != 0;
 }
 /**
  * ieee80211_has_retry - check if IEEE80211_FCTL_RETRY is set
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_has_retry(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_RETRY)) != 0;
 }
 /**
  * ieee80211_has_pm - check if IEEE80211_FCTL_PM is set
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_has_pm(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_PM)) != 0;
 }
 /**
  * ieee80211_has_moredata - check if IEEE80211_FCTL_MOREDATA is set
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_has_moredata(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_MOREDATA)) != 0;
 }
 /**
  * ieee80211_has_protected - check if IEEE80211_FCTL_PROTECTED is set
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_has_protected(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_PROTECTED)) != 0;
 }
 /**
  * ieee80211_has_order - check if IEEE80211_FCTL_ORDER is set
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_has_order(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_ORDER)) != 0;
 }
 /**
  * ieee80211_is_mgmt - check if type is IEEE80211_FTYPE_MGMT
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_is_mgmt(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_FTYPE)) ==
 	       cpu_to_le16(IEEE80211_FTYPE_MGMT);
 }
 /**
  * ieee80211_is_ctl - check if type is IEEE80211_FTYPE_CTL
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_is_ctl(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_FTYPE)) ==
 	       cpu_to_le16(IEEE80211_FTYPE_CTL);
 }
 /**
  * ieee80211_is_data - check if type is IEEE80211_FTYPE_DATA
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_is_data(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_FTYPE)) ==
 	       cpu_to_le16(IEEE80211_FTYPE_DATA);
 }
 /**
  * ieee80211_is_data_qos - check if type is IEEE80211_FTYPE_DATA and IEEE80211_STYPE_QOS_DATA is set
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_is_data_qos(__le16 fc)
 {
 	/*
 	 * mask with QOS_DATA rather than IEEE80211_FCTL_STYPE as we just need
 	 * to check the one bit
 	 */
 	return (fc & cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_STYPE_QOS_DATA)) ==
 	       cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_QOS_DATA);
 }
 /**
  * ieee80211_is_data_present - check if type is IEEE80211_FTYPE_DATA and has data
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_is_data_present(__le16 fc)
 {
 	/*
 	 * mask with 0x40 and test that that bit is clear to only return true
 	 * for the data-containing substypes.
 	 */
 	return (fc & cpu_to_le16(IEEE80211_FCTL_FTYPE | 0x40)) ==
 	       cpu_to_le16(IEEE80211_FTYPE_DATA);
 }
 /**
  * ieee80211_is_assoc_req - check if IEEE80211_FTYPE_MGMT && IEEE80211_STYPE_ASSOC_REQ
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_is_assoc_req(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) ==
 	       cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ASSOC_REQ);
 }
 /**
  * ieee80211_is_assoc_resp - check if IEEE80211_FTYPE_MGMT && IEEE80211_STYPE_ASSOC_RESP
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_is_assoc_resp(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) ==
 	       cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ASSOC_RESP);
 }
 /**
  * ieee80211_is_reassoc_req - check if IEEE80211_FTYPE_MGMT && IEEE80211_STYPE_REASSOC_REQ
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_is_reassoc_req(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) ==
 	       cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_REASSOC_REQ);
 }
 /**
  * ieee80211_is_reassoc_resp - check if IEEE80211_FTYPE_MGMT && IEEE80211_STYPE_REASSOC_RESP
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_is_reassoc_resp(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) ==
 	       cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_REASSOC_RESP);
 }
 /**
  * ieee80211_is_probe_req - check if IEEE80211_FTYPE_MGMT && IEEE80211_STYPE_PROBE_REQ
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_is_probe_req(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) ==
 	       cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_PROBE_REQ);
 }
 /**
  * ieee80211_is_probe_resp - check if IEEE80211_FTYPE_MGMT && IEEE80211_STYPE_PROBE_RESP
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_is_probe_resp(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) ==
 	       cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_PROBE_RESP);
 }
 /**
  * ieee80211_is_beacon - check if IEEE80211_FTYPE_MGMT && IEEE80211_STYPE_BEACON
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_is_beacon(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) ==
 	       cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON);
 }
 /**
  * ieee80211_is_atim - check if IEEE80211_FTYPE_MGMT && IEEE80211_STYPE_ATIM
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_is_atim(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) ==
 	       cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ATIM);
 }
 /**
  * ieee80211_is_disassoc - check if IEEE80211_FTYPE_MGMT && IEEE80211_STYPE_DISASSOC
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_is_disassoc(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) ==
 	       cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_DISASSOC);
 }
 /**
  * ieee80211_is_auth - check if IEEE80211_FTYPE_MGMT && IEEE80211_STYPE_AUTH
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_is_auth(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) ==
 	       cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_AUTH);
 }
 /**
  * ieee80211_is_deauth - check if IEEE80211_FTYPE_MGMT && IEEE80211_STYPE_DEAUTH
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_is_deauth(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) ==
 	       cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_DEAUTH);
 }
 /**
  * ieee80211_is_action - check if IEEE80211_FTYPE_MGMT && IEEE80211_STYPE_ACTION
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_is_action(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) ==
 	       cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION);
 }
 /**
  * ieee80211_is_back_req - check if IEEE80211_FTYPE_CTL && IEEE80211_STYPE_BACK_REQ
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_is_back_req(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) ==
 	       cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_BACK_REQ);
 }
 /**
  * ieee80211_is_back - check if IEEE80211_FTYPE_CTL && IEEE80211_STYPE_BACK
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_is_back(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) ==
 	       cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_BACK);
 }
 /**
  * ieee80211_is_pspoll - check if IEEE80211_FTYPE_CTL && IEEE80211_STYPE_PSPOLL
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_is_pspoll(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) ==
 	       cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_PSPOLL);
 }
 /**
  * ieee80211_is_rts - check if IEEE80211_FTYPE_CTL && IEEE80211_STYPE_RTS
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_is_rts(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) ==
 	       cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_RTS);
 }
 /**
  * ieee80211_is_cts - check if IEEE80211_FTYPE_CTL && IEEE80211_STYPE_CTS
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_is_cts(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) ==
 	       cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_CTS);
 }
 /**
  * ieee80211_is_ack - check if IEEE80211_FTYPE_CTL && IEEE80211_STYPE_ACK
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_is_ack(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) ==
 	       cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_ACK);
 }
 /**
  * ieee80211_is_cfend - check if IEEE80211_FTYPE_CTL && IEEE80211_STYPE_CFEND
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_is_cfend(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) ==
 	       cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_CFEND);
 }
 /**
  * ieee80211_is_cfendack - check if IEEE80211_FTYPE_CTL && IEEE80211_STYPE_CFENDACK
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_is_cfendack(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) ==
 	       cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_CFENDACK);
 }
 /**
  * ieee80211_is_nullfunc - check if FTYPE=IEEE80211_FTYPE_DATA and STYPE=IEEE80211_STYPE_NULLFUNC
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_is_nullfunc(__le16 fc)
 {
 	return (fc & cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) ==
 	       cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC);
 }
 struct ieee80211s_hdr {
 	u8 flags;
 	u8 ttl;
 	__le32 seqnum;
 	u8 eaddr1[6];
 	u8 eaddr2[6];
 	u8 eaddr3[6];
 } __attribute__ ((packed));
 /* Mesh flags */
 #define MESH_FLAGS_AE_A4 	0x1
 #define MESH_FLAGS_AE_A5_A6	0x2
 #define MESH_FLAGS_PS_DEEP	0x4
 /**
  * struct ieee80211_quiet_ie
  *
  * This structure refers to "Quiet information element"
  */
 struct ieee80211_quiet_ie {
 	u8 count;
 	u8 period;
 	__le16 duration;
 	__le16 offset;
 } __attribute__ ((packed));
 /**
  * struct ieee80211_msrment_ie
  *
  * This structure refers to "Measurement Request/Report information element"
  */
 struct ieee80211_msrment_ie {
 	u8 token;
 	u8 mode;
 	u8 type;
 	u8 request[0];
 } __attribute__ ((packed));
 /**
  * struct ieee80211_channel_sw_ie
  *
  * This structure refers to "Channel Switch Announcement information element"
  */
 struct ieee80211_channel_sw_ie {
 	u8 mode;
 	u8 new_ch_num;
 	u8 count;
 } __attribute__ ((packed));
 /**
  * struct ieee80211_tim
  *
  * This structure refers to "Traffic Indication Map information element"
  */
 struct ieee80211_tim_ie {
 	u8 dtim_count;
 	u8 dtim_period;
 	u8 bitmap_ctrl;
 	/* variable size: 1 - 251 bytes */
 	u8 virtual_map[0];
 } __attribute__ ((packed));
 struct ieee80211_mgmt {
 	__le16 frame_control;
 	__le16 duration;
 	u8 da[6];
 	u8 sa[6];
 	u8 bssid[6];
 	__le16 seq_ctrl;
 	union {
 		struct {
 			__le16 auth_alg;
 			__le16 auth_transaction;
 			__le16 status_code;
 			/* possibly followed by Challenge text */
 			u8 variable[0];
 		} __attribute__ ((packed)) auth;
 		struct {
 			__le16 reason_code;
 		} __attribute__ ((packed)) deauth;
 		struct {
 			__le16 capab_info;
 			__le16 listen_interval;
 			/* followed by SSID and Supported rates */
 			u8 variable[0];
 		} __attribute__ ((packed)) assoc_req;
 		struct {
 			__le16 capab_info;
 			__le16 status_code;
 			__le16 aid;
 			/* followed by Supported rates */
 			u8 variable[0];
 		} __attribute__ ((packed)) assoc_resp, reassoc_resp;
 		struct {
 			__le16 capab_info;
 			__le16 listen_interval;
 			u8 current_ap[6];
 			/* followed by SSID and Supported rates */
 			u8 variable[0];
 		} __attribute__ ((packed)) reassoc_req;
 		struct {
 			__le16 reason_code;
 		} __attribute__ ((packed)) disassoc;
 		struct {
 			__le64 timestamp;
 			__le16 beacon_int;
 			__le16 capab_info;
 			/* followed by some of SSID, Supported rates,
 			 * FH Params, DS Params, CF Params, IBSS Params, TIM */
 			u8 variable[0];
 		} __attribute__ ((packed)) beacon;
 		struct {
 			/* only variable items: SSID, Supported rates */
 			u8 variable[0];
 		} __attribute__ ((packed)) probe_req;
 		struct {
 			__le64 timestamp;
 			__le16 beacon_int;
 			__le16 capab_info;
 			/* followed by some of SSID, Supported rates,
 			 * FH Params, DS Params, CF Params, IBSS Params */
 			u8 variable[0];
 		} __attribute__ ((packed)) probe_resp;
 		struct {
 			u8 category;
 			union {
 				struct {
 					u8 action_code;
 					u8 dialog_token;
 					u8 status_code;
 					u8 variable[0];
 				} __attribute__ ((packed)) wme_action;
 				struct{
 					u8 action_code;
 					u8 element_id;
 					u8 length;
 					struct ieee80211_channel_sw_ie sw_elem;
 				} __attribute__((packed)) chan_switch;
 				struct{
 					u8 action_code;
 					u8 dialog_token;
 					u8 element_id;
 					u8 length;
 					struct ieee80211_msrment_ie msr_elem;
 				} __attribute__((packed)) measurement;
 				struct{
 					u8 action_code;
 					u8 dialog_token;
 					__le16 capab;
 					__le16 timeout;
 					__le16 start_seq_num;
 				} __attribute__((packed)) addba_req;
 				struct{
 					u8 action_code;
 					u8 dialog_token;
 					__le16 status;
 					__le16 capab;
 					__le16 timeout;
 				} __attribute__((packed)) addba_resp;
 				struct{
 					u8 action_code;
 					__le16 params;
 					__le16 reason_code;
 				} __attribute__((packed)) delba;
 				struct{
 					u8 action_code;
 					/* capab_info for open and confirm,
 					 * reason for close
 					 */
 					__le16 aux;
 					/* Followed in plink_confirm by status
 					 * code, AID and supported rates,
 					 * and directly by supported rates in
 					 * plink_open and plink_close
 					 */
 					u8 variable[0];
 				} __attribute__((packed)) plink_action;
 				struct{
 					u8 action_code;
 					u8 variable[0];
 				} __attribute__((packed)) mesh_action;
 			} u;
 		} __attribute__ ((packed)) action;
 	} u;
 } __attribute__ ((packed));
 /* mgmt header + 1 byte category code */
 #define IEEE80211_MIN_ACTION_SIZE offsetof(struct ieee80211_mgmt, u.action.u)
 /* Management MIC information element (IEEE 802.11w) */
 struct ieee80211_mmie {
 	u8 element_id;
 	u8 length;
 	__le16 key_id;
 	u8 sequence_number[6];
 	u8 mic[8];
 } __attribute__ ((packed));
 /* Control frames */
 struct ieee80211_rts {
 	__le16 frame_control;
 	__le16 duration;
 	u8 ra[6];
 	u8 ta[6];
 } __attribute__ ((packed));
 struct ieee80211_cts {
 	__le16 frame_control;
 	__le16 duration;
 	u8 ra[6];
 } __attribute__ ((packed));
 struct ieee80211_pspoll {
 	__le16 frame_control;
 	__le16 aid;
 	u8 bssid[6];
 	u8 ta[6];
 } __attribute__ ((packed));
 /**
  * struct ieee80211_bar - HT Block Ack Request
  *
  * This structure refers to "HT BlockAckReq" as
  * described in 802.11n draft section 7.2.1.7.1
  */
 struct ieee80211_bar {
 	__le16 frame_control;
 	__le16 duration;
 	__u8 ra[6];
 	__u8 ta[6];
 	__le16 control;
 	__le16 start_seq_num;
 } __attribute__((packed));
 /* 802.11 BAR control masks */
 #define IEEE80211_BAR_CTRL_ACK_POLICY_NORMAL     0x0000
 #define IEEE80211_BAR_CTRL_CBMTID_COMPRESSED_BA  0x0004
 #define IEEE80211_HT_MCS_MASK_LEN		10
 /**
  * struct ieee80211_mcs_info - MCS information
  * @rx_mask: RX mask
  * @rx_highest: highest supported RX rate
  * @tx_params: TX parameters
  */
 struct ieee80211_mcs_info {
 	u8 rx_mask[IEEE80211_HT_MCS_MASK_LEN];
 	__le16 rx_highest;
 	u8 tx_params;
 	u8 reserved[3];
 } __attribute__((packed));
 /* 802.11n HT capability MSC set */
 #define IEEE80211_HT_MCS_RX_HIGHEST_MASK	0x3ff
 #define IEEE80211_HT_MCS_TX_DEFINED		0x01
 #define IEEE80211_HT_MCS_TX_RX_DIFF		0x02
 /* value 0 == 1 stream etc */
 #define IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK	0x0C
 #define IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT	2
 #define		IEEE80211_HT_MCS_TX_MAX_STREAMS	4
 #define IEEE80211_HT_MCS_TX_UNEQUAL_MODULATION	0x10
 /*
  * 802.11n D5.0 20.3.5 / 20.6 says:
  * - indices 0 to 7 and 32 are single spatial stream
  * - 8 to 31 are multiple spatial streams using equal modulation
  *   [8..15 for two streams, 16..23 for three and 24..31 for four]
  * - remainder are multiple spatial streams using unequal modulation
  */
 #define IEEE80211_HT_MCS_UNEQUAL_MODULATION_START 33
 #define IEEE80211_HT_MCS_UNEQUAL_MODULATION_START_BYTE \
 	(IEEE80211_HT_MCS_UNEQUAL_MODULATION_START / 8)
 /**
  * struct ieee80211_ht_cap - HT capabilities
  *
  * This structure is the "HT capabilities element" as
  * described in 802.11n D5.0 7.3.2.57
  */
 struct ieee80211_ht_cap {
 	__le16 cap_info;
 	u8 ampdu_params_info;
 	/* 16 bytes MCS information */
 	struct ieee80211_mcs_info mcs;
 	__le16 extended_ht_cap_info;
 	__le32 tx_BF_cap_info;
 	u8 antenna_selection_info;
 } __attribute__ ((packed));
 /* 802.11n HT capabilities masks (for cap_info) */
 #define IEEE80211_HT_CAP_LDPC_CODING		0x0001
 #define IEEE80211_HT_CAP_SUP_WIDTH_20_40	0x0002
 #define IEEE80211_HT_CAP_SM_PS			0x000C
 #define IEEE80211_HT_CAP_GRN_FLD		0x0010
 #define IEEE80211_HT_CAP_SGI_20			0x0020
 #define IEEE80211_HT_CAP_SGI_40			0x0040
 #define IEEE80211_HT_CAP_TX_STBC		0x0080
 #define IEEE80211_HT_CAP_RX_STBC		0x0300
 #define IEEE80211_HT_CAP_DELAY_BA		0x0400
 #define IEEE80211_HT_CAP_MAX_AMSDU		0x0800
 #define IEEE80211_HT_CAP_DSSSCCK40		0x1000
 #define IEEE80211_HT_CAP_PSMP_SUPPORT		0x2000
 #define IEEE80211_HT_CAP_40MHZ_INTOLERANT	0x4000
 #define IEEE80211_HT_CAP_LSIG_TXOP_PROT		0x8000
 /* 802.11n HT capability AMPDU settings (for ampdu_params_info) */
 #define IEEE80211_HT_AMPDU_PARM_FACTOR		0x03
 #define IEEE80211_HT_AMPDU_PARM_DENSITY		0x1C
 /**
  * struct ieee80211_ht_info - HT information
  *
  * This structure is the "HT information element" as
  * described in 802.11n D5.0 7.3.2.58
  */
 struct ieee80211_ht_info {
 	u8 control_chan;
 	u8 ht_param;
 	__le16 operation_mode;
 	__le16 stbc_param;
 	u8 basic_set[16];
 } __attribute__ ((packed));
 /* for ht_param */
 #define IEEE80211_HT_PARAM_CHA_SEC_OFFSET		0x03
 #define		IEEE80211_HT_PARAM_CHA_SEC_NONE		0x00
 #define		IEEE80211_HT_PARAM_CHA_SEC_ABOVE	0x01
 #define		IEEE80211_HT_PARAM_CHA_SEC_BELOW	0x03
 #define IEEE80211_HT_PARAM_CHAN_WIDTH_ANY		0x04
 #define IEEE80211_HT_PARAM_RIFS_MODE			0x08
 #define IEEE80211_HT_PARAM_SPSMP_SUPPORT		0x10
 #define IEEE80211_HT_PARAM_SERV_INTERVAL_GRAN		0xE0
 /* for operation_mode */
 #define IEEE80211_HT_OP_MODE_PROTECTION			0x0003
 #define		IEEE80211_HT_OP_MODE_PROTECTION_NONE		0
 #define		IEEE80211_HT_OP_MODE_PROTECTION_NONMEMBER	1
 #define		IEEE80211_HT_OP_MODE_PROTECTION_20MHZ		2
 #define		IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED	3
 #define IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT		0x0004
 #define IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT		0x0010
 /* for stbc_param */
 #define IEEE80211_HT_STBC_PARAM_DUAL_BEACON		0x0040
 #define IEEE80211_HT_STBC_PARAM_DUAL_CTS_PROT		0x0080
 #define IEEE80211_HT_STBC_PARAM_STBC_BEACON		0x0100
 #define IEEE80211_HT_STBC_PARAM_LSIG_TXOP_FULLPROT	0x0200
 #define IEEE80211_HT_STBC_PARAM_PCO_ACTIVE		0x0400
 #define IEEE80211_HT_STBC_PARAM_PCO_PHASE		0x0800
 /* block-ack parameters */
 #define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002
 #define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C
 #define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0
 #define IEEE80211_DELBA_PARAM_TID_MASK 0xF000
 #define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800
 /*
  * A-PMDU buffer sizes
  * According to IEEE802.11n spec size varies from 8K to 64K (in powers of 2)
  */
 #define IEEE80211_MIN_AMPDU_BUF 0x8
 #define IEEE80211_MAX_AMPDU_BUF 0x40
 /* Spatial Multiplexing Power Save Modes */
 #define WLAN_HT_CAP_SM_PS_STATIC	0
 #define WLAN_HT_CAP_SM_PS_DYNAMIC	1
 #define WLAN_HT_CAP_SM_PS_INVALID	2
 #define WLAN_HT_CAP_SM_PS_DISABLED	3
 /* Authentication algorithms */
 #define WLAN_AUTH_OPEN 0
 #define WLAN_AUTH_SHARED_KEY 1
 #define WLAN_AUTH_LEAP 128
 #define WLAN_AUTH_CHALLENGE_LEN 128
 #define WLAN_CAPABILITY_ESS		(1<<0)
 #define WLAN_CAPABILITY_IBSS		(1<<1)
 #define WLAN_CAPABILITY_CF_POLLABLE	(1<<2)
 #define WLAN_CAPABILITY_CF_POLL_REQUEST	(1<<3)
 #define WLAN_CAPABILITY_PRIVACY		(1<<4)
 #define WLAN_CAPABILITY_SHORT_PREAMBLE	(1<<5)
 #define WLAN_CAPABILITY_PBCC		(1<<6)
 #define WLAN_CAPABILITY_CHANNEL_AGILITY	(1<<7)
 /* 802.11h */
 #define WLAN_CAPABILITY_SPECTRUM_MGMT	(1<<8)
 #define WLAN_CAPABILITY_QOS		(1<<9)
 #define WLAN_CAPABILITY_SHORT_SLOT_TIME	(1<<10)
 #define WLAN_CAPABILITY_DSSS_OFDM	(1<<13)
 /* measurement */
 #define IEEE80211_SPCT_MSR_RPRT_MODE_LATE	(1<<0)
 #define IEEE80211_SPCT_MSR_RPRT_MODE_INCAPABLE	(1<<1)
 #define IEEE80211_SPCT_MSR_RPRT_MODE_REFUSED	(1<<2)
 #define IEEE80211_SPCT_MSR_RPRT_TYPE_BASIC	0
 #define IEEE80211_SPCT_MSR_RPRT_TYPE_CCA	1
 #define IEEE80211_SPCT_MSR_RPRT_TYPE_RPI	2
 /* 802.11g ERP information element */
 #define WLAN_ERP_NON_ERP_PRESENT (1<<0)
 #define WLAN_ERP_USE_PROTECTION (1<<1)
 #define WLAN_ERP_BARKER_PREAMBLE (1<<2)
 /* WLAN_ERP_BARKER_PREAMBLE values */
 enum {
 	WLAN_ERP_PREAMBLE_SHORT = 0,
 	WLAN_ERP_PREAMBLE_LONG = 1,
 };
 /* Status codes */
 enum ieee80211_statuscode {
 	WLAN_STATUS_SUCCESS = 0,
 	WLAN_STATUS_UNSPECIFIED_FAILURE = 1,
 	WLAN_STATUS_CAPS_UNSUPPORTED = 10,
 	WLAN_STATUS_REASSOC_NO_ASSOC = 11,
 	WLAN_STATUS_ASSOC_DENIED_UNSPEC = 12,
 	WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG = 13,
 	WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION = 14,
 	WLAN_STATUS_CHALLENGE_FAIL = 15,
 	WLAN_STATUS_AUTH_TIMEOUT = 16,
 	WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA = 17,
 	WLAN_STATUS_ASSOC_DENIED_RATES = 18,
 	/* 802.11b */
 	WLAN_STATUS_ASSOC_DENIED_NOSHORTPREAMBLE = 19,
 	WLAN_STATUS_ASSOC_DENIED_NOPBCC = 20,
 	WLAN_STATUS_ASSOC_DENIED_NOAGILITY = 21,
 	/* 802.11h */
 	WLAN_STATUS_ASSOC_DENIED_NOSPECTRUM = 22,
 	WLAN_STATUS_ASSOC_REJECTED_BAD_POWER = 23,
 	WLAN_STATUS_ASSOC_REJECTED_BAD_SUPP_CHAN = 24,
 	/* 802.11g */
 	WLAN_STATUS_ASSOC_DENIED_NOSHORTTIME = 25,
 	WLAN_STATUS_ASSOC_DENIED_NODSSSOFDM = 26,
 	/* 802.11i */
 	WLAN_STATUS_INVALID_IE = 40,
 	WLAN_STATUS_INVALID_GROUP_CIPHER = 41,
 	WLAN_STATUS_INVALID_PAIRWISE_CIPHER = 42,
 	WLAN_STATUS_INVALID_AKMP = 43,
 	WLAN_STATUS_UNSUPP_RSN_VERSION = 44,
 	WLAN_STATUS_INVALID_RSN_IE_CAP = 45,
 	WLAN_STATUS_CIPHER_SUITE_REJECTED = 46,
 	/* 802.11e */
 	WLAN_STATUS_UNSPECIFIED_QOS = 32,
 	WLAN_STATUS_ASSOC_DENIED_NOBANDWIDTH = 33,
 	WLAN_STATUS_ASSOC_DENIED_LOWACK = 34,
 	WLAN_STATUS_ASSOC_DENIED_UNSUPP_QOS = 35,
 	WLAN_STATUS_REQUEST_DECLINED = 37,
 	WLAN_STATUS_INVALID_QOS_PARAM = 38,
 	WLAN_STATUS_CHANGE_TSPEC = 39,
 	WLAN_STATUS_WAIT_TS_DELAY = 47,
 	WLAN_STATUS_NO_DIRECT_LINK = 48,
 	WLAN_STATUS_STA_NOT_PRESENT = 49,
 	WLAN_STATUS_STA_NOT_QSTA = 50,
 };
 /* Reason codes */
 enum ieee80211_reasoncode {
 	WLAN_REASON_UNSPECIFIED = 1,
 	WLAN_REASON_PREV_AUTH_NOT_VALID = 2,
 	WLAN_REASON_DEAUTH_LEAVING = 3,
 	WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY = 4,
 	WLAN_REASON_DISASSOC_AP_BUSY = 5,
 	WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA = 6,
 	WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA = 7,
 	WLAN_REASON_DISASSOC_STA_HAS_LEFT = 8,
 	WLAN_REASON_STA_REQ_ASSOC_WITHOUT_AUTH = 9,
 	/* 802.11h */
 	WLAN_REASON_DISASSOC_BAD_POWER = 10,
 	WLAN_REASON_DISASSOC_BAD_SUPP_CHAN = 11,
 	/* 802.11i */
 	WLAN_REASON_INVALID_IE = 13,
 	WLAN_REASON_MIC_FAILURE = 14,
 	WLAN_REASON_4WAY_HANDSHAKE_TIMEOUT = 15,
 	WLAN_REASON_GROUP_KEY_HANDSHAKE_TIMEOUT = 16,
 	WLAN_REASON_IE_DIFFERENT = 17,
 	WLAN_REASON_INVALID_GROUP_CIPHER = 18,
 	WLAN_REASON_INVALID_PAIRWISE_CIPHER = 19,
 	WLAN_REASON_INVALID_AKMP = 20,
 	WLAN_REASON_UNSUPP_RSN_VERSION = 21,
 	WLAN_REASON_INVALID_RSN_IE_CAP = 22,
 	WLAN_REASON_IEEE8021X_FAILED = 23,
 	WLAN_REASON_CIPHER_SUITE_REJECTED = 24,
 	/* 802.11e */
 	WLAN_REASON_DISASSOC_UNSPECIFIED_QOS = 32,
 	WLAN_REASON_DISASSOC_QAP_NO_BANDWIDTH = 33,
 	WLAN_REASON_DISASSOC_LOW_ACK = 34,
 	WLAN_REASON_DISASSOC_QAP_EXCEED_TXOP = 35,
 	WLAN_REASON_QSTA_LEAVE_QBSS = 36,
 	WLAN_REASON_QSTA_NOT_USE = 37,
 	WLAN_REASON_QSTA_REQUIRE_SETUP = 38,
 	WLAN_REASON_QSTA_TIMEOUT = 39,
 	WLAN_REASON_QSTA_CIPHER_NOT_SUPP = 45,
 };
 /* Information Element IDs */
 enum ieee80211_eid {
 	WLAN_EID_SSID = 0,
 	WLAN_EID_SUPP_RATES = 1,
 	WLAN_EID_FH_PARAMS = 2,
 	WLAN_EID_DS_PARAMS = 3,
 	WLAN_EID_CF_PARAMS = 4,
 	WLAN_EID_TIM = 5,
 	WLAN_EID_IBSS_PARAMS = 6,
 	WLAN_EID_CHALLENGE = 16,
 	/* 802.11d */
 	WLAN_EID_COUNTRY = 7,
 	WLAN_EID_HP_PARAMS = 8,
 	WLAN_EID_HP_TABLE = 9,
 	WLAN_EID_REQUEST = 10,
 	/* 802.11e */
 	WLAN_EID_QBSS_LOAD = 11,
 	WLAN_EID_EDCA_PARAM_SET = 12,
 	WLAN_EID_TSPEC = 13,
 	WLAN_EID_TCLAS = 14,
 	WLAN_EID_SCHEDULE = 15,
 	WLAN_EID_TS_DELAY = 43,
 	WLAN_EID_TCLAS_PROCESSING = 44,
 	WLAN_EID_QOS_CAPA = 46,
 	/* 802.11s
 	 *
 	 * All mesh EID numbers are pending IEEE 802.11 ANA approval.
 	 * The numbers have been incremented from those suggested in
 	 * 802.11s/D2.0 so that MESH_CONFIG does not conflict with
 	 * EXT_SUPP_RATES.
 	 */
 	WLAN_EID_MESH_CONFIG = 51,
 	WLAN_EID_MESH_ID = 52,
 	WLAN_EID_PEER_LINK = 55,
 	WLAN_EID_PREQ = 68,
 	WLAN_EID_PREP = 69,
 	WLAN_EID_PERR = 70,
 	/* 802.11h */
 	WLAN_EID_PWR_CONSTRAINT = 32,
 	WLAN_EID_PWR_CAPABILITY = 33,
 	WLAN_EID_TPC_REQUEST = 34,
 	WLAN_EID_TPC_REPORT = 35,
 	WLAN_EID_SUPPORTED_CHANNELS = 36,
 	WLAN_EID_CHANNEL_SWITCH = 37,
 	WLAN_EID_MEASURE_REQUEST = 38,
 	WLAN_EID_MEASURE_REPORT = 39,
 	WLAN_EID_QUIET = 40,
 	WLAN_EID_IBSS_DFS = 41,
 	/* 802.11g */
 	WLAN_EID_ERP_INFO = 42,
 	WLAN_EID_EXT_SUPP_RATES = 50,
 	/* 802.11n */
 	WLAN_EID_HT_CAPABILITY = 45,
 	WLAN_EID_HT_INFORMATION = 61,
 	/* 802.11i */
 	WLAN_EID_RSN = 48,
 	WLAN_EID_MMIE = 76 /* 802.11w */,
 	WLAN_EID_WPA = 221,
 	WLAN_EID_GENERIC = 221,
 	WLAN_EID_VENDOR_SPECIFIC = 221,
 	WLAN_EID_QOS_PARAMETER = 222
 };
 /* Action category code */
 enum ieee80211_category {
 	WLAN_CATEGORY_SPECTRUM_MGMT = 0,
 	WLAN_CATEGORY_QOS = 1,
 	WLAN_CATEGORY_DLS = 2,
 	WLAN_CATEGORY_BACK = 3,
 	WLAN_CATEGORY_PUBLIC = 4,
 	WLAN_CATEGORY_WMM = 17,
 };
 /* SPECTRUM_MGMT action code */
 enum ieee80211_spectrum_mgmt_actioncode {
 	WLAN_ACTION_SPCT_MSR_REQ = 0,
 	WLAN_ACTION_SPCT_MSR_RPRT = 1,
 	WLAN_ACTION_SPCT_TPC_REQ = 2,
 	WLAN_ACTION_SPCT_TPC_RPRT = 3,
 	WLAN_ACTION_SPCT_CHL_SWITCH = 4,
 };
 /*
  * IEEE 802.11-2007 7.3.2.9 Country information element
  *
  * Minimum length is 8 octets, ie len must be evenly
  * divisible by 2
  */
 /* Although the spec says 8 I'm seeing 6 in practice */
 #define IEEE80211_COUNTRY_IE_MIN_LEN	6
 /*
  * For regulatory extension stuff see IEEE 802.11-2007
  * Annex I (page 1141) and Annex J (page 1147). Also
  * review 7.3.2.9.
  *
  * When dot11RegulatoryClassesRequired is true and the
  * first_channel/reg_extension_id is >= 201 then the IE
  * compromises of the 'ext' struct represented below:
  *
  *  - Regulatory extension ID - when generating IE this just needs
  *    to be monotonically increasing for each triplet passed in
  *    the IE
  *  - Regulatory class - index into set of rules
  *  - Coverage class - index into air propagation time (Table 7-27),
  *    in microseconds, you can compute the air propagation time from
  *    the index by multiplying by 3, so index 10 yields a propagation
  *    of 10 us. Valid values are 0-31, values 32-255 are not defined
  *    yet. A value of 0 inicates air propagation of <= 1 us.
  *
  *  See also Table I.2 for Emission limit sets and table
  *  I.3 for Behavior limit sets. Table J.1 indicates how to map
  *  a reg_class to an emission limit set and behavior limit set.
  */
 #define IEEE80211_COUNTRY_EXTENSION_ID 201
 /*
  *  Channels numbers in the IE must be monotonically increasing
  *  if dot11RegulatoryClassesRequired is not true.
  *
  *  If dot11RegulatoryClassesRequired is true consecutive
  *  subband triplets following a regulatory triplet shall
  *  have monotonically increasing first_channel number fields.
  *
  *  Channel numbers shall not overlap.
  *
  *  Note that max_power is signed.
  */
 struct ieee80211_country_ie_triplet {
 	union {
 		struct {
 			u8 first_channel;
 			u8 num_channels;
 			s8 max_power;
 		} __attribute__ ((packed)) chans;
 		struct {
 			u8 reg_extension_id;
 			u8 reg_class;
 			u8 coverage_class;
 		} __attribute__ ((packed)) ext;
 	};
 } __attribute__ ((packed));
 /* BACK action code */
 enum ieee80211_back_actioncode {
 	WLAN_ACTION_ADDBA_REQ = 0,
 	WLAN_ACTION_ADDBA_RESP = 1,
 	WLAN_ACTION_DELBA = 2,
 };
 /* BACK (block-ack) parties */
 enum ieee80211_back_parties {
 	WLAN_BACK_RECIPIENT = 0,
 	WLAN_BACK_INITIATOR = 1,
 	WLAN_BACK_TIMER = 2,
 };
 /* A-MSDU 802.11n */
 #define IEEE80211_QOS_CONTROL_A_MSDU_PRESENT 0x0080
 /* cipher suite selectors */
 #define WLAN_CIPHER_SUITE_USE_GROUP	0x000FAC00
 #define WLAN_CIPHER_SUITE_WEP40		0x000FAC01
 #define WLAN_CIPHER_SUITE_TKIP		0x000FAC02
 /* reserved: 				0x000FAC03 */
 #define WLAN_CIPHER_SUITE_CCMP		0x000FAC04
 #define WLAN_CIPHER_SUITE_WEP104	0x000FAC05
+#define WLAN_CIPHER_SUITE_AES_CMAC	0x000FAC06
 #define WLAN_MAX_KEY_LEN		32
 /**
  * ieee80211_get_qos_ctl - get pointer to qos control bytes
  * @hdr: the frame
  *
  * The qos ctrl bytes come after the frame_control, duration, seq_num
  * and 3 or 4 addresses of length ETH_ALEN.
  * 3 addr: 2 + 2 + 2 + 3*6 = 24
  * 4 addr: 2 + 2 + 2 + 4*6 = 30
  */
 static inline u8 *ieee80211_get_qos_ctl(struct ieee80211_hdr *hdr)
 {
 	if (ieee80211_has_a4(hdr->frame_control))
 		return (u8 *)hdr + 30;
 	else
 		return (u8 *)hdr + 24;
 }
 /**
  * ieee80211_get_SA - get pointer to SA
  * @hdr: the frame
  *
  * Given an 802.11 frame, this function returns the offset
  * to the source address (SA). It does not verify that the
  * header is long enough to contain the address, and the
  * header must be long enough to contain the frame control
  * field.
  */
 static inline u8 *ieee80211_get_SA(struct ieee80211_hdr *hdr)
 {
 	if (ieee80211_has_a4(hdr->frame_control))
 		return hdr->addr4;
 	if (ieee80211_has_fromds(hdr->frame_control))
 		return hdr->addr3;
 	return hdr->addr2;
 }
 /**
  * ieee80211_get_DA - get pointer to DA
  * @hdr: the frame
  *
  * Given an 802.11 frame, this function returns the offset
  * to the destination address (DA). It does not verify that
  * the header is long enough to contain the address, and the
  * header must be long enough to contain the frame control
  * field.
  */
 static inline u8 *ieee80211_get_DA(struct ieee80211_hdr *hdr)
 {
 	if (ieee80211_has_tods(hdr->frame_control))
 		return hdr->addr3;
 	else
 		return hdr->addr1;
 }
 /**
  * ieee80211_is_robust_mgmt_frame - check if frame is a robust management frame
  * @hdr: the frame (buffer must include at least the first octet of payload)
  */
 static inline bool ieee80211_is_robust_mgmt_frame(struct ieee80211_hdr *hdr)
 {
 	if (ieee80211_is_disassoc(hdr->frame_control) ||
 	    ieee80211_is_deauth(hdr->frame_control))
 		return true;
 	if (ieee80211_is_action(hdr->frame_control)) {
 		u8 *category;
 		/*
 		 * Action frames, excluding Public Action frames, are Robust
 		 * Management Frames. However, if we are looking at a Protected
 		 * frame, skip the check since the data may be encrypted and
 		 * the frame has already been found to be a Robust Management
 		 * Frame (by the other end).
 		 */
 		if (ieee80211_has_protected(hdr->frame_control))
 			return true;
 		category = ((u8 *) hdr) + 24;
 		return *category != WLAN_CATEGORY_PUBLIC;
 	}
 	return false;
 }
 /**
  * ieee80211_fhss_chan_to_freq - get channel frequency
  * @channel: the FHSS channel
  *
  * Convert IEEE802.11 FHSS channel to frequency (MHz)
  * Ref IEEE 802.11-2007 section 14.6
  */
 static inline int ieee80211_fhss_chan_to_freq(int channel)
 {
 	if ((channel > 1) && (channel < 96))
 		return channel + 2400;
 	else
 		return -1;
 }
 /**
  * ieee80211_freq_to_fhss_chan - get channel
  * @freq: the channels frequency
  *
  * Convert frequency (MHz) to IEEE802.11 FHSS channel
  * Ref IEEE 802.11-2007 section 14.6
  */
 static inline int ieee80211_freq_to_fhss_chan(int freq)
 {
 	if ((freq > 2401) && (freq < 2496))
 		return freq - 2400;
 	else
 		return -1;
 }
 /**
  * ieee80211_dsss_chan_to_freq - get channel center frequency
  * @channel: the DSSS channel
  *
  * Convert IEEE802.11 DSSS channel to the center frequency (MHz).
  * Ref IEEE 802.11-2007 section 15.6
  */
 static inline int ieee80211_dsss_chan_to_freq(int channel)
 {
 	if ((channel > 0) && (channel < 14))
 		return 2407 + (channel * 5);
 	else if (channel == 14)
 		return 2484;
 	else
 		return -1;
 }
 /**
  * ieee80211_freq_to_dsss_chan - get channel
  * @freq: the frequency
  *
  * Convert frequency (MHz) to IEEE802.11 DSSS channel
  * Ref IEEE 802.11-2007 section 15.6
  *
  * This routine selects the channel with the closest center frequency.
  */
 static inline int ieee80211_freq_to_dsss_chan(int freq)
 {
 	if ((freq >= 2410) && (freq < 2475))
 		return (freq - 2405) / 5;
 	else if ((freq >= 2482) && (freq < 2487))
 		return 14;
 	else
 		return -1;
 }
 /* Convert IEEE802.11 HR DSSS channel to frequency (MHz) and back
  * Ref IEEE 802.11-2007 section 18.4.6.2
  *
  * The channels and frequencies are the same as those defined for DSSS
  */
 #define ieee80211_hr_chan_to_freq(chan) ieee80211_dsss_chan_to_freq(chan)
 #define ieee80211_freq_to_hr_chan(freq) ieee80211_freq_to_dsss_chan(freq)
 /* Convert IEEE802.11 ERP channel to frequency (MHz) and back
  * Ref IEEE 802.11-2007 section 19.4.2
  */
 #define ieee80211_erp_chan_to_freq(chan) ieee80211_hr_chan_to_freq(chan)
 #define ieee80211_freq_to_erp_chan(freq) ieee80211_freq_to_hr_chan(freq)
 /**
  * ieee80211_ofdm_chan_to_freq - get channel center frequency
  * @s_freq: starting frequency == (dotChannelStartingFactor/2) MHz
  * @channel: the OFDM channel
  *
  * Convert IEEE802.11 OFDM channel to center frequency (MHz)
  * Ref IEEE 802.11-2007 section 17.3.8.3.2
  */
 static inline int ieee80211_ofdm_chan_to_freq(int s_freq, int channel)
 {
 	if ((channel > 0) && (channel <= 200) &&
 	    (s_freq >= 4000))
 		return s_freq + (channel * 5);
 	else
 		return -1;
 }
 /**
  * ieee80211_freq_to_ofdm_channel - get channel
  * @s_freq: starting frequency == (dotChannelStartingFactor/2) MHz
  * @freq: the frequency
  *
  * Convert frequency (MHz) to IEEE802.11 OFDM channel
  * Ref IEEE 802.11-2007 section 17.3.8.3.2
  *
  * This routine selects the channel with the closest center frequency.
  */
 static inline int ieee80211_freq_to_ofdm_chan(int s_freq, int freq)
 {
 	if ((freq > (s_freq + 2)) && (freq <= (s_freq + 1202)) &&
 	    (s_freq >= 4000))
 		return (freq + 2 - s_freq) / 5;
 	else
 		return -1;
 }
 #endif /* LINUX_IEEE80211_H */

include/linux/nl80211.h

Diff comments View file @ 3cfcf6a

 #ifndef __LINUX_NL80211_H
 #define __LINUX_NL80211_H
 /*
  * 802.11 netlink interface public header
  *
  * Copyright 2006, 2007, 2008 Johannes Berg <johannes@sipsolutions.net>
  * Copyright 2008 Michael Wu <flamingice@sourmilk.net>
  * Copyright 2008 Luis Carlos Cobo <luisca@cozybit.com>
  * Copyright 2008 Michael Buesch <mb@bu3sch.de>
  * Copyright 2008 Luis R. Rodriguez <lrodriguez@atheros.com>
  * Copyright 2008 Jouni Malinen <jouni.malinen@atheros.com>
  * Copyright 2008 Colin McCabe <colin@cozybit.com>
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
  */
 /**
  * DOC: Station handling
  *
  * Stations are added per interface, but a special case exists with VLAN
  * interfaces. When a station is bound to an AP interface, it may be moved
  * into a VLAN identified by a VLAN interface index (%NL80211_ATTR_STA_VLAN).
  * The station is still assumed to belong to the AP interface it was added
  * to.
  *
  * TODO: need more info?
  */
 /**
  * enum nl80211_commands - supported nl80211 commands
  *
  * @NL80211_CMD_UNSPEC: unspecified command to catch errors
  *
  * @NL80211_CMD_GET_WIPHY: request information about a wiphy or dump request
  *	to get a list of all present wiphys.
  * @NL80211_CMD_SET_WIPHY: set wiphy parameters, needs %NL80211_ATTR_WIPHY or
  *	%NL80211_ATTR_IFINDEX; can be used to set %NL80211_ATTR_WIPHY_NAME,
  *	%NL80211_ATTR_WIPHY_TXQ_PARAMS, %NL80211_ATTR_WIPHY_FREQ, and/or
  *	%NL80211_ATTR_WIPHY_SEC_CHAN_OFFSET.
  * @NL80211_CMD_NEW_WIPHY: Newly created wiphy, response to get request
  *	or rename notification. Has attributes %NL80211_ATTR_WIPHY and
  *	%NL80211_ATTR_WIPHY_NAME.
  * @NL80211_CMD_DEL_WIPHY: Wiphy deleted. Has attributes
  *	%NL80211_ATTR_WIPHY and %NL80211_ATTR_WIPHY_NAME.
  *
  * @NL80211_CMD_GET_INTERFACE: Request an interface's configuration;
  *	either a dump request on a %NL80211_ATTR_WIPHY or a specific get
  *	on an %NL80211_ATTR_IFINDEX is supported.
  * @NL80211_CMD_SET_INTERFACE: Set type of a virtual interface, requires
  *	%NL80211_ATTR_IFINDEX and %NL80211_ATTR_IFTYPE.
  * @NL80211_CMD_NEW_INTERFACE: Newly created virtual interface or response
  *	to %NL80211_CMD_GET_INTERFACE. Has %NL80211_ATTR_IFINDEX,
  *	%NL80211_ATTR_WIPHY and %NL80211_ATTR_IFTYPE attributes. Can also
  *	be sent from userspace to request creation of a new virtual interface,
  *	then requires attributes %NL80211_ATTR_WIPHY, %NL80211_ATTR_IFTYPE and
  *	%NL80211_ATTR_IFNAME.
  * @NL80211_CMD_DEL_INTERFACE: Virtual interface was deleted, has attributes
  *	%NL80211_ATTR_IFINDEX and %NL80211_ATTR_WIPHY. Can also be sent from
  *	userspace to request deletion of a virtual interface, then requires
  *	attribute %NL80211_ATTR_IFINDEX.
  *
  * @NL80211_CMD_GET_KEY: Get sequence counter information for a key specified
  *	by %NL80211_ATTR_KEY_IDX and/or %NL80211_ATTR_MAC.
- * @NL80211_CMD_SET_KEY: Set key attributes %NL80211_ATTR_KEY_DEFAULT or
+ * @NL80211_CMD_SET_KEY: Set key attributes %NL80211_ATTR_KEY_DEFAULT,
- *	%NL80211_ATTR_KEY_THRESHOLD.
+ *	%NL80211_ATTR_KEY_DEFAULT_MGMT, or %NL80211_ATTR_KEY_THRESHOLD.
  * @NL80211_CMD_NEW_KEY: add a key with given %NL80211_ATTR_KEY_DATA,
  *	%NL80211_ATTR_KEY_IDX, %NL80211_ATTR_MAC and %NL80211_ATTR_KEY_CIPHER
  *	attributes.
  * @NL80211_CMD_DEL_KEY: delete a key identified by %NL80211_ATTR_KEY_IDX
  *	or %NL80211_ATTR_MAC.
  *
  * @NL80211_CMD_GET_BEACON: retrieve beacon information (returned in a
  *	%NL80222_CMD_NEW_BEACON message)
  * @NL80211_CMD_SET_BEACON: set the beacon on an access point interface
  *	using the %NL80211_ATTR_BEACON_INTERVAL, %NL80211_ATTR_DTIM_PERIOD,
  *	%NL80211_BEACON_HEAD and %NL80211_BEACON_TAIL attributes.
  * @NL80211_CMD_NEW_BEACON: add a new beacon to an access point interface,
  *	parameters are like for %NL80211_CMD_SET_BEACON.
  * @NL80211_CMD_DEL_BEACON: remove the beacon, stop sending it
  *
  * @NL80211_CMD_GET_STATION: Get station attributes for station identified by
  *	%NL80211_ATTR_MAC on the interface identified by %NL80211_ATTR_IFINDEX.
  * @NL80211_CMD_SET_STATION: Set station attributes for station identified by
  *	%NL80211_ATTR_MAC on the interface identified by %NL80211_ATTR_IFINDEX.
  * @NL80211_CMD_NEW_STATION: Add a station with given attributes to the
  *	the interface identified by %NL80211_ATTR_IFINDEX.
  * @NL80211_CMD_DEL_STATION: Remove a station identified by %NL80211_ATTR_MAC
  *	or, if no MAC address given, all stations, on the interface identified
  *	by %NL80211_ATTR_IFINDEX.
  *
  * @NL80211_CMD_GET_MPATH: Get mesh path attributes for mesh path to
  * 	destination %NL80211_ATTR_MAC on the interface identified by
  * 	%NL80211_ATTR_IFINDEX.
  * @NL80211_CMD_SET_MPATH:  Set mesh path attributes for mesh path to
  * 	destination %NL80211_ATTR_MAC on the interface identified by
  * 	%NL80211_ATTR_IFINDEX.
  * @NL80211_CMD_NEW_PATH: Add a mesh path with given attributes to the
  *	the interface identified by %NL80211_ATTR_IFINDEX.
  * @NL80211_CMD_DEL_PATH: Remove a mesh path identified by %NL80211_ATTR_MAC
  *	or, if no MAC address given, all mesh paths, on the interface identified
  *	by %NL80211_ATTR_IFINDEX.
  * @NL80211_CMD_SET_BSS: Set BSS attributes for BSS identified by
  *	%NL80211_ATTR_IFINDEX.
  *
  * @NL80211_CMD_SET_REG: Set current regulatory domain. CRDA sends this command
  *	after being queried by the kernel. CRDA replies by sending a regulatory
  *	domain structure which consists of %NL80211_ATTR_REG_ALPHA set to our
  *	current alpha2 if it found a match. It also provides
  * 	NL80211_ATTR_REG_RULE_FLAGS, and a set of regulatory rules. Each
  * 	regulatory rule is a nested set of attributes  given by
  * 	%NL80211_ATTR_REG_RULE_FREQ_[START|END] and
  * 	%NL80211_ATTR_FREQ_RANGE_MAX_BW with an attached power rule given by
  * 	%NL80211_ATTR_REG_RULE_POWER_MAX_ANT_GAIN and
  * 	%NL80211_ATTR_REG_RULE_POWER_MAX_EIRP.
  * @NL80211_CMD_REQ_SET_REG: ask the wireless core to set the regulatory domain
  * 	to the the specified ISO/IEC 3166-1 alpha2 country code. The core will
  * 	store this as a valid request and then query userspace for it.
  *
  * @NL80211_CMD_GET_MESH_PARAMS: Get mesh networking properties for the
  *	interface identified by %NL80211_ATTR_IFINDEX
  *
  * @NL80211_CMD_SET_MESH_PARAMS: Set mesh networking properties for the
  *      interface identified by %NL80211_ATTR_IFINDEX
  *
  * @NL80211_CMD_MAX: highest used command number
  * @__NL80211_CMD_AFTER_LAST: internal use
  */
 enum nl80211_commands {
 /* don't change the order or add anything inbetween, this is ABI! */
 	NL80211_CMD_UNSPEC,
 	NL80211_CMD_GET_WIPHY,		/* can dump */
 	NL80211_CMD_SET_WIPHY,
 	NL80211_CMD_NEW_WIPHY,
 	NL80211_CMD_DEL_WIPHY,
 	NL80211_CMD_GET_INTERFACE,	/* can dump */
 	NL80211_CMD_SET_INTERFACE,
 	NL80211_CMD_NEW_INTERFACE,
 	NL80211_CMD_DEL_INTERFACE,
 	NL80211_CMD_GET_KEY,
 	NL80211_CMD_SET_KEY,
 	NL80211_CMD_NEW_KEY,
 	NL80211_CMD_DEL_KEY,
 	NL80211_CMD_GET_BEACON,
 	NL80211_CMD_SET_BEACON,
 	NL80211_CMD_NEW_BEACON,
 	NL80211_CMD_DEL_BEACON,
 	NL80211_CMD_GET_STATION,
 	NL80211_CMD_SET_STATION,
 	NL80211_CMD_NEW_STATION,
 	NL80211_CMD_DEL_STATION,
 	NL80211_CMD_GET_MPATH,
 	NL80211_CMD_SET_MPATH,
 	NL80211_CMD_NEW_MPATH,
 	NL80211_CMD_DEL_MPATH,
 	NL80211_CMD_SET_BSS,
 	NL80211_CMD_SET_REG,
 	NL80211_CMD_REQ_SET_REG,
 	NL80211_CMD_GET_MESH_PARAMS,
 	NL80211_CMD_SET_MESH_PARAMS,
 	/* add new commands above here */
 	/* used to define NL80211_CMD_MAX below */
 	__NL80211_CMD_AFTER_LAST,
 	NL80211_CMD_MAX = __NL80211_CMD_AFTER_LAST - 1
 };
 /*
  * Allow user space programs to use #ifdef on new commands by defining them
  * here
  */
 #define NL80211_CMD_SET_BSS NL80211_CMD_SET_BSS
 /**
  * enum nl80211_attrs - nl80211 netlink attributes
  *
  * @NL80211_ATTR_UNSPEC: unspecified attribute to catch errors
  *
  * @NL80211_ATTR_WIPHY: index of wiphy to operate on, cf.
  *	/sys/class/ieee80211/<phyname>/index
  * @NL80211_ATTR_WIPHY_NAME: wiphy name (used for renaming)
  * @NL80211_ATTR_WIPHY_TXQ_PARAMS: a nested array of TX queue parameters
  * @NL80211_ATTR_WIPHY_FREQ: frequency of the selected channel in MHz
  * @NL80211_ATTR_WIPHY_CHANNEL_TYPE: included with NL80211_ATTR_WIPHY_FREQ
  *	if HT20 or HT40 are allowed (i.e., 802.11n disabled if not included):
  *	NL80211_CHAN_NO_HT = HT not allowed (i.e., same as not including
  *		this attribute)
  *	NL80211_CHAN_HT20 = HT20 only
  *	NL80211_CHAN_HT40MINUS = secondary channel is below the primary channel
  *	NL80211_CHAN_HT40PLUS = secondary channel is above the primary channel
  *
  * @NL80211_ATTR_IFINDEX: network interface index of the device to operate on
  * @NL80211_ATTR_IFNAME: network interface name
  * @NL80211_ATTR_IFTYPE: type of virtual interface, see &enum nl80211_iftype
  *
  * @NL80211_ATTR_MAC: MAC address (various uses)
  *
  * @NL80211_ATTR_KEY_DATA: (temporal) key data; for TKIP this consists of
  *	16 bytes encryption key followed by 8 bytes each for TX and RX MIC
  *	keys
  * @NL80211_ATTR_KEY_IDX: key ID (u8, 0-3)
  * @NL80211_ATTR_KEY_CIPHER: key cipher suite (u32, as defined by IEEE 802.11
  *	section 7.3.2.25.1, e.g. 0x000FAC04)
  * @NL80211_ATTR_KEY_SEQ: transmit key sequence number (IV/PN) for TKIP and
  *	CCMP keys, each six bytes in little endian
  *
  * @NL80211_ATTR_BEACON_INTERVAL: beacon interval in TU
  * @NL80211_ATTR_DTIM_PERIOD: DTIM period for beaconing
  * @NL80211_ATTR_BEACON_HEAD: portion of the beacon before the TIM IE
  * @NL80211_ATTR_BEACON_TAIL: portion of the beacon after the TIM IE
  *
  * @NL80211_ATTR_STA_AID: Association ID for the station (u16)
  * @NL80211_ATTR_STA_FLAGS: flags, nested element with NLA_FLAG attributes of
  *	&enum nl80211_sta_flags.
  * @NL80211_ATTR_STA_LISTEN_INTERVAL: listen interval as defined by
  *	IEEE 802.11 7.3.1.6 (u16).
  * @NL80211_ATTR_STA_SUPPORTED_RATES: supported rates, array of supported
  *	rates as defined by IEEE 802.11 7.3.2.2 but without the length
  *	restriction (at most %NL80211_MAX_SUPP_RATES).
  * @NL80211_ATTR_STA_VLAN: interface index of VLAN interface to move station
  *	to, or the AP interface the station was originally added to to.
  * @NL80211_ATTR_STA_INFO: information about a station, part of station info
  *	given for %NL80211_CMD_GET_STATION, nested attribute containing
  *	info as possible, see &enum nl80211_sta_info.
  *
  * @NL80211_ATTR_WIPHY_BANDS: Information about an operating bands,
  *	consisting of a nested array.
  *
  * @NL80211_ATTR_MESH_ID: mesh id (1-32 bytes).
  * @NL80211_ATTR_PLINK_ACTION: action to perform on the mesh peer link.
  * @NL80211_ATTR_MPATH_NEXT_HOP: MAC address of the next hop for a mesh path.
  * @NL80211_ATTR_MPATH_INFO: information about a mesh_path, part of mesh path
  * 	info given for %NL80211_CMD_GET_MPATH, nested attribute described at
  *	&enum nl80211_mpath_info.
  *
  * @NL80211_ATTR_MNTR_FLAGS: flags, nested element with NLA_FLAG attributes of
  *      &enum nl80211_mntr_flags.
  *
  * @NL80211_ATTR_REG_ALPHA2: an ISO-3166-alpha2 country code for which the
  * 	current regulatory domain should be set to or is already set to.
  * 	For example, 'CR', for Costa Rica. This attribute is used by the kernel
  * 	to query the CRDA to retrieve one regulatory domain. This attribute can
  * 	also be used by userspace to query the kernel for the currently set
  * 	regulatory domain. We chose an alpha2 as that is also used by the
  * 	IEEE-802.11d country information element to identify a country.
  * 	Users can also simply ask the wireless core to set regulatory domain
  * 	to a specific alpha2.
  * @NL80211_ATTR_REG_RULES: a nested array of regulatory domain regulatory
  *	rules.
  *
  * @NL80211_ATTR_BSS_CTS_PROT: whether CTS protection is enabled (u8, 0 or 1)
  * @NL80211_ATTR_BSS_SHORT_PREAMBLE: whether short preamble is enabled
  *	(u8, 0 or 1)
  * @NL80211_ATTR_BSS_SHORT_SLOT_TIME: whether short slot time enabled
  *	(u8, 0 or 1)
  * @NL80211_ATTR_BSS_BASIC_RATES: basic rates, array of basic
  *	rates in format defined by IEEE 802.11 7.3.2.2 but without the length
  *	restriction (at most %NL80211_MAX_SUPP_RATES).
  *
  * @NL80211_ATTR_HT_CAPABILITY: HT Capability information element (from
  *	association request when used with NL80211_CMD_NEW_STATION)
  *
  * @NL80211_ATTR_SUPPORTED_IFTYPES: nested attribute containing all
  *	supported interface types, each a flag attribute with the number
  *	of the interface mode.
  *
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
  */
 enum nl80211_attrs {
 /* don't change the order or add anything inbetween, this is ABI! */
 	NL80211_ATTR_UNSPEC,
 	NL80211_ATTR_WIPHY,
 	NL80211_ATTR_WIPHY_NAME,
 	NL80211_ATTR_IFINDEX,
 	NL80211_ATTR_IFNAME,
 	NL80211_ATTR_IFTYPE,
 	NL80211_ATTR_MAC,
 	NL80211_ATTR_KEY_DATA,
 	NL80211_ATTR_KEY_IDX,
 	NL80211_ATTR_KEY_CIPHER,
 	NL80211_ATTR_KEY_SEQ,
 	NL80211_ATTR_KEY_DEFAULT,
 	NL80211_ATTR_BEACON_INTERVAL,
 	NL80211_ATTR_DTIM_PERIOD,
 	NL80211_ATTR_BEACON_HEAD,
 	NL80211_ATTR_BEACON_TAIL,
 	NL80211_ATTR_STA_AID,
 	NL80211_ATTR_STA_FLAGS,
 	NL80211_ATTR_STA_LISTEN_INTERVAL,
 	NL80211_ATTR_STA_SUPPORTED_RATES,
 	NL80211_ATTR_STA_VLAN,
 	NL80211_ATTR_STA_INFO,
 	NL80211_ATTR_WIPHY_BANDS,
 	NL80211_ATTR_MNTR_FLAGS,
 	NL80211_ATTR_MESH_ID,
 	NL80211_ATTR_STA_PLINK_ACTION,
 	NL80211_ATTR_MPATH_NEXT_HOP,
 	NL80211_ATTR_MPATH_INFO,
 	NL80211_ATTR_BSS_CTS_PROT,
 	NL80211_ATTR_BSS_SHORT_PREAMBLE,
 	NL80211_ATTR_BSS_SHORT_SLOT_TIME,
 	NL80211_ATTR_HT_CAPABILITY,
 	NL80211_ATTR_SUPPORTED_IFTYPES,
 	NL80211_ATTR_REG_ALPHA2,
 	NL80211_ATTR_REG_RULES,
 	NL80211_ATTR_MESH_PARAMS,
 	NL80211_ATTR_BSS_BASIC_RATES,
 	NL80211_ATTR_WIPHY_TXQ_PARAMS,
 	NL80211_ATTR_WIPHY_FREQ,
 	NL80211_ATTR_WIPHY_CHANNEL_TYPE,
+	NL80211_ATTR_KEY_DEFAULT_MGMT,
 	/* add attributes here, update the policy in nl80211.c */
 	__NL80211_ATTR_AFTER_LAST,
 	NL80211_ATTR_MAX = __NL80211_ATTR_AFTER_LAST - 1
 };
 /*
  * Allow user space programs to use #ifdef on new attributes by defining them
  * here
  */
 #define NL80211_ATTR_HT_CAPABILITY NL80211_ATTR_HT_CAPABILITY
 #define NL80211_ATTR_BSS_BASIC_RATES NL80211_ATTR_BSS_BASIC_RATES
 #define NL80211_ATTR_WIPHY_TXQ_PARAMS NL80211_ATTR_WIPHY_TXQ_PARAMS
 #define NL80211_ATTR_WIPHY_FREQ NL80211_ATTR_WIPHY_FREQ
 #define NL80211_ATTR_WIPHY_SEC_CHAN_OFFSET NL80211_ATTR_WIPHY_SEC_CHAN_OFFSET
 #define NL80211_MAX_SUPP_RATES			32
 #define NL80211_MAX_SUPP_REG_RULES		32
 #define NL80211_TKIP_DATA_OFFSET_ENCR_KEY	0
 #define NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY	16
 #define NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY	24
 #define NL80211_HT_CAPABILITY_LEN		26
 /**
  * enum nl80211_iftype - (virtual) interface types
  *
  * @NL80211_IFTYPE_UNSPECIFIED: unspecified type, driver decides
  * @NL80211_IFTYPE_ADHOC: independent BSS member
  * @NL80211_IFTYPE_STATION: managed BSS member
  * @NL80211_IFTYPE_AP: access point
  * @NL80211_IFTYPE_AP_VLAN: VLAN interface for access points
  * @NL80211_IFTYPE_WDS: wireless distribution interface
  * @NL80211_IFTYPE_MONITOR: monitor interface receiving all frames
  * @NL80211_IFTYPE_MESH_POINT: mesh point
  * @NL80211_IFTYPE_MAX: highest interface type number currently defined
  * @__NL80211_IFTYPE_AFTER_LAST: internal use
  *
  * These values are used with the %NL80211_ATTR_IFTYPE
  * to set the type of an interface.
  *
  */
 enum nl80211_iftype {
 	NL80211_IFTYPE_UNSPECIFIED,
 	NL80211_IFTYPE_ADHOC,
 	NL80211_IFTYPE_STATION,
 	NL80211_IFTYPE_AP,
 	NL80211_IFTYPE_AP_VLAN,
 	NL80211_IFTYPE_WDS,
 	NL80211_IFTYPE_MONITOR,
 	NL80211_IFTYPE_MESH_POINT,
 	/* keep last */
 	__NL80211_IFTYPE_AFTER_LAST,
 	NL80211_IFTYPE_MAX = __NL80211_IFTYPE_AFTER_LAST - 1
 };
 /**
  * enum nl80211_sta_flags - station flags
  *
  * Station flags. When a station is added to an AP interface, it is
  * assumed to be already associated (and hence authenticated.)
  *
  * @NL80211_STA_FLAG_AUTHORIZED: station is authorized (802.1X)
  * @NL80211_STA_FLAG_SHORT_PREAMBLE: station is capable of receiving frames
  *	with short barker preamble
  * @NL80211_STA_FLAG_WME: station is WME/QoS capable
  * @NL80211_STA_FLAG_MFP: station uses management frame protection
  */
 enum nl80211_sta_flags {
 	__NL80211_STA_FLAG_INVALID,
 	NL80211_STA_FLAG_AUTHORIZED,
 	NL80211_STA_FLAG_SHORT_PREAMBLE,
 	NL80211_STA_FLAG_WME,
 	NL80211_STA_FLAG_MFP,
 	/* keep last */
 	__NL80211_STA_FLAG_AFTER_LAST,
 	NL80211_STA_FLAG_MAX = __NL80211_STA_FLAG_AFTER_LAST - 1
 };
 /**
  * enum nl80211_rate_info - bitrate information
  *
  * These attribute types are used with %NL80211_STA_INFO_TXRATE
  * when getting information about the bitrate of a station.
  *
  * @__NL80211_RATE_INFO_INVALID: attribute number 0 is reserved
  * @NL80211_RATE_INFO_BITRATE: total bitrate (u16, 100kbit/s)
  * @NL80211_RATE_INFO_MCS: mcs index for 802.11n (u8)
  * @NL80211_RATE_INFO_40_MHZ_WIDTH: 40 Mhz dualchannel bitrate
  * @NL80211_RATE_INFO_SHORT_GI: 400ns guard interval
  * @NL80211_RATE_INFO_MAX: highest rate_info number currently defined
  * @__NL80211_RATE_INFO_AFTER_LAST: internal use
  */
 enum nl80211_rate_info {
 	__NL80211_RATE_INFO_INVALID,
 	NL80211_RATE_INFO_BITRATE,
 	NL80211_RATE_INFO_MCS,
 	NL80211_RATE_INFO_40_MHZ_WIDTH,
 	NL80211_RATE_INFO_SHORT_GI,
 	/* keep last */
 	__NL80211_RATE_INFO_AFTER_LAST,
 	NL80211_RATE_INFO_MAX = __NL80211_RATE_INFO_AFTER_LAST - 1
 };
 /**
  * enum nl80211_sta_info - station information
  *
  * These attribute types are used with %NL80211_ATTR_STA_INFO
  * when getting information about a station.
  *
  * @__NL80211_STA_INFO_INVALID: attribute number 0 is reserved
  * @NL80211_STA_INFO_INACTIVE_TIME: time since last activity (u32, msecs)
  * @NL80211_STA_INFO_RX_BYTES: total received bytes (u32, from this station)
  * @NL80211_STA_INFO_TX_BYTES: total transmitted bytes (u32, to this station)
  * @__NL80211_STA_INFO_AFTER_LAST: internal
  * @NL80211_STA_INFO_MAX: highest possible station info attribute
  * @NL80211_STA_INFO_SIGNAL: signal strength of last received PPDU (u8, dBm)
  * @NL80211_STA_INFO_TX_BITRATE: current unicast tx rate, nested attribute
  * 	containing info as possible, see &enum nl80211_sta_info_txrate.
  */
 enum nl80211_sta_info {
 	__NL80211_STA_INFO_INVALID,
 	NL80211_STA_INFO_INACTIVE_TIME,
 	NL80211_STA_INFO_RX_BYTES,
 	NL80211_STA_INFO_TX_BYTES,
 	NL80211_STA_INFO_LLID,
 	NL80211_STA_INFO_PLID,
 	NL80211_STA_INFO_PLINK_STATE,
 	NL80211_STA_INFO_SIGNAL,
 	NL80211_STA_INFO_TX_BITRATE,
 	/* keep last */
 	__NL80211_STA_INFO_AFTER_LAST,
 	NL80211_STA_INFO_MAX = __NL80211_STA_INFO_AFTER_LAST - 1
 };
 /**
  * enum nl80211_mpath_flags - nl80211 mesh path flags
  *
  * @NL80211_MPATH_FLAG_ACTIVE: the mesh path is active
  * @NL80211_MPATH_FLAG_RESOLVING: the mesh path discovery process is running
  * @NL80211_MPATH_FLAG_DSN_VALID: the mesh path contains a valid DSN
  * @NL80211_MPATH_FLAG_FIXED: the mesh path has been manually set
  * @NL80211_MPATH_FLAG_RESOLVED: the mesh path discovery process succeeded
  */
 enum nl80211_mpath_flags {
 	NL80211_MPATH_FLAG_ACTIVE =	1<<0,
 	NL80211_MPATH_FLAG_RESOLVING =	1<<1,
 	NL80211_MPATH_FLAG_DSN_VALID =	1<<2,
 	NL80211_MPATH_FLAG_FIXED =	1<<3,
 	NL80211_MPATH_FLAG_RESOLVED =	1<<4,
 };
 /**
  * enum nl80211_mpath_info - mesh path information
  *
  * These attribute types are used with %NL80211_ATTR_MPATH_INFO when getting
  * information about a mesh path.
  *
  * @__NL80211_MPATH_INFO_INVALID: attribute number 0 is reserved
  * @NL80211_ATTR_MPATH_FRAME_QLEN: number of queued frames for this destination
  * @NL80211_ATTR_MPATH_DSN: destination sequence number
  * @NL80211_ATTR_MPATH_METRIC: metric (cost) of this mesh path
  * @NL80211_ATTR_MPATH_EXPTIME: expiration time for the path, in msec from now
  * @NL80211_ATTR_MPATH_FLAGS: mesh path flags, enumerated in
  * 	&enum nl80211_mpath_flags;
  * @NL80211_ATTR_MPATH_DISCOVERY_TIMEOUT: total path discovery timeout, in msec
  * @NL80211_ATTR_MPATH_DISCOVERY_RETRIES: mesh path discovery retries
  */
 enum nl80211_mpath_info {
 	__NL80211_MPATH_INFO_INVALID,
 	NL80211_MPATH_INFO_FRAME_QLEN,
 	NL80211_MPATH_INFO_DSN,
 	NL80211_MPATH_INFO_METRIC,
 	NL80211_MPATH_INFO_EXPTIME,
 	NL80211_MPATH_INFO_FLAGS,
 	NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
 	NL80211_MPATH_INFO_DISCOVERY_RETRIES,
 	/* keep last */
 	__NL80211_MPATH_INFO_AFTER_LAST,
 	NL80211_MPATH_INFO_MAX = __NL80211_MPATH_INFO_AFTER_LAST - 1
 };
 /**
  * enum nl80211_band_attr - band attributes
  * @__NL80211_BAND_ATTR_INVALID: attribute number 0 is reserved
  * @NL80211_BAND_ATTR_FREQS: supported frequencies in this band,
  *	an array of nested frequency attributes
  * @NL80211_BAND_ATTR_RATES: supported bitrates in this band,
  *	an array of nested bitrate attributes
  * @NL80211_BAND_ATTR_HT_MCS_SET: 16-byte attribute containing the MCS set as
  *	defined in 802.11n
  * @NL80211_BAND_ATTR_HT_CAPA: HT capabilities, as in the HT information IE
  * @NL80211_BAND_ATTR_HT_AMPDU_FACTOR: A-MPDU factor, as in 11n
  * @NL80211_BAND_ATTR_HT_AMPDU_DENSITY: A-MPDU density, as in 11n
  */
 enum nl80211_band_attr {
 	__NL80211_BAND_ATTR_INVALID,
 	NL80211_BAND_ATTR_FREQS,
 	NL80211_BAND_ATTR_RATES,
 	NL80211_BAND_ATTR_HT_MCS_SET,
 	NL80211_BAND_ATTR_HT_CAPA,
 	NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 	NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 	/* keep last */
 	__NL80211_BAND_ATTR_AFTER_LAST,
 	NL80211_BAND_ATTR_MAX = __NL80211_BAND_ATTR_AFTER_LAST - 1
 };
 #define NL80211_BAND_ATTR_HT_CAPA NL80211_BAND_ATTR_HT_CAPA
 /**
  * enum nl80211_frequency_attr - frequency attributes
  * @NL80211_FREQUENCY_ATTR_FREQ: Frequency in MHz
  * @NL80211_FREQUENCY_ATTR_DISABLED: Channel is disabled in current
  *	regulatory domain.
  * @NL80211_FREQUENCY_ATTR_PASSIVE_SCAN: Only passive scanning is
  *	permitted on this channel in current regulatory domain.
  * @NL80211_FREQUENCY_ATTR_NO_IBSS: IBSS networks are not permitted
  *	on this channel in current regulatory domain.
  * @NL80211_FREQUENCY_ATTR_RADAR: Radar detection is mandatory
  *	on this channel in current regulatory domain.
  * @NL80211_FREQUENCY_ATTR_MAX_TX_POWER: Maximum transmission power in mBm
  *	(100 * dBm).
  */
 enum nl80211_frequency_attr {
 	__NL80211_FREQUENCY_ATTR_INVALID,
 	NL80211_FREQUENCY_ATTR_FREQ,
 	NL80211_FREQUENCY_ATTR_DISABLED,
 	NL80211_FREQUENCY_ATTR_PASSIVE_SCAN,
 	NL80211_FREQUENCY_ATTR_NO_IBSS,
 	NL80211_FREQUENCY_ATTR_RADAR,
 	NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 	/* keep last */
 	__NL80211_FREQUENCY_ATTR_AFTER_LAST,
 	NL80211_FREQUENCY_ATTR_MAX = __NL80211_FREQUENCY_ATTR_AFTER_LAST - 1
 };
 #define NL80211_FREQUENCY_ATTR_MAX_TX_POWER NL80211_FREQUENCY_ATTR_MAX_TX_POWER
 /**
  * enum nl80211_bitrate_attr - bitrate attributes
  * @NL80211_BITRATE_ATTR_RATE: Bitrate in units of 100 kbps
  * @NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE: Short preamble supported
  *	in 2.4 GHz band.
  */
 enum nl80211_bitrate_attr {
 	__NL80211_BITRATE_ATTR_INVALID,
 	NL80211_BITRATE_ATTR_RATE,
 	NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE,
 	/* keep last */
 	__NL80211_BITRATE_ATTR_AFTER_LAST,
 	NL80211_BITRATE_ATTR_MAX = __NL80211_BITRATE_ATTR_AFTER_LAST - 1
 };
 /**
  * enum nl80211_reg_rule_attr - regulatory rule attributes
  * @NL80211_ATTR_REG_RULE_FLAGS: a set of flags which specify additional
  * 	considerations for a given frequency range. These are the
  * 	&enum nl80211_reg_rule_flags.
  * @NL80211_ATTR_FREQ_RANGE_START: starting frequencry for the regulatory
  * 	rule in KHz. This is not a center of frequency but an actual regulatory
  * 	band edge.
  * @NL80211_ATTR_FREQ_RANGE_END: ending frequency for the regulatory rule
  * 	in KHz. This is not a center a frequency but an actual regulatory
  * 	band edge.
  * @NL80211_ATTR_FREQ_RANGE_MAX_BW: maximum allowed bandwidth for this
  * 	frequency range, in KHz.
  * @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN: the maximum allowed antenna gain
  * 	for a given frequency range. The value is in mBi (100 * dBi).
  * 	If you don't have one then don't send this.
  * @NL80211_ATTR_POWER_RULE_MAX_EIRP: the maximum allowed EIRP for
  * 	a given frequency range. The value is in mBm (100 * dBm).
  */
 enum nl80211_reg_rule_attr {
 	__NL80211_REG_RULE_ATTR_INVALID,
 	NL80211_ATTR_REG_RULE_FLAGS,
 	NL80211_ATTR_FREQ_RANGE_START,
 	NL80211_ATTR_FREQ_RANGE_END,
 	NL80211_ATTR_FREQ_RANGE_MAX_BW,
 	NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
 	NL80211_ATTR_POWER_RULE_MAX_EIRP,
 	/* keep last */
 	__NL80211_REG_RULE_ATTR_AFTER_LAST,
 	NL80211_REG_RULE_ATTR_MAX = __NL80211_REG_RULE_ATTR_AFTER_LAST - 1
 };
 /**
  * enum nl80211_reg_rule_flags - regulatory rule flags
  *
  * @NL80211_RRF_NO_OFDM: OFDM modulation not allowed
  * @NL80211_RRF_NO_CCK: CCK modulation not allowed
  * @NL80211_RRF_NO_INDOOR: indoor operation not allowed
  * @NL80211_RRF_NO_OUTDOOR: outdoor operation not allowed
  * @NL80211_RRF_DFS: DFS support is required to be used
  * @NL80211_RRF_PTP_ONLY: this is only for Point To Point links
  * @NL80211_RRF_PTMP_ONLY: this is only for Point To Multi Point links
  * @NL80211_RRF_PASSIVE_SCAN: passive scan is required
  * @NL80211_RRF_NO_IBSS: no IBSS is allowed
  */
 enum nl80211_reg_rule_flags {
 	NL80211_RRF_NO_OFDM		= 1<<0,
 	NL80211_RRF_NO_CCK		= 1<<1,
 	NL80211_RRF_NO_INDOOR		= 1<<2,
 	NL80211_RRF_NO_OUTDOOR		= 1<<3,
 	NL80211_RRF_DFS			= 1<<4,
 	NL80211_RRF_PTP_ONLY		= 1<<5,
 	NL80211_RRF_PTMP_ONLY		= 1<<6,
 	NL80211_RRF_PASSIVE_SCAN	= 1<<7,
 	NL80211_RRF_NO_IBSS		= 1<<8,
 };
 /**
  * enum nl80211_mntr_flags - monitor configuration flags
  *
  * Monitor configuration flags.
  *
  * @__NL80211_MNTR_FLAG_INVALID: reserved
  *
  * @NL80211_MNTR_FLAG_FCSFAIL: pass frames with bad FCS
  * @NL80211_MNTR_FLAG_PLCPFAIL: pass frames with bad PLCP
  * @NL80211_MNTR_FLAG_CONTROL: pass control frames
  * @NL80211_MNTR_FLAG_OTHER_BSS: disable BSSID filtering
  * @NL80211_MNTR_FLAG_COOK_FRAMES: report frames after processing.
  *	overrides all other flags.
  *
  * @__NL80211_MNTR_FLAG_AFTER_LAST: internal use
  * @NL80211_MNTR_FLAG_MAX: highest possible monitor flag
  */
 enum nl80211_mntr_flags {
 	__NL80211_MNTR_FLAG_INVALID,
 	NL80211_MNTR_FLAG_FCSFAIL,
 	NL80211_MNTR_FLAG_PLCPFAIL,
 	NL80211_MNTR_FLAG_CONTROL,
 	NL80211_MNTR_FLAG_OTHER_BSS,
 	NL80211_MNTR_FLAG_COOK_FRAMES,
 	/* keep last */
 	__NL80211_MNTR_FLAG_AFTER_LAST,
 	NL80211_MNTR_FLAG_MAX = __NL80211_MNTR_FLAG_AFTER_LAST - 1
 };
 /**
  * enum nl80211_meshconf_params - mesh configuration parameters
  *
  * Mesh configuration parameters
  *
  * @__NL80211_MESHCONF_INVALID: internal use
  *
  * @NL80211_MESHCONF_RETRY_TIMEOUT: specifies the initial retry timeout in
  * millisecond units, used by the Peer Link Open message
  *
  * @NL80211_MESHCONF_CONFIRM_TIMEOUT: specifies the inital confirm timeout, in
  * millisecond units, used by the peer link management to close a peer link
  *
  * @NL80211_MESHCONF_HOLDING_TIMEOUT: specifies the holding timeout, in
  * millisecond units
  *
  * @NL80211_MESHCONF_MAX_PEER_LINKS: maximum number of peer links allowed
  * on this mesh interface
  *
  * @NL80211_MESHCONF_MAX_RETRIES: specifies the maximum number of peer link
  * open retries that can be sent to establish a new peer link instance in a
  * mesh
  *
  * @NL80211_MESHCONF_TTL: specifies the value of TTL field set at a source mesh
  * point.
  *
  * @NL80211_MESHCONF_AUTO_OPEN_PLINKS: whether we should automatically
  * open peer links when we detect compatible mesh peers.
  *
  * @NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES: the number of action frames
  * containing a PREQ that an MP can send to a particular destination (path
  * target)
  *
  * @NL80211_MESHCONF_PATH_REFRESH_TIME: how frequently to refresh mesh paths
  * (in milliseconds)
  *
  * @NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT: minimum length of time to wait
  * until giving up on a path discovery (in milliseconds)
  *
  * @NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT: The time (in TUs) for which mesh
  * points receiving a PREQ shall consider the forwarding information from the
  * root to be valid. (TU = time unit)
  *
  * @NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL: The minimum interval of time (in
  * TUs) during which an MP can send only one action frame containing a PREQ
  * reference element
  *
  * @NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME: The interval of time (in TUs)
  * that it takes for an HWMP information element to propagate across the mesh
  *
  * @NL80211_MESHCONF_ATTR_MAX: highest possible mesh configuration attribute
  *
  * @__NL80211_MESHCONF_ATTR_AFTER_LAST: internal use
  */
 enum nl80211_meshconf_params {
 	__NL80211_MESHCONF_INVALID,
 	NL80211_MESHCONF_RETRY_TIMEOUT,
 	NL80211_MESHCONF_CONFIRM_TIMEOUT,
 	NL80211_MESHCONF_HOLDING_TIMEOUT,
 	NL80211_MESHCONF_MAX_PEER_LINKS,
 	NL80211_MESHCONF_MAX_RETRIES,
 	NL80211_MESHCONF_TTL,
 	NL80211_MESHCONF_AUTO_OPEN_PLINKS,
 	NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
 	NL80211_MESHCONF_PATH_REFRESH_TIME,
 	NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
 	NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
 	NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
 	NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
 	/* keep last */
 	__NL80211_MESHCONF_ATTR_AFTER_LAST,
 	NL80211_MESHCONF_ATTR_MAX = __NL80211_MESHCONF_ATTR_AFTER_LAST - 1
 };
 /**
  * enum nl80211_txq_attr - TX queue parameter attributes
  * @__NL80211_TXQ_ATTR_INVALID: Attribute number 0 is reserved
  * @NL80211_TXQ_ATTR_QUEUE: TX queue identifier (NL80211_TXQ_Q_*)
  * @NL80211_TXQ_ATTR_TXOP: Maximum burst time in units of 32 usecs, 0 meaning
  *	disabled
  * @NL80211_TXQ_ATTR_CWMIN: Minimum contention window [a value of the form
  *	2^n-1 in the range 1..32767]
  * @NL80211_TXQ_ATTR_CWMAX: Maximum contention window [a value of the form
  *	2^n-1 in the range 1..32767]
  * @NL80211_TXQ_ATTR_AIFS: Arbitration interframe space [0..255]
  * @__NL80211_TXQ_ATTR_AFTER_LAST: Internal
  * @NL80211_TXQ_ATTR_MAX: Maximum TXQ attribute number
  */
 enum nl80211_txq_attr {
 	__NL80211_TXQ_ATTR_INVALID,
 	NL80211_TXQ_ATTR_QUEUE,
 	NL80211_TXQ_ATTR_TXOP,
 	NL80211_TXQ_ATTR_CWMIN,
 	NL80211_TXQ_ATTR_CWMAX,
 	NL80211_TXQ_ATTR_AIFS,
 	/* keep last */
 	__NL80211_TXQ_ATTR_AFTER_LAST,
 	NL80211_TXQ_ATTR_MAX = __NL80211_TXQ_ATTR_AFTER_LAST - 1
 };
 enum nl80211_txq_q {
 	NL80211_TXQ_Q_VO,
 	NL80211_TXQ_Q_VI,
 	NL80211_TXQ_Q_BE,
 	NL80211_TXQ_Q_BK
 };
 enum nl80211_channel_type {
 	NL80211_CHAN_NO_HT,
 	NL80211_CHAN_HT20,
 	NL80211_CHAN_HT40MINUS,
 	NL80211_CHAN_HT40PLUS
 };
 #endif /* __LINUX_NL80211_H */

include/net/cfg80211.h

Diff comments View file @ 3cfcf6a

 #ifndef __NET_CFG80211_H
 #define __NET_CFG80211_H
 #include <linux/netlink.h>
 #include <linux/skbuff.h>
 #include <linux/nl80211.h>
 #include <net/genetlink.h>
 /* remove once we remove the wext stuff */
 #include <net/iw_handler.h>
 /*
  * 802.11 configuration in-kernel interface
  *
  * Copyright 2006, 2007	Johannes Berg <johannes@sipsolutions.net>
  */
 /**
  * struct vif_params - describes virtual interface parameters
  * @mesh_id: mesh ID to use
  * @mesh_id_len: length of the mesh ID
  */
 struct vif_params {
        u8 *mesh_id;
        int mesh_id_len;
 };
 /* Radiotap header iteration
  *   implemented in net/wireless/radiotap.c
  *   docs in Documentation/networking/radiotap-headers.txt
  */
 /**
  * struct ieee80211_radiotap_iterator - tracks walk thru present radiotap args
  * @rtheader: pointer to the radiotap header we are walking through
  * @max_length: length of radiotap header in cpu byte ordering
  * @this_arg_index: IEEE80211_RADIOTAP_... index of current arg
  * @this_arg: pointer to current radiotap arg
  * @arg_index: internal next argument index
  * @arg: internal next argument pointer
  * @next_bitmap: internal pointer to next present u32
  * @bitmap_shifter: internal shifter for curr u32 bitmap, b0 set == arg present
  */
 struct ieee80211_radiotap_iterator {
 	struct ieee80211_radiotap_header *rtheader;
 	int max_length;
 	int this_arg_index;
 	u8 *this_arg;
 	int arg_index;
 	u8 *arg;
 	__le32 *next_bitmap;
 	u32 bitmap_shifter;
 };
 extern int ieee80211_radiotap_iterator_init(
    struct ieee80211_radiotap_iterator *iterator,
    struct ieee80211_radiotap_header *radiotap_header,
    int max_length);
 extern int ieee80211_radiotap_iterator_next(
    struct ieee80211_radiotap_iterator *iterator);
  /**
  * struct key_params - key information
  *
  * Information about a key
  *
  * @key: key material
  * @key_len: length of key material
  * @cipher: cipher suite selector
  * @seq: sequence counter (IV/PN) for TKIP and CCMP keys, only used
  *	with the get_key() callback, must be in little endian,
  *	length given by @seq_len.
  */
 struct key_params {
 	u8 *key;
 	u8 *seq;
 	int key_len;
 	int seq_len;
 	u32 cipher;
 };
 /**
  * struct beacon_parameters - beacon parameters
  *
  * Used to configure the beacon for an interface.
  *
  * @head: head portion of beacon (before TIM IE)
  *     or %NULL if not changed
  * @tail: tail portion of beacon (after TIM IE)
  *     or %NULL if not changed
  * @interval: beacon interval or zero if not changed
  * @dtim_period: DTIM period or zero if not changed
  * @head_len: length of @head
  * @tail_len: length of @tail
  */
 struct beacon_parameters {
 	u8 *head, *tail;
 	int interval, dtim_period;
 	int head_len, tail_len;
 };
 /**
  * enum station_flags - station flags
  *
  * Station capability flags. Note that these must be the bits
  * according to the nl80211 flags.
  *
  * @STATION_FLAG_CHANGED: station flags were changed
  * @STATION_FLAG_AUTHORIZED: station is authorized to send frames (802.1X)
  * @STATION_FLAG_SHORT_PREAMBLE: station is capable of receiving frames
  *	with short preambles
  * @STATION_FLAG_WME: station is WME/QoS capable
  * @STATION_FLAG_MFP: station uses management frame protection
  */
 enum station_flags {
 	STATION_FLAG_CHANGED		= 1<<0,
 	STATION_FLAG_AUTHORIZED		= 1<<NL80211_STA_FLAG_AUTHORIZED,
 	STATION_FLAG_SHORT_PREAMBLE	= 1<<NL80211_STA_FLAG_SHORT_PREAMBLE,
 	STATION_FLAG_WME		= 1<<NL80211_STA_FLAG_WME,
 	STATION_FLAG_MFP		= 1<<NL80211_STA_FLAG_MFP,
 };
 /**
  * enum plink_action - actions to perform in mesh peers
  *
  * @PLINK_ACTION_INVALID: action 0 is reserved
  * @PLINK_ACTION_OPEN: start mesh peer link establishment
  * @PLINK_ACTION_BLOCL: block traffic from this mesh peer
  */
 enum plink_actions {
 	PLINK_ACTION_INVALID,
 	PLINK_ACTION_OPEN,
 	PLINK_ACTION_BLOCK,
 };
 /**
  * struct station_parameters - station parameters
  *
  * Used to change and create a new station.
  *
  * @vlan: vlan interface station should belong to
  * @supported_rates: supported rates in IEEE 802.11 format
  *	(or NULL for no change)
  * @supported_rates_len: number of supported rates
  * @station_flags: station flags (see &enum station_flags)
  * @listen_interval: listen interval or -1 for no change
  * @aid: AID or zero for no change
  */
 struct station_parameters {
 	u8 *supported_rates;
 	struct net_device *vlan;
 	u32 station_flags;
 	int listen_interval;
 	u16 aid;
 	u8 supported_rates_len;
 	u8 plink_action;
 	struct ieee80211_ht_cap *ht_capa;
 };
 /**
  * enum station_info_flags - station information flags
  *
  * Used by the driver to indicate which info in &struct station_info
  * it has filled in during get_station() or dump_station().
  *
  * @STATION_INFO_INACTIVE_TIME: @inactive_time filled
  * @STATION_INFO_RX_BYTES: @rx_bytes filled
  * @STATION_INFO_TX_BYTES: @tx_bytes filled
  * @STATION_INFO_LLID: @llid filled
  * @STATION_INFO_PLID: @plid filled
  * @STATION_INFO_PLINK_STATE: @plink_state filled
  * @STATION_INFO_SIGNAL: @signal filled
  * @STATION_INFO_TX_BITRATE: @tx_bitrate fields are filled
  *  (tx_bitrate, tx_bitrate_flags and tx_bitrate_mcs)
  */
 enum station_info_flags {
 	STATION_INFO_INACTIVE_TIME	= 1<<0,
 	STATION_INFO_RX_BYTES		= 1<<1,
 	STATION_INFO_TX_BYTES		= 1<<2,
 	STATION_INFO_LLID		= 1<<3,
 	STATION_INFO_PLID		= 1<<4,
 	STATION_INFO_PLINK_STATE	= 1<<5,
 	STATION_INFO_SIGNAL		= 1<<6,
 	STATION_INFO_TX_BITRATE		= 1<<7,
 };
 /**
  * enum station_info_rate_flags - bitrate info flags
  *
  * Used by the driver to indicate the specific rate transmission
  * type for 802.11n transmissions.
  *
  * @RATE_INFO_FLAGS_MCS: @tx_bitrate_mcs filled
  * @RATE_INFO_FLAGS_40_MHZ_WIDTH: 40 Mhz width transmission
  * @RATE_INFO_FLAGS_SHORT_GI: 400ns guard interval
  */
 enum rate_info_flags {
 	RATE_INFO_FLAGS_MCS		= 1<<0,
 	RATE_INFO_FLAGS_40_MHZ_WIDTH	= 1<<1,
 	RATE_INFO_FLAGS_SHORT_GI	= 1<<2,
 };
 /**
  * struct rate_info - bitrate information
  *
  * Information about a receiving or transmitting bitrate
  *
  * @flags: bitflag of flags from &enum rate_info_flags
  * @mcs: mcs index if struct describes a 802.11n bitrate
  * @legacy: bitrate in 100kbit/s for 802.11abg
  */
 struct rate_info {
 	u8 flags;
 	u8 mcs;
 	u16 legacy;
 };
 /**
  * struct station_info - station information
  *
  * Station information filled by driver for get_station() and dump_station.
  *
  * @filled: bitflag of flags from &enum station_info_flags
  * @inactive_time: time since last station activity (tx/rx) in milliseconds
  * @rx_bytes: bytes received from this station
  * @tx_bytes: bytes transmitted to this station
  * @llid: mesh local link id
  * @plid: mesh peer link id
  * @plink_state: mesh peer link state
  * @signal: signal strength of last received packet in dBm
  * @txrate: current unicast bitrate to this station
  */
 struct station_info {
 	u32 filled;
 	u32 inactive_time;
 	u32 rx_bytes;
 	u32 tx_bytes;
 	u16 llid;
 	u16 plid;
 	u8 plink_state;
 	s8 signal;
 	struct rate_info txrate;
 };
 /**
  * enum monitor_flags - monitor flags
  *
  * Monitor interface configuration flags. Note that these must be the bits
  * according to the nl80211 flags.
  *
  * @MONITOR_FLAG_FCSFAIL: pass frames with bad FCS
  * @MONITOR_FLAG_PLCPFAIL: pass frames with bad PLCP
  * @MONITOR_FLAG_CONTROL: pass control frames
  * @MONITOR_FLAG_OTHER_BSS: disable BSSID filtering
  * @MONITOR_FLAG_COOK_FRAMES: report frames after processing
  */
 enum monitor_flags {
 	MONITOR_FLAG_FCSFAIL		= 1<<NL80211_MNTR_FLAG_FCSFAIL,
 	MONITOR_FLAG_PLCPFAIL		= 1<<NL80211_MNTR_FLAG_PLCPFAIL,
 	MONITOR_FLAG_CONTROL		= 1<<NL80211_MNTR_FLAG_CONTROL,
 	MONITOR_FLAG_OTHER_BSS		= 1<<NL80211_MNTR_FLAG_OTHER_BSS,
 	MONITOR_FLAG_COOK_FRAMES	= 1<<NL80211_MNTR_FLAG_COOK_FRAMES,
 };
 /**
  * enum mpath_info_flags -  mesh path information flags
  *
  * Used by the driver to indicate which info in &struct mpath_info it has filled
  * in during get_station() or dump_station().
  *
  * MPATH_INFO_FRAME_QLEN: @frame_qlen filled
  * MPATH_INFO_DSN: @dsn filled
  * MPATH_INFO_METRIC: @metric filled
  * MPATH_INFO_EXPTIME: @exptime filled
  * MPATH_INFO_DISCOVERY_TIMEOUT: @discovery_timeout filled
  * MPATH_INFO_DISCOVERY_RETRIES: @discovery_retries filled
  * MPATH_INFO_FLAGS: @flags filled
  */
 enum mpath_info_flags {
 	MPATH_INFO_FRAME_QLEN		= BIT(0),
 	MPATH_INFO_DSN			= BIT(1),
 	MPATH_INFO_METRIC		= BIT(2),
 	MPATH_INFO_EXPTIME		= BIT(3),
 	MPATH_INFO_DISCOVERY_TIMEOUT	= BIT(4),
 	MPATH_INFO_DISCOVERY_RETRIES	= BIT(5),
 	MPATH_INFO_FLAGS		= BIT(6),
 };
 /**
  * struct mpath_info - mesh path information
  *
  * Mesh path information filled by driver for get_mpath() and dump_mpath().
  *
  * @filled: bitfield of flags from &enum mpath_info_flags
  * @frame_qlen: number of queued frames for this destination
  * @dsn: destination sequence number
  * @metric: metric (cost) of this mesh path
  * @exptime: expiration time for the mesh path from now, in msecs
  * @flags: mesh path flags
  * @discovery_timeout: total mesh path discovery timeout, in msecs
  * @discovery_retries: mesh path discovery retries
  */
 struct mpath_info {
 	u32 filled;
 	u32 frame_qlen;
 	u32 dsn;
 	u32 metric;
 	u32 exptime;
 	u32 discovery_timeout;
 	u8 discovery_retries;
 	u8 flags;
 };
 /**
  * struct bss_parameters - BSS parameters
  *
  * Used to change BSS parameters (mainly for AP mode).
  *
  * @use_cts_prot: Whether to use CTS protection
  *	(0 = no, 1 = yes, -1 = do not change)
  * @use_short_preamble: Whether the use of short preambles is allowed
  *	(0 = no, 1 = yes, -1 = do not change)
  * @use_short_slot_time: Whether the use of short slot time is allowed
  *	(0 = no, 1 = yes, -1 = do not change)
  * @basic_rates: basic rates in IEEE 802.11 format
  *	(or NULL for no change)
  * @basic_rates_len: number of basic rates
  */
 struct bss_parameters {
 	int use_cts_prot;
 	int use_short_preamble;
 	int use_short_slot_time;
 	u8 *basic_rates;
 	u8 basic_rates_len;
 };
 /**
  * enum reg_set_by - Indicates who is trying to set the regulatory domain
  * @REGDOM_SET_BY_INIT: regulatory domain was set by initialization. We will be
  * 	using a static world regulatory domain by default.
  * @REGDOM_SET_BY_CORE: Core queried CRDA for a dynamic world regulatory domain.
  * @REGDOM_SET_BY_USER: User asked the wireless core to set the
  * 	regulatory domain.
  * @REGDOM_SET_BY_DRIVER: a wireless drivers has hinted to the wireless core
  *	it thinks its knows the regulatory domain we should be in.
  * @REGDOM_SET_BY_COUNTRY_IE: the wireless core has received an 802.11 country
  *	information element with regulatory information it thinks we
  *	should consider.
  */
 enum reg_set_by {
 	REGDOM_SET_BY_INIT,
 	REGDOM_SET_BY_CORE,
 	REGDOM_SET_BY_USER,
 	REGDOM_SET_BY_DRIVER,
 	REGDOM_SET_BY_COUNTRY_IE,
 };
 struct ieee80211_freq_range {
 	u32 start_freq_khz;
 	u32 end_freq_khz;
 	u32 max_bandwidth_khz;
 };
 struct ieee80211_power_rule {
 	u32 max_antenna_gain;
 	u32 max_eirp;
 };
 struct ieee80211_reg_rule {
 	struct ieee80211_freq_range freq_range;
 	struct ieee80211_power_rule power_rule;
 	u32 flags;
 };
 struct ieee80211_regdomain {
 	u32 n_reg_rules;
 	char alpha2[2];
 	struct ieee80211_reg_rule reg_rules[];
 };
 #define MHZ_TO_KHZ(freq) ((freq) * 1000)
 #define KHZ_TO_MHZ(freq) ((freq) / 1000)
 #define DBI_TO_MBI(gain) ((gain) * 100)
 #define MBI_TO_DBI(gain) ((gain) / 100)
 #define DBM_TO_MBM(gain) ((gain) * 100)
 #define MBM_TO_DBM(gain) ((gain) / 100)
 #define REG_RULE(start, end, bw, gain, eirp, reg_flags) { \
 	.freq_range.start_freq_khz = MHZ_TO_KHZ(start), \
 	.freq_range.end_freq_khz = MHZ_TO_KHZ(end), \
 	.freq_range.max_bandwidth_khz = MHZ_TO_KHZ(bw), \
 	.power_rule.max_antenna_gain = DBI_TO_MBI(gain), \
 	.power_rule.max_eirp = DBM_TO_MBM(eirp), \
 	.flags = reg_flags, \
 	}
 struct mesh_config {
 	/* Timeouts in ms */
 	/* Mesh plink management parameters */
 	u16 dot11MeshRetryTimeout;
 	u16 dot11MeshConfirmTimeout;
 	u16 dot11MeshHoldingTimeout;
 	u16 dot11MeshMaxPeerLinks;
 	u8  dot11MeshMaxRetries;
 	u8  dot11MeshTTL;
 	bool auto_open_plinks;
 	/* HWMP parameters */
 	u8  dot11MeshHWMPmaxPREQretries;
 	u32 path_refresh_time;
 	u16 min_discovery_timeout;
 	u32 dot11MeshHWMPactivePathTimeout;
 	u16 dot11MeshHWMPpreqMinInterval;
 	u16 dot11MeshHWMPnetDiameterTraversalTime;
 };
 /**
  * struct ieee80211_txq_params - TX queue parameters
  * @queue: TX queue identifier (NL80211_TXQ_Q_*)
  * @txop: Maximum burst time in units of 32 usecs, 0 meaning disabled
  * @cwmin: Minimum contention window [a value of the form 2^n-1 in the range
  *	1..32767]
  * @cwmax: Maximum contention window [a value of the form 2^n-1 in the range
  *	1..32767]
  * @aifs: Arbitration interframe space [0..255]
  */
 struct ieee80211_txq_params {
 	enum nl80211_txq_q queue;
 	u16 txop;
 	u16 cwmin;
 	u16 cwmax;
 	u8 aifs;
 };
 /* from net/wireless.h */
 struct wiphy;
 /* from net/ieee80211.h */
 struct ieee80211_channel;
 /**
  * struct cfg80211_ops - backend description for wireless configuration
  *
  * This struct is registered by fullmac card drivers and/or wireless stacks
  * in order to handle configuration requests on their interfaces.
  *
  * All callbacks except where otherwise noted should return 0
  * on success or a negative error code.
  *
  * All operations are currently invoked under rtnl for consistency with the
  * wireless extensions but this is subject to reevaluation as soon as this
  * code is used more widely and we have a first user without wext.
  *
  * @add_virtual_intf: create a new virtual interface with the given name,
  *	must set the struct wireless_dev's iftype.
  *
  * @del_virtual_intf: remove the virtual interface determined by ifindex.
  *
  * @change_virtual_intf: change type/configuration of virtual interface,
  *	keep the struct wireless_dev's iftype updated.
  *
  * @add_key: add a key with the given parameters. @mac_addr will be %NULL
  *	when adding a group key.
  *
  * @get_key: get information about the key with the given parameters.
  *	@mac_addr will be %NULL when requesting information for a group
  *	key. All pointers given to the @callback function need not be valid
  *	after it returns.
  *
  * @del_key: remove a key given the @mac_addr (%NULL for a group key)
  *	and @key_index
  *
  * @set_default_key: set the default key on an interface
  *
+ * @set_default_mgmt_key: set the default management frame key on an interface
+ *
  * @add_beacon: Add a beacon with given parameters, @head, @interval
  *	and @dtim_period will be valid, @tail is optional.
  * @set_beacon: Change the beacon parameters for an access point mode
  *	interface. This should reject the call when no beacon has been
  *	configured.
  * @del_beacon: Remove beacon configuration and stop sending the beacon.
  *
  * @add_station: Add a new station.
  *
  * @del_station: Remove a station; @mac may be NULL to remove all stations.
  *
  * @change_station: Modify a given station.
  *
  * @get_mesh_params: Put the current mesh parameters into *params
  *
  * @set_mesh_params: Set mesh parameters.
  *	The mask is a bitfield which tells us which parameters to
  *	set, and which to leave alone.
  *
  * @set_mesh_cfg: set mesh parameters (by now, just mesh id)
  *
  * @change_bss: Modify parameters for a given BSS.
  *
  * @set_txq_params: Set TX queue parameters
  *
  * @set_channel: Set channel
  */
 struct cfg80211_ops {
 	int	(*add_virtual_intf)(struct wiphy *wiphy, char *name,
 				    enum nl80211_iftype type, u32 *flags,
 				    struct vif_params *params);
 	int	(*del_virtual_intf)(struct wiphy *wiphy, int ifindex);
 	int	(*change_virtual_intf)(struct wiphy *wiphy, int ifindex,
 				       enum nl80211_iftype type, u32 *flags,
 				       struct vif_params *params);
 	int	(*add_key)(struct wiphy *wiphy, struct net_device *netdev,
 			   u8 key_index, u8 *mac_addr,
 			   struct key_params *params);
 	int	(*get_key)(struct wiphy *wiphy, struct net_device *netdev,
 			   u8 key_index, u8 *mac_addr, void *cookie,
 			   void (*callback)(void *cookie, struct key_params*));
 	int	(*del_key)(struct wiphy *wiphy, struct net_device *netdev,
 			   u8 key_index, u8 *mac_addr);
 	int	(*set_default_key)(struct wiphy *wiphy,
 				   struct net_device *netdev,
 				   u8 key_index);
+	int	(*set_default_mgmt_key)(struct wiphy *wiphy,
+					struct net_device *netdev,
+					u8 key_index);
 	int	(*add_beacon)(struct wiphy *wiphy, struct net_device *dev,
 			      struct beacon_parameters *info);
 	int	(*set_beacon)(struct wiphy *wiphy, struct net_device *dev,
 			      struct beacon_parameters *info);
 	int	(*del_beacon)(struct wiphy *wiphy, struct net_device *dev);
 	int	(*add_station)(struct wiphy *wiphy, struct net_device *dev,
 			       u8 *mac, struct station_parameters *params);
 	int	(*del_station)(struct wiphy *wiphy, struct net_device *dev,
 			       u8 *mac);
 	int	(*change_station)(struct wiphy *wiphy, struct net_device *dev,
 				  u8 *mac, struct station_parameters *params);
 	int	(*get_station)(struct wiphy *wiphy, struct net_device *dev,
 			       u8 *mac, struct station_info *sinfo);
 	int	(*dump_station)(struct wiphy *wiphy, struct net_device *dev,
 			       int idx, u8 *mac, struct station_info *sinfo);
 	int	(*add_mpath)(struct wiphy *wiphy, struct net_device *dev,
 			       u8 *dst, u8 *next_hop);
 	int	(*del_mpath)(struct wiphy *wiphy, struct net_device *dev,
 			       u8 *dst);
 	int	(*change_mpath)(struct wiphy *wiphy, struct net_device *dev,
 				  u8 *dst, u8 *next_hop);
 	int	(*get_mpath)(struct wiphy *wiphy, struct net_device *dev,
 			       u8 *dst, u8 *next_hop,
 			       struct mpath_info *pinfo);
 	int	(*dump_mpath)(struct wiphy *wiphy, struct net_device *dev,
 			       int idx, u8 *dst, u8 *next_hop,
 			       struct mpath_info *pinfo);
 	int	(*get_mesh_params)(struct wiphy *wiphy,
 				struct net_device *dev,
 				struct mesh_config *conf);
 	int	(*set_mesh_params)(struct wiphy *wiphy,
 				struct net_device *dev,
 				const struct mesh_config *nconf, u32 mask);
 	int	(*change_bss)(struct wiphy *wiphy, struct net_device *dev,
 			      struct bss_parameters *params);
 	int	(*set_txq_params)(struct wiphy *wiphy,
 				  struct ieee80211_txq_params *params);
 	int	(*set_channel)(struct wiphy *wiphy,
 			       struct ieee80211_channel *chan,
 			       enum nl80211_channel_type channel_type);
 };
 /* temporary wext handlers */
 int cfg80211_wext_giwname(struct net_device *dev,
 			  struct iw_request_info *info,
 			  char *name, char *extra);
 int cfg80211_wext_siwmode(struct net_device *dev, struct iw_request_info *info,
 			  u32 *mode, char *extra);
 int cfg80211_wext_giwmode(struct net_device *dev, struct iw_request_info *info,
 			  u32 *mode, char *extra);
 #endif /* __NET_CFG80211_H */

include/net/mac80211.h

Diff comments View file @ 3cfcf6a

 /*
  * mac80211 <-> driver interface
  *
  * Copyright 2002-2005, Devicescape Software, Inc.
  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
  * Copyright 2007-2008	Johannes Berg <johannes@sipsolutions.net>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
 #ifndef MAC80211_H
 #define MAC80211_H
 #include <linux/kernel.h>
 #include <linux/if_ether.h>
 #include <linux/skbuff.h>
 #include <linux/wireless.h>
 #include <linux/device.h>
 #include <linux/ieee80211.h>
 #include <net/wireless.h>
 #include <net/cfg80211.h>
 /**
  * DOC: Introduction
  *
  * mac80211 is the Linux stack for 802.11 hardware that implements
  * only partial functionality in hard- or firmware. This document
  * defines the interface between mac80211 and low-level hardware
  * drivers.
  */
 /**
  * DOC: Calling mac80211 from interrupts
  *
  * Only ieee80211_tx_status_irqsafe() and ieee80211_rx_irqsafe() can be
  * called in hardware interrupt context. The low-level driver must not call any
  * other functions in hardware interrupt context. If there is a need for such
  * call, the low-level driver should first ACK the interrupt and perform the
  * IEEE 802.11 code call after this, e.g. from a scheduled workqueue or even
  * tasklet function.
  *
  * NOTE: If the driver opts to use the _irqsafe() functions, it may not also
  *	 use the non-IRQ-safe functions!
  */
 /**
  * DOC: Warning
  *
  * If you're reading this document and not the header file itself, it will
  * be incomplete because not all documentation has been converted yet.
  */
 /**
  * DOC: Frame format
  *
  * As a general rule, when frames are passed between mac80211 and the driver,
  * they start with the IEEE 802.11 header and include the same octets that are
  * sent over the air except for the FCS which should be calculated by the
  * hardware.
  *
  * There are, however, various exceptions to this rule for advanced features:
  *
  * The first exception is for hardware encryption and decryption offload
  * where the IV/ICV may or may not be generated in hardware.
  *
  * Secondly, when the hardware handles fragmentation, the frame handed to
  * the driver from mac80211 is the MSDU, not the MPDU.
  *
  * Finally, for received frames, the driver is able to indicate that it has
  * filled a radiotap header and put that in front of the frame; if it does
  * not do so then mac80211 may add this under certain circumstances.
  */
 /**
  * struct ieee80211_ht_bss_info - describing BSS's HT characteristics
  *
  * This structure describes most essential parameters needed
  * to describe 802.11n HT characteristics in a BSS.
  *
  * @primary_channel: channel number of primery channel
  * @bss_cap: 802.11n's general BSS capabilities (e.g. channel width)
  * @bss_op_mode: 802.11n's BSS operation modes (e.g. HT protection)
  */
 struct ieee80211_ht_bss_info {
 	u8 primary_channel;
 	u8 bss_cap;  /* use IEEE80211_HT_IE_CHA_ */
 	u8 bss_op_mode; /* use IEEE80211_HT_IE_ */
 };
 /**
  * enum ieee80211_max_queues - maximum number of queues
  *
  * @IEEE80211_MAX_QUEUES: Maximum number of regular device queues.
  * @IEEE80211_MAX_AMPDU_QUEUES: Maximum number of queues usable
  *	for A-MPDU operation.
  */
 enum ieee80211_max_queues {
 	IEEE80211_MAX_QUEUES =		16,
 	IEEE80211_MAX_AMPDU_QUEUES =	16,
 };
 /**
  * struct ieee80211_tx_queue_params - transmit queue configuration
  *
  * The information provided in this structure is required for QoS
  * transmit queue configuration. Cf. IEEE 802.11 7.3.2.29.
  *
  * @aifs: arbitration interframe space [0..255]
  * @cw_min: minimum contention window [a value of the form
  *	2^n-1 in the range 1..32767]
  * @cw_max: maximum contention window [like @cw_min]
  * @txop: maximum burst time in units of 32 usecs, 0 meaning disabled
  */
 struct ieee80211_tx_queue_params {
 	u16 txop;
 	u16 cw_min;
 	u16 cw_max;
 	u8 aifs;
 };
 /**
  * struct ieee80211_tx_queue_stats - transmit queue statistics
  *
  * @len: number of packets in queue
  * @limit: queue length limit
  * @count: number of frames sent
  */
 struct ieee80211_tx_queue_stats {
 	unsigned int len;
 	unsigned int limit;
 	unsigned int count;
 };
 struct ieee80211_low_level_stats {
 	unsigned int dot11ACKFailureCount;
 	unsigned int dot11RTSFailureCount;
 	unsigned int dot11FCSErrorCount;
 	unsigned int dot11RTSSuccessCount;
 };
 /**
  * enum ieee80211_bss_change - BSS change notification flags
  *
  * These flags are used with the bss_info_changed() callback
  * to indicate which BSS parameter changed.
  *
  * @BSS_CHANGED_ASSOC: association status changed (associated/disassociated),
  *	also implies a change in the AID.
  * @BSS_CHANGED_ERP_CTS_PROT: CTS protection changed
  * @BSS_CHANGED_ERP_PREAMBLE: preamble changed
  * @BSS_CHANGED_ERP_SLOT: slot timing changed
  * @BSS_CHANGED_HT: 802.11n parameters changed
  * @BSS_CHANGED_BASIC_RATES: Basic rateset changed
  */
 enum ieee80211_bss_change {
 	BSS_CHANGED_ASSOC		= 1<<0,
 	BSS_CHANGED_ERP_CTS_PROT	= 1<<1,
 	BSS_CHANGED_ERP_PREAMBLE	= 1<<2,
 	BSS_CHANGED_ERP_SLOT		= 1<<3,
 	BSS_CHANGED_HT                  = 1<<4,
 	BSS_CHANGED_BASIC_RATES		= 1<<5,
 };
 /**
  * struct ieee80211_bss_ht_conf - BSS's changing HT configuration
  * @operation_mode: HT operation mode (like in &struct ieee80211_ht_info)
  */
 struct ieee80211_bss_ht_conf {
 	u16 operation_mode;
 };
 /**
  * struct ieee80211_bss_conf - holds the BSS's changing parameters
  *
  * This structure keeps information about a BSS (and an association
  * to that BSS) that can change during the lifetime of the BSS.
  *
  * @assoc: association status
  * @aid: association ID number, valid only when @assoc is true
  * @use_cts_prot: use CTS protection
  * @use_short_preamble: use 802.11b short preamble;
  *	if the hardware cannot handle this it must set the
  *	IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE hardware flag
  * @use_short_slot: use short slot time (only relevant for ERP);
  *	if the hardware cannot handle this it must set the
  *	IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE hardware flag
  * @dtim_period: num of beacons before the next DTIM, for PSM
  * @timestamp: beacon timestamp
  * @beacon_int: beacon interval
  * @assoc_capability: capabilities taken from assoc resp
  * @ht: BSS's HT configuration
  * @basic_rates: bitmap of basic rates, each bit stands for an
  *	index into the rate table configured by the driver in
  *	the current band.
  */
 struct ieee80211_bss_conf {
 	/* association related data */
 	bool assoc;
 	u16 aid;
 	/* erp related data */
 	bool use_cts_prot;
 	bool use_short_preamble;
 	bool use_short_slot;
 	u8 dtim_period;
 	u16 beacon_int;
 	u16 assoc_capability;
 	u64 timestamp;
 	u64 basic_rates;
 	struct ieee80211_bss_ht_conf ht;
 };
 /**
  * enum mac80211_tx_control_flags - flags to describe transmission information/status
  *
  * These flags are used with the @flags member of &ieee80211_tx_info.
  *
  * @IEEE80211_TX_CTL_REQ_TX_STATUS: request TX status callback for this frame.
  * @IEEE80211_TX_CTL_ASSIGN_SEQ: The driver has to assign a sequence
  *	number to this frame, taking care of not overwriting the fragment
  *	number and increasing the sequence number only when the
  *	IEEE80211_TX_CTL_FIRST_FRAGMENT flag is set. mac80211 will properly
  *	assign sequence numbers to QoS-data frames but cannot do so correctly
  *	for non-QoS-data and management frames because beacons need them from
  *	that counter as well and mac80211 cannot guarantee proper sequencing.
  *	If this flag is set, the driver should instruct the hardware to
  *	assign a sequence number to the frame or assign one itself. Cf. IEEE
  *	802.11-2007 7.1.3.4.1 paragraph 3. This flag will always be set for
  *	beacons and always be clear for frames without a sequence number field.
  * @IEEE80211_TX_CTL_NO_ACK: tell the low level not to wait for an ack
  * @IEEE80211_TX_CTL_CLEAR_PS_FILT: clear powersave filter for destination
  *	station
  * @IEEE80211_TX_CTL_FIRST_FRAGMENT: this is a first fragment of the frame
  * @IEEE80211_TX_CTL_SEND_AFTER_DTIM: send this frame after DTIM beacon
  * @IEEE80211_TX_CTL_AMPDU: this frame should be sent as part of an A-MPDU
  * @IEEE80211_TX_CTL_INJECTED: Frame was injected, internal to mac80211.
  * @IEEE80211_TX_STAT_TX_FILTERED: The frame was not transmitted
  *	because the destination STA was in powersave mode.
  * @IEEE80211_TX_STAT_ACK: Frame was acknowledged
  * @IEEE80211_TX_STAT_AMPDU: The frame was aggregated, so status
  * 	is for the whole aggregation.
  * @IEEE80211_TX_STAT_AMPDU_NO_BACK: no block ack was returned,
  * 	so consider using block ack request (BAR).
  * @IEEE80211_TX_CTL_RATE_CTRL_PROBE: internal to mac80211, can be
  *	set by rate control algorithms to indicate probe rate, will
  *	be cleared for fragmented frames (except on the last fragment)
  */
 enum mac80211_tx_control_flags {
 	IEEE80211_TX_CTL_REQ_TX_STATUS		= BIT(0),
 	IEEE80211_TX_CTL_ASSIGN_SEQ		= BIT(1),
 	IEEE80211_TX_CTL_NO_ACK			= BIT(2),
 	IEEE80211_TX_CTL_CLEAR_PS_FILT		= BIT(3),
 	IEEE80211_TX_CTL_FIRST_FRAGMENT		= BIT(4),
 	IEEE80211_TX_CTL_SEND_AFTER_DTIM	= BIT(5),
 	IEEE80211_TX_CTL_AMPDU			= BIT(6),
 	IEEE80211_TX_CTL_INJECTED		= BIT(7),
 	IEEE80211_TX_STAT_TX_FILTERED		= BIT(8),
 	IEEE80211_TX_STAT_ACK			= BIT(9),
 	IEEE80211_TX_STAT_AMPDU			= BIT(10),
 	IEEE80211_TX_STAT_AMPDU_NO_BACK		= BIT(11),
 	IEEE80211_TX_CTL_RATE_CTRL_PROBE	= BIT(12),
 };
 enum mac80211_rate_control_flags {
 	IEEE80211_TX_RC_USE_RTS_CTS		= BIT(0),
 	IEEE80211_TX_RC_USE_CTS_PROTECT		= BIT(1),
 	IEEE80211_TX_RC_USE_SHORT_PREAMBLE	= BIT(2),
 	/* rate index is an MCS rate number instead of an index */
 	IEEE80211_TX_RC_MCS			= BIT(3),
 	IEEE80211_TX_RC_GREEN_FIELD		= BIT(4),
 	IEEE80211_TX_RC_40_MHZ_WIDTH		= BIT(5),
 	IEEE80211_TX_RC_DUP_DATA		= BIT(6),
 	IEEE80211_TX_RC_SHORT_GI		= BIT(7),
 };
 /* there are 40 bytes if you don't need the rateset to be kept */
 #define IEEE80211_TX_INFO_DRIVER_DATA_SIZE 40
 /* if you do need the rateset, then you have less space */
 #define IEEE80211_TX_INFO_RATE_DRIVER_DATA_SIZE 24
 /* maximum number of rate stages */
 #define IEEE80211_TX_MAX_RATES	5
 /**
  * struct ieee80211_tx_rate - rate selection/status
  *
  * @idx: rate index to attempt to send with
  * @flags: rate control flags (&enum mac80211_rate_control_flags)
  * @count: number of tries in this rate before going to the next rate
  *
  * A value of -1 for @idx indicates an invalid rate and, if used
  * in an array of retry rates, that no more rates should be tried.
  *
  * When used for transmit status reporting, the driver should
  * always report the rate along with the flags it used.
  */
 struct ieee80211_tx_rate {
 	s8 idx;
 	u8 count;
 	u8 flags;
 } __attribute__((packed));
 /**
  * struct ieee80211_tx_info - skb transmit information
  *
  * This structure is placed in skb->cb for three uses:
  *  (1) mac80211 TX control - mac80211 tells the driver what to do
  *  (2) driver internal use (if applicable)
  *  (3) TX status information - driver tells mac80211 what happened
  *
  * The TX control's sta pointer is only valid during the ->tx call,
  * it may be NULL.
  *
  * @flags: transmit info flags, defined above
  * @band: the band to transmit on (use for checking for races)
  * @antenna_sel_tx: antenna to use, 0 for automatic diversity
  * @pad: padding, ignore
  * @control: union for control data
  * @status: union for status data
  * @driver_data: array of driver_data pointers
  * @ampdu_ack_len: number of aggregated frames.
  * 	relevant only if IEEE80211_TX_STATUS_AMPDU was set.
  * @ampdu_ack_map: block ack bit map for the aggregation.
  * 	relevant only if IEEE80211_TX_STATUS_AMPDU was set.
  * @ack_signal: signal strength of the ACK frame
  */
 struct ieee80211_tx_info {
 	/* common information */
 	u32 flags;
 	u8 band;
 	u8 antenna_sel_tx;
 	/* 2 byte hole */
 	u8 pad[2];
 	union {
 		struct {
 			union {
 				/* rate control */
 				struct {
 					struct ieee80211_tx_rate rates[
 						IEEE80211_TX_MAX_RATES];
 					s8 rts_cts_rate_idx;
 				};
 				/* only needed before rate control */
 				unsigned long jiffies;
 			};
 			/* NB: vif can be NULL for injected frames */
 			struct ieee80211_vif *vif;
 			struct ieee80211_key_conf *hw_key;
 			struct ieee80211_sta *sta;
 		} control;
 		struct {
 			struct ieee80211_tx_rate rates[IEEE80211_TX_MAX_RATES];
 			u8 ampdu_ack_len;
 			u64 ampdu_ack_map;
 			int ack_signal;
 			/* 8 bytes free */
 		} status;
 		struct {
 			struct ieee80211_tx_rate driver_rates[
 				IEEE80211_TX_MAX_RATES];
 			void *rate_driver_data[
 				IEEE80211_TX_INFO_RATE_DRIVER_DATA_SIZE / sizeof(void *)];
 		};
 		void *driver_data[
 			IEEE80211_TX_INFO_DRIVER_DATA_SIZE / sizeof(void *)];
 	};
 };
 static inline struct ieee80211_tx_info *IEEE80211_SKB_CB(struct sk_buff *skb)
 {
 	return (struct ieee80211_tx_info *)skb->cb;
 }
 /**
  * ieee80211_tx_info_clear_status - clear TX status
  *
  * @info: The &struct ieee80211_tx_info to be cleared.
  *
  * When the driver passes an skb back to mac80211, it must report
  * a number of things in TX status. This function clears everything
  * in the TX status but the rate control information (it does clear
  * the count since you need to fill that in anyway).
  *
  * NOTE: You can only use this function if you do NOT use
  *	 info->driver_data! Use info->rate_driver_data
  *	 instead if you need only the less space that allows.
  */
 static inline void
 ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
 {
 	int i;
 	BUILD_BUG_ON(offsetof(struct ieee80211_tx_info, status.rates) !=
 		     offsetof(struct ieee80211_tx_info, control.rates));
 	BUILD_BUG_ON(offsetof(struct ieee80211_tx_info, status.rates) !=
 		     offsetof(struct ieee80211_tx_info, driver_rates));
 	BUILD_BUG_ON(offsetof(struct ieee80211_tx_info, status.rates) != 8);
 	/* clear the rate counts */
 	for (i = 0; i < IEEE80211_TX_MAX_RATES; i++)
 		info->status.rates[i].count = 0;
 	BUILD_BUG_ON(
 	    offsetof(struct ieee80211_tx_info, status.ampdu_ack_len) != 23);
 	memset(&info->status.ampdu_ack_len, 0,
 	       sizeof(struct ieee80211_tx_info) -
 	       offsetof(struct ieee80211_tx_info, status.ampdu_ack_len));
 }
 /**
  * enum mac80211_rx_flags - receive flags
  *
  * These flags are used with the @flag member of &struct ieee80211_rx_status.
  * @RX_FLAG_MMIC_ERROR: Michael MIC error was reported on this frame.
  *	Use together with %RX_FLAG_MMIC_STRIPPED.
  * @RX_FLAG_DECRYPTED: This frame was decrypted in hardware.
  * @RX_FLAG_RADIOTAP: This frame starts with a radiotap header.
  * @RX_FLAG_MMIC_STRIPPED: the Michael MIC is stripped off this frame,
  *	verification has been done by the hardware.
  * @RX_FLAG_IV_STRIPPED: The IV/ICV are stripped from this frame.
  *	If this flag is set, the stack cannot do any replay detection
  *	hence the driver or hardware will have to do that.
  * @RX_FLAG_FAILED_FCS_CRC: Set this flag if the FCS check failed on
  *	the frame.
  * @RX_FLAG_FAILED_PLCP_CRC: Set this flag if the PCLP check failed on
  *	the frame.
  * @RX_FLAG_TSFT: The timestamp passed in the RX status (@mactime field)
  *	is valid. This is useful in monitor mode and necessary for beacon frames
  *	to enable IBSS merging.
  * @RX_FLAG_SHORTPRE: Short preamble was used for this frame
  * @RX_FLAG_HT: HT MCS was used and rate_idx is MCS index
  * @RX_FLAG_40MHZ: HT40 (40 MHz) was used
  * @RX_FLAG_SHORT_GI: Short guard interval was used
  */
 enum mac80211_rx_flags {
 	RX_FLAG_MMIC_ERROR	= 1<<0,
 	RX_FLAG_DECRYPTED	= 1<<1,
 	RX_FLAG_RADIOTAP	= 1<<2,
 	RX_FLAG_MMIC_STRIPPED	= 1<<3,
 	RX_FLAG_IV_STRIPPED	= 1<<4,
 	RX_FLAG_FAILED_FCS_CRC	= 1<<5,
 	RX_FLAG_FAILED_PLCP_CRC = 1<<6,
 	RX_FLAG_TSFT		= 1<<7,
 	RX_FLAG_SHORTPRE	= 1<<8,
 	RX_FLAG_HT		= 1<<9,
 	RX_FLAG_40MHZ		= 1<<10,
 	RX_FLAG_SHORT_GI	= 1<<11,
 };
 /**
  * struct ieee80211_rx_status - receive status
  *
  * The low-level driver should provide this information (the subset
  * supported by hardware) to the 802.11 code with each received
  * frame.
  *
  * @mactime: value in microseconds of the 64-bit Time Synchronization Function
  * 	(TSF) timer when the first data symbol (MPDU) arrived at the hardware.
  * @band: the active band when this frame was received
  * @freq: frequency the radio was tuned to when receiving this frame, in MHz
  * @signal: signal strength when receiving this frame, either in dBm, in dB or
  *	unspecified depending on the hardware capabilities flags
  *	@IEEE80211_HW_SIGNAL_*
  * @noise: noise when receiving this frame, in dBm.
  * @qual: overall signal quality indication, in percent (0-100).
  * @antenna: antenna used
  * @rate_idx: index of data rate into band's supported rates or MCS index if
  *	HT rates are use (RX_FLAG_HT)
  * @flag: %RX_FLAG_*
  */
 struct ieee80211_rx_status {
 	u64 mactime;
 	enum ieee80211_band band;
 	int freq;
 	int signal;
 	int noise;
 	int qual;
 	int antenna;
 	int rate_idx;
 	int flag;
 };
 /**
  * enum ieee80211_conf_flags - configuration flags
  *
  * Flags to define PHY configuration options
  *
  * @IEEE80211_CONF_RADIOTAP: add radiotap header at receive time (if supported)
  * @IEEE80211_CONF_PS: Enable 802.11 power save mode
  */
 enum ieee80211_conf_flags {
 	IEEE80211_CONF_RADIOTAP		= (1<<0),
 	IEEE80211_CONF_PS		= (1<<1),
 };
 /* XXX: remove all this once drivers stop trying to use it */
 static inline int __deprecated __IEEE80211_CONF_SHORT_SLOT_TIME(void)
 {
 	return 0;
 }
 #define IEEE80211_CONF_SHORT_SLOT_TIME (__IEEE80211_CONF_SHORT_SLOT_TIME())
 /**
  * enum ieee80211_conf_changed - denotes which configuration changed
  *
  * @IEEE80211_CONF_CHANGE_RADIO_ENABLED: the value of radio_enabled changed
  * @IEEE80211_CONF_CHANGE_BEACON_INTERVAL: the beacon interval changed
  * @IEEE80211_CONF_CHANGE_LISTEN_INTERVAL: the listen interval changed
  * @IEEE80211_CONF_CHANGE_RADIOTAP: the radiotap flag changed
  * @IEEE80211_CONF_CHANGE_PS: the PS flag changed
  * @IEEE80211_CONF_CHANGE_DYNPS_TIMEOUT: the dynamic PS timeout changed
  * @IEEE80211_CONF_CHANGE_POWER: the TX power changed
  * @IEEE80211_CONF_CHANGE_CHANNEL: the channel/channel_type changed
  * @IEEE80211_CONF_CHANGE_RETRY_LIMITS: retry limits changed
  */
 enum ieee80211_conf_changed {
 	IEEE80211_CONF_CHANGE_RADIO_ENABLED	= BIT(0),
 	IEEE80211_CONF_CHANGE_BEACON_INTERVAL	= BIT(1),
 	IEEE80211_CONF_CHANGE_LISTEN_INTERVAL	= BIT(2),
 	IEEE80211_CONF_CHANGE_RADIOTAP		= BIT(3),
 	IEEE80211_CONF_CHANGE_PS		= BIT(4),
 	IEEE80211_CONF_CHANGE_DYNPS_TIMEOUT	= BIT(5),
 	IEEE80211_CONF_CHANGE_POWER		= BIT(6),
 	IEEE80211_CONF_CHANGE_CHANNEL		= BIT(7),
 	IEEE80211_CONF_CHANGE_RETRY_LIMITS	= BIT(8),
 };
 /**
  * struct ieee80211_conf - configuration of the device
  *
  * This struct indicates how the driver shall configure the hardware.
  *
  * @radio_enabled: when zero, driver is required to switch off the radio.
  * @beacon_int: beacon interval (TODO make interface config)
  * @listen_interval: listen interval in units of beacon interval
  * @flags: configuration flags defined above
  * @power_level: requested transmit power (in dBm)
  * @dynamic_ps_timeout: dynamic powersave timeout (in ms)
  * @channel: the channel to tune to
  * @channel_type: the channel (HT) type
  * @long_frame_max_tx_count: Maximum number of transmissions for a "long" frame
  *    (a frame not RTS protected), called "dot11LongRetryLimit" in 802.11,
  *    but actually means the number of transmissions not the number of retries
  * @short_frame_max_tx_count: Maximum number of transmissions for a "short"
  *    frame, called "dot11ShortRetryLimit" in 802.11, but actually means the
  *    number of transmissions not the number of retries
  */
 struct ieee80211_conf {
 	int beacon_int;
 	u32 flags;
 	int power_level, dynamic_ps_timeout;
 	u16 listen_interval;
 	bool radio_enabled;
 	u8 long_frame_max_tx_count, short_frame_max_tx_count;
 	struct ieee80211_channel *channel;
 	enum nl80211_channel_type channel_type;
 };
 /**
  * struct ieee80211_vif - per-interface data
  *
  * Data in this structure is continually present for driver
  * use during the life of a virtual interface.
  *
  * @type: type of this virtual interface
  * @bss_conf: BSS configuration for this interface, either our own
  *	or the BSS we're associated to
  * @drv_priv: data area for driver use, will always be aligned to
  *	sizeof(void *).
  */
 struct ieee80211_vif {
 	enum nl80211_iftype type;
 	struct ieee80211_bss_conf bss_conf;
 	/* must be last */
 	u8 drv_priv[0] __attribute__((__aligned__(sizeof(void *))));
 };
 static inline bool ieee80211_vif_is_mesh(struct ieee80211_vif *vif)
 {
 #ifdef CONFIG_MAC80211_MESH
 	return vif->type == NL80211_IFTYPE_MESH_POINT;
 #endif
 	return false;
 }
 /**
  * struct ieee80211_if_init_conf - initial configuration of an interface
  *
  * @vif: pointer to a driver-use per-interface structure. The pointer
  *	itself is also used for various functions including
  *	ieee80211_beacon_get() and ieee80211_get_buffered_bc().
  * @type: one of &enum nl80211_iftype constants. Determines the type of
  *	added/removed interface.
  * @mac_addr: pointer to MAC address of the interface. This pointer is valid
  *	until the interface is removed (i.e. it cannot be used after
  *	remove_interface() callback was called for this interface).
  *
  * This structure is used in add_interface() and remove_interface()
  * callbacks of &struct ieee80211_hw.
  *
  * When you allow multiple interfaces to be added to your PHY, take care
  * that the hardware can actually handle multiple MAC addresses. However,
  * also take care that when there's no interface left with mac_addr != %NULL
  * you remove the MAC address from the device to avoid acknowledging packets
  * in pure monitor mode.
  */
 struct ieee80211_if_init_conf {
 	enum nl80211_iftype type;
 	struct ieee80211_vif *vif;
 	void *mac_addr;
 };
 /**
  * enum ieee80211_if_conf_change - interface config change flags
  *
  * @IEEE80211_IFCC_BSSID: The BSSID changed.
  * @IEEE80211_IFCC_BEACON: The beacon for this interface changed
  *	(currently AP and MESH only), use ieee80211_beacon_get().
  */
 enum ieee80211_if_conf_change {
 	IEEE80211_IFCC_BSSID	= BIT(0),
 	IEEE80211_IFCC_BEACON	= BIT(1),
 };
 /**
  * struct ieee80211_if_conf - configuration of an interface
  *
  * @changed: parameters that have changed, see &enum ieee80211_if_conf_change.
  * @bssid: BSSID of the network we are associated to/creating.
  *
  * This structure is passed to the config_interface() callback of
  * &struct ieee80211_hw.
  */
 struct ieee80211_if_conf {
 	u32 changed;
 	u8 *bssid;
 };
 /**
  * enum ieee80211_key_alg - key algorithm
  * @ALG_WEP: WEP40 or WEP104
  * @ALG_TKIP: TKIP
  * @ALG_CCMP: CCMP (AES)
+ * @ALG_AES_CMAC: AES-128-CMAC
  */
 enum ieee80211_key_alg {
 	ALG_WEP,
 	ALG_TKIP,
 	ALG_CCMP,
+	ALG_AES_CMAC,
 };
 /**
  * enum ieee80211_key_len - key length
  * @LEN_WEP40: WEP 5-byte long key
  * @LEN_WEP104: WEP 13-byte long key
  */
 enum ieee80211_key_len {
 	LEN_WEP40 = 5,
 	LEN_WEP104 = 13,
 };
 /**
  * enum ieee80211_key_flags - key flags
  *
  * These flags are used for communication about keys between the driver
  * and mac80211, with the @flags parameter of &struct ieee80211_key_conf.
  *
  * @IEEE80211_KEY_FLAG_WMM_STA: Set by mac80211, this flag indicates
  *	that the STA this key will be used with could be using QoS.
  * @IEEE80211_KEY_FLAG_GENERATE_IV: This flag should be set by the
  *	driver to indicate that it requires IV generation for this
  *	particular key.
  * @IEEE80211_KEY_FLAG_GENERATE_MMIC: This flag should be set by
  *	the driver for a TKIP key if it requires Michael MIC
  *	generation in software.
  * @IEEE80211_KEY_FLAG_PAIRWISE: Set by mac80211, this flag indicates
  *	that the key is pairwise rather then a shared key.
  */
 enum ieee80211_key_flags {
 	IEEE80211_KEY_FLAG_WMM_STA	= 1<<0,
 	IEEE80211_KEY_FLAG_GENERATE_IV	= 1<<1,
 	IEEE80211_KEY_FLAG_GENERATE_MMIC= 1<<2,
 	IEEE80211_KEY_FLAG_PAIRWISE	= 1<<3,
 };
 /**
  * struct ieee80211_key_conf - key information
  *
  * This key information is given by mac80211 to the driver by
  * the set_key() callback in &struct ieee80211_ops.
  *
  * @hw_key_idx: To be set by the driver, this is the key index the driver
  *	wants to be given when a frame is transmitted and needs to be
  *	encrypted in hardware.
  * @alg: The key algorithm.
  * @flags: key flags, see &enum ieee80211_key_flags.
  * @keyidx: the key index (0-3)
  * @keylen: key material length
  * @key: key material. For ALG_TKIP the key is encoded as a 256-bit (32 byte)
  * 	data block:
  * 	- Temporal Encryption Key (128 bits)
  * 	- Temporal Authenticator Tx MIC Key (64 bits)
  * 	- Temporal Authenticator Rx MIC Key (64 bits)
  * @icv_len: The ICV length for this key type
  * @iv_len: The IV length for this key type
  */
 struct ieee80211_key_conf {
 	enum ieee80211_key_alg alg;
 	u8 icv_len;
 	u8 iv_len;
 	u8 hw_key_idx;
 	u8 flags;
 	s8 keyidx;
 	u8 keylen;
 	u8 key[0];
 };
 /**
  * enum set_key_cmd - key command
  *
  * Used with the set_key() callback in &struct ieee80211_ops, this
  * indicates whether a key is being removed or added.
  *
  * @SET_KEY: a key is set
  * @DISABLE_KEY: a key must be disabled
  */
 enum set_key_cmd {
 	SET_KEY, DISABLE_KEY,
 };
 /**
  * struct ieee80211_sta - station table entry
  *
  * A station table entry represents a station we are possibly
  * communicating with. Since stations are RCU-managed in
  * mac80211, any ieee80211_sta pointer you get access to must
  * either be protected by rcu_read_lock() explicitly or implicitly,
  * or you must take good care to not use such a pointer after a
  * call to your sta_notify callback that removed it.
  *
  * @addr: MAC address
  * @aid: AID we assigned to the station if we're an AP
  * @supp_rates: Bitmap of supported rates (per band)
  * @ht_cap: HT capabilities of this STA; restricted to our own TX capabilities
  * @drv_priv: data area for driver use, will always be aligned to
  *	sizeof(void *), size is determined in hw information.
  */
 struct ieee80211_sta {
 	u64 supp_rates[IEEE80211_NUM_BANDS];
 	u8 addr[ETH_ALEN];
 	u16 aid;
 	struct ieee80211_sta_ht_cap ht_cap;
 	/* must be last */
 	u8 drv_priv[0] __attribute__((__aligned__(sizeof(void *))));
 };
 /**
  * enum sta_notify_cmd - sta notify command
  *
  * Used with the sta_notify() callback in &struct ieee80211_ops, this
  * indicates addition and removal of a station to station table,
  * or if a associated station made a power state transition.
  *
  * @STA_NOTIFY_ADD: a station was added to the station table
  * @STA_NOTIFY_REMOVE: a station being removed from the station table
  * @STA_NOTIFY_SLEEP: a station is now sleeping
  * @STA_NOTIFY_AWAKE: a sleeping station woke up
  */
 enum sta_notify_cmd {
 	STA_NOTIFY_ADD, STA_NOTIFY_REMOVE,
 	STA_NOTIFY_SLEEP, STA_NOTIFY_AWAKE,
 };
 /**
  * enum ieee80211_tkip_key_type - get tkip key
  *
  * Used by drivers which need to get a tkip key for skb. Some drivers need a
  * phase 1 key, others need a phase 2 key. A single function allows the driver
  * to get the key, this enum indicates what type of key is required.
  *
  * @IEEE80211_TKIP_P1_KEY: the driver needs a phase 1 key
  * @IEEE80211_TKIP_P2_KEY: the driver needs a phase 2 key
  */
 enum ieee80211_tkip_key_type {
 	IEEE80211_TKIP_P1_KEY,
 	IEEE80211_TKIP_P2_KEY,
 };
 /**
  * enum ieee80211_hw_flags - hardware flags
  *
  * These flags are used to indicate hardware capabilities to
  * the stack. Generally, flags here should have their meaning
  * done in a way that the simplest hardware doesn't need setting
  * any particular flags. There are some exceptions to this rule,
  * however, so you are advised to review these flags carefully.
  *
  * @IEEE80211_HW_RX_INCLUDES_FCS:
  *	Indicates that received frames passed to the stack include
  *	the FCS at the end.
  *
  * @IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING:
  *	Some wireless LAN chipsets buffer broadcast/multicast frames
  *	for power saving stations in the hardware/firmware and others
  *	rely on the host system for such buffering. This option is used
  *	to configure the IEEE 802.11 upper layer to buffer broadcast and
  *	multicast frames when there are power saving stations so that
  *	the driver can fetch them with ieee80211_get_buffered_bc().
  *
  * @IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE:
  *	Hardware is not capable of short slot operation on the 2.4 GHz band.
  *
  * @IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE:
  *	Hardware is not capable of receiving frames with short preamble on
  *	the 2.4 GHz band.
  *
  * @IEEE80211_HW_SIGNAL_UNSPEC:
  *	Hardware can provide signal values but we don't know its units. We
  *	expect values between 0 and @max_signal.
  *	If possible please provide dB or dBm instead.
  *
  * @IEEE80211_HW_SIGNAL_DB:
  *	Hardware gives signal values in dB, decibel difference from an
  *	arbitrary, fixed reference. We expect values between 0 and @max_signal.
  *	If possible please provide dBm instead.
  *
  * @IEEE80211_HW_SIGNAL_DBM:
  *	Hardware gives signal values in dBm, decibel difference from
  *	one milliwatt. This is the preferred method since it is standardized
  *	between different devices. @max_signal does not need to be set.
  *
  * @IEEE80211_HW_NOISE_DBM:
  *	Hardware can provide noise (radio interference) values in units dBm,
  *      decibel difference from one milliwatt.
  *
  * @IEEE80211_HW_SPECTRUM_MGMT:
  * 	Hardware supports spectrum management defined in 802.11h
  * 	Measurement, Channel Switch, Quieting, TPC
  *
  * @IEEE80211_HW_AMPDU_AGGREGATION:
  *	Hardware supports 11n A-MPDU aggregation.
  *
  * @IEEE80211_HW_SUPPORTS_PS:
  *	Hardware has power save support (i.e. can go to sleep).
  *
  * @IEEE80211_HW_PS_NULLFUNC_STACK:
  *	Hardware requires nullfunc frame handling in stack, implies
  *	stack support for dynamic PS.
  *
  * @IEEE80211_HW_SUPPORTS_DYNAMIC_PS:
  *	Hardware has support for dynamic PS.
  */
 enum ieee80211_hw_flags {
 	IEEE80211_HW_RX_INCLUDES_FCS			= 1<<1,
 	IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING	= 1<<2,
 	IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE		= 1<<3,
 	IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE	= 1<<4,
 	IEEE80211_HW_SIGNAL_UNSPEC			= 1<<5,
 	IEEE80211_HW_SIGNAL_DB				= 1<<6,
 	IEEE80211_HW_SIGNAL_DBM				= 1<<7,
 	IEEE80211_HW_NOISE_DBM				= 1<<8,
 	IEEE80211_HW_SPECTRUM_MGMT			= 1<<9,
 	IEEE80211_HW_AMPDU_AGGREGATION			= 1<<10,
 	IEEE80211_HW_SUPPORTS_PS			= 1<<11,
 	IEEE80211_HW_PS_NULLFUNC_STACK			= 1<<12,
 	IEEE80211_HW_SUPPORTS_DYNAMIC_PS		= 1<<13,
 };
 /**
  * struct ieee80211_hw - hardware information and state
  *
  * This structure contains the configuration and hardware
  * information for an 802.11 PHY.
  *
  * @wiphy: This points to the &struct wiphy allocated for this
  *	802.11 PHY. You must fill in the @perm_addr and @dev
  *	members of this structure using SET_IEEE80211_DEV()
  *	and SET_IEEE80211_PERM_ADDR(). Additionally, all supported
  *	bands (with channels, bitrates) are registered here.
  *
  * @conf: &struct ieee80211_conf, device configuration, don't use.
  *
  * @workqueue: single threaded workqueue available for driver use,
  *	allocated by mac80211 on registration and flushed when an
  *	interface is removed.
  *	NOTICE: All work performed on this workqueue should NEVER
  *	acquire the RTNL lock (i.e. Don't use the function
  *	ieee80211_iterate_active_interfaces())
  *
  * @priv: pointer to private area that was allocated for driver use
  *	along with this structure.
  *
  * @flags: hardware flags, see &enum ieee80211_hw_flags.
  *
  * @extra_tx_headroom: headroom to reserve in each transmit skb
  *	for use by the driver (e.g. for transmit headers.)
  *
  * @channel_change_time: time (in microseconds) it takes to change channels.
  *
  * @max_signal: Maximum value for signal (rssi) in RX information, used
  *     only when @IEEE80211_HW_SIGNAL_UNSPEC or @IEEE80211_HW_SIGNAL_DB
  *
  * @max_listen_interval: max listen interval in units of beacon interval
  *     that HW supports
  *
  * @queues: number of available hardware transmit queues for
  *	data packets. WMM/QoS requires at least four, these
  *	queues need to have configurable access parameters.
  *
  * @ampdu_queues: number of available hardware transmit queues
  *	for A-MPDU packets, these have no access parameters
  *	because they're used only for A-MPDU frames. Note that
  *	mac80211 will not currently use any of the regular queues
  *	for aggregation.
  *
  * @rate_control_algorithm: rate control algorithm for this hardware.
  *	If unset (NULL), the default algorithm will be used. Must be
  *	set before calling ieee80211_register_hw().
  *
  * @vif_data_size: size (in bytes) of the drv_priv data area
  *	within &struct ieee80211_vif.
  * @sta_data_size: size (in bytes) of the drv_priv data area
  *	within &struct ieee80211_sta.
  *
  * @max_rates: maximum number of alternate rate retry stages
  * @max_rate_tries: maximum number of tries for each stage
  */
 struct ieee80211_hw {
 	struct ieee80211_conf conf;
 	struct wiphy *wiphy;
 	struct workqueue_struct *workqueue;
 	const char *rate_control_algorithm;
 	void *priv;
 	u32 flags;
 	unsigned int extra_tx_headroom;
 	int channel_change_time;
 	int vif_data_size;
 	int sta_data_size;
 	u16 queues;
 	u16 ampdu_queues;
 	u16 max_listen_interval;
 	s8 max_signal;
 	u8 max_rates;
 	u8 max_rate_tries;
 };
 /**
  * SET_IEEE80211_DEV - set device for 802.11 hardware
  *
  * @hw: the &struct ieee80211_hw to set the device for
  * @dev: the &struct device of this 802.11 device
  */
 static inline void SET_IEEE80211_DEV(struct ieee80211_hw *hw, struct device *dev)
 {
 	set_wiphy_dev(hw->wiphy, dev);
 }
 /**
  * SET_IEEE80211_PERM_ADDR - set the permanent MAC address for 802.11 hardware
  *
  * @hw: the &struct ieee80211_hw to set the MAC address for
  * @addr: the address to set
  */
 static inline void SET_IEEE80211_PERM_ADDR(struct ieee80211_hw *hw, u8 *addr)
 {
 	memcpy(hw->wiphy->perm_addr, addr, ETH_ALEN);
 }
 static inline int ieee80211_num_regular_queues(struct ieee80211_hw *hw)
 {
 	return hw->queues;
 }
 static inline int ieee80211_num_queues(struct ieee80211_hw *hw)
 {
 	return hw->queues + hw->ampdu_queues;
 }
 static inline struct ieee80211_rate *
 ieee80211_get_tx_rate(const struct ieee80211_hw *hw,
 		      const struct ieee80211_tx_info *c)
 {
 	if (WARN_ON(c->control.rates[0].idx < 0))
 		return NULL;
 	return &hw->wiphy->bands[c->band]->bitrates[c->control.rates[0].idx];
 }
 static inline struct ieee80211_rate *
 ieee80211_get_rts_cts_rate(const struct ieee80211_hw *hw,
 			   const struct ieee80211_tx_info *c)
 {
 	if (c->control.rts_cts_rate_idx < 0)
 		return NULL;
 	return &hw->wiphy->bands[c->band]->bitrates[c->control.rts_cts_rate_idx];
 }
 static inline struct ieee80211_rate *
 ieee80211_get_alt_retry_rate(const struct ieee80211_hw *hw,
 			     const struct ieee80211_tx_info *c, int idx)
 {
 	if (c->control.rates[idx + 1].idx < 0)
 		return NULL;
 	return &hw->wiphy->bands[c->band]->bitrates[c->control.rates[idx + 1].idx];
 }
 /**
  * DOC: Hardware crypto acceleration
  *
  * mac80211 is capable of taking advantage of many hardware
  * acceleration designs for encryption and decryption operations.
  *
  * The set_key() callback in the &struct ieee80211_ops for a given
  * device is called to enable hardware acceleration of encryption and
  * decryption. The callback takes a @sta parameter that will be NULL
  * for default keys or keys used for transmission only, or point to
  * the station information for the peer for individual keys.
  * Multiple transmission keys with the same key index may be used when
  * VLANs are configured for an access point.
  *
  * When transmitting, the TX control data will use the @hw_key_idx
  * selected by the driver by modifying the &struct ieee80211_key_conf
  * pointed to by the @key parameter to the set_key() function.
  *
  * The set_key() call for the %SET_KEY command should return 0 if
  * the key is now in use, -%EOPNOTSUPP or -%ENOSPC if it couldn't be
  * added; if you return 0 then hw_key_idx must be assigned to the
  * hardware key index, you are free to use the full u8 range.
  *
  * When the cmd is %DISABLE_KEY then it must succeed.
  *
  * Note that it is permissible to not decrypt a frame even if a key
  * for it has been uploaded to hardware, the stack will not make any
  * decision based on whether a key has been uploaded or not but rather
  * based on the receive flags.
  *
  * The &struct ieee80211_key_conf structure pointed to by the @key
  * parameter is guaranteed to be valid until another call to set_key()
  * removes it, but it can only be used as a cookie to differentiate
  * keys.
  *
  * In TKIP some HW need to be provided a phase 1 key, for RX decryption
  * acceleration (i.e. iwlwifi). Those drivers should provide update_tkip_key
  * handler.
  * The update_tkip_key() call updates the driver with the new phase 1 key.
  * This happens everytime the iv16 wraps around (every 65536 packets). The
  * set_key() call will happen only once for each key (unless the AP did
  * rekeying), it will not include a valid phase 1 key. The valid phase 1 key is
  * provided by update_tkip_key only. The trigger that makes mac80211 call this
  * handler is software decryption with wrap around of iv16.
  */
 /**
  * DOC: Powersave support
  *
  * mac80211 has support for various powersave implementations.
  *
  * First, it can support hardware that handles all powersaving by
  * itself, such hardware should simply set the %IEEE80211_HW_SUPPORTS_PS
  * hardware flag. In that case, it will be told about the desired
  * powersave mode depending on the association status, and the driver
  * must take care of sending nullfunc frames when necessary, i.e. when
  * entering and leaving powersave mode. The driver is required to look at
  * the AID in beacons and signal to the AP that it woke up when it finds
  * traffic directed to it. This mode supports dynamic PS by simply
  * enabling/disabling PS.
  *
  * Additionally, such hardware may set the %IEEE80211_HW_SUPPORTS_DYNAMIC_PS
  * flag to indicate that it can support dynamic PS mode itself (see below).
  *
  * Other hardware designs cannot send nullfunc frames by themselves and also
  * need software support for parsing the TIM bitmap. This is also supported
  * by mac80211 by combining the %IEEE80211_HW_SUPPORTS_PS and
  * %IEEE80211_HW_PS_NULLFUNC_STACK flags. The hardware is of course still
  * required to pass up beacons. Additionally, in this case, mac80211 will
  * wake up the hardware when multicast traffic is announced in the beacon.
  *
  * FIXME: I don't think we can be fast enough in software when we want to
  *	  receive multicast traffic?
  *
  * Dynamic powersave mode is an extension to normal powersave mode in which
  * the hardware stays awake for a user-specified period of time after sending
  * a frame so that reply frames need not be buffered and therefore delayed
  * to the next wakeup. This can either be supported by hardware, in which case
  * the driver needs to look at the @dynamic_ps_timeout hardware configuration
  * value, or by the stack if all nullfunc handling is in the stack.
  */
 /**
  * DOC: Frame filtering
  *
  * mac80211 requires to see many management frames for proper
  * operation, and users may want to see many more frames when
  * in monitor mode. However, for best CPU usage and power consumption,
  * having as few frames as possible percolate through the stack is
  * desirable. Hence, the hardware should filter as much as possible.
  *
  * To achieve this, mac80211 uses filter flags (see below) to tell
  * the driver's configure_filter() function which frames should be
  * passed to mac80211 and which should be filtered out.
  *
  * The configure_filter() callback is invoked with the parameters
  * @mc_count and @mc_list for the combined multicast address list
  * of all virtual interfaces, @changed_flags telling which flags
  * were changed and @total_flags with the new flag states.
  *
  * If your device has no multicast address filters your driver will
  * need to check both the %FIF_ALLMULTI flag and the @mc_count
  * parameter to see whether multicast frames should be accepted
  * or dropped.
  *
  * All unsupported flags in @total_flags must be cleared.
  * Hardware does not support a flag if it is incapable of _passing_
  * the frame to the stack. Otherwise the driver must ignore
  * the flag, but not clear it.
  * You must _only_ clear the flag (announce no support for the
  * flag to mac80211) if you are not able to pass the packet type
  * to the stack (so the hardware always filters it).
  * So for example, you should clear @FIF_CONTROL, if your hardware
  * always filters control frames. If your hardware always passes
  * control frames to the kernel and is incapable of filtering them,
  * you do _not_ clear the @FIF_CONTROL flag.
  * This rule applies to all other FIF flags as well.
  */
 /**
  * enum ieee80211_filter_flags - hardware filter flags
  *
  * These flags determine what the filter in hardware should be
  * programmed to let through and what should not be passed to the
  * stack. It is always safe to pass more frames than requested,
  * but this has negative impact on power consumption.
  *
  * @FIF_PROMISC_IN_BSS: promiscuous mode within your BSS,
  *	think of the BSS as your network segment and then this corresponds
  *	to the regular ethernet device promiscuous mode.
  *
  * @FIF_ALLMULTI: pass all multicast frames, this is used if requested
  *	by the user or if the hardware is not capable of filtering by
  *	multicast address.
  *
  * @FIF_FCSFAIL: pass frames with failed FCS (but you need to set the
  *	%RX_FLAG_FAILED_FCS_CRC for them)
  *
  * @FIF_PLCPFAIL: pass frames with failed PLCP CRC (but you need to set
  *	the %RX_FLAG_FAILED_PLCP_CRC for them
  *
  * @FIF_BCN_PRBRESP_PROMISC: This flag is set during scanning to indicate
  *	to the hardware that it should not filter beacons or probe responses
  *	by BSSID. Filtering them can greatly reduce the amount of processing
  *	mac80211 needs to do and the amount of CPU wakeups, so you should
  *	honour this flag if possible.
  *
  * @FIF_CONTROL: pass control frames, if PROMISC_IN_BSS is not set then
  *	only those addressed to this station
  *
  * @FIF_OTHER_BSS: pass frames destined to other BSSes
  */
 enum ieee80211_filter_flags {
 	FIF_PROMISC_IN_BSS	= 1<<0,
 	FIF_ALLMULTI		= 1<<1,
 	FIF_FCSFAIL		= 1<<2,
 	FIF_PLCPFAIL		= 1<<3,
 	FIF_BCN_PRBRESP_PROMISC	= 1<<4,
 	FIF_CONTROL		= 1<<5,
 	FIF_OTHER_BSS		= 1<<6,
 };
 /**
  * enum ieee80211_ampdu_mlme_action - A-MPDU actions
  *
  * These flags are used with the ampdu_action() callback in
  * &struct ieee80211_ops to indicate which action is needed.
  * @IEEE80211_AMPDU_RX_START: start Rx aggregation
  * @IEEE80211_AMPDU_RX_STOP: stop Rx aggregation
  * @IEEE80211_AMPDU_TX_START: start Tx aggregation
  * @IEEE80211_AMPDU_TX_STOP: stop Tx aggregation
  * @IEEE80211_AMPDU_TX_RESUME: resume TX aggregation
  */
 enum ieee80211_ampdu_mlme_action {
 	IEEE80211_AMPDU_RX_START,
 	IEEE80211_AMPDU_RX_STOP,
 	IEEE80211_AMPDU_TX_START,
 	IEEE80211_AMPDU_TX_STOP,
 	IEEE80211_AMPDU_TX_RESUME,
 };
 /**
  * struct ieee80211_ops - callbacks from mac80211 to the driver
  *
  * This structure contains various callbacks that the driver may
  * handle or, in some cases, must handle, for example to configure
  * the hardware to a new channel or to transmit a frame.
  *
  * @tx: Handler that 802.11 module calls for each transmitted frame.
  *	skb contains the buffer starting from the IEEE 802.11 header.
  *	The low-level driver should send the frame out based on
  *	configuration in the TX control data. This handler should,
  *	preferably, never fail and stop queues appropriately, more
  *	importantly, however, it must never fail for A-MPDU-queues.
  *	Must be implemented and atomic.
  *
  * @start: Called before the first netdevice attached to the hardware
  *	is enabled. This should turn on the hardware and must turn on
  *	frame reception (for possibly enabled monitor interfaces.)
  *	Returns negative error codes, these may be seen in userspace,
  *	or zero.
  *	When the device is started it should not have a MAC address
  *	to avoid acknowledging frames before a non-monitor device
  *	is added.
  *	Must be implemented.
  *
  * @stop: Called after last netdevice attached to the hardware
  *	is disabled. This should turn off the hardware (at least
  *	it must turn off frame reception.)
  *	May be called right after add_interface if that rejects
  *	an interface.
  *	Must be implemented.
  *
  * @add_interface: Called when a netdevice attached to the hardware is
  *	enabled. Because it is not called for monitor mode devices, @start
  *	and @stop must be implemented.
  *	The driver should perform any initialization it needs before
  *	the device can be enabled. The initial configuration for the
  *	interface is given in the conf parameter.
  *	The callback may refuse to add an interface by returning a
  *	negative error code (which will be seen in userspace.)
  *	Must be implemented.
  *
  * @remove_interface: Notifies a driver that an interface is going down.
  *	The @stop callback is called after this if it is the last interface
  *	and no monitor interfaces are present.
  *	When all interfaces are removed, the MAC address in the hardware
  *	must be cleared so the device no longer acknowledges packets,
  *	the mac_addr member of the conf structure is, however, set to the
  *	MAC address of the device going away.
  *	Hence, this callback must be implemented.
  *
  * @config: Handler for configuration requests. IEEE 802.11 code calls this
  *	function to change hardware configuration, e.g., channel.
  *
  * @config_interface: Handler for configuration requests related to interfaces
  *	(e.g. BSSID changes.)
  *
  * @bss_info_changed: Handler for configuration requests related to BSS
  *	parameters that may vary during BSS's lifespan, and may affect low
  *	level driver (e.g. assoc/disassoc status, erp parameters).
  *	This function should not be used if no BSS has been set, unless
  *	for association indication. The @changed parameter indicates which
  *	of the bss parameters has changed when a call is made.
  *
  * @configure_filter: Configure the device's RX filter.
  *	See the section "Frame filtering" for more information.
  *	This callback must be implemented and atomic.
  *
  * @set_tim: Set TIM bit. mac80211 calls this function when a TIM bit
  * 	must be set or cleared for a given STA. Must be atomic.
  *
  * @set_key: See the section "Hardware crypto acceleration"
  *	This callback can sleep, and is only called between add_interface
  *	and remove_interface calls, i.e. while the given virtual interface
  *	is enabled.
  *
  * @update_tkip_key: See the section "Hardware crypto acceleration"
  * 	This callback will be called in the context of Rx. Called for drivers
  * 	which set IEEE80211_KEY_FLAG_TKIP_REQ_RX_P1_KEY.
  *
  * @hw_scan: Ask the hardware to service the scan request, no need to start
  *	the scan state machine in stack. The scan must honour the channel
  *	configuration done by the regulatory agent in the wiphy's registered
  *	bands. When the scan finishes, ieee80211_scan_completed() must be
  *	called; note that it also must be called when the scan cannot finish
  *	because the hardware is turned off! Anything else is a bug!
  *
  * @get_stats: return low-level statistics
  *
  * @get_tkip_seq: If your device implements TKIP encryption in hardware this
  *	callback should be provided to read the TKIP transmit IVs (both IV32
  *	and IV16) for the given key from hardware.
  *
  * @set_rts_threshold: Configuration of RTS threshold (if device needs it)
  *
  * @sta_notify: Notifies low level driver about addition, removal or power
  *	state transition of an associated station, AP,  IBSS/WDS/mesh peer etc.
  *	Must be atomic.
  *
  * @conf_tx: Configure TX queue parameters (EDCF (aifs, cw_min, cw_max),
  *	bursting) for a hardware TX queue.
  *
  * @get_tx_stats: Get statistics of the current TX queue status. This is used
  *	to get number of currently queued packets (queue length), maximum queue
  *	size (limit), and total number of packets sent using each TX queue
  *	(count). The 'stats' pointer points to an array that has hw->queues +
  *	hw->ampdu_queues items.
  *
  * @get_tsf: Get the current TSF timer value from firmware/hardware. Currently,
  *	this is only used for IBSS mode debugging and, as such, is not a
  *	required function. Must be atomic.
  *
  * @reset_tsf: Reset the TSF timer and allow firmware/hardware to synchronize
  *	with other STAs in the IBSS. This is only used in IBSS mode. This
  *	function is optional if the firmware/hardware takes full care of
  *	TSF synchronization.
  *
  * @tx_last_beacon: Determine whether the last IBSS beacon was sent by us.
  *	This is needed only for IBSS mode and the result of this function is
  *	used to determine whether to reply to Probe Requests.
  *
  * @ampdu_action: Perform a certain A-MPDU action
  * 	The RA/TID combination determines the destination and TID we want
  * 	the ampdu action to be performed for. The action is defined through
  * 	ieee80211_ampdu_mlme_action. Starting sequence number (@ssn)
  * 	is the first frame we expect to perform the action on. notice
  * 	that TX/RX_STOP can pass NULL for this parameter.
  */
 struct ieee80211_ops {
 	int (*tx)(struct ieee80211_hw *hw, struct sk_buff *skb);
 	int (*start)(struct ieee80211_hw *hw);
 	void (*stop)(struct ieee80211_hw *hw);
 	int (*add_interface)(struct ieee80211_hw *hw,
 			     struct ieee80211_if_init_conf *conf);
 	void (*remove_interface)(struct ieee80211_hw *hw,
 				 struct ieee80211_if_init_conf *conf);
 	int (*config)(struct ieee80211_hw *hw, u32 changed);
 	int (*config_interface)(struct ieee80211_hw *hw,
 				struct ieee80211_vif *vif,
 				struct ieee80211_if_conf *conf);
 	void (*bss_info_changed)(struct ieee80211_hw *hw,
 				 struct ieee80211_vif *vif,
 				 struct ieee80211_bss_conf *info,
 				 u32 changed);
 	void (*configure_filter)(struct ieee80211_hw *hw,
 				 unsigned int changed_flags,
 				 unsigned int *total_flags,
 				 int mc_count, struct dev_addr_list *mc_list);
 	int (*set_tim)(struct ieee80211_hw *hw, struct ieee80211_sta *sta,
 		       bool set);
 	int (*set_key)(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 		       struct ieee80211_vif *vif, struct ieee80211_sta *sta,
 		       struct ieee80211_key_conf *key);
 	void (*update_tkip_key)(struct ieee80211_hw *hw,
 			struct ieee80211_key_conf *conf, const u8 *address,
 			u32 iv32, u16 *phase1key);
 	int (*hw_scan)(struct ieee80211_hw *hw, u8 *ssid, size_t len);
 	int (*get_stats)(struct ieee80211_hw *hw,
 			 struct ieee80211_low_level_stats *stats);
 	void (*get_tkip_seq)(struct ieee80211_hw *hw, u8 hw_key_idx,
 			     u32 *iv32, u16 *iv16);
 	int (*set_rts_threshold)(struct ieee80211_hw *hw, u32 value);
 	void (*sta_notify)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 			enum sta_notify_cmd, struct ieee80211_sta *sta);
 	int (*conf_tx)(struct ieee80211_hw *hw, u16 queue,
 		       const struct ieee80211_tx_queue_params *params);
 	int (*get_tx_stats)(struct ieee80211_hw *hw,
 			    struct ieee80211_tx_queue_stats *stats);
 	u64 (*get_tsf)(struct ieee80211_hw *hw);
 	void (*reset_tsf)(struct ieee80211_hw *hw);
 	int (*tx_last_beacon)(struct ieee80211_hw *hw);
 	int (*ampdu_action)(struct ieee80211_hw *hw,
 			    enum ieee80211_ampdu_mlme_action action,
 			    struct ieee80211_sta *sta, u16 tid, u16 *ssn);
 };
 /**
  * ieee80211_alloc_hw -  Allocate a new hardware device
  *
  * This must be called once for each hardware device. The returned pointer
  * must be used to refer to this device when calling other functions.
  * mac80211 allocates a private data area for the driver pointed to by
  * @priv in &struct ieee80211_hw, the size of this area is given as
  * @priv_data_len.
  *
  * @priv_data_len: length of private data
  * @ops: callbacks for this device
  */
 struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
 					const struct ieee80211_ops *ops);
 /**
  * ieee80211_register_hw - Register hardware device
  *
  * You must call this function before any other functions in
  * mac80211. Note that before a hardware can be registered, you
  * need to fill the contained wiphy's information.
  *
  * @hw: the device to register as returned by ieee80211_alloc_hw()
  */
 int ieee80211_register_hw(struct ieee80211_hw *hw);
 #ifdef CONFIG_MAC80211_LEDS
 extern char *__ieee80211_get_tx_led_name(struct ieee80211_hw *hw);
 extern char *__ieee80211_get_rx_led_name(struct ieee80211_hw *hw);
 extern char *__ieee80211_get_assoc_led_name(struct ieee80211_hw *hw);
 extern char *__ieee80211_get_radio_led_name(struct ieee80211_hw *hw);
 #endif
 /**
  * ieee80211_get_tx_led_name - get name of TX LED
  *
  * mac80211 creates a transmit LED trigger for each wireless hardware
  * that can be used to drive LEDs if your driver registers a LED device.
  * This function returns the name (or %NULL if not configured for LEDs)
  * of the trigger so you can automatically link the LED device.
  *
  * @hw: the hardware to get the LED trigger name for
  */
 static inline char *ieee80211_get_tx_led_name(struct ieee80211_hw *hw)
 {
 #ifdef CONFIG_MAC80211_LEDS
 	return __ieee80211_get_tx_led_name(hw);
 #else
 	return NULL;
 #endif
 }
 /**
  * ieee80211_get_rx_led_name - get name of RX LED
  *
  * mac80211 creates a receive LED trigger for each wireless hardware
  * that can be used to drive LEDs if your driver registers a LED device.
  * This function returns the name (or %NULL if not configured for LEDs)
  * of the trigger so you can automatically link the LED device.
  *
  * @hw: the hardware to get the LED trigger name for
  */
 static inline char *ieee80211_get_rx_led_name(struct ieee80211_hw *hw)
 {
 #ifdef CONFIG_MAC80211_LEDS
 	return __ieee80211_get_rx_led_name(hw);
 #else
 	return NULL;
 #endif
 }
 /**
  * ieee80211_get_assoc_led_name - get name of association LED
  *
  * mac80211 creates a association LED trigger for each wireless hardware
  * that can be used to drive LEDs if your driver registers a LED device.
  * This function returns the name (or %NULL if not configured for LEDs)
  * of the trigger so you can automatically link the LED device.
  *
  * @hw: the hardware to get the LED trigger name for
  */
 static inline char *ieee80211_get_assoc_led_name(struct ieee80211_hw *hw)
 {
 #ifdef CONFIG_MAC80211_LEDS
 	return __ieee80211_get_assoc_led_name(hw);
 #else
 	return NULL;
 #endif
 }
 /**
  * ieee80211_get_radio_led_name - get name of radio LED
  *
  * mac80211 creates a radio change LED trigger for each wireless hardware
  * that can be used to drive LEDs if your driver registers a LED device.
  * This function returns the name (or %NULL if not configured for LEDs)
  * of the trigger so you can automatically link the LED device.
  *
  * @hw: the hardware to get the LED trigger name for
  */
 static inline char *ieee80211_get_radio_led_name(struct ieee80211_hw *hw)
 {
 #ifdef CONFIG_MAC80211_LEDS
 	return __ieee80211_get_radio_led_name(hw);
 #else
 	return NULL;
 #endif
 }
 /**
  * ieee80211_unregister_hw - Unregister a hardware device
  *
  * This function instructs mac80211 to free allocated resources
  * and unregister netdevices from the networking subsystem.
  *
  * @hw: the hardware to unregister
  */
 void ieee80211_unregister_hw(struct ieee80211_hw *hw);
 /**
  * ieee80211_free_hw - free hardware descriptor
  *
  * This function frees everything that was allocated, including the
  * private data for the driver. You must call ieee80211_unregister_hw()
  * before calling this function.
  *
  * @hw: the hardware to free
  */
 void ieee80211_free_hw(struct ieee80211_hw *hw);
 /* trick to avoid symbol clashes with the ieee80211 subsystem */
 void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
 		    struct ieee80211_rx_status *status);
 /**
  * ieee80211_rx - receive frame
  *
  * Use this function to hand received frames to mac80211. The receive
  * buffer in @skb must start with an IEEE 802.11 header or a radiotap
  * header if %RX_FLAG_RADIOTAP is set in the @status flags.
  *
  * This function may not be called in IRQ context. Calls to this function
  * for a single hardware must be synchronized against each other. Calls
  * to this function and ieee80211_rx_irqsafe() may not be mixed for a
  * single hardware.
  *
  * @hw: the hardware this frame came in on
  * @skb: the buffer to receive, owned by mac80211 after this call
  * @status: status of this frame; the status pointer need not be valid
  *	after this function returns
  */
 static inline void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
 				struct ieee80211_rx_status *status)
 {
 	__ieee80211_rx(hw, skb, status);
 }
 /**
  * ieee80211_rx_irqsafe - receive frame
  *
  * Like ieee80211_rx() but can be called in IRQ context
  * (internally defers to a tasklet.)
  *
  * Calls to this function and ieee80211_rx() may not be mixed for a
  * single hardware.
  *
  * @hw: the hardware this frame came in on
  * @skb: the buffer to receive, owned by mac80211 after this call
  * @status: status of this frame; the status pointer need not be valid
  *	after this function returns and is not freed by mac80211,
  *	it is recommended that it points to a stack area
  */
 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw,
 			  struct sk_buff *skb,
 			  struct ieee80211_rx_status *status);
 /**
  * ieee80211_tx_status - transmit status callback
  *
  * Call this function for all transmitted frames after they have been
  * transmitted. It is permissible to not call this function for
  * multicast frames but this can affect statistics.
  *
  * This function may not be called in IRQ context. Calls to this function
  * for a single hardware must be synchronized against each other. Calls
  * to this function and ieee80211_tx_status_irqsafe() may not be mixed
  * for a single hardware.
  *
  * @hw: the hardware the frame was transmitted by
  * @skb: the frame that was transmitted, owned by mac80211 after this call
  */
 void ieee80211_tx_status(struct ieee80211_hw *hw,
 			 struct sk_buff *skb);
 /**
  * ieee80211_tx_status_irqsafe - IRQ-safe transmit status callback
  *
  * Like ieee80211_tx_status() but can be called in IRQ context
  * (internally defers to a tasklet.)
  *
  * Calls to this function and ieee80211_tx_status() may not be mixed for a
  * single hardware.
  *
  * @hw: the hardware the frame was transmitted by
  * @skb: the frame that was transmitted, owned by mac80211 after this call
  */
 void ieee80211_tx_status_irqsafe(struct ieee80211_hw *hw,
 				 struct sk_buff *skb);
 /**
  * ieee80211_beacon_get - beacon generation function
  * @hw: pointer obtained from ieee80211_alloc_hw().
  * @vif: &struct ieee80211_vif pointer from &struct ieee80211_if_init_conf.
  *
  * If the beacon frames are generated by the host system (i.e., not in
  * hardware/firmware), the low-level driver uses this function to receive
  * the next beacon frame from the 802.11 code. The low-level is responsible
  * for calling this function before beacon data is needed (e.g., based on
  * hardware interrupt). Returned skb is used only once and low-level driver
  * is responsible for freeing it.
  */
 struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
 				     struct ieee80211_vif *vif);
 /**
  * ieee80211_rts_get - RTS frame generation function
  * @hw: pointer obtained from ieee80211_alloc_hw().
  * @vif: &struct ieee80211_vif pointer from &struct ieee80211_if_init_conf.
  * @frame: pointer to the frame that is going to be protected by the RTS.
  * @frame_len: the frame length (in octets).
  * @frame_txctl: &struct ieee80211_tx_info of the frame.
  * @rts: The buffer where to store the RTS frame.
  *
  * If the RTS frames are generated by the host system (i.e., not in
  * hardware/firmware), the low-level driver uses this function to receive
  * the next RTS frame from the 802.11 code. The low-level is responsible
  * for calling this function before and RTS frame is needed.
  */
 void ieee80211_rts_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 		       const void *frame, size_t frame_len,
 		       const struct ieee80211_tx_info *frame_txctl,
 		       struct ieee80211_rts *rts);
 /**
  * ieee80211_rts_duration - Get the duration field for an RTS frame
  * @hw: pointer obtained from ieee80211_alloc_hw().
  * @vif: &struct ieee80211_vif pointer from &struct ieee80211_if_init_conf.
  * @frame_len: the length of the frame that is going to be protected by the RTS.
  * @frame_txctl: &struct ieee80211_tx_info of the frame.
  *
  * If the RTS is generated in firmware, but the host system must provide
  * the duration field, the low-level driver uses this function to receive
  * the duration field value in little-endian byteorder.
  */
 __le16 ieee80211_rts_duration(struct ieee80211_hw *hw,
 			      struct ieee80211_vif *vif, size_t frame_len,
 			      const struct ieee80211_tx_info *frame_txctl);
 /**
  * ieee80211_ctstoself_get - CTS-to-self frame generation function
  * @hw: pointer obtained from ieee80211_alloc_hw().
  * @vif: &struct ieee80211_vif pointer from &struct ieee80211_if_init_conf.
  * @frame: pointer to the frame that is going to be protected by the CTS-to-self.
  * @frame_len: the frame length (in octets).
  * @frame_txctl: &struct ieee80211_tx_info of the frame.
  * @cts: The buffer where to store the CTS-to-self frame.
  *
  * If the CTS-to-self frames are generated by the host system (i.e., not in
  * hardware/firmware), the low-level driver uses this function to receive
  * the next CTS-to-self frame from the 802.11 code. The low-level is responsible
  * for calling this function before and CTS-to-self frame is needed.
  */
 void ieee80211_ctstoself_get(struct ieee80211_hw *hw,
 			     struct ieee80211_vif *vif,
 			     const void *frame, size_t frame_len,
 			     const struct ieee80211_tx_info *frame_txctl,
 			     struct ieee80211_cts *cts);
 /**
  * ieee80211_ctstoself_duration - Get the duration field for a CTS-to-self frame
  * @hw: pointer obtained from ieee80211_alloc_hw().
  * @vif: &struct ieee80211_vif pointer from &struct ieee80211_if_init_conf.
  * @frame_len: the length of the frame that is going to be protected by the CTS-to-self.
  * @frame_txctl: &struct ieee80211_tx_info of the frame.
  *
  * If the CTS-to-self is generated in firmware, but the host system must provide
  * the duration field, the low-level driver uses this function to receive
  * the duration field value in little-endian byteorder.
  */
 __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
 				    struct ieee80211_vif *vif,
 				    size_t frame_len,
 				    const struct ieee80211_tx_info *frame_txctl);
 /**
  * ieee80211_generic_frame_duration - Calculate the duration field for a frame
  * @hw: pointer obtained from ieee80211_alloc_hw().
  * @vif: &struct ieee80211_vif pointer from &struct ieee80211_if_init_conf.
  * @frame_len: the length of the frame.
  * @rate: the rate at which the frame is going to be transmitted.
  *
  * Calculate the duration field of some generic frame, given its
  * length and transmission rate (in 100kbps).
  */
 __le16 ieee80211_generic_frame_duration(struct ieee80211_hw *hw,
 					struct ieee80211_vif *vif,
 					size_t frame_len,
 					struct ieee80211_rate *rate);
 /**
  * ieee80211_get_buffered_bc - accessing buffered broadcast and multicast frames
  * @hw: pointer as obtained from ieee80211_alloc_hw().
  * @vif: &struct ieee80211_vif pointer from &struct ieee80211_if_init_conf.
  *
  * Function for accessing buffered broadcast and multicast frames. If
  * hardware/firmware does not implement buffering of broadcast/multicast
  * frames when power saving is used, 802.11 code buffers them in the host
  * memory. The low-level driver uses this function to fetch next buffered
  * frame. In most cases, this is used when generating beacon frame. This
  * function returns a pointer to the next buffered skb or NULL if no more
  * buffered frames are available.
  *
  * Note: buffered frames are returned only after DTIM beacon frame was
  * generated with ieee80211_beacon_get() and the low-level driver must thus
  * call ieee80211_beacon_get() first. ieee80211_get_buffered_bc() returns
  * NULL if the previous generated beacon was not DTIM, so the low-level driver
  * does not need to check for DTIM beacons separately and should be able to
  * use common code for all beacons.
  */
 struct sk_buff *
 ieee80211_get_buffered_bc(struct ieee80211_hw *hw, struct ieee80211_vif *vif);
 /**
  * ieee80211_get_hdrlen_from_skb - get header length from data
  *
  * Given an skb with a raw 802.11 header at the data pointer this function
  * returns the 802.11 header length in bytes (not including encryption
  * headers). If the data in the sk_buff is too short to contain a valid 802.11
  * header the function returns 0.
  *
  * @skb: the frame
  */
 unsigned int ieee80211_get_hdrlen_from_skb(const struct sk_buff *skb);
 /**
  * ieee80211_hdrlen - get header length in bytes from frame control
  * @fc: frame control field in little-endian format
  */
 unsigned int ieee80211_hdrlen(__le16 fc);
 /**
  * ieee80211_get_tkip_key - get a TKIP rc4 for skb
  *
  * This function computes a TKIP rc4 key for an skb. It computes
  * a phase 1 key if needed (iv16 wraps around). This function is to
  * be used by drivers which can do HW encryption but need to compute
  * to phase 1/2 key in SW.
  *
  * @keyconf: the parameter passed with the set key
  * @skb: the skb for which the key is needed
  * @type: TBD
  * @key: a buffer to which the key will be written
  */
 void ieee80211_get_tkip_key(struct ieee80211_key_conf *keyconf,
 				struct sk_buff *skb,
 				enum ieee80211_tkip_key_type type, u8 *key);
 /**
  * ieee80211_wake_queue - wake specific queue
  * @hw: pointer as obtained from ieee80211_alloc_hw().
  * @queue: queue number (counted from zero).
  *
  * Drivers should use this function instead of netif_wake_queue.
  */
 void ieee80211_wake_queue(struct ieee80211_hw *hw, int queue);
 /**
  * ieee80211_stop_queue - stop specific queue
  * @hw: pointer as obtained from ieee80211_alloc_hw().
  * @queue: queue number (counted from zero).
  *
  * Drivers should use this function instead of netif_stop_queue.
  */
 void ieee80211_stop_queue(struct ieee80211_hw *hw, int queue);
 /**
  * ieee80211_queue_stopped - test status of the queue
  * @hw: pointer as obtained from ieee80211_alloc_hw().
  * @queue: queue number (counted from zero).
  *
  * Drivers should use this function instead of netif_stop_queue.
  */
 int ieee80211_queue_stopped(struct ieee80211_hw *hw, int queue);
 /**
  * ieee80211_stop_queues - stop all queues
  * @hw: pointer as obtained from ieee80211_alloc_hw().
  *
  * Drivers should use this function instead of netif_stop_queue.
  */
 void ieee80211_stop_queues(struct ieee80211_hw *hw);
 /**
  * ieee80211_wake_queues - wake all queues
  * @hw: pointer as obtained from ieee80211_alloc_hw().
  *
  * Drivers should use this function instead of netif_wake_queue.
  */
 void ieee80211_wake_queues(struct ieee80211_hw *hw);
 /**
  * ieee80211_scan_completed - completed hardware scan
  *
  * When hardware scan offload is used (i.e. the hw_scan() callback is
  * assigned) this function needs to be called by the driver to notify
  * mac80211 that the scan finished.
  *
  * @hw: the hardware that finished the scan
  */
 void ieee80211_scan_completed(struct ieee80211_hw *hw);
 /**
  * ieee80211_iterate_active_interfaces - iterate active interfaces
  *
  * This function iterates over the interfaces associated with a given
  * hardware that are currently active and calls the callback for them.
  * This function allows the iterator function to sleep, when the iterator
  * function is atomic @ieee80211_iterate_active_interfaces_atomic can
  * be used.
  *
  * @hw: the hardware struct of which the interfaces should be iterated over
  * @iterator: the iterator function to call
  * @data: first argument of the iterator function
  */
 void ieee80211_iterate_active_interfaces(struct ieee80211_hw *hw,
 					 void (*iterator)(void *data, u8 *mac,
 						struct ieee80211_vif *vif),
 					 void *data);
 /**
  * ieee80211_iterate_active_interfaces_atomic - iterate active interfaces
  *
  * This function iterates over the interfaces associated with a given
  * hardware that are currently active and calls the callback for them.
  * This function requires the iterator callback function to be atomic,
  * if that is not desired, use @ieee80211_iterate_active_interfaces instead.
  *
  * @hw: the hardware struct of which the interfaces should be iterated over
  * @iterator: the iterator function to call, cannot sleep
  * @data: first argument of the iterator function
  */
 void ieee80211_iterate_active_interfaces_atomic(struct ieee80211_hw *hw,
 						void (*iterator)(void *data,
 						    u8 *mac,
 						    struct ieee80211_vif *vif),
 						void *data);
 /**
  * ieee80211_start_tx_ba_session - Start a tx Block Ack session.
  * @hw: pointer as obtained from ieee80211_alloc_hw().
  * @ra: receiver address of the BA session recipient
  * @tid: the TID to BA on.
  *
  * Return: success if addBA request was sent, failure otherwise
  *
  * Although mac80211/low level driver/user space application can estimate
  * the need to start aggregation on a certain RA/TID, the session level
  * will be managed by the mac80211.
  */
 int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid);
 /**
  * ieee80211_start_tx_ba_cb - low level driver ready to aggregate.
  * @hw: pointer as obtained from ieee80211_alloc_hw().
  * @ra: receiver address of the BA session recipient.
  * @tid: the TID to BA on.
  *
  * This function must be called by low level driver once it has
  * finished with preparations for the BA session.
  */
 void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid);
 /**
  * ieee80211_start_tx_ba_cb_irqsafe - low level driver ready to aggregate.
  * @hw: pointer as obtained from ieee80211_alloc_hw().
  * @ra: receiver address of the BA session recipient.
  * @tid: the TID to BA on.
  *
  * This function must be called by low level driver once it has
  * finished with preparations for the BA session.
  * This version of the function is IRQ-safe.
  */
 void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_hw *hw, const u8 *ra,
 				      u16 tid);
 /**
  * ieee80211_stop_tx_ba_session - Stop a Block Ack session.
  * @hw: pointer as obtained from ieee80211_alloc_hw().
  * @ra: receiver address of the BA session recipient
  * @tid: the TID to stop BA.
  * @initiator: if indicates initiator DELBA frame will be sent.
  *
  * Return: error if no sta with matching da found, success otherwise
  *
  * Although mac80211/low level driver/user space application can estimate
  * the need to stop aggregation on a certain RA/TID, the session level
  * will be managed by the mac80211.
  */
 int ieee80211_stop_tx_ba_session(struct ieee80211_hw *hw,
 				 u8 *ra, u16 tid,
 				 enum ieee80211_back_parties initiator);
 /**
  * ieee80211_stop_tx_ba_cb - low level driver ready to stop aggregate.
  * @hw: pointer as obtained from ieee80211_alloc_hw().
  * @ra: receiver address of the BA session recipient.
  * @tid: the desired TID to BA on.
  *
  * This function must be called by low level driver once it has
  * finished with preparations for the BA session tear down.
  */
 void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid);
 /**
  * ieee80211_stop_tx_ba_cb_irqsafe - low level driver ready to stop aggregate.
  * @hw: pointer as obtained from ieee80211_alloc_hw().
  * @ra: receiver address of the BA session recipient.
  * @tid: the desired TID to BA on.
  *
  * This function must be called by low level driver once it has
  * finished with preparations for the BA session tear down.
  * This version of the function is IRQ-safe.
  */
 void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_hw *hw, const u8 *ra,
 				     u16 tid);
 /**
  * ieee80211_find_sta - find a station
  *
  * @hw: pointer as obtained from ieee80211_alloc_hw()
  * @addr: station's address
  *
  * This function must be called under RCU lock and the
  * resulting pointer is only valid under RCU lock as well.
  */
 struct ieee80211_sta *ieee80211_find_sta(struct ieee80211_hw *hw,
 					 const u8 *addr);
 /* Rate control API */
 /**
  * struct ieee80211_tx_rate_control - rate control information for/from RC algo
  *
  * @hw: The hardware the algorithm is invoked for.
  * @sband: The band this frame is being transmitted on.
  * @bss_conf: the current BSS configuration
  * @reported_rate: The rate control algorithm can fill this in to indicate
  *	which rate should be reported to userspace as the current rate and
  *	used for rate calculations in the mesh network.
  * @rts: whether RTS will be used for this frame because it is longer than the
  *	RTS threshold
  * @short_preamble: whether mac80211 will request short-preamble transmission
  *	if the selected rate supports it
  * @max_rate_idx: user-requested maximum rate (not MCS for now)
  * @skb: the skb that will be transmitted, the control information in it needs
  *	to be filled in
  */
 struct ieee80211_tx_rate_control {
 	struct ieee80211_hw *hw;
 	struct ieee80211_supported_band *sband;
 	struct ieee80211_bss_conf *bss_conf;
 	struct sk_buff *skb;
 	struct ieee80211_tx_rate reported_rate;
 	bool rts, short_preamble;
 	u8 max_rate_idx;
 };
 struct rate_control_ops {
 	struct module *module;
 	const char *name;
 	void *(*alloc)(struct ieee80211_hw *hw, struct dentry *debugfsdir);
 	void (*free)(void *priv);
 	void *(*alloc_sta)(void *priv, struct ieee80211_sta *sta, gfp_t gfp);
 	void (*rate_init)(void *priv, struct ieee80211_supported_band *sband,
 			  struct ieee80211_sta *sta, void *priv_sta);
 	void (*free_sta)(void *priv, struct ieee80211_sta *sta,
 			 void *priv_sta);
 	void (*tx_status)(void *priv, struct ieee80211_supported_band *sband,
 			  struct ieee80211_sta *sta, void *priv_sta,
 			  struct sk_buff *skb);
 	void (*get_rate)(void *priv, struct ieee80211_sta *sta, void *priv_sta,
 			 struct ieee80211_tx_rate_control *txrc);
 	void (*add_sta_debugfs)(void *priv, void *priv_sta,
 				struct dentry *dir);
 	void (*remove_sta_debugfs)(void *priv, void *priv_sta);
 };
 static inline int rate_supported(struct ieee80211_sta *sta,
 				 enum ieee80211_band band,
 				 int index)
 {
 	return (sta == NULL || sta->supp_rates[band] & BIT(index));
 }
 static inline s8
 rate_lowest_index(struct ieee80211_supported_band *sband,
 		  struct ieee80211_sta *sta)
 {
 	int i;
 	for (i = 0; i < sband->n_bitrates; i++)
 		if (rate_supported(sta, sband->band, i))
 			return i;
 	/* warn when we cannot find a rate. */
 	WARN_ON(1);
 	return 0;
 }
 int ieee80211_rate_control_register(struct rate_control_ops *ops);
 void ieee80211_rate_control_unregister(struct rate_control_ops *ops);
 static inline bool
 conf_is_ht20(struct ieee80211_conf *conf)
 {
 	return conf->channel_type == NL80211_CHAN_HT20;
 }
 static inline bool
 conf_is_ht40_minus(struct ieee80211_conf *conf)
 {
 	return conf->channel_type == NL80211_CHAN_HT40MINUS;
 }
 static inline bool
 conf_is_ht40_plus(struct ieee80211_conf *conf)
 {
 	return conf->channel_type == NL80211_CHAN_HT40PLUS;
 }
 static inline bool
 conf_is_ht40(struct ieee80211_conf *conf)
 {
 	return conf_is_ht40_minus(conf) || conf_is_ht40_plus(conf);
 }
 static inline bool
 conf_is_ht(struct ieee80211_conf *conf)
 {
 	return conf->channel_type != NL80211_CHAN_NO_HT;
 }
 #endif /* MAC80211_H */

net/mac80211/cfg.c

Diff comments View file @ 3cfcf6a

 /*
  * mac80211 configuration hooks for cfg80211
  *
  * Copyright 2006, 2007	Johannes Berg <johannes@sipsolutions.net>
  *
  * This file is GPLv2 as found in COPYING.
  */
 #include <linux/ieee80211.h>
 #include <linux/nl80211.h>
 #include <linux/rtnetlink.h>
 #include <net/net_namespace.h>
 #include <linux/rcupdate.h>
 #include <net/cfg80211.h>
 #include "ieee80211_i.h"
 #include "cfg.h"
 #include "rate.h"
 #include "mesh.h"
 static bool nl80211_type_check(enum nl80211_iftype type)
 {
 	switch (type) {
 	case NL80211_IFTYPE_ADHOC:
 	case NL80211_IFTYPE_STATION:
 	case NL80211_IFTYPE_MONITOR:
 #ifdef CONFIG_MAC80211_MESH
 	case NL80211_IFTYPE_MESH_POINT:
 #endif
 	case NL80211_IFTYPE_AP:
 	case NL80211_IFTYPE_AP_VLAN:
 	case NL80211_IFTYPE_WDS:
 		return true;
 	default:
 		return false;
 	}
 }
 static int ieee80211_add_iface(struct wiphy *wiphy, char *name,
 			       enum nl80211_iftype type, u32 *flags,
 			       struct vif_params *params)
 {
 	struct ieee80211_local *local = wiphy_priv(wiphy);
 	struct net_device *dev;
 	struct ieee80211_sub_if_data *sdata;
 	int err;
 	if (!nl80211_type_check(type))
 		return -EINVAL;
 	err = ieee80211_if_add(local, name, &dev, type, params);
 	if (err || type != NL80211_IFTYPE_MONITOR || !flags)
 		return err;
 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 	sdata->u.mntr_flags = *flags;
 	return 0;
 }
 static int ieee80211_del_iface(struct wiphy *wiphy, int ifindex)
 {
 	struct net_device *dev;
 	struct ieee80211_sub_if_data *sdata;
 	/* we're under RTNL */
 	dev = __dev_get_by_index(&init_net, ifindex);
 	if (!dev)
 		return -ENODEV;
 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 	ieee80211_if_remove(sdata);
 	return 0;
 }
 static int ieee80211_change_iface(struct wiphy *wiphy, int ifindex,
 				  enum nl80211_iftype type, u32 *flags,
 				  struct vif_params *params)
 {
 	struct net_device *dev;
 	struct ieee80211_sub_if_data *sdata;
 	int ret;
 	/* we're under RTNL */
 	dev = __dev_get_by_index(&init_net, ifindex);
 	if (!dev)
 		return -ENODEV;
 	if (!nl80211_type_check(type))
 		return -EINVAL;
 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 	ret = ieee80211_if_change_type(sdata, type);
 	if (ret)
 		return ret;
 	if (netif_running(sdata->dev))
 		return -EBUSY;
 	if (ieee80211_vif_is_mesh(&sdata->vif) && params->mesh_id_len)
 		ieee80211_sdata_set_mesh_id(sdata,
 					    params->mesh_id_len,
 					    params->mesh_id);
 	if (sdata->vif.type != NL80211_IFTYPE_MONITOR || !flags)
 		return 0;
 	sdata->u.mntr_flags = *flags;
 	return 0;
 }
 static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
 			     u8 key_idx, u8 *mac_addr,
 			     struct key_params *params)
 {
 	struct ieee80211_sub_if_data *sdata;
 	struct sta_info *sta = NULL;
 	enum ieee80211_key_alg alg;
 	struct ieee80211_key *key;
 	int err;
 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 	switch (params->cipher) {
 	case WLAN_CIPHER_SUITE_WEP40:
 	case WLAN_CIPHER_SUITE_WEP104:
 		alg = ALG_WEP;
 		break;
 	case WLAN_CIPHER_SUITE_TKIP:
 		alg = ALG_TKIP;
 		break;
 	case WLAN_CIPHER_SUITE_CCMP:
 		alg = ALG_CCMP;
 		break;
+	case WLAN_CIPHER_SUITE_AES_CMAC:
+		alg = ALG_AES_CMAC;
+		break;
 	default:
 		return -EINVAL;
 	}
 	key = ieee80211_key_alloc(alg, key_idx, params->key_len, params->key);
 	if (!key)
 		return -ENOMEM;
 	rcu_read_lock();
 	if (mac_addr) {
 		sta = sta_info_get(sdata->local, mac_addr);
 		if (!sta) {
 			ieee80211_key_free(key);
 			err = -ENOENT;
 			goto out_unlock;
 		}
 	}
 	ieee80211_key_link(key, sdata, sta);
 	err = 0;
  out_unlock:
 	rcu_read_unlock();
 	return err;
 }
 static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
 			     u8 key_idx, u8 *mac_addr)
 {
 	struct ieee80211_sub_if_data *sdata;
 	struct sta_info *sta;
 	int ret;
 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 	rcu_read_lock();
 	if (mac_addr) {
 		ret = -ENOENT;
 		sta = sta_info_get(sdata->local, mac_addr);
 		if (!sta)
 			goto out_unlock;
 		if (sta->key) {
 			ieee80211_key_free(sta->key);
 			WARN_ON(sta->key);
 			ret = 0;
 		}
 		goto out_unlock;
 	}
 	if (!sdata->keys[key_idx]) {
 		ret = -ENOENT;
 		goto out_unlock;
 	}
 	ieee80211_key_free(sdata->keys[key_idx]);
 	WARN_ON(sdata->keys[key_idx]);
 	ret = 0;
  out_unlock:
 	rcu_read_unlock();
 	return ret;
 }
 static int ieee80211_get_key(struct wiphy *wiphy, struct net_device *dev,
 			     u8 key_idx, u8 *mac_addr, void *cookie,
 			     void (*callback)(void *cookie,
 					      struct key_params *params))
 {
 	struct ieee80211_sub_if_data *sdata;
 	struct sta_info *sta = NULL;
 	u8 seq[6] = {0};
 	struct key_params params;
 	struct ieee80211_key *key;
 	u32 iv32;
 	u16 iv16;
 	int err = -ENOENT;
 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 	rcu_read_lock();
 	if (mac_addr) {
 		sta = sta_info_get(sdata->local, mac_addr);
 		if (!sta)
 			goto out;
 		key = sta->key;
 	} else
 		key = sdata->keys[key_idx];
 	if (!key)
 		goto out;
 	memset(&params, 0, sizeof(params));
 	switch (key->conf.alg) {
 	case ALG_TKIP:
 		params.cipher = WLAN_CIPHER_SUITE_TKIP;
 		iv32 = key->u.tkip.tx.iv32;
 		iv16 = key->u.tkip.tx.iv16;
 		if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE &&
 		    sdata->local->ops->get_tkip_seq)
 			sdata->local->ops->get_tkip_seq(
 				local_to_hw(sdata->local),
 				key->conf.hw_key_idx,
 				&iv32, &iv16);
 		seq[0] = iv16 & 0xff;
 		seq[1] = (iv16 >> 8) & 0xff;
 		seq[2] = iv32 & 0xff;
 		seq[3] = (iv32 >> 8) & 0xff;
 		seq[4] = (iv32 >> 16) & 0xff;
 		seq[5] = (iv32 >> 24) & 0xff;
 		params.seq = seq;
 		params.seq_len = 6;
 		break;
 	case ALG_CCMP:
 		params.cipher = WLAN_CIPHER_SUITE_CCMP;
 		seq[0] = key->u.ccmp.tx_pn[5];
 		seq[1] = key->u.ccmp.tx_pn[4];
 		seq[2] = key->u.ccmp.tx_pn[3];
 		seq[3] = key->u.ccmp.tx_pn[2];
 		seq[4] = key->u.ccmp.tx_pn[1];
 		seq[5] = key->u.ccmp.tx_pn[0];
 		params.seq = seq;
 		params.seq_len = 6;
 		break;
 	case ALG_WEP:
 		if (key->conf.keylen == 5)
 			params.cipher = WLAN_CIPHER_SUITE_WEP40;
 		else
 			params.cipher = WLAN_CIPHER_SUITE_WEP104;
 		break;
+	case ALG_AES_CMAC:
+		params.cipher = WLAN_CIPHER_SUITE_AES_CMAC;
+		seq[0] = key->u.aes_cmac.tx_pn[5];
+		seq[1] = key->u.aes_cmac.tx_pn[4];
+		seq[2] = key->u.aes_cmac.tx_pn[3];
+		seq[3] = key->u.aes_cmac.tx_pn[2];
+		seq[4] = key->u.aes_cmac.tx_pn[1];
+		seq[5] = key->u.aes_cmac.tx_pn[0];
+		params.seq = seq;
+		params.seq_len = 6;
+		break;
 	}
 	params.key = key->conf.key;
 	params.key_len = key->conf.keylen;
 	callback(cookie, &params);
 	err = 0;
  out:
 	rcu_read_unlock();
 	return err;
 }
 static int ieee80211_config_default_key(struct wiphy *wiphy,
 					struct net_device *dev,
 					u8 key_idx)
 {
 	struct ieee80211_sub_if_data *sdata;
 	rcu_read_lock();
 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 	ieee80211_set_default_key(sdata, key_idx);
 	rcu_read_unlock();
 	return 0;
 }
+static int ieee80211_config_default_mgmt_key(struct wiphy *wiphy,
+					     struct net_device *dev,
+					     u8 key_idx)
+{
+	struct ieee80211_sub_if_data *sdata;
+	rcu_read_lock();
+	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+	ieee80211_set_default_mgmt_key(sdata, key_idx);
+	rcu_read_unlock();
+	return 0;
+}
 static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
 {
 	struct ieee80211_sub_if_data *sdata = sta->sdata;
 	sinfo->filled = STATION_INFO_INACTIVE_TIME |
 			STATION_INFO_RX_BYTES |
 			STATION_INFO_TX_BYTES |
 			STATION_INFO_TX_BITRATE;
 	sinfo->inactive_time = jiffies_to_msecs(jiffies - sta->last_rx);
 	sinfo->rx_bytes = sta->rx_bytes;
 	sinfo->tx_bytes = sta->tx_bytes;
 	if (sta->local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
 		sinfo->filled |= STATION_INFO_SIGNAL;
 		sinfo->signal = (s8)sta->last_signal;
 	}
 	sinfo->txrate.flags = 0;
 	if (sta->last_tx_rate.flags & IEEE80211_TX_RC_MCS)
 		sinfo->txrate.flags |= RATE_INFO_FLAGS_MCS;
 	if (sta->last_tx_rate.flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
 		sinfo->txrate.flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
 	if (sta->last_tx_rate.flags & IEEE80211_TX_RC_SHORT_GI)
 		sinfo->txrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
 	if (!(sta->last_tx_rate.flags & IEEE80211_TX_RC_MCS)) {
 		struct ieee80211_supported_band *sband;
 		sband = sta->local->hw.wiphy->bands[
 				sta->local->hw.conf.channel->band];
 		sinfo->txrate.legacy =
 			sband->bitrates[sta->last_tx_rate.idx].bitrate;
 	} else
 		sinfo->txrate.mcs = sta->last_tx_rate.idx;
 	if (ieee80211_vif_is_mesh(&sdata->vif)) {
 #ifdef CONFIG_MAC80211_MESH
 		sinfo->filled |= STATION_INFO_LLID |
 				 STATION_INFO_PLID |
 				 STATION_INFO_PLINK_STATE;
 		sinfo->llid = le16_to_cpu(sta->llid);
 		sinfo->plid = le16_to_cpu(sta->plid);
 		sinfo->plink_state = sta->plink_state;
 #endif
 	}
 }
 static int ieee80211_dump_station(struct wiphy *wiphy, struct net_device *dev,
 				 int idx, u8 *mac, struct station_info *sinfo)
 {
 	struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 	struct sta_info *sta;
 	int ret = -ENOENT;
 	rcu_read_lock();
 	sta = sta_info_get_by_idx(local, idx, dev);
 	if (sta) {
 		ret = 0;
 		memcpy(mac, sta->sta.addr, ETH_ALEN);
 		sta_set_sinfo(sta, sinfo);
 	}
 	rcu_read_unlock();
 	return ret;
 }
 static int ieee80211_get_station(struct wiphy *wiphy, struct net_device *dev,
 				 u8 *mac, struct station_info *sinfo)
 {
 	struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 	struct sta_info *sta;
 	int ret = -ENOENT;
 	rcu_read_lock();
 	/* XXX: verify sta->dev == dev */
 	sta = sta_info_get(local, mac);
 	if (sta) {
 		ret = 0;
 		sta_set_sinfo(sta, sinfo);
 	}
 	rcu_read_unlock();
 	return ret;
 }
 /*
  * This handles both adding a beacon and setting new beacon info
  */
 static int ieee80211_config_beacon(struct ieee80211_sub_if_data *sdata,
 				   struct beacon_parameters *params)
 {
 	struct beacon_data *new, *old;
 	int new_head_len, new_tail_len;
 	int size;
 	int err = -EINVAL;
 	old = sdata->u.ap.beacon;
 	/* head must not be zero-length */
 	if (params->head && !params->head_len)
 		return -EINVAL;
 	/*
 	 * This is a kludge. beacon interval should really be part
 	 * of the beacon information.
 	 */
 	if (params->interval) {
 		sdata->local->hw.conf.beacon_int = params->interval;
 		err = ieee80211_hw_config(sdata->local,
 					IEEE80211_CONF_CHANGE_BEACON_INTERVAL);
 		if (err < 0)
 			return err;
 		/*
 		 * We updated some parameter so if below bails out
 		 * it's not an error.
 		 */
 		err = 0;
 	}
 	/* Need to have a beacon head if we don't have one yet */
 	if (!params->head && !old)
 		return err;
 	/* sorry, no way to start beaconing without dtim period */
 	if (!params->dtim_period && !old)
 		return err;
 	/* new or old head? */
 	if (params->head)
 		new_head_len = params->head_len;
 	else
 		new_head_len = old->head_len;
 	/* new or old tail? */
 	if (params->tail || !old)
 		/* params->tail_len will be zero for !params->tail */
 		new_tail_len = params->tail_len;
 	else
 		new_tail_len = old->tail_len;
 	size = sizeof(*new) + new_head_len + new_tail_len;
 	new = kzalloc(size, GFP_KERNEL);
 	if (!new)
 		return -ENOMEM;
 	/* start filling the new info now */
 	/* new or old dtim period? */
 	if (params->dtim_period)
 		new->dtim_period = params->dtim_period;
 	else
 		new->dtim_period = old->dtim_period;
 	/*
 	 * pointers go into the block we allocated,
 	 * memory is | beacon_data | head | tail |
 	 */
 	new->head = ((u8 *) new) + sizeof(*new);
 	new->tail = new->head + new_head_len;
 	new->head_len = new_head_len;
 	new->tail_len = new_tail_len;
 	/* copy in head */
 	if (params->head)
 		memcpy(new->head, params->head, new_head_len);
 	else
 		memcpy(new->head, old->head, new_head_len);
 	/* copy in optional tail */
 	if (params->tail)
 		memcpy(new->tail, params->tail, new_tail_len);
 	else
 		if (old)
 			memcpy(new->tail, old->tail, new_tail_len);
 	rcu_assign_pointer(sdata->u.ap.beacon, new);
 	synchronize_rcu();
 	kfree(old);
 	return ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
 }
 static int ieee80211_add_beacon(struct wiphy *wiphy, struct net_device *dev,
 				struct beacon_parameters *params)
 {
 	struct ieee80211_sub_if_data *sdata;
 	struct beacon_data *old;
 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 	if (sdata->vif.type != NL80211_IFTYPE_AP)
 		return -EINVAL;
 	old = sdata->u.ap.beacon;
 	if (old)
 		return -EALREADY;
 	return ieee80211_config_beacon(sdata, params);
 }
 static int ieee80211_set_beacon(struct wiphy *wiphy, struct net_device *dev,
 				struct beacon_parameters *params)
 {
 	struct ieee80211_sub_if_data *sdata;
 	struct beacon_data *old;
 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 	if (sdata->vif.type != NL80211_IFTYPE_AP)
 		return -EINVAL;
 	old = sdata->u.ap.beacon;
 	if (!old)
 		return -ENOENT;
 	return ieee80211_config_beacon(sdata, params);
 }
 static int ieee80211_del_beacon(struct wiphy *wiphy, struct net_device *dev)
 {
 	struct ieee80211_sub_if_data *sdata;
 	struct beacon_data *old;
 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 	if (sdata->vif.type != NL80211_IFTYPE_AP)
 		return -EINVAL;
 	old = sdata->u.ap.beacon;
 	if (!old)
 		return -ENOENT;
 	rcu_assign_pointer(sdata->u.ap.beacon, NULL);
 	synchronize_rcu();
 	kfree(old);
 	return ieee80211_if_config(sdata, IEEE80211_IFCC_BEACON);
 }
 /* Layer 2 Update frame (802.2 Type 1 LLC XID Update response) */
 struct iapp_layer2_update {
 	u8 da[ETH_ALEN];	/* broadcast */
 	u8 sa[ETH_ALEN];	/* STA addr */
 	__be16 len;		/* 6 */
 	u8 dsap;		/* 0 */
 	u8 ssap;		/* 0 */
 	u8 control;
 	u8 xid_info[3];
 } __attribute__ ((packed));
 static void ieee80211_send_layer2_update(struct sta_info *sta)
 {
 	struct iapp_layer2_update *msg;
 	struct sk_buff *skb;
 	/* Send Level 2 Update Frame to update forwarding tables in layer 2
 	 * bridge devices */
 	skb = dev_alloc_skb(sizeof(*msg));
 	if (!skb)
 		return;
 	msg = (struct iapp_layer2_update *)skb_put(skb, sizeof(*msg));
 	/* 802.2 Type 1 Logical Link Control (LLC) Exchange Identifier (XID)
 	 * Update response frame; IEEE Std 802.2-1998, 5.4.1.2.1 */
 	memset(msg->da, 0xff, ETH_ALEN);
 	memcpy(msg->sa, sta->sta.addr, ETH_ALEN);
 	msg->len = htons(6);
 	msg->dsap = 0;
 	msg->ssap = 0x01;	/* NULL LSAP, CR Bit: Response */
 	msg->control = 0xaf;	/* XID response lsb.1111F101.
 				 * F=0 (no poll command; unsolicited frame) */
 	msg->xid_info[0] = 0x81;	/* XID format identifier */
 	msg->xid_info[1] = 1;	/* LLC types/classes: Type 1 LLC */
 	msg->xid_info[2] = 0;	/* XID sender's receive window size (RW) */
 	skb->dev = sta->sdata->dev;
 	skb->protocol = eth_type_trans(skb, sta->sdata->dev);
 	memset(skb->cb, 0, sizeof(skb->cb));
 	netif_rx(skb);
 }
 static void sta_apply_parameters(struct ieee80211_local *local,
 				 struct sta_info *sta,
 				 struct station_parameters *params)
 {
 	u32 rates;
 	int i, j;
 	struct ieee80211_supported_band *sband;
 	struct ieee80211_sub_if_data *sdata = sta->sdata;
 	sband = local->hw.wiphy->bands[local->oper_channel->band];
 	/*
 	 * FIXME: updating the flags is racy when this function is
 	 *	  called from ieee80211_change_station(), this will
 	 *	  be resolved in a future patch.
 	 */
 	if (params->station_flags & STATION_FLAG_CHANGED) {
 		spin_lock_bh(&sta->lock);
 		sta->flags &= ~WLAN_STA_AUTHORIZED;
 		if (params->station_flags & STATION_FLAG_AUTHORIZED)
 			sta->flags |= WLAN_STA_AUTHORIZED;
 		sta->flags &= ~WLAN_STA_SHORT_PREAMBLE;
 		if (params->station_flags & STATION_FLAG_SHORT_PREAMBLE)
 			sta->flags |= WLAN_STA_SHORT_PREAMBLE;
 		sta->flags &= ~WLAN_STA_WME;
 		if (params->station_flags & STATION_FLAG_WME)
 			sta->flags |= WLAN_STA_WME;
 		sta->flags &= ~WLAN_STA_MFP;
 		if (params->station_flags & STATION_FLAG_MFP)
 			sta->flags |= WLAN_STA_MFP;
 		spin_unlock_bh(&sta->lock);
 	}
 	/*
 	 * FIXME: updating the following information is racy when this
 	 *	  function is called from ieee80211_change_station().
 	 *	  However, all this information should be static so
 	 *	  maybe we should just reject attemps to change it.
 	 */
 	if (params->aid) {
 		sta->sta.aid = params->aid;
 		if (sta->sta.aid > IEEE80211_MAX_AID)
 			sta->sta.aid = 0; /* XXX: should this be an error? */
 	}
 	if (params->listen_interval >= 0)
 		sta->listen_interval = params->listen_interval;
 	if (params->supported_rates) {
 		rates = 0;
 		for (i = 0; i < params->supported_rates_len; i++) {
 			int rate = (params->supported_rates[i] & 0x7f) * 5;
 			for (j = 0; j < sband->n_bitrates; j++) {
 				if (sband->bitrates[j].bitrate == rate)
 					rates |= BIT(j);
 			}
 		}
 		sta->sta.supp_rates[local->oper_channel->band] = rates;
 	}
 	if (params->ht_capa)
 		ieee80211_ht_cap_ie_to_sta_ht_cap(sband,
 						  params->ht_capa,
 						  &sta->sta.ht_cap);
 	if (ieee80211_vif_is_mesh(&sdata->vif) && params->plink_action) {
 		switch (params->plink_action) {
 		case PLINK_ACTION_OPEN:
 			mesh_plink_open(sta);
 			break;
 		case PLINK_ACTION_BLOCK:
 			mesh_plink_block(sta);
 			break;
 		}
 	}
 }
 static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
 				 u8 *mac, struct station_parameters *params)
 {
 	struct ieee80211_local *local = wiphy_priv(wiphy);
 	struct sta_info *sta;
 	struct ieee80211_sub_if_data *sdata;
 	int err;
 	int layer2_update;
 	/* Prevent a race with changing the rate control algorithm */
 	if (!netif_running(dev))
 		return -ENETDOWN;
 	if (params->vlan) {
 		sdata = IEEE80211_DEV_TO_SUB_IF(params->vlan);
 		if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
 		    sdata->vif.type != NL80211_IFTYPE_AP)
 			return -EINVAL;
 	} else
 		sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 	if (compare_ether_addr(mac, dev->dev_addr) == 0)
 		return -EINVAL;
 	if (is_multicast_ether_addr(mac))
 		return -EINVAL;
 	sta = sta_info_alloc(sdata, mac, GFP_KERNEL);
 	if (!sta)
 		return -ENOMEM;
 	sta->flags = WLAN_STA_AUTH | WLAN_STA_ASSOC;
 	sta_apply_parameters(local, sta, params);
 	rate_control_rate_init(sta);
 	layer2_update = sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
 		sdata->vif.type == NL80211_IFTYPE_AP;
 	rcu_read_lock();
 	err = sta_info_insert(sta);
 	if (err) {
 		/* STA has been freed */
 		if (err == -EEXIST && layer2_update) {
 			/* Need to update layer 2 devices on reassociation */
 			sta = sta_info_get(local, mac);
 			if (sta)
 				ieee80211_send_layer2_update(sta);
 		}
 		rcu_read_unlock();
 		return err;
 	}
 	if (layer2_update)
 		ieee80211_send_layer2_update(sta);
 	rcu_read_unlock();
 	return 0;
 }
 static int ieee80211_del_station(struct wiphy *wiphy, struct net_device *dev,
 				 u8 *mac)
 {
 	struct ieee80211_local *local = wiphy_priv(wiphy);
 	struct ieee80211_sub_if_data *sdata;
 	struct sta_info *sta;
 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 	if (mac) {
 		rcu_read_lock();
 		/* XXX: get sta belonging to dev */
 		sta = sta_info_get(local, mac);
 		if (!sta) {
 			rcu_read_unlock();
 			return -ENOENT;
 		}
 		sta_info_unlink(&sta);
 		rcu_read_unlock();
 		sta_info_destroy(sta);
 	} else
 		sta_info_flush(local, sdata);
 	return 0;
 }
 static int ieee80211_change_station(struct wiphy *wiphy,
 				    struct net_device *dev,
 				    u8 *mac,
 				    struct station_parameters *params)
 {
 	struct ieee80211_local *local = wiphy_priv(wiphy);
 	struct sta_info *sta;
 	struct ieee80211_sub_if_data *vlansdata;
 	rcu_read_lock();
 	/* XXX: get sta belonging to dev */
 	sta = sta_info_get(local, mac);
 	if (!sta) {
 		rcu_read_unlock();
 		return -ENOENT;
 	}
 	if (params->vlan && params->vlan != sta->sdata->dev) {
 		vlansdata = IEEE80211_DEV_TO_SUB_IF(params->vlan);
 		if (vlansdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
 		    vlansdata->vif.type != NL80211_IFTYPE_AP) {
 			rcu_read_unlock();
 			return -EINVAL;
 		}
 		sta->sdata = vlansdata;
 		ieee80211_send_layer2_update(sta);
 	}
 	sta_apply_parameters(local, sta, params);
 	rcu_read_unlock();
 	return 0;
 }
 #ifdef CONFIG_MAC80211_MESH
 static int ieee80211_add_mpath(struct wiphy *wiphy, struct net_device *dev,
 				 u8 *dst, u8 *next_hop)
 {
 	struct ieee80211_local *local = wiphy_priv(wiphy);
 	struct ieee80211_sub_if_data *sdata;
 	struct mesh_path *mpath;
 	struct sta_info *sta;
 	int err;
 	if (!netif_running(dev))
 		return -ENETDOWN;
 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 	if (sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
 		return -ENOTSUPP;
 	rcu_read_lock();
 	sta = sta_info_get(local, next_hop);
 	if (!sta) {
 		rcu_read_unlock();
 		return -ENOENT;
 	}
 	err = mesh_path_add(dst, sdata);
 	if (err) {
 		rcu_read_unlock();
 		return err;
 	}
 	mpath = mesh_path_lookup(dst, sdata);
 	if (!mpath) {
 		rcu_read_unlock();
 		return -ENXIO;
 	}
 	mesh_path_fix_nexthop(mpath, sta);
 	rcu_read_unlock();
 	return 0;
 }
 static int ieee80211_del_mpath(struct wiphy *wiphy, struct net_device *dev,
 				 u8 *dst)
 {
 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 	if (dst)
 		return mesh_path_del(dst, sdata);
 	mesh_path_flush(sdata);
 	return 0;
 }
 static int ieee80211_change_mpath(struct wiphy *wiphy,
 				    struct net_device *dev,
 				    u8 *dst, u8 *next_hop)
 {
 	struct ieee80211_local *local = wiphy_priv(wiphy);
 	struct ieee80211_sub_if_data *sdata;
 	struct mesh_path *mpath;
 	struct sta_info *sta;
 	if (!netif_running(dev))
 		return -ENETDOWN;
 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 	if (sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
 		return -ENOTSUPP;
 	rcu_read_lock();
 	sta = sta_info_get(local, next_hop);
 	if (!sta) {
 		rcu_read_unlock();
 		return -ENOENT;
 	}
 	mpath = mesh_path_lookup(dst, sdata);
 	if (!mpath) {
 		rcu_read_unlock();
 		return -ENOENT;
 	}
 	mesh_path_fix_nexthop(mpath, sta);
 	rcu_read_unlock();
 	return 0;
 }
 static void mpath_set_pinfo(struct mesh_path *mpath, u8 *next_hop,
 			    struct mpath_info *pinfo)
 {
 	if (mpath->next_hop)
 		memcpy(next_hop, mpath->next_hop->sta.addr, ETH_ALEN);
 	else
 		memset(next_hop, 0, ETH_ALEN);
 	pinfo->filled = MPATH_INFO_FRAME_QLEN |
 			MPATH_INFO_DSN |
 			MPATH_INFO_METRIC |
 			MPATH_INFO_EXPTIME |
 			MPATH_INFO_DISCOVERY_TIMEOUT |
 			MPATH_INFO_DISCOVERY_RETRIES |
 			MPATH_INFO_FLAGS;
 	pinfo->frame_qlen = mpath->frame_queue.qlen;
 	pinfo->dsn = mpath->dsn;
 	pinfo->metric = mpath->metric;
 	if (time_before(jiffies, mpath->exp_time))
 		pinfo->exptime = jiffies_to_msecs(mpath->exp_time - jiffies);
 	pinfo->discovery_timeout =
 			jiffies_to_msecs(mpath->discovery_timeout);
 	pinfo->discovery_retries = mpath->discovery_retries;
 	pinfo->flags = 0;
 	if (mpath->flags & MESH_PATH_ACTIVE)
 		pinfo->flags |= NL80211_MPATH_FLAG_ACTIVE;
 	if (mpath->flags & MESH_PATH_RESOLVING)
 		pinfo->flags |= NL80211_MPATH_FLAG_RESOLVING;
 	if (mpath->flags & MESH_PATH_DSN_VALID)
 		pinfo->flags |= NL80211_MPATH_FLAG_DSN_VALID;
 	if (mpath->flags & MESH_PATH_FIXED)
 		pinfo->flags |= NL80211_MPATH_FLAG_FIXED;
 	if (mpath->flags & MESH_PATH_RESOLVING)
 		pinfo->flags |= NL80211_MPATH_FLAG_RESOLVING;
 	pinfo->flags = mpath->flags;
 }
 static int ieee80211_get_mpath(struct wiphy *wiphy, struct net_device *dev,
 			       u8 *dst, u8 *next_hop, struct mpath_info *pinfo)
 {
 	struct ieee80211_sub_if_data *sdata;
 	struct mesh_path *mpath;
 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 	if (sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
 		return -ENOTSUPP;
 	rcu_read_lock();
 	mpath = mesh_path_lookup(dst, sdata);
 	if (!mpath) {
 		rcu_read_unlock();
 		return -ENOENT;
 	}
 	memcpy(dst, mpath->dst, ETH_ALEN);
 	mpath_set_pinfo(mpath, next_hop, pinfo);
 	rcu_read_unlock();
 	return 0;
 }
 static int ieee80211_dump_mpath(struct wiphy *wiphy, struct net_device *dev,
 				 int idx, u8 *dst, u8 *next_hop,
 				 struct mpath_info *pinfo)
 {
 	struct ieee80211_sub_if_data *sdata;
 	struct mesh_path *mpath;
 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 	if (sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
 		return -ENOTSUPP;
 	rcu_read_lock();
 	mpath = mesh_path_lookup_by_idx(idx, sdata);
 	if (!mpath) {
 		rcu_read_unlock();
 		return -ENOENT;
 	}
 	memcpy(dst, mpath->dst, ETH_ALEN);
 	mpath_set_pinfo(mpath, next_hop, pinfo);
 	rcu_read_unlock();
 	return 0;
 }
 static int ieee80211_get_mesh_params(struct wiphy *wiphy,
 				struct net_device *dev,
 				struct mesh_config *conf)
 {
 	struct ieee80211_sub_if_data *sdata;
 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 	if (sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
 		return -ENOTSUPP;
 	memcpy(conf, &(sdata->u.mesh.mshcfg), sizeof(struct mesh_config));
 	return 0;
 }
 static inline bool _chg_mesh_attr(enum nl80211_meshconf_params parm, u32 mask)
 {
 	return (mask >> (parm-1)) & 0x1;
 }
 static int ieee80211_set_mesh_params(struct wiphy *wiphy,
 				struct net_device *dev,
 				const struct mesh_config *nconf, u32 mask)
 {
 	struct mesh_config *conf;
 	struct ieee80211_sub_if_data *sdata;
 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 	if (sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
 		return -ENOTSUPP;
 	/* Set the config options which we are interested in setting */
 	conf = &(sdata->u.mesh.mshcfg);
 	if (_chg_mesh_attr(NL80211_MESHCONF_RETRY_TIMEOUT, mask))
 		conf->dot11MeshRetryTimeout = nconf->dot11MeshRetryTimeout;
 	if (_chg_mesh_attr(NL80211_MESHCONF_CONFIRM_TIMEOUT, mask))
 		conf->dot11MeshConfirmTimeout = nconf->dot11MeshConfirmTimeout;
 	if (_chg_mesh_attr(NL80211_MESHCONF_HOLDING_TIMEOUT, mask))
 		conf->dot11MeshHoldingTimeout = nconf->dot11MeshHoldingTimeout;
 	if (_chg_mesh_attr(NL80211_MESHCONF_MAX_PEER_LINKS, mask))
 		conf->dot11MeshMaxPeerLinks = nconf->dot11MeshMaxPeerLinks;
 	if (_chg_mesh_attr(NL80211_MESHCONF_MAX_RETRIES, mask))
 		conf->dot11MeshMaxRetries = nconf->dot11MeshMaxRetries;
 	if (_chg_mesh_attr(NL80211_MESHCONF_TTL, mask))
 		conf->dot11MeshTTL = nconf->dot11MeshTTL;
 	if (_chg_mesh_attr(NL80211_MESHCONF_AUTO_OPEN_PLINKS, mask))
 		conf->auto_open_plinks = nconf->auto_open_plinks;
 	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, mask))
 		conf->dot11MeshHWMPmaxPREQretries =
 			nconf->dot11MeshHWMPmaxPREQretries;
 	if (_chg_mesh_attr(NL80211_MESHCONF_PATH_REFRESH_TIME, mask))
 		conf->path_refresh_time = nconf->path_refresh_time;
 	if (_chg_mesh_attr(NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, mask))
 		conf->min_discovery_timeout = nconf->min_discovery_timeout;
 	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, mask))
 		conf->dot11MeshHWMPactivePathTimeout =
 			nconf->dot11MeshHWMPactivePathTimeout;
 	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL, mask))
 		conf->dot11MeshHWMPpreqMinInterval =
 			nconf->dot11MeshHWMPpreqMinInterval;
 	if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
 			   mask))
 		conf->dot11MeshHWMPnetDiameterTraversalTime =
 			nconf->dot11MeshHWMPnetDiameterTraversalTime;
 	return 0;
 }
 #endif
 static int ieee80211_change_bss(struct wiphy *wiphy,
 				struct net_device *dev,
 				struct bss_parameters *params)
 {
 	struct ieee80211_sub_if_data *sdata;
 	u32 changed = 0;
 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 	if (sdata->vif.type != NL80211_IFTYPE_AP)
 		return -EINVAL;
 	if (params->use_cts_prot >= 0) {
 		sdata->vif.bss_conf.use_cts_prot = params->use_cts_prot;
 		changed |= BSS_CHANGED_ERP_CTS_PROT;
 	}
 	if (params->use_short_preamble >= 0) {
 		sdata->vif.bss_conf.use_short_preamble =
 			params->use_short_preamble;
 		changed |= BSS_CHANGED_ERP_PREAMBLE;
 	}
 	if (params->use_short_slot_time >= 0) {
 		sdata->vif.bss_conf.use_short_slot =
 			params->use_short_slot_time;
 		changed |= BSS_CHANGED_ERP_SLOT;
 	}
 	if (params->basic_rates) {
 		int i, j;
 		u32 rates = 0;
 		struct ieee80211_local *local = wiphy_priv(wiphy);
 		struct ieee80211_supported_band *sband =
 			wiphy->bands[local->oper_channel->band];
 		for (i = 0; i < params->basic_rates_len; i++) {
 			int rate = (params->basic_rates[i] & 0x7f) * 5;
 			for (j = 0; j < sband->n_bitrates; j++) {
 				if (sband->bitrates[j].bitrate == rate)
 					rates |= BIT(j);
 			}
 		}
 		sdata->vif.bss_conf.basic_rates = rates;
 		changed |= BSS_CHANGED_BASIC_RATES;
 	}
 	ieee80211_bss_info_change_notify(sdata, changed);
 	return 0;
 }
 static int ieee80211_set_txq_params(struct wiphy *wiphy,
 				    struct ieee80211_txq_params *params)
 {
 	struct ieee80211_local *local = wiphy_priv(wiphy);
 	struct ieee80211_tx_queue_params p;
 	if (!local->ops->conf_tx)
 		return -EOPNOTSUPP;
 	memset(&p, 0, sizeof(p));
 	p.aifs = params->aifs;
 	p.cw_max = params->cwmax;
 	p.cw_min = params->cwmin;
 	p.txop = params->txop;
 	if (local->ops->conf_tx(local_to_hw(local), params->queue, &p)) {
 		printk(KERN_DEBUG "%s: failed to set TX queue "
 		       "parameters for queue %d\n", local->mdev->name,
 		       params->queue);
 		return -EINVAL;
 	}
 	return 0;
 }
 static int ieee80211_set_channel(struct wiphy *wiphy,
 				 struct ieee80211_channel *chan,
 				 enum nl80211_channel_type channel_type)
 {
 	struct ieee80211_local *local = wiphy_priv(wiphy);
 	local->oper_channel = chan;
 	local->oper_channel_type = channel_type;
 	return ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
 }
 struct cfg80211_ops mac80211_config_ops = {
 	.add_virtual_intf = ieee80211_add_iface,
 	.del_virtual_intf = ieee80211_del_iface,
 	.change_virtual_intf = ieee80211_change_iface,
 	.add_key = ieee80211_add_key,
 	.del_key = ieee80211_del_key,
 	.get_key = ieee80211_get_key,
 	.set_default_key = ieee80211_config_default_key,
+	.set_default_mgmt_key = ieee80211_config_default_mgmt_key,
 	.add_beacon = ieee80211_add_beacon,
 	.set_beacon = ieee80211_set_beacon,
 	.del_beacon = ieee80211_del_beacon,
 	.add_station = ieee80211_add_station,
 	.del_station = ieee80211_del_station,
 	.change_station = ieee80211_change_station,
 	.get_station = ieee80211_get_station,
 	.dump_station = ieee80211_dump_station,
 #ifdef CONFIG_MAC80211_MESH
 	.add_mpath = ieee80211_add_mpath,
 	.del_mpath = ieee80211_del_mpath,
 	.change_mpath = ieee80211_change_mpath,
 	.get_mpath = ieee80211_get_mpath,
 	.dump_mpath = ieee80211_dump_mpath,
 	.set_mesh_params = ieee80211_set_mesh_params,
 	.get_mesh_params = ieee80211_get_mesh_params,
 #endif
 	.change_bss = ieee80211_change_bss,
 	.set_txq_params = ieee80211_set_txq_params,
 	.set_channel = ieee80211_set_channel,
 };

net/mac80211/debugfs_key.c

Diff comments View file @ 3cfcf6a

 /*
  * Copyright 2003-2005	Devicescape Software, Inc.
  * Copyright (c) 2006	Jiri Benc <jbenc@suse.cz>
  * Copyright 2007	Johannes Berg <johannes@sipsolutions.net>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
 #include <linux/kobject.h>
 #include "ieee80211_i.h"
 #include "key.h"
 #include "debugfs.h"
 #include "debugfs_key.h"
 #define KEY_READ(name, prop, buflen, format_string)			\
 static ssize_t key_##name##_read(struct file *file,			\
 				 char __user *userbuf,			\
 				 size_t count, loff_t *ppos)		\
 {									\
 	char buf[buflen];						\
 	struct ieee80211_key *key = file->private_data;			\
 	int res = scnprintf(buf, buflen, format_string, key->prop);	\
 	return simple_read_from_buffer(userbuf, count, ppos, buf, res);	\
 }
 #define KEY_READ_D(name) KEY_READ(name, name, 20, "%d\n")
 #define KEY_READ_X(name) KEY_READ(name, name, 20, "0x%x\n")
 #define KEY_OPS(name)							\
 static const struct file_operations key_ ##name## _ops = {		\
 	.read = key_##name##_read,					\
 	.open = mac80211_open_file_generic,				\
 }
 #define KEY_FILE(name, format)						\
 		 KEY_READ_##format(name)				\
 		 KEY_OPS(name)
 #define KEY_CONF_READ(name, buflen, format_string)			\
 	KEY_READ(conf_##name, conf.name, buflen, format_string)
 #define KEY_CONF_READ_D(name) KEY_CONF_READ(name, 20, "%d\n")
 #define KEY_CONF_OPS(name)						\
 static const struct file_operations key_ ##name## _ops = {		\
 	.read = key_conf_##name##_read,					\
 	.open = mac80211_open_file_generic,				\
 }
 #define KEY_CONF_FILE(name, format)					\
 		 KEY_CONF_READ_##format(name)				\
 		 KEY_CONF_OPS(name)
 KEY_CONF_FILE(keylen, D);
 KEY_CONF_FILE(keyidx, D);
 KEY_CONF_FILE(hw_key_idx, D);
 KEY_FILE(flags, X);
 KEY_FILE(tx_rx_count, D);
 KEY_READ(ifindex, sdata->dev->ifindex, 20, "%d\n");
 KEY_OPS(ifindex);
 static ssize_t key_algorithm_read(struct file *file,
 				  char __user *userbuf,
 				  size_t count, loff_t *ppos)
 {
 	char *alg;
 	struct ieee80211_key *key = file->private_data;
 	switch (key->conf.alg) {
 	case ALG_WEP:
 		alg = "WEP\n";
 		break;
 	case ALG_TKIP:
 		alg = "TKIP\n";
 		break;
 	case ALG_CCMP:
 		alg = "CCMP\n";
 		break;
+	case ALG_AES_CMAC:
+		alg = "AES-128-CMAC\n";
+		break;
 	default:
 		return 0;
 	}
 	return simple_read_from_buffer(userbuf, count, ppos, alg, strlen(alg));
 }
 KEY_OPS(algorithm);
 static ssize_t key_tx_spec_read(struct file *file, char __user *userbuf,
 				size_t count, loff_t *ppos)
 {
 	const u8 *tpn;
 	char buf[20];
 	int len;
 	struct ieee80211_key *key = file->private_data;
 	switch (key->conf.alg) {
 	case ALG_WEP:
 		len = scnprintf(buf, sizeof(buf), "\n");
 		break;
 	case ALG_TKIP:
 		len = scnprintf(buf, sizeof(buf), "%08x %04x\n",
 				key->u.tkip.tx.iv32,
 				key->u.tkip.tx.iv16);
 		break;
 	case ALG_CCMP:
 		tpn = key->u.ccmp.tx_pn;
 		len = scnprintf(buf, sizeof(buf), "%02x%02x%02x%02x%02x%02x\n",
 				tpn[0], tpn[1], tpn[2], tpn[3], tpn[4], tpn[5]);
 		break;
+	case ALG_AES_CMAC:
+		tpn = key->u.aes_cmac.tx_pn;
+		len = scnprintf(buf, sizeof(buf), "%02x%02x%02x%02x%02x%02x\n",
+				tpn[0], tpn[1], tpn[2], tpn[3], tpn[4],
+				tpn[5]);
+		break;
 	default:
 		return 0;
 	}
 	return simple_read_from_buffer(userbuf, count, ppos, buf, len);
 }
 KEY_OPS(tx_spec);
 static ssize_t key_rx_spec_read(struct file *file, char __user *userbuf,
 				size_t count, loff_t *ppos)
 {
 	struct ieee80211_key *key = file->private_data;
 	char buf[14*NUM_RX_DATA_QUEUES+1], *p = buf;
 	int i, len;
 	const u8 *rpn;
 	switch (key->conf.alg) {
 	case ALG_WEP:
 		len = scnprintf(buf, sizeof(buf), "\n");
 		break;
 	case ALG_TKIP:
 		for (i = 0; i < NUM_RX_DATA_QUEUES; i++)
 			p += scnprintf(p, sizeof(buf)+buf-p,
 				       "%08x %04x\n",
 				       key->u.tkip.rx[i].iv32,
 				       key->u.tkip.rx[i].iv16);
 		len = p - buf;
 		break;
 	case ALG_CCMP:
 		for (i = 0; i < NUM_RX_DATA_QUEUES; i++) {
 			rpn = key->u.ccmp.rx_pn[i];
 			p += scnprintf(p, sizeof(buf)+buf-p,
 				       "%02x%02x%02x%02x%02x%02x\n",
 				       rpn[0], rpn[1], rpn[2],
 				       rpn[3], rpn[4], rpn[5]);
 		}
 		len = p - buf;
 		break;
+	case ALG_AES_CMAC:
+		rpn = key->u.aes_cmac.rx_pn;
+		p += scnprintf(p, sizeof(buf)+buf-p,
+			       "%02x%02x%02x%02x%02x%02x\n",
+			       rpn[0], rpn[1], rpn[2],
+			       rpn[3], rpn[4], rpn[5]);
+		len = p - buf;
+		break;
 	default:
 		return 0;
 	}
 	return simple_read_from_buffer(userbuf, count, ppos, buf, len);
 }
 KEY_OPS(rx_spec);
 static ssize_t key_replays_read(struct file *file, char __user *userbuf,
 				size_t count, loff_t *ppos)
 {
 	struct ieee80211_key *key = file->private_data;
 	char buf[20];
 	int len;
-	if (key->conf.alg != ALG_CCMP)
+	switch (key->conf.alg) {
+	case ALG_CCMP:
+		len = scnprintf(buf, sizeof(buf), "%u\n", key->u.ccmp.replays);
+		break;
+	case ALG_AES_CMAC:
+		len = scnprintf(buf, sizeof(buf), "%u\n",
+				key->u.aes_cmac.replays);
+		break;
+	default:
 		return 0;
-	len = scnprintf(buf, sizeof(buf), "%u\n", key->u.ccmp.replays);
+	}
 	return simple_read_from_buffer(userbuf, count, ppos, buf, len);
 }
 KEY_OPS(replays);
+static ssize_t key_icverrors_read(struct file *file, char __user *userbuf,
+				  size_t count, loff_t *ppos)
+{
+	struct ieee80211_key *key = file->private_data;
+	char buf[20];
+	int len;
+	switch (key->conf.alg) {
+	case ALG_AES_CMAC:
+		len = scnprintf(buf, sizeof(buf), "%u\n",
+				key->u.aes_cmac.icverrors);
+		break;
+	default:
+		return 0;
+	}
+	return simple_read_from_buffer(userbuf, count, ppos, buf, len);
+}
+KEY_OPS(icverrors);
 static ssize_t key_key_read(struct file *file, char __user *userbuf,
 			    size_t count, loff_t *ppos)
 {
 	struct ieee80211_key *key = file->private_data;
 	int i, res, bufsize = 2 * key->conf.keylen + 2;
 	char *buf = kmalloc(bufsize, GFP_KERNEL);
 	char *p = buf;
 	for (i = 0; i < key->conf.keylen; i++)
 		p += scnprintf(p, bufsize + buf - p, "%02x", key->conf.key[i]);
 	p += scnprintf(p, bufsize+buf-p, "\n");
 	res = simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
 	kfree(buf);
 	return res;
 }
 KEY_OPS(key);
 #define DEBUGFS_ADD(name) \
 	key->debugfs.name = debugfs_create_file(#name, 0400,\
 				key->debugfs.dir, key, &key_##name##_ops);
 void ieee80211_debugfs_key_add(struct ieee80211_key *key)
   {
 	static int keycount;
 	char buf[50];
 	struct sta_info *sta;
 	if (!key->local->debugfs.keys)
 		return;
 	sprintf(buf, "%d", keycount);
 	key->debugfs.cnt = keycount;
 	keycount++;
 	key->debugfs.dir = debugfs_create_dir(buf,
 					key->local->debugfs.keys);
 	if (!key->debugfs.dir)
 		return;
 	rcu_read_lock();
 	sta = rcu_dereference(key->sta);
 	if (sta)
 		sprintf(buf, "../../stations/%pM", sta->sta.addr);
 	rcu_read_unlock();
 	/* using sta as a boolean is fine outside RCU lock */
 	if (sta)
 		key->debugfs.stalink =
 			debugfs_create_symlink("station", key->debugfs.dir, buf);
 	DEBUGFS_ADD(keylen);
 	DEBUGFS_ADD(flags);
 	DEBUGFS_ADD(keyidx);
 	DEBUGFS_ADD(hw_key_idx);
 	DEBUGFS_ADD(tx_rx_count);
 	DEBUGFS_ADD(algorithm);
 	DEBUGFS_ADD(tx_spec);
 	DEBUGFS_ADD(rx_spec);
 	DEBUGFS_ADD(replays);
+	DEBUGFS_ADD(icverrors);
 	DEBUGFS_ADD(key);
 	DEBUGFS_ADD(ifindex);
 };
 #define DEBUGFS_DEL(name) \
 	debugfs_remove(key->debugfs.name); key->debugfs.name = NULL;
 void ieee80211_debugfs_key_remove(struct ieee80211_key *key)
 {
 	if (!key)
 		return;
 	DEBUGFS_DEL(keylen);
 	DEBUGFS_DEL(flags);
 	DEBUGFS_DEL(keyidx);
 	DEBUGFS_DEL(hw_key_idx);
 	DEBUGFS_DEL(tx_rx_count);
 	DEBUGFS_DEL(algorithm);
 	DEBUGFS_DEL(tx_spec);
 	DEBUGFS_DEL(rx_spec);
 	DEBUGFS_DEL(replays);
+	DEBUGFS_DEL(icverrors);
 	DEBUGFS_DEL(key);
 	DEBUGFS_DEL(ifindex);
 	debugfs_remove(key->debugfs.stalink);
 	key->debugfs.stalink = NULL;
 	debugfs_remove(key->debugfs.dir);
 	key->debugfs.dir = NULL;
 }
 void ieee80211_debugfs_key_add_default(struct ieee80211_sub_if_data *sdata)
 {
 	char buf[50];
 	struct ieee80211_key *key;
 	if (!sdata->debugfsdir)
 		return;
 	/* this is running under the key lock */
 	key = sdata->default_key;
 	if (key) {
 		sprintf(buf, "../keys/%d", key->debugfs.cnt);
 		sdata->common_debugfs.default_key =
 			debugfs_create_symlink("default_key",
 					       sdata->debugfsdir, buf);
 	} else
 		ieee80211_debugfs_key_remove_default(sdata);
 }
 void ieee80211_debugfs_key_remove_default(struct ieee80211_sub_if_data *sdata)
 {
 	if (!sdata)
 		return;
 	debugfs_remove(sdata->common_debugfs.default_key);
 	sdata->common_debugfs.default_key = NULL;
+}
+void ieee80211_debugfs_key_add_mgmt_default(struct ieee80211_sub_if_data *sdata)
+{
+	char buf[50];
+	struct ieee80211_key *key;
+	if (!sdata->debugfsdir)
+		return;
+	/* this is running under the key lock */
+	key = sdata->default_mgmt_key;
+	if (key) {
+		sprintf(buf, "../keys/%d", key->debugfs.cnt);
+		sdata->common_debugfs.default_mgmt_key =
+			debugfs_create_symlink("default_mgmt_key",
+					       sdata->debugfsdir, buf);
+	} else
+		ieee80211_debugfs_key_remove_mgmt_default(sdata);
+}
+void ieee80211_debugfs_key_remove_mgmt_default(struct ieee80211_sub_if_data *sdata)
+{
+	if (!sdata)
+		return;
+	debugfs_remove(sdata->common_debugfs.default_mgmt_key);
+	sdata->common_debugfs.default_mgmt_key = NULL;
 }
 void ieee80211_debugfs_key_sta_del(struct ieee80211_key *key,
 				   struct sta_info *sta)
 {
 	debugfs_remove(key->debugfs.stalink);
 	key->debugfs.stalink = NULL;
 }

net/mac80211/debugfs_key.h

Diff comments View file @ 3cfcf6a

 #ifndef __MAC80211_DEBUGFS_KEY_H
 #define __MAC80211_DEBUGFS_KEY_H
 #ifdef CONFIG_MAC80211_DEBUGFS
 void ieee80211_debugfs_key_add(struct ieee80211_key *key);
 void ieee80211_debugfs_key_remove(struct ieee80211_key *key);
 void ieee80211_debugfs_key_add_default(struct ieee80211_sub_if_data *sdata);
 void ieee80211_debugfs_key_remove_default(struct ieee80211_sub_if_data *sdata);
+void ieee80211_debugfs_key_add_mgmt_default(
+	struct ieee80211_sub_if_data *sdata);
+void ieee80211_debugfs_key_remove_mgmt_default(
+	struct ieee80211_sub_if_data *sdata);
 void ieee80211_debugfs_key_sta_del(struct ieee80211_key *key,
 				   struct sta_info *sta);
 #else
 static inline void ieee80211_debugfs_key_add(struct ieee80211_key *key)
 {}
 static inline void ieee80211_debugfs_key_remove(struct ieee80211_key *key)
 {}
 static inline void ieee80211_debugfs_key_add_default(
 	struct ieee80211_sub_if_data *sdata)
 {}
 static inline void ieee80211_debugfs_key_remove_default(
+	struct ieee80211_sub_if_data *sdata)
+{}
+static inline void ieee80211_debugfs_key_add_mgmt_default(
+	struct ieee80211_sub_if_data *sdata)
+{}
+static inline void ieee80211_debugfs_key_remove_mgmt_default(
 	struct ieee80211_sub_if_data *sdata)
 {}
 static inline void ieee80211_debugfs_key_sta_del(struct ieee80211_key *key,
 						 struct sta_info *sta)
 {}
 #endif
 #endif /* __MAC80211_DEBUGFS_KEY_H */

net/mac80211/ieee80211_i.h

Diff comments View file @ 3cfcf6a

 /*
  * Copyright 2002-2005, Instant802 Networks, Inc.
  * Copyright 2005, Devicescape Software, Inc.
  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
  * Copyright 2007-2008	Johannes Berg <johannes@sipsolutions.net>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
 #ifndef IEEE80211_I_H
 #define IEEE80211_I_H
 #include <linux/kernel.h>
 #include <linux/device.h>
 #include <linux/if_ether.h>
 #include <linux/interrupt.h>
 #include <linux/list.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
 #include <linux/workqueue.h>
 #include <linux/types.h>
 #include <linux/spinlock.h>
 #include <linux/etherdevice.h>
 #include <net/cfg80211.h>
 #include <net/wireless.h>
 #include <net/iw_handler.h>
 #include <net/mac80211.h>
 #include "key.h"
 #include "sta_info.h"
 struct ieee80211_local;
 /* Maximum number of broadcast/multicast frames to buffer when some of the
  * associated stations are using power saving. */
 #define AP_MAX_BC_BUFFER 128
 /* Maximum number of frames buffered to all STAs, including multicast frames.
  * Note: increasing this limit increases the potential memory requirement. Each
  * frame can be up to about 2 kB long. */
 #define TOTAL_MAX_TX_BUFFER 512
 /* Required encryption head and tailroom */
 #define IEEE80211_ENCRYPT_HEADROOM 8
 #define IEEE80211_ENCRYPT_TAILROOM 18
 /* IEEE 802.11 (Ch. 9.5 Defragmentation) requires support for concurrent
  * reception of at least three fragmented frames. This limit can be increased
  * by changing this define, at the cost of slower frame reassembly and
  * increased memory use (about 2 kB of RAM per entry). */
 #define IEEE80211_FRAGMENT_MAX 4
 /*
  * Time after which we ignore scan results and no longer report/use
  * them in any way.
  */
 #define IEEE80211_SCAN_RESULT_EXPIRE (10 * HZ)
 struct ieee80211_fragment_entry {
 	unsigned long first_frag_time;
 	unsigned int seq;
 	unsigned int rx_queue;
 	unsigned int last_frag;
 	unsigned int extra_len;
 	struct sk_buff_head skb_list;
 	int ccmp; /* Whether fragments were encrypted with CCMP */
 	u8 last_pn[6]; /* PN of the last fragment if CCMP was used */
 };
 struct ieee80211_bss {
 	struct list_head list;
 	struct ieee80211_bss *hnext;
 	size_t ssid_len;
 	atomic_t users;
 	u8 bssid[ETH_ALEN];
 	u8 ssid[IEEE80211_MAX_SSID_LEN];
 	u8 dtim_period;
 	u16 capability; /* host byte order */
 	enum ieee80211_band band;
 	int freq;
 	int signal, noise, qual;
 	u8 *ies; /* all information elements from the last Beacon or Probe
 		  * Response frames; note Beacon frame is not allowed to
 		  * override values from Probe Response */
 	size_t ies_len;
 	bool wmm_used;
 #ifdef CONFIG_MAC80211_MESH
 	u8 *mesh_id;
 	size_t mesh_id_len;
 	u8 *mesh_cfg;
 #endif
 #define IEEE80211_MAX_SUPP_RATES 32
 	u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
 	size_t supp_rates_len;
 	u64 timestamp;
 	int beacon_int;
 	unsigned long last_probe_resp;
 	unsigned long last_update;
 	/* during assocation, we save an ERP value from a probe response so
 	 * that we can feed ERP info to the driver when handling the
 	 * association completes. these fields probably won't be up-to-date
 	 * otherwise, you probably don't want to use them. */
 	int has_erp_value;
 	u8 erp_value;
 };
 static inline u8 *bss_mesh_cfg(struct ieee80211_bss *bss)
 {
 #ifdef CONFIG_MAC80211_MESH
 	return bss->mesh_cfg;
 #endif
 	return NULL;
 }
 static inline u8 *bss_mesh_id(struct ieee80211_bss *bss)
 {
 #ifdef CONFIG_MAC80211_MESH
 	return bss->mesh_id;
 #endif
 	return NULL;
 }
 static inline u8 bss_mesh_id_len(struct ieee80211_bss *bss)
 {
 #ifdef CONFIG_MAC80211_MESH
 	return bss->mesh_id_len;
 #endif
 	return 0;
 }
 typedef unsigned __bitwise__ ieee80211_tx_result;
 #define TX_CONTINUE	((__force ieee80211_tx_result) 0u)
 #define TX_DROP		((__force ieee80211_tx_result) 1u)
 #define TX_QUEUED	((__force ieee80211_tx_result) 2u)
 #define IEEE80211_TX_FRAGMENTED		BIT(0)
 #define IEEE80211_TX_UNICAST		BIT(1)
 #define IEEE80211_TX_PS_BUFFERED	BIT(2)
 struct ieee80211_tx_data {
 	struct sk_buff *skb;
 	struct net_device *dev;
 	struct ieee80211_local *local;
 	struct ieee80211_sub_if_data *sdata;
 	struct sta_info *sta;
 	struct ieee80211_key *key;
 	struct ieee80211_channel *channel;
 	/* Extra fragments (in addition to the first fragment
 	 * in skb) */
 	struct sk_buff **extra_frag;
 	int num_extra_frag;
 	u16 ethertype;
 	unsigned int flags;
 };
 typedef unsigned __bitwise__ ieee80211_rx_result;
 #define RX_CONTINUE		((__force ieee80211_rx_result) 0u)
 #define RX_DROP_UNUSABLE	((__force ieee80211_rx_result) 1u)
 #define RX_DROP_MONITOR		((__force ieee80211_rx_result) 2u)
 #define RX_QUEUED		((__force ieee80211_rx_result) 3u)
 #define IEEE80211_RX_IN_SCAN		BIT(0)
 /* frame is destined to interface currently processed (incl. multicast frames) */
 #define IEEE80211_RX_RA_MATCH		BIT(1)
 #define IEEE80211_RX_AMSDU		BIT(2)
 #define IEEE80211_RX_CMNTR_REPORTED	BIT(3)
 #define IEEE80211_RX_FRAGMENTED		BIT(4)
 struct ieee80211_rx_data {
 	struct sk_buff *skb;
 	struct net_device *dev;
 	struct ieee80211_local *local;
 	struct ieee80211_sub_if_data *sdata;
 	struct sta_info *sta;
 	struct ieee80211_key *key;
 	struct ieee80211_rx_status *status;
 	struct ieee80211_rate *rate;
 	unsigned int flags;
 	int sent_ps_buffered;
 	int queue;
 	u32 tkip_iv32;
 	u16 tkip_iv16;
 };
 struct ieee80211_tx_stored_packet {
 	struct sk_buff *skb;
 	struct sk_buff **extra_frag;
 	int num_extra_frag;
 };
 struct beacon_data {
 	u8 *head, *tail;
 	int head_len, tail_len;
 	int dtim_period;
 };
 struct ieee80211_if_ap {
 	struct beacon_data *beacon;
 	struct list_head vlans;
 	/* yes, this looks ugly, but guarantees that we can later use
 	 * bitmap_empty :)
 	 * NB: don't touch this bitmap, use sta_info_{set,clear}_tim_bit */
 	u8 tim[sizeof(unsigned long) * BITS_TO_LONGS(IEEE80211_MAX_AID + 1)];
 	struct sk_buff_head ps_bc_buf;
 	atomic_t num_sta_ps; /* number of stations in PS mode */
 	int dtim_count;
 };
 struct ieee80211_if_wds {
 	struct sta_info *sta;
 	u8 remote_addr[ETH_ALEN];
 };
 struct ieee80211_if_vlan {
 	struct list_head list;
 };
 struct mesh_stats {
 	__u32 fwded_frames;		/* Mesh forwarded frames */
 	__u32 dropped_frames_ttl;	/* Not transmitted since mesh_ttl == 0*/
 	__u32 dropped_frames_no_route;	/* Not transmitted, no route found */
 	atomic_t estab_plinks;
 };
 #define PREQ_Q_F_START		0x1
 #define PREQ_Q_F_REFRESH	0x2
 struct mesh_preq_queue {
 	struct list_head list;
 	u8 dst[ETH_ALEN];
 	u8 flags;
 };
 /* flags used in struct ieee80211_if_sta.flags */
 #define IEEE80211_STA_SSID_SET		BIT(0)
 #define IEEE80211_STA_BSSID_SET		BIT(1)
 #define IEEE80211_STA_PREV_BSSID_SET	BIT(2)
 #define IEEE80211_STA_AUTHENTICATED	BIT(3)
 #define IEEE80211_STA_ASSOCIATED	BIT(4)
 #define IEEE80211_STA_PROBEREQ_POLL	BIT(5)
 #define IEEE80211_STA_CREATE_IBSS	BIT(6)
 #define IEEE80211_STA_MIXED_CELL	BIT(7)
 #define IEEE80211_STA_WMM_ENABLED	BIT(8)
 #define IEEE80211_STA_AUTO_SSID_SEL	BIT(10)
 #define IEEE80211_STA_AUTO_BSSID_SEL	BIT(11)
 #define IEEE80211_STA_AUTO_CHANNEL_SEL	BIT(12)
 #define IEEE80211_STA_PRIVACY_INVOKED	BIT(13)
 #define IEEE80211_STA_TKIP_WEP_USED	BIT(14)
 #define IEEE80211_STA_CSA_RECEIVED	BIT(15)
 #define IEEE80211_STA_MFP_ENABLED	BIT(16)
 /* flags for MLME request */
 #define IEEE80211_STA_REQ_SCAN 0
 #define IEEE80211_STA_REQ_DIRECT_PROBE 1
 #define IEEE80211_STA_REQ_AUTH 2
 #define IEEE80211_STA_REQ_RUN  3
 /* STA/IBSS MLME states */
 enum ieee80211_sta_mlme_state {
 	IEEE80211_STA_MLME_DISABLED,
 	IEEE80211_STA_MLME_DIRECT_PROBE,
 	IEEE80211_STA_MLME_AUTHENTICATE,
 	IEEE80211_STA_MLME_ASSOCIATE,
 	IEEE80211_STA_MLME_ASSOCIATED,
 	IEEE80211_STA_MLME_IBSS_SEARCH,
 	IEEE80211_STA_MLME_IBSS_JOINED,
 };
 /* bitfield of allowed auth algs */
 #define IEEE80211_AUTH_ALG_OPEN BIT(0)
 #define IEEE80211_AUTH_ALG_SHARED_KEY BIT(1)
 #define IEEE80211_AUTH_ALG_LEAP BIT(2)
 struct ieee80211_if_sta {
 	struct timer_list timer;
 	struct timer_list chswitch_timer;
 	struct work_struct work;
 	struct work_struct chswitch_work;
 	u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN];
 	u8 ssid[IEEE80211_MAX_SSID_LEN];
 	enum ieee80211_sta_mlme_state state;
 	size_t ssid_len;
 	u8 scan_ssid[IEEE80211_MAX_SSID_LEN];
 	size_t scan_ssid_len;
 	u16 aid;
 	u16 ap_capab, capab;
 	u8 *extra_ie; /* to be added to the end of AssocReq */
 	size_t extra_ie_len;
 	/* The last AssocReq/Resp IEs */
 	u8 *assocreq_ies, *assocresp_ies;
 	size_t assocreq_ies_len, assocresp_ies_len;
 	struct sk_buff_head skb_queue;
 	int assoc_scan_tries; /* number of scans done pre-association */
 	int direct_probe_tries; /* retries for direct probes */
 	int auth_tries; /* retries for auth req */
 	int assoc_tries; /* retries for assoc req */
 	unsigned long request;
 	unsigned long last_probe;
 	unsigned int flags;
 	unsigned int auth_algs; /* bitfield of allowed auth algs */
 	int auth_alg; /* currently used IEEE 802.11 authentication algorithm */
 	int auth_transaction;
 	unsigned long ibss_join_req;
 	struct sk_buff *probe_resp; /* ProbeResp template for IBSS */
 	u32 supp_rates_bits[IEEE80211_NUM_BANDS];
 	int wmm_last_param_set;
 };
 struct ieee80211_if_mesh {
 	struct work_struct work;
 	struct timer_list housekeeping_timer;
 	struct timer_list mesh_path_timer;
 	struct sk_buff_head skb_queue;
 	bool housekeeping;
 	u8 mesh_id[IEEE80211_MAX_MESH_ID_LEN];
 	size_t mesh_id_len;
 	/* Active Path Selection Protocol Identifier */
 	u8 mesh_pp_id[4];
 	/* Active Path Selection Metric Identifier */
 	u8 mesh_pm_id[4];
 	/* Congestion Control Mode Identifier */
 	u8 mesh_cc_id[4];
 	/* Local mesh Destination Sequence Number */
 	u32 dsn;
 	/* Last used PREQ ID */
 	u32 preq_id;
 	atomic_t mpaths;
 	/* Timestamp of last DSN update */
 	unsigned long last_dsn_update;
 	/* Timestamp of last DSN sent */
 	unsigned long last_preq;
 	struct mesh_rmc *rmc;
 	spinlock_t mesh_preq_queue_lock;
 	struct mesh_preq_queue preq_queue;
 	int preq_queue_len;
 	struct mesh_stats mshstats;
 	struct mesh_config mshcfg;
 	u32 mesh_seqnum;
 	bool accepting_plinks;
 };
 #ifdef CONFIG_MAC80211_MESH
 #define IEEE80211_IFSTA_MESH_CTR_INC(msh, name)	\
 	do { (msh)->mshstats.name++; } while (0)
 #else
 #define IEEE80211_IFSTA_MESH_CTR_INC(msh, name) \
 	do { } while (0)
 #endif
 /**
  * enum ieee80211_sub_if_data_flags - virtual interface flags
  *
  * @IEEE80211_SDATA_ALLMULTI: interface wants all multicast packets
  * @IEEE80211_SDATA_PROMISC: interface is promisc
  * @IEEE80211_SDATA_USERSPACE_MLME: userspace MLME is active
  * @IEEE80211_SDATA_OPERATING_GMODE: operating in G-only mode
  * @IEEE80211_SDATA_DONT_BRIDGE_PACKETS: bridge packets between
  *	associated stations and deliver multicast frames both
  *	back to wireless media and to the local net stack.
  */
 enum ieee80211_sub_if_data_flags {
 	IEEE80211_SDATA_ALLMULTI		= BIT(0),
 	IEEE80211_SDATA_PROMISC			= BIT(1),
 	IEEE80211_SDATA_USERSPACE_MLME		= BIT(2),
 	IEEE80211_SDATA_OPERATING_GMODE		= BIT(3),
 	IEEE80211_SDATA_DONT_BRIDGE_PACKETS	= BIT(4),
 };
 struct ieee80211_sub_if_data {
 	struct list_head list;
 	struct wireless_dev wdev;
 	/* keys */
 	struct list_head key_list;
 	struct net_device *dev;
 	struct ieee80211_local *local;
 	unsigned int flags;
 	int drop_unencrypted;
 	/* Fragment table for host-based reassembly */
 	struct ieee80211_fragment_entry	fragments[IEEE80211_FRAGMENT_MAX];
 	unsigned int fragment_next;
 #define NUM_DEFAULT_KEYS 4
-	struct ieee80211_key *keys[NUM_DEFAULT_KEYS];
+#define NUM_DEFAULT_MGMT_KEYS 2
+	struct ieee80211_key *keys[NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS];
 	struct ieee80211_key *default_key;
+	struct ieee80211_key *default_mgmt_key;
 	u16 sequence_number;
 	/*
 	 * AP this belongs to: self in AP mode and
 	 * corresponding AP in VLAN mode, NULL for
 	 * all others (might be needed later in IBSS)
 	 */
 	struct ieee80211_if_ap *bss;
 	int force_unicast_rateidx; /* forced TX rateidx for unicast frames */
 	int max_ratectrl_rateidx; /* max TX rateidx for rate control */
 	union {
 		struct ieee80211_if_ap ap;
 		struct ieee80211_if_wds wds;
 		struct ieee80211_if_vlan vlan;
 		struct ieee80211_if_sta sta;
 #ifdef CONFIG_MAC80211_MESH
 		struct ieee80211_if_mesh mesh;
 #endif
 		u32 mntr_flags;
 	} u;
 #ifdef CONFIG_MAC80211_DEBUGFS
 	struct dentry *debugfsdir;
 	union {
 		struct {
 			struct dentry *drop_unencrypted;
 			struct dentry *state;
 			struct dentry *bssid;
 			struct dentry *prev_bssid;
 			struct dentry *ssid_len;
 			struct dentry *aid;
 			struct dentry *ap_capab;
 			struct dentry *capab;
 			struct dentry *extra_ie_len;
 			struct dentry *auth_tries;
 			struct dentry *assoc_tries;
 			struct dentry *auth_algs;
 			struct dentry *auth_alg;
 			struct dentry *auth_transaction;
 			struct dentry *flags;
 			struct dentry *force_unicast_rateidx;
 			struct dentry *max_ratectrl_rateidx;
 		} sta;
 		struct {
 			struct dentry *drop_unencrypted;
 			struct dentry *num_sta_ps;
 			struct dentry *dtim_count;
 			struct dentry *force_unicast_rateidx;
 			struct dentry *max_ratectrl_rateidx;
 			struct dentry *num_buffered_multicast;
 		} ap;
 		struct {
 			struct dentry *drop_unencrypted;
 			struct dentry *peer;
 			struct dentry *force_unicast_rateidx;
 			struct dentry *max_ratectrl_rateidx;
 		} wds;
 		struct {
 			struct dentry *drop_unencrypted;
 			struct dentry *force_unicast_rateidx;
 			struct dentry *max_ratectrl_rateidx;
 		} vlan;
 		struct {
 			struct dentry *mode;
 		} monitor;
 	} debugfs;
 	struct {
 		struct dentry *default_key;
+		struct dentry *default_mgmt_key;
 	} common_debugfs;
 #ifdef CONFIG_MAC80211_MESH
 	struct dentry *mesh_stats_dir;
 	struct {
 		struct dentry *fwded_frames;
 		struct dentry *dropped_frames_ttl;
 		struct dentry *dropped_frames_no_route;
 		struct dentry *estab_plinks;
 		struct timer_list mesh_path_timer;
 	} mesh_stats;
 	struct dentry *mesh_config_dir;
 	struct {
 		struct dentry *dot11MeshRetryTimeout;
 		struct dentry *dot11MeshConfirmTimeout;
 		struct dentry *dot11MeshHoldingTimeout;
 		struct dentry *dot11MeshMaxRetries;
 		struct dentry *dot11MeshTTL;
 		struct dentry *auto_open_plinks;
 		struct dentry *dot11MeshMaxPeerLinks;
 		struct dentry *dot11MeshHWMPactivePathTimeout;
 		struct dentry *dot11MeshHWMPpreqMinInterval;
 		struct dentry *dot11MeshHWMPnetDiameterTraversalTime;
 		struct dentry *dot11MeshHWMPmaxPREQretries;
 		struct dentry *path_refresh_time;
 		struct dentry *min_discovery_timeout;
 	} mesh_config;
 #endif
 #endif
 	/* must be last, dynamically sized area in this! */
 	struct ieee80211_vif vif;
 };
 static inline
 struct ieee80211_sub_if_data *vif_to_sdata(struct ieee80211_vif *p)
 {
 	return container_of(p, struct ieee80211_sub_if_data, vif);
 }
 static inline void
 ieee80211_sdata_set_mesh_id(struct ieee80211_sub_if_data *sdata,
 			    u8 mesh_id_len, u8 *mesh_id)
 {
 #ifdef CONFIG_MAC80211_MESH
 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
 	ifmsh->mesh_id_len = mesh_id_len;
 	memcpy(ifmsh->mesh_id, mesh_id, mesh_id_len);
 #else
 	WARN_ON(1);
 #endif
 }
 enum {
 	IEEE80211_RX_MSG	= 1,
 	IEEE80211_TX_STATUS_MSG	= 2,
 	IEEE80211_DELBA_MSG	= 3,
 	IEEE80211_ADDBA_MSG	= 4,
 };
 enum queue_stop_reason {
 	IEEE80211_QUEUE_STOP_REASON_DRIVER,
 	IEEE80211_QUEUE_STOP_REASON_PS,
 	IEEE80211_QUEUE_STOP_REASON_CSA
 };
 /* maximum number of hardware queues we support. */
 #define QD_MAX_QUEUES (IEEE80211_MAX_AMPDU_QUEUES + IEEE80211_MAX_QUEUES)
 struct ieee80211_master_priv {
 	struct ieee80211_local *local;
 };
 struct ieee80211_local {
 	/* embed the driver visible part.
 	 * don't cast (use the static inlines below), but we keep
 	 * it first anyway so they become a no-op */
 	struct ieee80211_hw hw;
 	const struct ieee80211_ops *ops;
 	unsigned long queue_pool[BITS_TO_LONGS(QD_MAX_QUEUES)];
 	unsigned long queue_stop_reasons[IEEE80211_MAX_QUEUES];
 	spinlock_t queue_stop_reason_lock;
 	struct net_device *mdev; /* wmaster# - "master" 802.11 device */
 	int open_count;
 	int monitors, cooked_mntrs;
 	/* number of interfaces with corresponding FIF_ flags */
 	int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss;
 	unsigned int filter_flags; /* FIF_* */
 	struct iw_statistics wstats;
 	u8 wstats_flags;
 	bool tim_in_locked_section; /* see ieee80211_beacon_get() */
 	int tx_headroom; /* required headroom for hardware/radiotap */
 	/* Tasklet and skb queue to process calls from IRQ mode. All frames
 	 * added to skb_queue will be processed, but frames in
 	 * skb_queue_unreliable may be dropped if the total length of these
 	 * queues increases over the limit. */
 #define IEEE80211_IRQSAFE_QUEUE_LIMIT 128
 	struct tasklet_struct tasklet;
 	struct sk_buff_head skb_queue;
 	struct sk_buff_head skb_queue_unreliable;
 	/* Station data */
 	/*
 	 * The lock only protects the list, hash, timer and counter
 	 * against manipulation, reads are done in RCU. Additionally,
 	 * the lock protects each BSS's TIM bitmap.
 	 */
 	spinlock_t sta_lock;
 	unsigned long num_sta;
 	struct list_head sta_list;
 	struct list_head sta_flush_list;
 	struct work_struct sta_flush_work;
 	struct sta_info *sta_hash[STA_HASH_SIZE];
 	struct timer_list sta_cleanup;
 	unsigned long queues_pending[BITS_TO_LONGS(IEEE80211_MAX_QUEUES)];
 	unsigned long queues_pending_run[BITS_TO_LONGS(IEEE80211_MAX_QUEUES)];
 	struct ieee80211_tx_stored_packet pending_packet[IEEE80211_MAX_QUEUES];
 	struct tasklet_struct tx_pending_tasklet;
 	/* number of interfaces with corresponding IFF_ flags */
 	atomic_t iff_allmultis, iff_promiscs;
 	struct rate_control_ref *rate_ctrl;
 	int rts_threshold;
 	int fragmentation_threshold;
 	struct crypto_blkcipher *wep_tx_tfm;
 	struct crypto_blkcipher *wep_rx_tfm;
 	u32 wep_iv;
 	struct list_head interfaces;
 	/*
 	 * Key lock, protects sdata's key_list and sta_info's
 	 * key pointers (write access, they're RCU.)
 	 */
 	spinlock_t key_lock;
 	/* Scanning and BSS list */
 	bool sw_scanning, hw_scanning;
 	int scan_channel_idx;
 	enum ieee80211_band scan_band;
 	enum { SCAN_SET_CHANNEL, SCAN_SEND_PROBE } scan_state;
 	unsigned long last_scan_completed;
 	struct delayed_work scan_work;
 	struct ieee80211_sub_if_data *scan_sdata;
 	struct ieee80211_channel *oper_channel, *scan_channel, *csa_channel;
 	enum nl80211_channel_type oper_channel_type;
 	u8 scan_ssid[IEEE80211_MAX_SSID_LEN];
 	size_t scan_ssid_len;
 	struct list_head bss_list;
 	struct ieee80211_bss *bss_hash[STA_HASH_SIZE];
 	spinlock_t bss_lock;
 	/* SNMP counters */
 	/* dot11CountersTable */
 	u32 dot11TransmittedFragmentCount;
 	u32 dot11MulticastTransmittedFrameCount;
 	u32 dot11FailedCount;
 	u32 dot11RetryCount;
 	u32 dot11MultipleRetryCount;
 	u32 dot11FrameDuplicateCount;
 	u32 dot11ReceivedFragmentCount;
 	u32 dot11MulticastReceivedFrameCount;
 	u32 dot11TransmittedFrameCount;
 #ifdef CONFIG_MAC80211_LEDS
 	int tx_led_counter, rx_led_counter;
 	struct led_trigger *tx_led, *rx_led, *assoc_led, *radio_led;
 	char tx_led_name[32], rx_led_name[32],
 	     assoc_led_name[32], radio_led_name[32];
 #endif
 #ifdef CONFIG_MAC80211_DEBUGFS
 	struct work_struct sta_debugfs_add;
 #endif
 #ifdef CONFIG_MAC80211_DEBUG_COUNTERS
 	/* TX/RX handler statistics */
 	unsigned int tx_handlers_drop;
 	unsigned int tx_handlers_queued;
 	unsigned int tx_handlers_drop_unencrypted;
 	unsigned int tx_handlers_drop_fragment;
 	unsigned int tx_handlers_drop_wep;
 	unsigned int tx_handlers_drop_not_assoc;
 	unsigned int tx_handlers_drop_unauth_port;
 	unsigned int rx_handlers_drop;
 	unsigned int rx_handlers_queued;
 	unsigned int rx_handlers_drop_nullfunc;
 	unsigned int rx_handlers_drop_defrag;
 	unsigned int rx_handlers_drop_short;
 	unsigned int rx_handlers_drop_passive_scan;
 	unsigned int tx_expand_skb_head;
 	unsigned int tx_expand_skb_head_cloned;
 	unsigned int rx_expand_skb_head;
 	unsigned int rx_expand_skb_head2;
 	unsigned int rx_handlers_fragments;
 	unsigned int tx_status_drop;
 #define I802_DEBUG_INC(c) (c)++
 #else /* CONFIG_MAC80211_DEBUG_COUNTERS */
 #define I802_DEBUG_INC(c) do { } while (0)
 #endif /* CONFIG_MAC80211_DEBUG_COUNTERS */
 	int total_ps_buffered; /* total number of all buffered unicast and
 				* multicast packets for power saving stations
 				*/
 	int wifi_wme_noack_test;
 	unsigned int wmm_acm; /* bit field of ACM bits (BIT(802.1D tag)) */
 	bool powersave;
 	struct work_struct dynamic_ps_enable_work;
 	struct work_struct dynamic_ps_disable_work;
 	struct timer_list dynamic_ps_timer;
 	int user_power_level; /* in dBm */
 #ifdef CONFIG_MAC80211_DEBUGFS
 	struct local_debugfsdentries {
 		struct dentry *rcdir;
 		struct dentry *rcname;
 		struct dentry *frequency;
 		struct dentry *rts_threshold;
 		struct dentry *fragmentation_threshold;
 		struct dentry *short_retry_limit;
 		struct dentry *long_retry_limit;
 		struct dentry *total_ps_buffered;
 		struct dentry *wep_iv;
 		struct dentry *statistics;
 		struct local_debugfsdentries_statsdentries {
 			struct dentry *transmitted_fragment_count;
 			struct dentry *multicast_transmitted_frame_count;
 			struct dentry *failed_count;
 			struct dentry *retry_count;
 			struct dentry *multiple_retry_count;
 			struct dentry *frame_duplicate_count;
 			struct dentry *received_fragment_count;
 			struct dentry *multicast_received_frame_count;
 			struct dentry *transmitted_frame_count;
 			struct dentry *wep_undecryptable_count;
 			struct dentry *num_scans;
 #ifdef CONFIG_MAC80211_DEBUG_COUNTERS
 			struct dentry *tx_handlers_drop;
 			struct dentry *tx_handlers_queued;
 			struct dentry *tx_handlers_drop_unencrypted;
 			struct dentry *tx_handlers_drop_fragment;
 			struct dentry *tx_handlers_drop_wep;
 			struct dentry *tx_handlers_drop_not_assoc;
 			struct dentry *tx_handlers_drop_unauth_port;
 			struct dentry *rx_handlers_drop;
 			struct dentry *rx_handlers_queued;
 			struct dentry *rx_handlers_drop_nullfunc;
 			struct dentry *rx_handlers_drop_defrag;
 			struct dentry *rx_handlers_drop_short;
 			struct dentry *rx_handlers_drop_passive_scan;
 			struct dentry *tx_expand_skb_head;
 			struct dentry *tx_expand_skb_head_cloned;
 			struct dentry *rx_expand_skb_head;
 			struct dentry *rx_expand_skb_head2;
 			struct dentry *rx_handlers_fragments;
 			struct dentry *tx_status_drop;
 #endif
 			struct dentry *dot11ACKFailureCount;
 			struct dentry *dot11RTSFailureCount;
 			struct dentry *dot11FCSErrorCount;
 			struct dentry *dot11RTSSuccessCount;
 		} stats;
 		struct dentry *stations;
 		struct dentry *keys;
 	} debugfs;
 #endif
 };
 static inline struct ieee80211_sub_if_data *
 IEEE80211_DEV_TO_SUB_IF(struct net_device *dev)
 {
 	struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 	BUG_ON(!local || local->mdev == dev);
 	return netdev_priv(dev);
 }
 /* this struct represents 802.11n's RA/TID combination */
 struct ieee80211_ra_tid {
 	u8 ra[ETH_ALEN];
 	u16 tid;
 };
 /* Parsed Information Elements */
 struct ieee802_11_elems {
 	u8 *ie_start;
 	size_t total_len;
 	/* pointers to IEs */
 	u8 *ssid;
 	u8 *supp_rates;
 	u8 *fh_params;
 	u8 *ds_params;
 	u8 *cf_params;
 	u8 *tim;
 	u8 *ibss_params;
 	u8 *challenge;
 	u8 *wpa;
 	u8 *rsn;
 	u8 *erp_info;
 	u8 *ext_supp_rates;
 	u8 *wmm_info;
 	u8 *wmm_param;
 	struct ieee80211_ht_cap *ht_cap_elem;
 	struct ieee80211_ht_info *ht_info_elem;
 	u8 *mesh_config;
 	u8 *mesh_id;
 	u8 *peer_link;
 	u8 *preq;
 	u8 *prep;
 	u8 *perr;
 	u8 *ch_switch_elem;
 	u8 *country_elem;
 	u8 *pwr_constr_elem;
 	u8 *quiet_elem; 	/* first quite element */
 	/* length of them, respectively */
 	u8 ssid_len;
 	u8 supp_rates_len;
 	u8 fh_params_len;
 	u8 ds_params_len;
 	u8 cf_params_len;
 	u8 tim_len;
 	u8 ibss_params_len;
 	u8 challenge_len;
 	u8 wpa_len;
 	u8 rsn_len;
 	u8 erp_info_len;
 	u8 ext_supp_rates_len;
 	u8 wmm_info_len;
 	u8 wmm_param_len;
 	u8 mesh_config_len;
 	u8 mesh_id_len;
 	u8 peer_link_len;
 	u8 preq_len;
 	u8 prep_len;
 	u8 perr_len;
 	u8 ch_switch_elem_len;
 	u8 country_elem_len;
 	u8 pwr_constr_elem_len;
 	u8 quiet_elem_len;
 	u8 num_of_quiet_elem;	/* can be more the one */
 };
 static inline struct ieee80211_local *hw_to_local(
 	struct ieee80211_hw *hw)
 {
 	return container_of(hw, struct ieee80211_local, hw);
 }
 static inline struct ieee80211_hw *local_to_hw(
 	struct ieee80211_local *local)
 {
 	return &local->hw;
 }
 static inline int ieee80211_bssid_match(const u8 *raddr, const u8 *addr)
 {
 	return compare_ether_addr(raddr, addr) == 0 ||
 	       is_broadcast_ether_addr(raddr);
 }
 int ieee80211_hw_config(struct ieee80211_local *local, u32 changed);
 int ieee80211_if_config(struct ieee80211_sub_if_data *sdata, u32 changed);
 void ieee80211_tx_set_protected(struct ieee80211_tx_data *tx);
 void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
 				      u32 changed);
 void ieee80211_configure_filter(struct ieee80211_local *local);
 /* wireless extensions */
 extern const struct iw_handler_def ieee80211_iw_handler_def;
 /* STA/IBSS code */
 void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata);
 void ieee80211_scan_work(struct work_struct *work);
 void ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
 			   struct ieee80211_rx_status *rx_status);
 int ieee80211_sta_set_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t len);
 int ieee80211_sta_get_ssid(struct ieee80211_sub_if_data *sdata, char *ssid, size_t *len);
 int ieee80211_sta_set_bssid(struct ieee80211_sub_if_data *sdata, u8 *bssid);
 void ieee80211_sta_req_auth(struct ieee80211_sub_if_data *sdata,
 			    struct ieee80211_if_sta *ifsta);
 struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
 					u8 *bssid, u8 *addr, u64 supp_rates);
 int ieee80211_sta_deauthenticate(struct ieee80211_sub_if_data *sdata, u16 reason);
 int ieee80211_sta_disassociate(struct ieee80211_sub_if_data *sdata, u16 reason);
 u32 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata);
 u64 ieee80211_sta_get_rates(struct ieee80211_local *local,
 			    struct ieee802_11_elems *elems,
 			    enum ieee80211_band band);
 void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
 			      u8 *ssid, size_t ssid_len);
 /* scan/BSS handling */
 int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
 			   u8 *ssid, size_t ssid_len);
 int ieee80211_scan_results(struct ieee80211_local *local,
 			   struct iw_request_info *info,
 			   char *buf, size_t len);
 ieee80211_rx_result
 ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata,
 		  struct sk_buff *skb,
 		  struct ieee80211_rx_status *rx_status);
 void ieee80211_rx_bss_list_init(struct ieee80211_local *local);
 void ieee80211_rx_bss_list_deinit(struct ieee80211_local *local);
 int ieee80211_sta_set_extra_ie(struct ieee80211_sub_if_data *sdata,
 			       char *ie, size_t len);
 void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local);
 int ieee80211_start_scan(struct ieee80211_sub_if_data *scan_sdata,
 			 u8 *ssid, size_t ssid_len);
 struct ieee80211_bss *
 ieee80211_bss_info_update(struct ieee80211_local *local,
 			  struct ieee80211_rx_status *rx_status,
 			  struct ieee80211_mgmt *mgmt,
 			  size_t len,
 			  struct ieee802_11_elems *elems,
 			  int freq, bool beacon);
 struct ieee80211_bss *
 ieee80211_rx_bss_add(struct ieee80211_local *local, u8 *bssid, int freq,
 		     u8 *ssid, u8 ssid_len);
 struct ieee80211_bss *
 ieee80211_rx_bss_get(struct ieee80211_local *local, u8 *bssid, int freq,
 		     u8 *ssid, u8 ssid_len);
 void ieee80211_rx_bss_put(struct ieee80211_local *local,
 			  struct ieee80211_bss *bss);
 /* interface handling */
 int ieee80211_if_add(struct ieee80211_local *local, const char *name,
 		     struct net_device **new_dev, enum nl80211_iftype type,
 		     struct vif_params *params);
 int ieee80211_if_change_type(struct ieee80211_sub_if_data *sdata,
 			     enum nl80211_iftype type);
 void ieee80211_if_remove(struct ieee80211_sub_if_data *sdata);
 void ieee80211_remove_interfaces(struct ieee80211_local *local);
 /* tx handling */
 void ieee80211_clear_tx_pending(struct ieee80211_local *local);
 void ieee80211_tx_pending(unsigned long data);
 int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev);
 int ieee80211_monitor_start_xmit(struct sk_buff *skb, struct net_device *dev);
 int ieee80211_subif_start_xmit(struct sk_buff *skb, struct net_device *dev);
 /* HT */
 void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_supported_band *sband,
 				       struct ieee80211_ht_cap *ht_cap_ie,
 				       struct ieee80211_sta_ht_cap *ht_cap);
 u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
 			struct ieee80211_ht_info *hti,
 			u16 ap_ht_cap_flags);
 void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u16 ssn);
 void ieee80211_sta_stop_rx_ba_session(struct ieee80211_sub_if_data *sdata, u8 *da,
 				u16 tid, u16 initiator, u16 reason);
 void ieee80211_sta_tear_down_BA_sessions(struct ieee80211_sub_if_data *sdata, u8 *addr);
 void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
 			     struct sta_info *sta,
 			     struct ieee80211_mgmt *mgmt, size_t len);
 void ieee80211_process_addba_resp(struct ieee80211_local *local,
 				  struct sta_info *sta,
 				  struct ieee80211_mgmt *mgmt,
 				  size_t len);
 void ieee80211_process_addba_request(struct ieee80211_local *local,
 				     struct sta_info *sta,
 				     struct ieee80211_mgmt *mgmt,
 				     size_t len);
 /* Spectrum management */
 void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
 				       struct ieee80211_mgmt *mgmt,
 				       size_t len);
 void ieee80211_chswitch_timer(unsigned long data);
 void ieee80211_chswitch_work(struct work_struct *work);
 void ieee80211_process_chanswitch(struct ieee80211_sub_if_data *sdata,
 				  struct ieee80211_channel_sw_ie *sw_elem,
 				  struct ieee80211_bss *bss);
 /* utility functions/constants */
 extern void *mac80211_wiphy_privid; /* for wiphy privid */
 extern const unsigned char rfc1042_header[6];
 extern const unsigned char bridge_tunnel_header[6];
 u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
 			enum nl80211_iftype type);
 int ieee80211_frame_duration(struct ieee80211_local *local, size_t len,
 			     int rate, int erp, int short_preamble);
 void mac80211_ev_michael_mic_failure(struct ieee80211_sub_if_data *sdata, int keyidx,
 				     struct ieee80211_hdr *hdr);
 void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata);
 void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
 		      int encrypt);
 void ieee802_11_parse_elems(u8 *start, size_t len,
 			    struct ieee802_11_elems *elems);
 int ieee80211_set_freq(struct ieee80211_sub_if_data *sdata, int freq);
 u64 ieee80211_mandatory_rates(struct ieee80211_local *local,
 			      enum ieee80211_band band);
 void ieee80211_dynamic_ps_enable_work(struct work_struct *work);
 void ieee80211_dynamic_ps_disable_work(struct work_struct *work);
 void ieee80211_dynamic_ps_timer(unsigned long data);
 void ieee80211_send_nullfunc(struct ieee80211_local *local,
 			     struct ieee80211_sub_if_data *sdata,
 			     int powersave);
 void ieee80211_wake_queues_by_reason(struct ieee80211_hw *hw,
 				     enum queue_stop_reason reason);
 void ieee80211_stop_queues_by_reason(struct ieee80211_hw *hw,
 				     enum queue_stop_reason reason);
 #ifdef CONFIG_MAC80211_NOINLINE
 #define debug_noinline noinline
 #else
 #define debug_noinline
 #endif
 #endif /* IEEE80211_I_H */

net/mac80211/key.c

Diff comments View file @ 3cfcf6a

 /*
  * Copyright 2002-2005, Instant802 Networks, Inc.
  * Copyright 2005-2006, Devicescape Software, Inc.
  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
  * Copyright 2007-2008	Johannes Berg <johannes@sipsolutions.net>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
 #include <linux/if_ether.h>
 #include <linux/etherdevice.h>
 #include <linux/list.h>
 #include <linux/rcupdate.h>
 #include <linux/rtnetlink.h>
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
 #include "debugfs_key.h"
 #include "aes_ccm.h"
+#include "aes_cmac.h"
 /**
  * DOC: Key handling basics
  *
  * Key handling in mac80211 is done based on per-interface (sub_if_data)
  * keys and per-station keys. Since each station belongs to an interface,
  * each station key also belongs to that interface.
  *
  * Hardware acceleration is done on a best-effort basis, for each key
  * that is eligible the hardware is asked to enable that key but if
  * it cannot do that they key is simply kept for software encryption.
  * There is currently no way of knowing this except by looking into
  * debugfs.
  *
  * All key operations are protected internally so you can call them at
  * any time.
  *
  * Within mac80211, key references are, just as STA structure references,
  * protected by RCU. Note, however, that some things are unprotected,
  * namely the key->sta dereferences within the hardware acceleration
  * functions. This means that sta_info_destroy() must flush the key todo
  * list.
  *
  * All the direct key list manipulation functions must not sleep because
  * they can operate on STA info structs that are protected by RCU.
  */
 static const u8 bcast_addr[ETH_ALEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
 /* key mutex: used to synchronise todo runners */
 static DEFINE_MUTEX(key_mutex);
 static DEFINE_SPINLOCK(todo_lock);
 static LIST_HEAD(todo_list);
 static void key_todo(struct work_struct *work)
 {
 	ieee80211_key_todo();
 }
 static DECLARE_WORK(todo_work, key_todo);
 /**
  * add_todo - add todo item for a key
  *
  * @key: key to add to do item for
  * @flag: todo flag(s)
  */
 static void add_todo(struct ieee80211_key *key, u32 flag)
 {
 	if (!key)
 		return;
 	spin_lock(&todo_lock);
 	key->flags |= flag;
 	/*
 	 * Remove again if already on the list so that we move it to the end.
 	 */
 	if (!list_empty(&key->todo))
 		list_del(&key->todo);
 	list_add_tail(&key->todo, &todo_list);
 	schedule_work(&todo_work);
 	spin_unlock(&todo_lock);
 }
 /**
  * ieee80211_key_lock - lock the mac80211 key operation lock
  *
  * This locks the (global) mac80211 key operation lock, all
  * key operations must be done under this lock.
  */
 static void ieee80211_key_lock(void)
 {
 	mutex_lock(&key_mutex);
 }
 /**
  * ieee80211_key_unlock - unlock the mac80211 key operation lock
  */
 static void ieee80211_key_unlock(void)
 {
 	mutex_unlock(&key_mutex);
 }
 static void assert_key_lock(void)
 {
 	WARN_ON(!mutex_is_locked(&key_mutex));
 }
 static struct ieee80211_sta *get_sta_for_key(struct ieee80211_key *key)
 {
 	if (key->sta)
 		return &key->sta->sta;
 	return NULL;
 }
 static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
 {
 	struct ieee80211_sub_if_data *sdata;
 	struct ieee80211_sta *sta;
 	int ret;
 	assert_key_lock();
 	might_sleep();
 	if (!key->local->ops->set_key)
 		return;
 	sta = get_sta_for_key(key);
 	sdata = key->sdata;
 	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
 		sdata = container_of(sdata->bss,
 				     struct ieee80211_sub_if_data,
 				     u.ap);
 	ret = key->local->ops->set_key(local_to_hw(key->local), SET_KEY,
 				       &sdata->vif, sta, &key->conf);
 	if (!ret) {
 		spin_lock(&todo_lock);
 		key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
 		spin_unlock(&todo_lock);
 	}
 	if (ret && ret != -ENOSPC && ret != -EOPNOTSUPP)
 		printk(KERN_ERR "mac80211-%s: failed to set key "
 		       "(%d, %pM) to hardware (%d)\n",
 		       wiphy_name(key->local->hw.wiphy),
 		       key->conf.keyidx, sta ? sta->addr : bcast_addr, ret);
 }
 static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
 {
 	struct ieee80211_sub_if_data *sdata;
 	struct ieee80211_sta *sta;
 	int ret;
 	assert_key_lock();
 	might_sleep();
 	if (!key || !key->local->ops->set_key)
 		return;
 	spin_lock(&todo_lock);
 	if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)) {
 		spin_unlock(&todo_lock);
 		return;
 	}
 	spin_unlock(&todo_lock);
 	sta = get_sta_for_key(key);
 	sdata = key->sdata;
 	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
 		sdata = container_of(sdata->bss,
 				     struct ieee80211_sub_if_data,
 				     u.ap);
 	ret = key->local->ops->set_key(local_to_hw(key->local), DISABLE_KEY,
 				       &sdata->vif, sta, &key->conf);
 	if (ret)
 		printk(KERN_ERR "mac80211-%s: failed to remove key "
 		       "(%d, %pM) from hardware (%d)\n",
 		       wiphy_name(key->local->hw.wiphy),
 		       key->conf.keyidx, sta ? sta->addr : bcast_addr, ret);
 	spin_lock(&todo_lock);
 	key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
 	spin_unlock(&todo_lock);
 }
 static void __ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata,
 					int idx)
 {
 	struct ieee80211_key *key = NULL;
 	if (idx >= 0 && idx < NUM_DEFAULT_KEYS)
 		key = sdata->keys[idx];
 	rcu_assign_pointer(sdata->default_key, key);
 	if (key)
 		add_todo(key, KEY_FLAG_TODO_DEFKEY);
 }
 void ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata, int idx)
 {
 	unsigned long flags;
 	spin_lock_irqsave(&sdata->local->key_lock, flags);
 	__ieee80211_set_default_key(sdata, idx);
 	spin_unlock_irqrestore(&sdata->local->key_lock, flags);
 }
+static void
+__ieee80211_set_default_mgmt_key(struct ieee80211_sub_if_data *sdata, int idx)
+{
+	struct ieee80211_key *key = NULL;
+	if (idx >= NUM_DEFAULT_KEYS &&
+	    idx < NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
+		key = sdata->keys[idx];
+	rcu_assign_pointer(sdata->default_mgmt_key, key);
+	if (key)
+		add_todo(key, KEY_FLAG_TODO_DEFMGMTKEY);
+}
+void ieee80211_set_default_mgmt_key(struct ieee80211_sub_if_data *sdata,
+				    int idx)
+{
+	unsigned long flags;
+	spin_lock_irqsave(&sdata->local->key_lock, flags);
+	__ieee80211_set_default_mgmt_key(sdata, idx);
+	spin_unlock_irqrestore(&sdata->local->key_lock, flags);
+}
 static void __ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
 				    struct sta_info *sta,
 				    struct ieee80211_key *old,
 				    struct ieee80211_key *new)
 {
-	int idx, defkey;
+	int idx, defkey, defmgmtkey;
 	if (new)
 		list_add(&new->list, &sdata->key_list);
 	if (sta) {
 		rcu_assign_pointer(sta->key, new);
 	} else {
 		WARN_ON(new && old && new->conf.keyidx != old->conf.keyidx);
 		if (old)
 			idx = old->conf.keyidx;
 		else
 			idx = new->conf.keyidx;
 		defkey = old && sdata->default_key == old;
+		defmgmtkey = old && sdata->default_mgmt_key == old;
 		if (defkey && !new)
 			__ieee80211_set_default_key(sdata, -1);
+		if (defmgmtkey && !new)
+			__ieee80211_set_default_mgmt_key(sdata, -1);
 		rcu_assign_pointer(sdata->keys[idx], new);
 		if (defkey && new)
 			__ieee80211_set_default_key(sdata, new->conf.keyidx);
+		if (defmgmtkey && new)
+			__ieee80211_set_default_mgmt_key(sdata,
+							 new->conf.keyidx);
 	}
 	if (old) {
 		/*
 		 * We'll use an empty list to indicate that the key
 		 * has already been removed.
 		 */
 		list_del_init(&old->list);
 	}
 }
 struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
 					  int idx,
 					  size_t key_len,
 					  const u8 *key_data)
 {
 	struct ieee80211_key *key;
-	BUG_ON(idx < 0 || idx >= NUM_DEFAULT_KEYS);
+	BUG_ON(idx < 0 || idx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS);
 	key = kzalloc(sizeof(struct ieee80211_key) + key_len, GFP_KERNEL);
 	if (!key)
 		return NULL;
 	/*
 	 * Default to software encryption; we'll later upload the
 	 * key to the hardware if possible.
 	 */
 	key->conf.flags = 0;
 	key->flags = 0;
 	key->conf.alg = alg;
 	key->conf.keyidx = idx;
 	key->conf.keylen = key_len;
 	switch (alg) {
 	case ALG_WEP:
 		key->conf.iv_len = WEP_IV_LEN;
 		key->conf.icv_len = WEP_ICV_LEN;
 		break;
 	case ALG_TKIP:
 		key->conf.iv_len = TKIP_IV_LEN;
 		key->conf.icv_len = TKIP_ICV_LEN;
 		break;
 	case ALG_CCMP:
 		key->conf.iv_len = CCMP_HDR_LEN;
 		key->conf.icv_len = CCMP_MIC_LEN;
 		break;
+	case ALG_AES_CMAC:
+		key->conf.iv_len = 0;
+		key->conf.icv_len = sizeof(struct ieee80211_mmie);
+		break;
 	}
 	memcpy(key->conf.key, key_data, key_len);
 	INIT_LIST_HEAD(&key->list);
 	INIT_LIST_HEAD(&key->todo);
 	if (alg == ALG_CCMP) {
 		/*
 		 * Initialize AES key state here as an optimization so that
 		 * it does not need to be initialized for every packet.
 		 */
 		key->u.ccmp.tfm = ieee80211_aes_key_setup_encrypt(key_data);
 		if (!key->u.ccmp.tfm) {
 			kfree(key);
 			return NULL;
 		}
 	}
+	if (alg == ALG_AES_CMAC) {
+		/*
+		 * Initialize AES key state here as an optimization so that
+		 * it does not need to be initialized for every packet.
+		 */
+		key->u.aes_cmac.tfm =
+			ieee80211_aes_cmac_key_setup(key_data);
+		if (!key->u.aes_cmac.tfm) {
+			kfree(key);
+			return NULL;
+		}
+	}
 	return key;
 }
 void ieee80211_key_link(struct ieee80211_key *key,
 			struct ieee80211_sub_if_data *sdata,
 			struct sta_info *sta)
 {
 	struct ieee80211_key *old_key;
 	unsigned long flags;
 	int idx;
 	BUG_ON(!sdata);
 	BUG_ON(!key);
 	idx = key->conf.keyidx;
 	key->local = sdata->local;
 	key->sdata = sdata;
 	key->sta = sta;
 	if (sta) {
 		/*
 		 * some hardware cannot handle TKIP with QoS, so
 		 * we indicate whether QoS could be in use.
 		 */
 		if (test_sta_flags(sta, WLAN_STA_WME))
 			key->conf.flags |= IEEE80211_KEY_FLAG_WMM_STA;
 		/*
 		 * This key is for a specific sta interface,
 		 * inform the driver that it should try to store
 		 * this key as pairwise key.
 		 */
 		key->conf.flags |= IEEE80211_KEY_FLAG_PAIRWISE;
 	} else {
 		if (sdata->vif.type == NL80211_IFTYPE_STATION) {
 			struct sta_info *ap;
 			/*
 			 * We're getting a sta pointer in,
 			 * so must be under RCU read lock.
 			 */
 			/* same here, the AP could be using QoS */
 			ap = sta_info_get(key->local, key->sdata->u.sta.bssid);
 			if (ap) {
 				if (test_sta_flags(ap, WLAN_STA_WME))
 					key->conf.flags |=
 						IEEE80211_KEY_FLAG_WMM_STA;
 			}
 		}
 	}
 	spin_lock_irqsave(&sdata->local->key_lock, flags);
 	if (sta)
 		old_key = sta->key;
 	else
 		old_key = sdata->keys[idx];
 	__ieee80211_key_replace(sdata, sta, old_key, key);
 	spin_unlock_irqrestore(&sdata->local->key_lock, flags);
 	/* free old key later */
 	add_todo(old_key, KEY_FLAG_TODO_DELETE);
 	add_todo(key, KEY_FLAG_TODO_ADD_DEBUGFS);
 	if (netif_running(sdata->dev))
 		add_todo(key, KEY_FLAG_TODO_HWACCEL_ADD);
 }
 static void __ieee80211_key_free(struct ieee80211_key *key)
 {
 	/*
 	 * Replace key with nothingness if it was ever used.
 	 */
 	if (key->sdata)
 		__ieee80211_key_replace(key->sdata, key->sta,
 					key, NULL);
 	add_todo(key, KEY_FLAG_TODO_DELETE);
 }
 void ieee80211_key_free(struct ieee80211_key *key)
 {
 	unsigned long flags;
 	if (!key)
 		return;
 	if (!key->sdata) {
 		/* The key has not been linked yet, simply free it
 		 * and don't Oops */
 		if (key->conf.alg == ALG_CCMP)
 			ieee80211_aes_key_free(key->u.ccmp.tfm);
 		kfree(key);
 		return;
 	}
 	spin_lock_irqsave(&key->sdata->local->key_lock, flags);
 	__ieee80211_key_free(key);
 	spin_unlock_irqrestore(&key->sdata->local->key_lock, flags);
 }
 /*
  * To be safe against concurrent manipulations of the list (which shouldn't
  * actually happen) we need to hold the spinlock. But under the spinlock we
  * can't actually do much, so we defer processing to the todo list. Then run
  * the todo list to be sure the operation and possibly previously pending
  * operations are completed.
  */
 static void ieee80211_todo_for_each_key(struct ieee80211_sub_if_data *sdata,
 					u32 todo_flags)
 {
 	struct ieee80211_key *key;
 	unsigned long flags;
 	might_sleep();
 	spin_lock_irqsave(&sdata->local->key_lock, flags);
 	list_for_each_entry(key, &sdata->key_list, list)
 		add_todo(key, todo_flags);
 	spin_unlock_irqrestore(&sdata->local->key_lock, flags);
 	ieee80211_key_todo();
 }
 void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata)
 {
 	ASSERT_RTNL();
 	if (WARN_ON(!netif_running(sdata->dev)))
 		return;
 	ieee80211_todo_for_each_key(sdata, KEY_FLAG_TODO_HWACCEL_ADD);
 }
 void ieee80211_disable_keys(struct ieee80211_sub_if_data *sdata)
 {
 	ASSERT_RTNL();
 	ieee80211_todo_for_each_key(sdata, KEY_FLAG_TODO_HWACCEL_REMOVE);
 }
 static void __ieee80211_key_destroy(struct ieee80211_key *key)
 {
 	if (!key)
 		return;
 	ieee80211_key_disable_hw_accel(key);
 	if (key->conf.alg == ALG_CCMP)
 		ieee80211_aes_key_free(key->u.ccmp.tfm);
+	if (key->conf.alg == ALG_AES_CMAC)
+		ieee80211_aes_cmac_key_free(key->u.aes_cmac.tfm);
 	ieee80211_debugfs_key_remove(key);
 	kfree(key);
 }
 static void __ieee80211_key_todo(void)
 {
 	struct ieee80211_key *key;
 	bool work_done;
 	u32 todoflags;
 	/*
 	 * NB: sta_info_destroy relies on this!
 	 */
 	synchronize_rcu();
 	spin_lock(&todo_lock);
 	while (!list_empty(&todo_list)) {
 		key = list_first_entry(&todo_list, struct ieee80211_key, todo);
 		list_del_init(&key->todo);
 		todoflags = key->flags & (KEY_FLAG_TODO_ADD_DEBUGFS |
 					  KEY_FLAG_TODO_DEFKEY |
+					  KEY_FLAG_TODO_DEFMGMTKEY |
 					  KEY_FLAG_TODO_HWACCEL_ADD |
 					  KEY_FLAG_TODO_HWACCEL_REMOVE |
 					  KEY_FLAG_TODO_DELETE);
 		key->flags &= ~todoflags;
 		spin_unlock(&todo_lock);
 		work_done = false;
 		if (todoflags & KEY_FLAG_TODO_ADD_DEBUGFS) {
 			ieee80211_debugfs_key_add(key);
 			work_done = true;
 		}
 		if (todoflags & KEY_FLAG_TODO_DEFKEY) {
 			ieee80211_debugfs_key_remove_default(key->sdata);
 			ieee80211_debugfs_key_add_default(key->sdata);
 			work_done = true;
 		}
+		if (todoflags & KEY_FLAG_TODO_DEFMGMTKEY) {
+			ieee80211_debugfs_key_remove_mgmt_default(key->sdata);
+			ieee80211_debugfs_key_add_mgmt_default(key->sdata);
+			work_done = true;
+		}
 		if (todoflags & KEY_FLAG_TODO_HWACCEL_ADD) {
 			ieee80211_key_enable_hw_accel(key);
 			work_done = true;
 		}
 		if (todoflags & KEY_FLAG_TODO_HWACCEL_REMOVE) {
 			ieee80211_key_disable_hw_accel(key);
 			work_done = true;
 		}
 		if (todoflags & KEY_FLAG_TODO_DELETE) {
 			__ieee80211_key_destroy(key);
 			work_done = true;
 		}
 		WARN_ON(!work_done);
 		spin_lock(&todo_lock);
 	}
 	spin_unlock(&todo_lock);
 }
 void ieee80211_key_todo(void)
 {
 	ieee80211_key_lock();
 	__ieee80211_key_todo();
 	ieee80211_key_unlock();
 }
 void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata)
 {
 	struct ieee80211_key *key, *tmp;
 	unsigned long flags;
 	ieee80211_key_lock();
 	ieee80211_debugfs_key_remove_default(sdata);
+	ieee80211_debugfs_key_remove_mgmt_default(sdata);
 	spin_lock_irqsave(&sdata->local->key_lock, flags);
 	list_for_each_entry_safe(key, tmp, &sdata->key_list, list)
 		__ieee80211_key_free(key);
 	spin_unlock_irqrestore(&sdata->local->key_lock, flags);
 	__ieee80211_key_todo();
 	ieee80211_key_unlock();
 }

net/mac80211/key.h

Diff comments View file @ 3cfcf6a

 /*
  * Copyright 2002-2004, Instant802 Networks, Inc.
  * Copyright 2005, Devicescape Software, Inc.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
 #ifndef IEEE80211_KEY_H
 #define IEEE80211_KEY_H
 #include <linux/types.h>
 #include <linux/list.h>
 #include <linux/crypto.h>
 #include <linux/rcupdate.h>
 #include <net/mac80211.h>
 #define WEP_IV_LEN		4
 #define WEP_ICV_LEN		4
 #define ALG_TKIP_KEY_LEN	32
 #define ALG_CCMP_KEY_LEN	16
 #define CCMP_HDR_LEN		8
 #define CCMP_MIC_LEN		8
 #define CCMP_TK_LEN		16
 #define CCMP_PN_LEN		6
 #define TKIP_IV_LEN		8
 #define TKIP_ICV_LEN		4
 #define NUM_RX_DATA_QUEUES	17
 struct ieee80211_local;
 struct ieee80211_sub_if_data;
 struct sta_info;
 /**
  * enum ieee80211_internal_key_flags - internal key flags
  *
  * @KEY_FLAG_UPLOADED_TO_HARDWARE: Indicates that this key is present
  *	in the hardware for TX crypto hardware acceleration.
  * @KEY_FLAG_TODO_DELETE: Key is marked for deletion and will, after an
  *	RCU grace period, no longer be reachable other than from the
  *	todo list.
  * @KEY_FLAG_TODO_HWACCEL_ADD: Key needs to be added to hardware acceleration.
  * @KEY_FLAG_TODO_HWACCEL_REMOVE: Key needs to be removed from hardware
  *	acceleration.
  * @KEY_FLAG_TODO_DEFKEY: Key is default key and debugfs needs to be updated.
  * @KEY_FLAG_TODO_ADD_DEBUGFS: Key needs to be added to debugfs.
+ * @KEY_FLAG_TODO_DEFMGMTKEY: Key is default management key and debugfs needs
+ *	to be updated.
  */
 enum ieee80211_internal_key_flags {
 	KEY_FLAG_UPLOADED_TO_HARDWARE	= BIT(0),
 	KEY_FLAG_TODO_DELETE		= BIT(1),
 	KEY_FLAG_TODO_HWACCEL_ADD	= BIT(2),
 	KEY_FLAG_TODO_HWACCEL_REMOVE	= BIT(3),
 	KEY_FLAG_TODO_DEFKEY		= BIT(4),
 	KEY_FLAG_TODO_ADD_DEBUGFS	= BIT(5),
+	KEY_FLAG_TODO_DEFMGMTKEY	= BIT(6),
 };
 struct tkip_ctx {
 	u32 iv32;
 	u16 iv16;
 	u16 p1k[5];
 	int initialized;
 };
 struct ieee80211_key {
 	struct ieee80211_local *local;
 	struct ieee80211_sub_if_data *sdata;
 	struct sta_info *sta;
 	/* for sdata list */
 	struct list_head list;
 	/* for todo list */
 	struct list_head todo;
 	/* protected by todo lock! */
 	unsigned int flags;
 	union {
 		struct {
 			/* last used TSC */
 			struct tkip_ctx tx;
 			/* last received RSC */
 			struct tkip_ctx rx[NUM_RX_DATA_QUEUES];
 		} tkip;
 		struct {
 			u8 tx_pn[6];
 			u8 rx_pn[NUM_RX_DATA_QUEUES][6];
 			struct crypto_cipher *tfm;
 			u32 replays; /* dot11RSNAStatsCCMPReplays */
 			/* scratch buffers for virt_to_page() (crypto API) */
 #ifndef AES_BLOCK_LEN
 #define AES_BLOCK_LEN 16
 #endif
 			u8 tx_crypto_buf[6 * AES_BLOCK_LEN];
 			u8 rx_crypto_buf[6 * AES_BLOCK_LEN];
 		} ccmp;
 		struct {
 			u8 tx_pn[6];
 			u8 rx_pn[6];
 			struct crypto_cipher *tfm;
 			u32 replays; /* dot11RSNAStatsCMACReplays */
 			u32 icverrors; /* dot11RSNAStatsCMACICVErrors */
 			/* scratch buffers for virt_to_page() (crypto API) */
 			u8 tx_crypto_buf[2 * AES_BLOCK_LEN];
 			u8 rx_crypto_buf[2 * AES_BLOCK_LEN];
 		} aes_cmac;
 	} u;
 	/* number of times this key has been used */
 	int tx_rx_count;
 #ifdef CONFIG_MAC80211_DEBUGFS
 	struct {
 		struct dentry *stalink;
 		struct dentry *dir;
 		struct dentry *keylen;
 		struct dentry *flags;
 		struct dentry *keyidx;
 		struct dentry *hw_key_idx;
 		struct dentry *tx_rx_count;
 		struct dentry *algorithm;
 		struct dentry *tx_spec;
 		struct dentry *rx_spec;
 		struct dentry *replays;
+		struct dentry *icverrors;
 		struct dentry *key;
 		struct dentry *ifindex;
 		int cnt;
 	} debugfs;
 #endif
 	/*
 	 * key config, must be last because it contains key
 	 * material as variable length member
 	 */
 	struct ieee80211_key_conf conf;
 };
 struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
 					  int idx,
 					  size_t key_len,
 					  const u8 *key_data);
 /*
  * Insert a key into data structures (sdata, sta if necessary)
  * to make it used, free old key.
  */
 void ieee80211_key_link(struct ieee80211_key *key,
 			struct ieee80211_sub_if_data *sdata,
 			struct sta_info *sta);
 void ieee80211_key_free(struct ieee80211_key *key);
 void ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata, int idx);
+void ieee80211_set_default_mgmt_key(struct ieee80211_sub_if_data *sdata,
+				    int idx);
 void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata);
 void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata);
 void ieee80211_disable_keys(struct ieee80211_sub_if_data *sdata);
 void ieee80211_key_todo(void);
 #endif /* IEEE80211_KEY_H */

net/mac80211/rx.c

Diff comments View file @ 3cfcf6a

 /*
  * Copyright 2002-2005, Instant802 Networks, Inc.
  * Copyright 2005-2006, Devicescape Software, Inc.
  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
  * Copyright 2007	Johannes Berg <johannes@sipsolutions.net>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
 #include <linux/jiffies.h>
 #include <linux/kernel.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/rcupdate.h>
 #include <net/mac80211.h>
 #include <net/ieee80211_radiotap.h>
 #include "ieee80211_i.h"
 #include "led.h"
 #include "mesh.h"
 #include "wep.h"
 #include "wpa.h"
 #include "tkip.h"
 #include "wme.h"
 static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
 					   struct tid_ampdu_rx *tid_agg_rx,
 					   struct sk_buff *skb,
 					   u16 mpdu_seq_num,
 					   int bar_req);
 /*
  * monitor mode reception
  *
  * This function cleans up the SKB, i.e. it removes all the stuff
  * only useful for monitoring.
  */
 static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
 					   struct sk_buff *skb,
 					   int rtap_len)
 {
 	skb_pull(skb, rtap_len);
 	if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
 		if (likely(skb->len > FCS_LEN))
 			skb_trim(skb, skb->len - FCS_LEN);
 		else {
 			/* driver bug */
 			WARN_ON(1);
 			dev_kfree_skb(skb);
 			skb = NULL;
 		}
 	}
 	return skb;
 }
 static inline int should_drop_frame(struct ieee80211_rx_status *status,
 				    struct sk_buff *skb,
 				    int present_fcs_len,
 				    int radiotap_len)
 {
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 	if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
 		return 1;
 	if (unlikely(skb->len < 16 + present_fcs_len + radiotap_len))
 		return 1;
 	if (ieee80211_is_ctl(hdr->frame_control) &&
 	    !ieee80211_is_pspoll(hdr->frame_control) &&
 	    !ieee80211_is_back_req(hdr->frame_control))
 		return 1;
 	return 0;
 }
 static int
 ieee80211_rx_radiotap_len(struct ieee80211_local *local,
 			  struct ieee80211_rx_status *status)
 {
 	int len;
 	/* always present fields */
 	len = sizeof(struct ieee80211_radiotap_header) + 9;
 	if (status->flag & RX_FLAG_TSFT)
 		len += 8;
 	if (local->hw.flags & IEEE80211_HW_SIGNAL_DB ||
 	    local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
 		len += 1;
 	if (local->hw.flags & IEEE80211_HW_NOISE_DBM)
 		len += 1;
 	if (len & 1) /* padding for RX_FLAGS if necessary */
 		len++;
 	/* make sure radiotap starts at a naturally aligned address */
 	if (len % 8)
 		len = roundup(len, 8);
 	return len;
 }
 /*
  * ieee80211_add_rx_radiotap_header - add radiotap header
  *
  * add a radiotap header containing all the fields which the hardware provided.
  */
 static void
 ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
 				 struct sk_buff *skb,
 				 struct ieee80211_rx_status *status,
 				 struct ieee80211_rate *rate,
 				 int rtap_len)
 {
 	struct ieee80211_radiotap_header *rthdr;
 	unsigned char *pos;
 	rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
 	memset(rthdr, 0, rtap_len);
 	/* radiotap header, set always present flags */
 	rthdr->it_present =
 		cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
 			    (1 << IEEE80211_RADIOTAP_CHANNEL) |
 			    (1 << IEEE80211_RADIOTAP_ANTENNA) |
 			    (1 << IEEE80211_RADIOTAP_RX_FLAGS));
 	rthdr->it_len = cpu_to_le16(rtap_len);
 	pos = (unsigned char *)(rthdr+1);
 	/* the order of the following fields is important */
 	/* IEEE80211_RADIOTAP_TSFT */
 	if (status->flag & RX_FLAG_TSFT) {
 		*(__le64 *)pos = cpu_to_le64(status->mactime);
 		rthdr->it_present |=
 			cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
 		pos += 8;
 	}
 	/* IEEE80211_RADIOTAP_FLAGS */
 	if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
 		*pos |= IEEE80211_RADIOTAP_F_FCS;
 	if (status->flag & RX_FLAG_SHORTPRE)
 		*pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
 	pos++;
 	/* IEEE80211_RADIOTAP_RATE */
 	if (status->flag & RX_FLAG_HT) {
 		/*
 		 * TODO: add following information into radiotap header once
 		 * suitable fields are defined for it:
 		 * - MCS index (status->rate_idx)
 		 * - HT40 (status->flag & RX_FLAG_40MHZ)
 		 * - short-GI (status->flag & RX_FLAG_SHORT_GI)
 		 */
 		*pos = 0;
 	} else {
 		rthdr->it_present |= (1 << IEEE80211_RADIOTAP_RATE);
 		*pos = rate->bitrate / 5;
 	}
 	pos++;
 	/* IEEE80211_RADIOTAP_CHANNEL */
 	*(__le16 *)pos = cpu_to_le16(status->freq);
 	pos += 2;
 	if (status->band == IEEE80211_BAND_5GHZ)
 		*(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_OFDM |
 					     IEEE80211_CHAN_5GHZ);
 	else if (rate->flags & IEEE80211_RATE_ERP_G)
 		*(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_OFDM |
 					     IEEE80211_CHAN_2GHZ);
 	else
 		*(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_CCK |
 					     IEEE80211_CHAN_2GHZ);
 	pos += 2;
 	/* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
 	if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
 		*pos = status->signal;
 		rthdr->it_present |=
 			cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
 		pos++;
 	}
 	/* IEEE80211_RADIOTAP_DBM_ANTNOISE */
 	if (local->hw.flags & IEEE80211_HW_NOISE_DBM) {
 		*pos = status->noise;
 		rthdr->it_present |=
 			cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTNOISE);
 		pos++;
 	}
 	/* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
 	/* IEEE80211_RADIOTAP_ANTENNA */
 	*pos = status->antenna;
 	pos++;
 	/* IEEE80211_RADIOTAP_DB_ANTSIGNAL */
 	if (local->hw.flags & IEEE80211_HW_SIGNAL_DB) {
 		*pos = status->signal;
 		rthdr->it_present |=
 			cpu_to_le32(1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL);
 		pos++;
 	}
 	/* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
 	/* IEEE80211_RADIOTAP_RX_FLAGS */
 	/* ensure 2 byte alignment for the 2 byte field as required */
 	if ((pos - (unsigned char *)rthdr) & 1)
 		pos++;
 	/* FIXME: when radiotap gets a 'bad PLCP' flag use it here */
 	if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
 		*(__le16 *)pos |= cpu_to_le16(IEEE80211_RADIOTAP_F_RX_BADFCS);
 	pos += 2;
 }
 /*
  * This function copies a received frame to all monitor interfaces and
  * returns a cleaned-up SKB that no longer includes the FCS nor the
  * radiotap header the driver might have added.
  */
 static struct sk_buff *
 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
 		     struct ieee80211_rx_status *status,
 		     struct ieee80211_rate *rate)
 {
 	struct ieee80211_sub_if_data *sdata;
 	int needed_headroom = 0;
 	struct sk_buff *skb, *skb2;
 	struct net_device *prev_dev = NULL;
 	int present_fcs_len = 0;
 	int rtap_len = 0;
 	/*
 	 * First, we may need to make a copy of the skb because
 	 *  (1) we need to modify it for radiotap (if not present), and
 	 *  (2) the other RX handlers will modify the skb we got.
 	 *
 	 * We don't need to, of course, if we aren't going to return
 	 * the SKB because it has a bad FCS/PLCP checksum.
 	 */
 	if (status->flag & RX_FLAG_RADIOTAP)
 		rtap_len = ieee80211_get_radiotap_len(origskb->data);
 	else
 		/* room for the radiotap header based on driver features */
 		needed_headroom = ieee80211_rx_radiotap_len(local, status);
 	if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
 		present_fcs_len = FCS_LEN;
 	if (!local->monitors) {
 		if (should_drop_frame(status, origskb, present_fcs_len,
 				      rtap_len)) {
 			dev_kfree_skb(origskb);
 			return NULL;
 		}
 		return remove_monitor_info(local, origskb, rtap_len);
 	}
 	if (should_drop_frame(status, origskb, present_fcs_len, rtap_len)) {
 		/* only need to expand headroom if necessary */
 		skb = origskb;
 		origskb = NULL;
 		/*
 		 * This shouldn't trigger often because most devices have an
 		 * RX header they pull before we get here, and that should
 		 * be big enough for our radiotap information. We should
 		 * probably export the length to drivers so that we can have
 		 * them allocate enough headroom to start with.
 		 */
 		if (skb_headroom(skb) < needed_headroom &&
 		    pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
 			dev_kfree_skb(skb);
 			return NULL;
 		}
 	} else {
 		/*
 		 * Need to make a copy and possibly remove radiotap header
 		 * and FCS from the original.
 		 */
 		skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
 		origskb = remove_monitor_info(local, origskb, rtap_len);
 		if (!skb)
 			return origskb;
 	}
 	/* if necessary, prepend radiotap information */
 	if (!(status->flag & RX_FLAG_RADIOTAP))
 		ieee80211_add_rx_radiotap_header(local, skb, status, rate,
 						 needed_headroom);
 	skb_reset_mac_header(skb);
 	skb->ip_summed = CHECKSUM_UNNECESSARY;
 	skb->pkt_type = PACKET_OTHERHOST;
 	skb->protocol = htons(ETH_P_802_2);
 	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
 		if (!netif_running(sdata->dev))
 			continue;
 		if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
 			continue;
 		if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
 			continue;
 		if (prev_dev) {
 			skb2 = skb_clone(skb, GFP_ATOMIC);
 			if (skb2) {
 				skb2->dev = prev_dev;
 				netif_rx(skb2);
 			}
 		}
 		prev_dev = sdata->dev;
 		sdata->dev->stats.rx_packets++;
 		sdata->dev->stats.rx_bytes += skb->len;
 	}
 	if (prev_dev) {
 		skb->dev = prev_dev;
 		netif_rx(skb);
 	} else
 		dev_kfree_skb(skb);
 	return origskb;
 }
 static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
 {
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
 	int tid;
 	/* does the frame have a qos control field? */
 	if (ieee80211_is_data_qos(hdr->frame_control)) {
 		u8 *qc = ieee80211_get_qos_ctl(hdr);
 		/* frame has qos control */
 		tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
 		if (*qc & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
 			rx->flags |= IEEE80211_RX_AMSDU;
 		else
 			rx->flags &= ~IEEE80211_RX_AMSDU;
 	} else {
 		/*
 		 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
 		 *
 		 *	Sequence numbers for management frames, QoS data
 		 *	frames with a broadcast/multicast address in the
 		 *	Address 1 field, and all non-QoS data frames sent
 		 *	by QoS STAs are assigned using an additional single
 		 *	modulo-4096 counter, [...]
 		 *
 		 * We also use that counter for non-QoS STAs.
 		 */
 		tid = NUM_RX_DATA_QUEUES - 1;
 	}
 	rx->queue = tid;
 	/* Set skb->priority to 1d tag if highest order bit of TID is not set.
 	 * For now, set skb->priority to 0 for other cases. */
 	rx->skb->priority = (tid > 7) ? 0 : tid;
 }
 /**
  * DOC: Packet alignment
  *
  * Drivers always need to pass packets that are aligned to two-byte boundaries
  * to the stack.
  *
  * Additionally, should, if possible, align the payload data in a way that
  * guarantees that the contained IP header is aligned to a four-byte
  * boundary. In the case of regular frames, this simply means aligning the
  * payload to a four-byte boundary (because either the IP header is directly
  * contained, or IV/RFC1042 headers that have a length divisible by four are
  * in front of it).
  *
  * With A-MSDU frames, however, the payload data address must yield two modulo
  * four because there are 14-byte 802.3 headers within the A-MSDU frames that
  * push the IP header further back to a multiple of four again. Thankfully, the
  * specs were sane enough this time around to require padding each A-MSDU
  * subframe to a length that is a multiple of four.
  *
  * Padding like Atheros hardware adds which is inbetween the 802.11 header and
  * the payload is not supported, the driver is required to move the 802.11
  * header to be directly in front of the payload in that case.
  */
 static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
 {
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
 	int hdrlen;
 #ifndef CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT
 	return;
 #endif
 	if (WARN_ONCE((unsigned long)rx->skb->data & 1,
 		      "unaligned packet at 0x%p\n", rx->skb->data))
 		return;
 	if (!ieee80211_is_data_present(hdr->frame_control))
 		return;
 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
 	if (rx->flags & IEEE80211_RX_AMSDU)
 		hdrlen += ETH_HLEN;
 	WARN_ONCE(((unsigned long)(rx->skb->data + hdrlen)) & 3,
 		  "unaligned IP payload at 0x%p\n", rx->skb->data + hdrlen);
 }
 /* rx handlers */
 static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
 {
 	struct ieee80211_local *local = rx->local;
 	struct sk_buff *skb = rx->skb;
 	if (unlikely(local->hw_scanning))
 		return ieee80211_scan_rx(rx->sdata, skb, rx->status);
 	if (unlikely(local->sw_scanning)) {
 		/* drop all the other packets during a software scan anyway */
 		if (ieee80211_scan_rx(rx->sdata, skb, rx->status)
 		    != RX_QUEUED)
 			dev_kfree_skb(skb);
 		return RX_QUEUED;
 	}
 	if (unlikely(rx->flags & IEEE80211_RX_IN_SCAN)) {
 		/* scanning finished during invoking of handlers */
 		I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
 		return RX_DROP_UNUSABLE;
 	}
 	return RX_CONTINUE;
 }
+static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
+{
+	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+	if (skb->len < 24 || is_multicast_ether_addr(hdr->addr1))
+		return 0;
+	return ieee80211_is_robust_mgmt_frame(hdr);
+}
+static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
+{
+	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+	if (skb->len < 24 || !is_multicast_ether_addr(hdr->addr1))
+		return 0;
+	return ieee80211_is_robust_mgmt_frame(hdr);
+}
+/* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
+static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
+{
+	struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
+	struct ieee80211_mmie *mmie;
+	if (skb->len < 24 + sizeof(*mmie) ||
+	    !is_multicast_ether_addr(hdr->da))
+		return -1;
+	if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *) hdr))
+		return -1; /* not a robust management frame */
+	mmie = (struct ieee80211_mmie *)
+		(skb->data + skb->len - sizeof(*mmie));
+	if (mmie->element_id != WLAN_EID_MMIE ||
+	    mmie->length != sizeof(*mmie) - 2)
+		return -1;
+	return le16_to_cpu(mmie->key_id);
+}
 static ieee80211_rx_result
 ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
 {
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
 	unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control);
 	if (ieee80211_is_data(hdr->frame_control)) {
 		if (!ieee80211_has_a4(hdr->frame_control))
 			return RX_DROP_MONITOR;
 		if (memcmp(hdr->addr4, rx->dev->dev_addr, ETH_ALEN) == 0)
 			return RX_DROP_MONITOR;
 	}
 	/* If there is not an established peer link and this is not a peer link
 	 * establisment frame, beacon or probe, drop the frame.
 	 */
 	if (!rx->sta || sta_plink_state(rx->sta) != PLINK_ESTAB) {
 		struct ieee80211_mgmt *mgmt;
 		if (!ieee80211_is_mgmt(hdr->frame_control))
 			return RX_DROP_MONITOR;
 		if (ieee80211_is_action(hdr->frame_control)) {
 			mgmt = (struct ieee80211_mgmt *)hdr;
 			if (mgmt->u.action.category != PLINK_CATEGORY)
 				return RX_DROP_MONITOR;
 			return RX_CONTINUE;
 		}
 		if (ieee80211_is_probe_req(hdr->frame_control) ||
 		    ieee80211_is_probe_resp(hdr->frame_control) ||
 		    ieee80211_is_beacon(hdr->frame_control))
 			return RX_CONTINUE;
 		return RX_DROP_MONITOR;
 	}
 #define msh_h_get(h, l) ((struct ieee80211s_hdr *) ((u8 *)h + l))
 	if (ieee80211_is_data(hdr->frame_control) &&
 	    is_multicast_ether_addr(hdr->addr1) &&
 	    mesh_rmc_check(hdr->addr4, msh_h_get(hdr, hdrlen), rx->sdata))
 		return RX_DROP_MONITOR;
 #undef msh_h_get
 	return RX_CONTINUE;
 }
 static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
 {
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
 	/* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
 	if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
 		if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
 			     rx->sta->last_seq_ctrl[rx->queue] ==
 			     hdr->seq_ctrl)) {
 			if (rx->flags & IEEE80211_RX_RA_MATCH) {
 				rx->local->dot11FrameDuplicateCount++;
 				rx->sta->num_duplicates++;
 			}
 			return RX_DROP_MONITOR;
 		} else
 			rx->sta->last_seq_ctrl[rx->queue] = hdr->seq_ctrl;
 	}
 	if (unlikely(rx->skb->len < 16)) {
 		I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
 		return RX_DROP_MONITOR;
 	}
 	/* Drop disallowed frame classes based on STA auth/assoc state;
 	 * IEEE 802.11, Chap 5.5.
 	 *
 	 * mac80211 filters only based on association state, i.e. it drops
 	 * Class 3 frames from not associated stations. hostapd sends
 	 * deauth/disassoc frames when needed. In addition, hostapd is
 	 * responsible for filtering on both auth and assoc states.
 	 */
 	if (ieee80211_vif_is_mesh(&rx->sdata->vif))
 		return ieee80211_rx_mesh_check(rx);
 	if (unlikely((ieee80211_is_data(hdr->frame_control) ||
 		      ieee80211_is_pspoll(hdr->frame_control)) &&
 		     rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
 		     (!rx->sta || !test_sta_flags(rx->sta, WLAN_STA_ASSOC)))) {
 		if ((!ieee80211_has_fromds(hdr->frame_control) &&
 		     !ieee80211_has_tods(hdr->frame_control) &&
 		     ieee80211_is_data(hdr->frame_control)) ||
 		    !(rx->flags & IEEE80211_RX_RA_MATCH)) {
 			/* Drop IBSS frames and frames for other hosts
 			 * silently. */
 			return RX_DROP_MONITOR;
 		}
 		return RX_DROP_MONITOR;
 	}
 	return RX_CONTINUE;
 }
 static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
 {
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
 	int keyidx;
 	int hdrlen;
 	ieee80211_rx_result result = RX_DROP_UNUSABLE;
 	struct ieee80211_key *stakey = NULL;
+	int mmie_keyidx = -1;
 	/*
 	 * Key selection 101
 	 *
-	 * There are three types of keys:
+	 * There are four types of keys:
 	 *  - GTK (group keys)
+	 *  - IGTK (group keys for management frames)
 	 *  - PTK (pairwise keys)
 	 *  - STK (station-to-station pairwise keys)
 	 *
 	 * When selecting a key, we have to distinguish between multicast
 	 * (including broadcast) and unicast frames, the latter can only
-	 * use PTKs and STKs while the former always use GTKs. Unless, of
+	 * use PTKs and STKs while the former always use GTKs and IGTKs.
-	 * course, actual WEP keys ("pre-RSNA") are used, then unicast
+	 * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
-	 * frames can also use key indizes like GTKs. Hence, if we don't
+	 * unicast frames can also use key indices like GTKs. Hence, if we
-	 * have a PTK/STK we check the key index for a WEP key.
+	 * don't have a PTK/STK we check the key index for a WEP key.
 	 *
 	 * Note that in a regular BSS, multicast frames are sent by the
 	 * AP only, associated stations unicast the frame to the AP first
 	 * which then multicasts it on their behalf.
 	 *
 	 * There is also a slight problem in IBSS mode: GTKs are negotiated
 	 * with each station, that is something we don't currently handle.
 	 * The spec seems to expect that one negotiates the same key with
 	 * every station but there's no such requirement; VLANs could be
 	 * possible.
 	 */
-	if (!ieee80211_has_protected(hdr->frame_control))
+	if (!ieee80211_has_protected(hdr->frame_control)) {
-		return RX_CONTINUE;
+		if (!ieee80211_is_mgmt(hdr->frame_control) ||
+		    rx->sta == NULL || !test_sta_flags(rx->sta, WLAN_STA_MFP))
+			return RX_CONTINUE;
+		mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
+		if (mmie_keyidx < 0)
+			return RX_CONTINUE;
+	}
 	/*
 	 * No point in finding a key and decrypting if the frame is neither
 	 * addressed to us nor a multicast frame.
 	 */
 	if (!(rx->flags & IEEE80211_RX_RA_MATCH))
 		return RX_CONTINUE;
 	if (rx->sta)
 		stakey = rcu_dereference(rx->sta->key);
 	if (!is_multicast_ether_addr(hdr->addr1) && stakey) {
 		rx->key = stakey;
+	} else if (mmie_keyidx >= 0) {
+		/* Broadcast/multicast robust management frame / BIP */
+		if ((rx->status->flag & RX_FLAG_DECRYPTED) &&
+		    (rx->status->flag & RX_FLAG_IV_STRIPPED))
+			return RX_CONTINUE;
+		if (mmie_keyidx < NUM_DEFAULT_KEYS ||
+		    mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
+			return RX_DROP_MONITOR; /* unexpected BIP keyidx */
+		rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
 	} else {
 		/*
 		 * The device doesn't give us the IV so we won't be
 		 * able to look up the key. That's ok though, we
 		 * don't need to decrypt the frame, we just won't
 		 * be able to keep statistics accurate.
 		 * Except for key threshold notifications, should
 		 * we somehow allow the driver to tell us which key
 		 * the hardware used if this flag is set?
 		 */
 		if ((rx->status->flag & RX_FLAG_DECRYPTED) &&
 		    (rx->status->flag & RX_FLAG_IV_STRIPPED))
 			return RX_CONTINUE;
 		hdrlen = ieee80211_hdrlen(hdr->frame_control);
 		if (rx->skb->len < 8 + hdrlen)
 			return RX_DROP_UNUSABLE; /* TODO: count this? */
 		/*
 		 * no need to call ieee80211_wep_get_keyidx,
 		 * it verifies a bunch of things we've done already
 		 */
 		keyidx = rx->skb->data[hdrlen + 3] >> 6;
 		rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
 		/*
 		 * RSNA-protected unicast frames should always be sent with
 		 * pairwise or station-to-station keys, but for WEP we allow
 		 * using a key index as well.
 		 */
 		if (rx->key && rx->key->conf.alg != ALG_WEP &&
 		    !is_multicast_ether_addr(hdr->addr1))
 			rx->key = NULL;
 	}
 	if (rx->key) {
 		rx->key->tx_rx_count++;
 		/* TODO: add threshold stuff again */
 	} else {
 		return RX_DROP_MONITOR;
 	}
 	/* Check for weak IVs if possible */
 	if (rx->sta && rx->key->conf.alg == ALG_WEP &&
 	    ieee80211_is_data(hdr->frame_control) &&
 	    (!(rx->status->flag & RX_FLAG_IV_STRIPPED) ||
 	     !(rx->status->flag & RX_FLAG_DECRYPTED)) &&
 	    ieee80211_wep_is_weak_iv(rx->skb, rx->key))
 		rx->sta->wep_weak_iv_count++;
 	switch (rx->key->conf.alg) {
 	case ALG_WEP:
 		result = ieee80211_crypto_wep_decrypt(rx);
 		break;
 	case ALG_TKIP:
 		result = ieee80211_crypto_tkip_decrypt(rx);
 		break;
 	case ALG_CCMP:
 		result = ieee80211_crypto_ccmp_decrypt(rx);
 		break;
+	case ALG_AES_CMAC:
+		result = ieee80211_crypto_aes_cmac_decrypt(rx);
+		break;
 	}
 	/* either the frame has been decrypted or will be dropped */
 	rx->status->flag |= RX_FLAG_DECRYPTED;
 	return result;
 }
 static void ap_sta_ps_start(struct sta_info *sta)
 {
 	struct ieee80211_sub_if_data *sdata = sta->sdata;
 	struct ieee80211_local *local = sdata->local;
 	atomic_inc(&sdata->bss->num_sta_ps);
 	set_and_clear_sta_flags(sta, WLAN_STA_PS, WLAN_STA_PSPOLL);
 	if (local->ops->sta_notify)
 		local->ops->sta_notify(local_to_hw(local), &sdata->vif,
 					STA_NOTIFY_SLEEP, &sta->sta);
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
 	printk(KERN_DEBUG "%s: STA %pM aid %d enters power save mode\n",
 	       sdata->dev->name, sta->sta.addr, sta->sta.aid);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 }
 static int ap_sta_ps_end(struct sta_info *sta)
 {
 	struct ieee80211_sub_if_data *sdata = sta->sdata;
 	struct ieee80211_local *local = sdata->local;
 	struct sk_buff *skb;
 	int sent = 0;
 	atomic_dec(&sdata->bss->num_sta_ps);
 	clear_sta_flags(sta, WLAN_STA_PS | WLAN_STA_PSPOLL);
 	if (local->ops->sta_notify)
 		local->ops->sta_notify(local_to_hw(local), &sdata->vif,
 					STA_NOTIFY_AWAKE, &sta->sta);
 	if (!skb_queue_empty(&sta->ps_tx_buf))
 		sta_info_clear_tim_bit(sta);
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
 	printk(KERN_DEBUG "%s: STA %pM aid %d exits power save mode\n",
 	       sdata->dev->name, sta->sta.addr, sta->sta.aid);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 	/* Send all buffered frames to the station */
 	while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL) {
 		sent++;
 		skb->requeue = 1;
 		dev_queue_xmit(skb);
 	}
 	while ((skb = skb_dequeue(&sta->ps_tx_buf)) != NULL) {
 		local->total_ps_buffered--;
 		sent++;
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
 		printk(KERN_DEBUG "%s: STA %pM aid %d send PS frame "
 		       "since STA not sleeping anymore\n", sdata->dev->name,
 		       sta->sta.addr, sta->sta.aid);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 		skb->requeue = 1;
 		dev_queue_xmit(skb);
 	}
 	return sent;
 }
 static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
 {
 	struct sta_info *sta = rx->sta;
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
 	if (!sta)
 		return RX_CONTINUE;
 	/* Update last_rx only for IBSS packets which are for the current
 	 * BSSID to avoid keeping the current IBSS network alive in cases where
 	 * other STAs are using different BSSID. */
 	if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
 		u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
 						NL80211_IFTYPE_ADHOC);
 		if (compare_ether_addr(bssid, rx->sdata->u.sta.bssid) == 0)
 			sta->last_rx = jiffies;
 	} else
 	if (!is_multicast_ether_addr(hdr->addr1) ||
 	    rx->sdata->vif.type == NL80211_IFTYPE_STATION) {
 		/* Update last_rx only for unicast frames in order to prevent
 		 * the Probe Request frames (the only broadcast frames from a
 		 * STA in infrastructure mode) from keeping a connection alive.
 		 * Mesh beacons will update last_rx when if they are found to
 		 * match the current local configuration when processed.
 		 */
 		sta->last_rx = jiffies;
 	}
 	if (!(rx->flags & IEEE80211_RX_RA_MATCH))
 		return RX_CONTINUE;
 	sta->rx_fragments++;
 	sta->rx_bytes += rx->skb->len;
 	sta->last_signal = rx->status->signal;
 	sta->last_qual = rx->status->qual;
 	sta->last_noise = rx->status->noise;
 	/*
 	 * Change STA power saving mode only at the end of a frame
 	 * exchange sequence.
 	 */
 	if (!ieee80211_has_morefrags(hdr->frame_control) &&
 	    (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
 	     rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
 		if (test_sta_flags(sta, WLAN_STA_PS)) {
 			/*
 			 * Ignore doze->wake transitions that are
 			 * indicated by non-data frames, the standard
 			 * is unclear here, but for example going to
 			 * PS mode and then scanning would cause a
 			 * doze->wake transition for the probe request,
 			 * and that is clearly undesirable.
 			 */
 			if (ieee80211_is_data(hdr->frame_control) &&
 			    !ieee80211_has_pm(hdr->frame_control))
 				rx->sent_ps_buffered += ap_sta_ps_end(sta);
 		} else {
 			if (ieee80211_has_pm(hdr->frame_control))
 				ap_sta_ps_start(sta);
 		}
 	}
 	/* Drop data::nullfunc frames silently, since they are used only to
 	 * control station power saving mode. */
 	if (ieee80211_is_nullfunc(hdr->frame_control)) {
 		I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
 		/* Update counter and free packet here to avoid counting this
 		 * as a dropped packed. */
 		sta->rx_packets++;
 		dev_kfree_skb(rx->skb);
 		return RX_QUEUED;
 	}
 	return RX_CONTINUE;
 } /* ieee80211_rx_h_sta_process */
 static inline struct ieee80211_fragment_entry *
 ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
 			 unsigned int frag, unsigned int seq, int rx_queue,
 			 struct sk_buff **skb)
 {
 	struct ieee80211_fragment_entry *entry;
 	int idx;
 	idx = sdata->fragment_next;
 	entry = &sdata->fragments[sdata->fragment_next++];
 	if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
 		sdata->fragment_next = 0;
 	if (!skb_queue_empty(&entry->skb_list)) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
 		struct ieee80211_hdr *hdr =
 			(struct ieee80211_hdr *) entry->skb_list.next->data;
 		printk(KERN_DEBUG "%s: RX reassembly removed oldest "
 		       "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
 		       "addr1=%pM addr2=%pM\n",
 		       sdata->dev->name, idx,
 		       jiffies - entry->first_frag_time, entry->seq,
 		       entry->last_frag, hdr->addr1, hdr->addr2);
 #endif
 		__skb_queue_purge(&entry->skb_list);
 	}
 	__skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
 	*skb = NULL;
 	entry->first_frag_time = jiffies;
 	entry->seq = seq;
 	entry->rx_queue = rx_queue;
 	entry->last_frag = frag;
 	entry->ccmp = 0;
 	entry->extra_len = 0;
 	return entry;
 }
 static inline struct ieee80211_fragment_entry *
 ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
 			  unsigned int frag, unsigned int seq,
 			  int rx_queue, struct ieee80211_hdr *hdr)
 {
 	struct ieee80211_fragment_entry *entry;
 	int i, idx;
 	idx = sdata->fragment_next;
 	for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
 		struct ieee80211_hdr *f_hdr;
 		idx--;
 		if (idx < 0)
 			idx = IEEE80211_FRAGMENT_MAX - 1;
 		entry = &sdata->fragments[idx];
 		if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
 		    entry->rx_queue != rx_queue ||
 		    entry->last_frag + 1 != frag)
 			continue;
 		f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
 		/*
 		 * Check ftype and addresses are equal, else check next fragment
 		 */
 		if (((hdr->frame_control ^ f_hdr->frame_control) &
 		     cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
 		    compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
 		    compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
 			continue;
 		if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
 			__skb_queue_purge(&entry->skb_list);
 			continue;
 		}
 		return entry;
 	}
 	return NULL;
 }
 static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
 {
 	struct ieee80211_hdr *hdr;
 	u16 sc;
 	__le16 fc;
 	unsigned int frag, seq;
 	struct ieee80211_fragment_entry *entry;
 	struct sk_buff *skb;
 	hdr = (struct ieee80211_hdr *)rx->skb->data;
 	fc = hdr->frame_control;
 	sc = le16_to_cpu(hdr->seq_ctrl);
 	frag = sc & IEEE80211_SCTL_FRAG;
 	if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
 		   (rx->skb)->len < 24 ||
 		   is_multicast_ether_addr(hdr->addr1))) {
 		/* not fragmented */
 		goto out;
 	}
 	I802_DEBUG_INC(rx->local->rx_handlers_fragments);
 	seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
 	if (frag == 0) {
 		/* This is the first fragment of a new frame. */
 		entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
 						 rx->queue, &(rx->skb));
 		if (rx->key && rx->key->conf.alg == ALG_CCMP &&
 		    ieee80211_has_protected(fc)) {
 			/* Store CCMP PN so that we can verify that the next
 			 * fragment has a sequential PN value. */
 			entry->ccmp = 1;
 			memcpy(entry->last_pn,
 			       rx->key->u.ccmp.rx_pn[rx->queue],
 			       CCMP_PN_LEN);
 		}
 		return RX_QUEUED;
 	}
 	/* This is a fragment for a frame that should already be pending in
 	 * fragment cache. Add this fragment to the end of the pending entry.
 	 */
 	entry = ieee80211_reassemble_find(rx->sdata, frag, seq, rx->queue, hdr);
 	if (!entry) {
 		I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
 		return RX_DROP_MONITOR;
 	}
 	/* Verify that MPDUs within one MSDU have sequential PN values.
 	 * (IEEE 802.11i, 8.3.3.4.5) */
 	if (entry->ccmp) {
 		int i;
 		u8 pn[CCMP_PN_LEN], *rpn;
 		if (!rx->key || rx->key->conf.alg != ALG_CCMP)
 			return RX_DROP_UNUSABLE;
 		memcpy(pn, entry->last_pn, CCMP_PN_LEN);
 		for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
 			pn[i]++;
 			if (pn[i])
 				break;
 		}
 		rpn = rx->key->u.ccmp.rx_pn[rx->queue];
 		if (memcmp(pn, rpn, CCMP_PN_LEN))
 			return RX_DROP_UNUSABLE;
 		memcpy(entry->last_pn, pn, CCMP_PN_LEN);
 	}
 	skb_pull(rx->skb, ieee80211_hdrlen(fc));
 	__skb_queue_tail(&entry->skb_list, rx->skb);
 	entry->last_frag = frag;
 	entry->extra_len += rx->skb->len;
 	if (ieee80211_has_morefrags(fc)) {
 		rx->skb = NULL;
 		return RX_QUEUED;
 	}
 	rx->skb = __skb_dequeue(&entry->skb_list);
 	if (skb_tailroom(rx->skb) < entry->extra_len) {
 		I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
 		if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
 					      GFP_ATOMIC))) {
 			I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
 			__skb_queue_purge(&entry->skb_list);
 			return RX_DROP_UNUSABLE;
 		}
 	}
 	while ((skb = __skb_dequeue(&entry->skb_list))) {
 		memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
 		dev_kfree_skb(skb);
 	}
 	/* Complete frame has been reassembled - process it now */
 	rx->flags |= IEEE80211_RX_FRAGMENTED;
  out:
 	if (rx->sta)
 		rx->sta->rx_packets++;
 	if (is_multicast_ether_addr(hdr->addr1))
 		rx->local->dot11MulticastReceivedFrameCount++;
 	else
 		ieee80211_led_rx(rx->local);
 	return RX_CONTINUE;
 }
 static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
 {
 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
 	struct sk_buff *skb;
 	int no_pending_pkts;
 	__le16 fc = ((struct ieee80211_hdr *)rx->skb->data)->frame_control;
 	if (likely(!rx->sta || !ieee80211_is_pspoll(fc) ||
 		   !(rx->flags & IEEE80211_RX_RA_MATCH)))
 		return RX_CONTINUE;
 	if ((sdata->vif.type != NL80211_IFTYPE_AP) &&
 	    (sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
 		return RX_DROP_UNUSABLE;
 	skb = skb_dequeue(&rx->sta->tx_filtered);
 	if (!skb) {
 		skb = skb_dequeue(&rx->sta->ps_tx_buf);
 		if (skb)
 			rx->local->total_ps_buffered--;
 	}
 	no_pending_pkts = skb_queue_empty(&rx->sta->tx_filtered) &&
 		skb_queue_empty(&rx->sta->ps_tx_buf);
 	if (skb) {
 		struct ieee80211_hdr *hdr =
 			(struct ieee80211_hdr *) skb->data;
 		/*
 		 * Tell TX path to send one frame even though the STA may
 		 * still remain is PS mode after this frame exchange.
 		 */
 		set_sta_flags(rx->sta, WLAN_STA_PSPOLL);
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
 		printk(KERN_DEBUG "STA %pM aid %d: PS Poll (entries after %d)\n",
 		       rx->sta->sta.addr, rx->sta->sta.aid,
 		       skb_queue_len(&rx->sta->ps_tx_buf));
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 		/* Use MoreData flag to indicate whether there are more
 		 * buffered frames for this STA */
 		if (no_pending_pkts)
 			hdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
 		else
 			hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREDATA);
 		dev_queue_xmit(skb);
 		if (no_pending_pkts)
 			sta_info_clear_tim_bit(rx->sta);
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
 	} else if (!rx->sent_ps_buffered) {
 		/*
 		 * FIXME: This can be the result of a race condition between
 		 *	  us expiring a frame and the station polling for it.
 		 *	  Should we send it a null-func frame indicating we
 		 *	  have nothing buffered for it?
 		 */
 		printk(KERN_DEBUG "%s: STA %pM sent PS Poll even "
 		       "though there are no buffered frames for it\n",
 		       rx->dev->name, rx->sta->sta.addr);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 	}
 	/* Free PS Poll skb here instead of returning RX_DROP that would
 	 * count as an dropped frame. */
 	dev_kfree_skb(rx->skb);
 	return RX_QUEUED;
 }
 static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data *rx)
 {
 	u8 *data = rx->skb->data;
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)data;
 	if (!ieee80211_is_data_qos(hdr->frame_control))
 		return RX_CONTINUE;
 	/* remove the qos control field, update frame type and meta-data */
 	memmove(data + IEEE80211_QOS_CTL_LEN, data,
 		ieee80211_hdrlen(hdr->frame_control) - IEEE80211_QOS_CTL_LEN);
 	hdr = (struct ieee80211_hdr *)skb_pull(rx->skb, IEEE80211_QOS_CTL_LEN);
 	/* change frame type to non QOS */
 	hdr->frame_control &= ~cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
 	return RX_CONTINUE;
 }
 static int
 ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
 {
 	if (unlikely(!rx->sta ||
 	    !test_sta_flags(rx->sta, WLAN_STA_AUTHORIZED)))
 		return -EACCES;
 	return 0;
 }
 static int
 ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
 {
 	/*
 	 * Pass through unencrypted frames if the hardware has
 	 * decrypted them already.
 	 */
 	if (rx->status->flag & RX_FLAG_DECRYPTED)
 		return 0;
 	/* Drop unencrypted frames if key is set. */
 	if (unlikely(!ieee80211_has_protected(fc) &&
 		     !ieee80211_is_nullfunc(fc) &&
+		     (!ieee80211_is_mgmt(fc) ||
+		      (ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
+		       rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP))) &&
+		     (rx->key || rx->sdata->drop_unencrypted)))
+		return -EACCES;
+	/* BIP does not use Protected field, so need to check MMIE */
+	if (unlikely(rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP) &&
+		     ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
+		     ieee80211_get_mmie_keyidx(rx->skb) < 0 &&
 		     (rx->key || rx->sdata->drop_unencrypted)))
 		return -EACCES;
 	return 0;
 }
 static int
 ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
 {
 	struct net_device *dev = rx->dev;
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
 	u16 hdrlen, ethertype;
 	u8 *payload;
 	u8 dst[ETH_ALEN];
 	u8 src[ETH_ALEN] __aligned(2);
 	struct sk_buff *skb = rx->skb;
 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
 		return -1;
 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
 	/* convert IEEE 802.11 header + possible LLC headers into Ethernet
 	 * header
 	 * IEEE 802.11 address fields:
 	 * ToDS FromDS Addr1 Addr2 Addr3 Addr4
 	 *   0     0   DA    SA    BSSID n/a
 	 *   0     1   DA    BSSID SA    n/a
 	 *   1     0   BSSID SA    DA    n/a
 	 *   1     1   RA    TA    DA    SA
 	 */
 	memcpy(dst, ieee80211_get_DA(hdr), ETH_ALEN);
 	memcpy(src, ieee80211_get_SA(hdr), ETH_ALEN);
 	switch (hdr->frame_control &
 		cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
 	case __constant_cpu_to_le16(IEEE80211_FCTL_TODS):
 		if (unlikely(sdata->vif.type != NL80211_IFTYPE_AP &&
 			     sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
 			return -1;
 		break;
 	case __constant_cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
 		if (unlikely(sdata->vif.type != NL80211_IFTYPE_WDS &&
 			     sdata->vif.type != NL80211_IFTYPE_MESH_POINT))
 			return -1;
 		if (ieee80211_vif_is_mesh(&sdata->vif)) {
 			struct ieee80211s_hdr *meshdr = (struct ieee80211s_hdr *)
 				(skb->data + hdrlen);
 			hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
 			if (meshdr->flags & MESH_FLAGS_AE_A5_A6) {
 				memcpy(dst, meshdr->eaddr1, ETH_ALEN);
 				memcpy(src, meshdr->eaddr2, ETH_ALEN);
 			}
 		}
 		break;
 	case __constant_cpu_to_le16(IEEE80211_FCTL_FROMDS):
 		if (sdata->vif.type != NL80211_IFTYPE_STATION ||
 		    (is_multicast_ether_addr(dst) &&
 		     !compare_ether_addr(src, dev->dev_addr)))
 			return -1;
 		break;
 	case __constant_cpu_to_le16(0):
 		if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
 			return -1;
 		break;
 	}
 	if (unlikely(skb->len - hdrlen < 8))
 		return -1;
 	payload = skb->data + hdrlen;
 	ethertype = (payload[6] << 8) | payload[7];
 	if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
 		    ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
 		   compare_ether_addr(payload, bridge_tunnel_header) == 0)) {
 		/* remove RFC1042 or Bridge-Tunnel encapsulation and
 		 * replace EtherType */
 		skb_pull(skb, hdrlen + 6);
 		memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN);
 		memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN);
 	} else {
 		struct ethhdr *ehdr;
 		__be16 len;
 		skb_pull(skb, hdrlen);
 		len = htons(skb->len);
 		ehdr = (struct ethhdr *) skb_push(skb, sizeof(struct ethhdr));
 		memcpy(ehdr->h_dest, dst, ETH_ALEN);
 		memcpy(ehdr->h_source, src, ETH_ALEN);
 		ehdr->h_proto = len;
 	}
 	return 0;
 }
 /*
  * requires that rx->skb is a frame with ethernet header
  */
 static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
 {
 	static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
 		= { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
 	struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
 	/*
 	 * Allow EAPOL frames to us/the PAE group address regardless
 	 * of whether the frame was encrypted or not.
 	 */
 	if (ehdr->h_proto == htons(ETH_P_PAE) &&
 	    (compare_ether_addr(ehdr->h_dest, rx->dev->dev_addr) == 0 ||
 	     compare_ether_addr(ehdr->h_dest, pae_group_addr) == 0))
 		return true;
 	if (ieee80211_802_1x_port_control(rx) ||
 	    ieee80211_drop_unencrypted(rx, fc))
 		return false;
 	return true;
 }
 /*
  * requires that rx->skb is a frame with ethernet header
  */
 static void
 ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
 {
 	struct net_device *dev = rx->dev;
 	struct ieee80211_local *local = rx->local;
 	struct sk_buff *skb, *xmit_skb;
 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 	struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
 	struct sta_info *dsta;
 	skb = rx->skb;
 	xmit_skb = NULL;
 	if ((sdata->vif.type == NL80211_IFTYPE_AP ||
 	     sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
 	    !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
 	    (rx->flags & IEEE80211_RX_RA_MATCH)) {
 		if (is_multicast_ether_addr(ehdr->h_dest)) {
 			/*
 			 * send multicast frames both to higher layers in
 			 * local net stack and back to the wireless medium
 			 */
 			xmit_skb = skb_copy(skb, GFP_ATOMIC);
 			if (!xmit_skb && net_ratelimit())
 				printk(KERN_DEBUG "%s: failed to clone "
 				       "multicast frame\n", dev->name);
 		} else {
 			dsta = sta_info_get(local, skb->data);
 			if (dsta && dsta->sdata->dev == dev) {
 				/*
 				 * The destination station is associated to
 				 * this AP (in this VLAN), so send the frame
 				 * directly to it and do not pass it to local
 				 * net stack.
 				 */
 				xmit_skb = skb;
 				skb = NULL;
 			}
 		}
 	}
 	if (skb) {
 		int align __maybe_unused;
 #if defined(CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT) || !defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
 		/*
 		 * 'align' will only take the values 0 or 2 here
 		 * since all frames are required to be aligned
 		 * to 2-byte boundaries when being passed to
 		 * mac80211. That also explains the __skb_push()
 		 * below.
 		 */
 		align = (unsigned long)skb->data & 4;
 		if (align) {
 			if (WARN_ON(skb_headroom(skb) < 3)) {
 				dev_kfree_skb(skb);
 				skb = NULL;
 			} else {
 				u8 *data = skb->data;
 				size_t len = skb->len;
 				u8 *new = __skb_push(skb, align);
 				memmove(new, data, len);
 				__skb_trim(skb, len);
 			}
 		}
 #endif
 		if (skb) {
 			/* deliver to local stack */
 			skb->protocol = eth_type_trans(skb, dev);
 			memset(skb->cb, 0, sizeof(skb->cb));
 			netif_rx(skb);
 		}
 	}
 	if (xmit_skb) {
 		/* send to wireless media */
 		xmit_skb->protocol = htons(ETH_P_802_3);
 		skb_reset_network_header(xmit_skb);
 		skb_reset_mac_header(xmit_skb);
 		dev_queue_xmit(xmit_skb);
 	}
 }
 static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
 {
 	struct net_device *dev = rx->dev;
 	struct ieee80211_local *local = rx->local;
 	u16 ethertype;
 	u8 *payload;
 	struct sk_buff *skb = rx->skb, *frame = NULL;
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 	__le16 fc = hdr->frame_control;
 	const struct ethhdr *eth;
 	int remaining, err;
 	u8 dst[ETH_ALEN];
 	u8 src[ETH_ALEN];
 	if (unlikely(!ieee80211_is_data(fc)))
 		return RX_CONTINUE;
 	if (unlikely(!ieee80211_is_data_present(fc)))
 		return RX_DROP_MONITOR;
 	if (!(rx->flags & IEEE80211_RX_AMSDU))
 		return RX_CONTINUE;
 	err = ieee80211_data_to_8023(rx);
 	if (unlikely(err))
 		return RX_DROP_UNUSABLE;
 	skb->dev = dev;
 	dev->stats.rx_packets++;
 	dev->stats.rx_bytes += skb->len;
 	/* skip the wrapping header */
 	eth = (struct ethhdr *) skb_pull(skb, sizeof(struct ethhdr));
 	if (!eth)
 		return RX_DROP_UNUSABLE;
 	while (skb != frame) {
 		u8 padding;
 		__be16 len = eth->h_proto;
 		unsigned int subframe_len = sizeof(struct ethhdr) + ntohs(len);
 		remaining = skb->len;
 		memcpy(dst, eth->h_dest, ETH_ALEN);
 		memcpy(src, eth->h_source, ETH_ALEN);
 		padding = ((4 - subframe_len) & 0x3);
 		/* the last MSDU has no padding */
 		if (subframe_len > remaining)
 			return RX_DROP_UNUSABLE;
 		skb_pull(skb, sizeof(struct ethhdr));
 		/* if last subframe reuse skb */
 		if (remaining <= subframe_len + padding)
 			frame = skb;
 		else {
 			/*
 			 * Allocate and reserve two bytes more for payload
 			 * alignment since sizeof(struct ethhdr) is 14.
 			 */
 			frame = dev_alloc_skb(
 				ALIGN(local->hw.extra_tx_headroom, 4) +
 				subframe_len + 2);
 			if (frame == NULL)
 				return RX_DROP_UNUSABLE;
 			skb_reserve(frame,
 				    ALIGN(local->hw.extra_tx_headroom, 4) +
 				    sizeof(struct ethhdr) + 2);
 			memcpy(skb_put(frame, ntohs(len)), skb->data,
 				ntohs(len));
 			eth = (struct ethhdr *) skb_pull(skb, ntohs(len) +
 							padding);
 			if (!eth) {
 				dev_kfree_skb(frame);
 				return RX_DROP_UNUSABLE;
 			}
 		}
 		skb_reset_network_header(frame);
 		frame->dev = dev;
 		frame->priority = skb->priority;
 		rx->skb = frame;
 		payload = frame->data;
 		ethertype = (payload[6] << 8) | payload[7];
 		if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
 			    ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
 			   compare_ether_addr(payload,
 					      bridge_tunnel_header) == 0)) {
 			/* remove RFC1042 or Bridge-Tunnel
 			 * encapsulation and replace EtherType */
 			skb_pull(frame, 6);
 			memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
 			memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
 		} else {
 			memcpy(skb_push(frame, sizeof(__be16)),
 			       &len, sizeof(__be16));
 			memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
 			memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
 		}
 		if (!ieee80211_frame_allowed(rx, fc)) {
 			if (skb == frame) /* last frame */
 				return RX_DROP_UNUSABLE;
 			dev_kfree_skb(frame);
 			continue;
 		}
 		ieee80211_deliver_skb(rx);
 	}
 	return RX_QUEUED;
 }
 #ifdef CONFIG_MAC80211_MESH
 static ieee80211_rx_result
 ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
 {
 	struct ieee80211_hdr *hdr;
 	struct ieee80211s_hdr *mesh_hdr;
 	unsigned int hdrlen;
 	struct sk_buff *skb = rx->skb, *fwd_skb;
 	hdr = (struct ieee80211_hdr *) skb->data;
 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
 	mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
 	if (!ieee80211_is_data(hdr->frame_control))
 		return RX_CONTINUE;
 	if (!mesh_hdr->ttl)
 		/* illegal frame */
 		return RX_DROP_MONITOR;
 	if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6){
 		struct ieee80211_sub_if_data *sdata;
 		struct mesh_path *mppath;
 		sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
 		rcu_read_lock();
 		mppath = mpp_path_lookup(mesh_hdr->eaddr2, sdata);
 		if (!mppath) {
 			mpp_path_add(mesh_hdr->eaddr2, hdr->addr4, sdata);
 		} else {
 			spin_lock_bh(&mppath->state_lock);
 			mppath->exp_time = jiffies;
 			if (compare_ether_addr(mppath->mpp, hdr->addr4) != 0)
 				memcpy(mppath->mpp, hdr->addr4, ETH_ALEN);
 			spin_unlock_bh(&mppath->state_lock);
 		}
 		rcu_read_unlock();
 	}
 	if (compare_ether_addr(rx->dev->dev_addr, hdr->addr3) == 0)
 		return RX_CONTINUE;
 	mesh_hdr->ttl--;
 	if (rx->flags & IEEE80211_RX_RA_MATCH) {
 		if (!mesh_hdr->ttl)
 			IEEE80211_IFSTA_MESH_CTR_INC(&rx->sdata->u.mesh,
 						     dropped_frames_ttl);
 		else {
 			struct ieee80211_hdr *fwd_hdr;
 			fwd_skb = skb_copy(skb, GFP_ATOMIC);
 			if (!fwd_skb && net_ratelimit())
 				printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
 						   rx->dev->name);
 			fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
 			/*
 			 * Save TA to addr1 to send TA a path error if a
 			 * suitable next hop is not found
 			 */
 			memcpy(fwd_hdr->addr1, fwd_hdr->addr2, ETH_ALEN);
 			memcpy(fwd_hdr->addr2, rx->dev->dev_addr, ETH_ALEN);
 			fwd_skb->dev = rx->local->mdev;
 			fwd_skb->iif = rx->dev->ifindex;
 			dev_queue_xmit(fwd_skb);
 		}
 	}
 	if (is_multicast_ether_addr(hdr->addr3) ||
 	    rx->dev->flags & IFF_PROMISC)
 		return RX_CONTINUE;
 	else
 		return RX_DROP_MONITOR;
 }
 #endif
 static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
 {
 	struct net_device *dev = rx->dev;
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
 	__le16 fc = hdr->frame_control;
 	int err;
 	if (unlikely(!ieee80211_is_data(hdr->frame_control)))
 		return RX_CONTINUE;
 	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
 		return RX_DROP_MONITOR;
 	err = ieee80211_data_to_8023(rx);
 	if (unlikely(err))
 		return RX_DROP_UNUSABLE;
 	if (!ieee80211_frame_allowed(rx, fc))
 		return RX_DROP_MONITOR;
 	rx->skb->dev = dev;
 	dev->stats.rx_packets++;
 	dev->stats.rx_bytes += rx->skb->len;
 	ieee80211_deliver_skb(rx);
 	return RX_QUEUED;
 }
 static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
 {
 	struct ieee80211_local *local = rx->local;
 	struct ieee80211_hw *hw = &local->hw;
 	struct sk_buff *skb = rx->skb;
 	struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
 	struct tid_ampdu_rx *tid_agg_rx;
 	u16 start_seq_num;
 	u16 tid;
 	if (likely(!ieee80211_is_ctl(bar->frame_control)))
 		return RX_CONTINUE;
 	if (ieee80211_is_back_req(bar->frame_control)) {
 		if (!rx->sta)
 			return RX_CONTINUE;
 		tid = le16_to_cpu(bar->control) >> 12;
 		if (rx->sta->ampdu_mlme.tid_state_rx[tid]
 					!= HT_AGG_STATE_OPERATIONAL)
 			return RX_CONTINUE;
 		tid_agg_rx = rx->sta->ampdu_mlme.tid_rx[tid];
 		start_seq_num = le16_to_cpu(bar->start_seq_num) >> 4;
 		/* reset session timer */
 		if (tid_agg_rx->timeout) {
 			unsigned long expires =
 				jiffies + (tid_agg_rx->timeout / 1000) * HZ;
 			mod_timer(&tid_agg_rx->session_timer, expires);
 		}
 		/* manage reordering buffer according to requested */
 		/* sequence number */
 		rcu_read_lock();
 		ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, NULL,
 						 start_seq_num, 1);
 		rcu_read_unlock();
 		return RX_DROP_UNUSABLE;
 	}
 	return RX_CONTINUE;
 }
 static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
 {
 	struct ieee80211_local *local = rx->local;
 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
 	struct ieee80211_if_sta *ifsta = &sdata->u.sta;
 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
 	struct ieee80211_bss *bss;
 	int len = rx->skb->len;
 	if (!ieee80211_is_action(mgmt->frame_control))
 		return RX_CONTINUE;
 	if (!rx->sta)
 		return RX_DROP_MONITOR;
 	if (!(rx->flags & IEEE80211_RX_RA_MATCH))
 		return RX_DROP_MONITOR;
 	/* all categories we currently handle have action_code */
 	if (len < IEEE80211_MIN_ACTION_SIZE + 1)
 		return RX_DROP_MONITOR;
 	switch (mgmt->u.action.category) {
 	case WLAN_CATEGORY_BACK:
 		switch (mgmt->u.action.u.addba_req.action_code) {
 		case WLAN_ACTION_ADDBA_REQ:
 			if (len < (IEEE80211_MIN_ACTION_SIZE +
 				   sizeof(mgmt->u.action.u.addba_req)))
 				return RX_DROP_MONITOR;
 			ieee80211_process_addba_request(local, rx->sta, mgmt, len);
 			break;
 		case WLAN_ACTION_ADDBA_RESP:
 			if (len < (IEEE80211_MIN_ACTION_SIZE +
 				   sizeof(mgmt->u.action.u.addba_resp)))
 				return RX_DROP_MONITOR;
 			ieee80211_process_addba_resp(local, rx->sta, mgmt, len);
 			break;
 		case WLAN_ACTION_DELBA:
 			if (len < (IEEE80211_MIN_ACTION_SIZE +
 				   sizeof(mgmt->u.action.u.delba)))
 				return RX_DROP_MONITOR;
 			ieee80211_process_delba(sdata, rx->sta, mgmt, len);
 			break;
 		}
 		break;
 	case WLAN_CATEGORY_SPECTRUM_MGMT:
 		if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
 			return RX_DROP_MONITOR;
 		switch (mgmt->u.action.u.measurement.action_code) {
 		case WLAN_ACTION_SPCT_MSR_REQ:
 			if (len < (IEEE80211_MIN_ACTION_SIZE +
 				   sizeof(mgmt->u.action.u.measurement)))
 				return RX_DROP_MONITOR;
 			ieee80211_process_measurement_req(sdata, mgmt, len);
 			break;
 		case WLAN_ACTION_SPCT_CHL_SWITCH:
 			if (len < (IEEE80211_MIN_ACTION_SIZE +
 				   sizeof(mgmt->u.action.u.chan_switch)))
 				return RX_DROP_MONITOR;
 			if (memcmp(mgmt->bssid, ifsta->bssid, ETH_ALEN) != 0)
 				return RX_DROP_MONITOR;
 			bss = ieee80211_rx_bss_get(local, ifsta->bssid,
 					   local->hw.conf.channel->center_freq,
 					   ifsta->ssid, ifsta->ssid_len);
 			if (!bss)
 				return RX_DROP_MONITOR;
 			ieee80211_process_chanswitch(sdata,
 				     &mgmt->u.action.u.chan_switch.sw_elem, bss);
 			ieee80211_rx_bss_put(local, bss);
 			break;
 		}
 		break;
 	default:
 		return RX_CONTINUE;
 	}
 	rx->sta->rx_packets++;
 	dev_kfree_skb(rx->skb);
 	return RX_QUEUED;
 }
 static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
 {
 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
 	if (!(rx->flags & IEEE80211_RX_RA_MATCH))
 		return RX_DROP_MONITOR;
 	if (ieee80211_vif_is_mesh(&sdata->vif))
 		return ieee80211_mesh_rx_mgmt(sdata, rx->skb, rx->status);
 	if (sdata->vif.type != NL80211_IFTYPE_STATION &&
 	    sdata->vif.type != NL80211_IFTYPE_ADHOC)
 		return RX_DROP_MONITOR;
 	if (sdata->flags & IEEE80211_SDATA_USERSPACE_MLME)
 		return RX_DROP_MONITOR;
 	ieee80211_sta_rx_mgmt(sdata, rx->skb, rx->status);
 	return RX_QUEUED;
 }
 static void ieee80211_rx_michael_mic_report(struct net_device *dev,
 					    struct ieee80211_hdr *hdr,
 					    struct ieee80211_rx_data *rx)
 {
 	int keyidx;
 	unsigned int hdrlen;
 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
 	if (rx->skb->len >= hdrlen + 4)
 		keyidx = rx->skb->data[hdrlen + 3] >> 6;
 	else
 		keyidx = -1;
 	if (!rx->sta) {
 		/*
 		 * Some hardware seem to generate incorrect Michael MIC
 		 * reports; ignore them to avoid triggering countermeasures.
 		 */
 		goto ignore;
 	}
 	if (!ieee80211_has_protected(hdr->frame_control))
 		goto ignore;
 	if (rx->sdata->vif.type == NL80211_IFTYPE_AP && keyidx) {
 		/*
 		 * APs with pairwise keys should never receive Michael MIC
 		 * errors for non-zero keyidx because these are reserved for
 		 * group keys and only the AP is sending real multicast
 		 * frames in the BSS.
 		 */
 		goto ignore;
 	}
 	if (!ieee80211_is_data(hdr->frame_control) &&
 	    !ieee80211_is_auth(hdr->frame_control))
 		goto ignore;
 	mac80211_ev_michael_mic_failure(rx->sdata, keyidx, hdr);
  ignore:
 	dev_kfree_skb(rx->skb);
 	rx->skb = NULL;
 }
 /* TODO: use IEEE80211_RX_FRAGMENTED */
 static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx)
 {
 	struct ieee80211_sub_if_data *sdata;
 	struct ieee80211_local *local = rx->local;
 	struct ieee80211_rtap_hdr {
 		struct ieee80211_radiotap_header hdr;
 		u8 flags;
 		u8 rate;
 		__le16 chan_freq;
 		__le16 chan_flags;
 	} __attribute__ ((packed)) *rthdr;
 	struct sk_buff *skb = rx->skb, *skb2;
 	struct net_device *prev_dev = NULL;
 	struct ieee80211_rx_status *status = rx->status;
 	if (rx->flags & IEEE80211_RX_CMNTR_REPORTED)
 		goto out_free_skb;
 	if (skb_headroom(skb) < sizeof(*rthdr) &&
 	    pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
 		goto out_free_skb;
 	rthdr = (void *)skb_push(skb, sizeof(*rthdr));
 	memset(rthdr, 0, sizeof(*rthdr));
 	rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
 	rthdr->hdr.it_present =
 		cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
 			    (1 << IEEE80211_RADIOTAP_RATE) |
 			    (1 << IEEE80211_RADIOTAP_CHANNEL));
 	rthdr->rate = rx->rate->bitrate / 5;
 	rthdr->chan_freq = cpu_to_le16(status->freq);
 	if (status->band == IEEE80211_BAND_5GHZ)
 		rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_OFDM |
 						IEEE80211_CHAN_5GHZ);
 	else
 		rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_DYN |
 						IEEE80211_CHAN_2GHZ);
 	skb_set_mac_header(skb, 0);
 	skb->ip_summed = CHECKSUM_UNNECESSARY;
 	skb->pkt_type = PACKET_OTHERHOST;
 	skb->protocol = htons(ETH_P_802_2);
 	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
 		if (!netif_running(sdata->dev))
 			continue;
 		if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
 		    !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
 			continue;
 		if (prev_dev) {
 			skb2 = skb_clone(skb, GFP_ATOMIC);
 			if (skb2) {
 				skb2->dev = prev_dev;
 				netif_rx(skb2);
 			}
 		}
 		prev_dev = sdata->dev;
 		sdata->dev->stats.rx_packets++;
 		sdata->dev->stats.rx_bytes += skb->len;
 	}
 	if (prev_dev) {
 		skb->dev = prev_dev;
 		netif_rx(skb);
 		skb = NULL;
 	} else
 		goto out_free_skb;
 	rx->flags |= IEEE80211_RX_CMNTR_REPORTED;
 	return;
  out_free_skb:
 	dev_kfree_skb(skb);
 }
 static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
 					 struct ieee80211_rx_data *rx,
 					 struct sk_buff *skb)
 {
 	ieee80211_rx_result res = RX_DROP_MONITOR;
 	rx->skb = skb;
 	rx->sdata = sdata;
 	rx->dev = sdata->dev;
 #define CALL_RXH(rxh)			\
 	do {				\
 		res = rxh(rx);		\
 		if (res != RX_CONTINUE)	\
 			goto rxh_done;  \
 	} while (0);
 	CALL_RXH(ieee80211_rx_h_passive_scan)
 	CALL_RXH(ieee80211_rx_h_check)
 	CALL_RXH(ieee80211_rx_h_decrypt)
 	CALL_RXH(ieee80211_rx_h_sta_process)
 	CALL_RXH(ieee80211_rx_h_defragment)
 	CALL_RXH(ieee80211_rx_h_ps_poll)
 	CALL_RXH(ieee80211_rx_h_michael_mic_verify)
 	/* must be after MMIC verify so header is counted in MPDU mic */
 	CALL_RXH(ieee80211_rx_h_remove_qos_control)
 	CALL_RXH(ieee80211_rx_h_amsdu)
 #ifdef CONFIG_MAC80211_MESH
 	if (ieee80211_vif_is_mesh(&sdata->vif))
 		CALL_RXH(ieee80211_rx_h_mesh_fwding);
 #endif
 	CALL_RXH(ieee80211_rx_h_data)
 	CALL_RXH(ieee80211_rx_h_ctrl)
 	CALL_RXH(ieee80211_rx_h_action)
 	CALL_RXH(ieee80211_rx_h_mgmt)
 #undef CALL_RXH
  rxh_done:
 	switch (res) {
 	case RX_DROP_MONITOR:
 		I802_DEBUG_INC(sdata->local->rx_handlers_drop);
 		if (rx->sta)
 			rx->sta->rx_dropped++;
 		/* fall through */
 	case RX_CONTINUE:
 		ieee80211_rx_cooked_monitor(rx);
 		break;
 	case RX_DROP_UNUSABLE:
 		I802_DEBUG_INC(sdata->local->rx_handlers_drop);
 		if (rx->sta)
 			rx->sta->rx_dropped++;
 		dev_kfree_skb(rx->skb);
 		break;
 	case RX_QUEUED:
 		I802_DEBUG_INC(sdata->local->rx_handlers_queued);
 		break;
 	}
 }
 /* main receive path */
 static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
 				u8 *bssid, struct ieee80211_rx_data *rx,
 				struct ieee80211_hdr *hdr)
 {
 	int multicast = is_multicast_ether_addr(hdr->addr1);
 	switch (sdata->vif.type) {
 	case NL80211_IFTYPE_STATION:
 		if (!bssid)
 			return 0;
 		if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
 			if (!(rx->flags & IEEE80211_RX_IN_SCAN))
 				return 0;
 			rx->flags &= ~IEEE80211_RX_RA_MATCH;
 		} else if (!multicast &&
 			   compare_ether_addr(sdata->dev->dev_addr,
 					      hdr->addr1) != 0) {
 			if (!(sdata->dev->flags & IFF_PROMISC))
 				return 0;
 			rx->flags &= ~IEEE80211_RX_RA_MATCH;
 		}
 		break;
 	case NL80211_IFTYPE_ADHOC:
 		if (!bssid)
 			return 0;
 		if (ieee80211_is_beacon(hdr->frame_control)) {
 			return 1;
 		}
 		else if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
 			if (!(rx->flags & IEEE80211_RX_IN_SCAN))
 				return 0;
 			rx->flags &= ~IEEE80211_RX_RA_MATCH;
 		} else if (!multicast &&
 			   compare_ether_addr(sdata->dev->dev_addr,
 					      hdr->addr1) != 0) {
 			if (!(sdata->dev->flags & IFF_PROMISC))
 				return 0;
 			rx->flags &= ~IEEE80211_RX_RA_MATCH;
 		} else if (!rx->sta) {
 			int rate_idx;
 			if (rx->status->flag & RX_FLAG_HT)
 				rate_idx = 0; /* TODO: HT rates */
 			else
 				rate_idx = rx->status->rate_idx;
 			rx->sta = ieee80211_ibss_add_sta(sdata, bssid, hdr->addr2,
 				BIT(rate_idx));
 		}
 		break;
 	case NL80211_IFTYPE_MESH_POINT:
 		if (!multicast &&
 		    compare_ether_addr(sdata->dev->dev_addr,
 				       hdr->addr1) != 0) {
 			if (!(sdata->dev->flags & IFF_PROMISC))
 				return 0;
 			rx->flags &= ~IEEE80211_RX_RA_MATCH;
 		}
 		break;
 	case NL80211_IFTYPE_AP_VLAN:
 	case NL80211_IFTYPE_AP:
 		if (!bssid) {
 			if (compare_ether_addr(sdata->dev->dev_addr,
 					       hdr->addr1))
 				return 0;
 		} else if (!ieee80211_bssid_match(bssid,
 					sdata->dev->dev_addr)) {
 			if (!(rx->flags & IEEE80211_RX_IN_SCAN))
 				return 0;
 			rx->flags &= ~IEEE80211_RX_RA_MATCH;
 		}
 		break;
 	case NL80211_IFTYPE_WDS:
 		if (bssid || !ieee80211_is_data(hdr->frame_control))
 			return 0;
 		if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
 			return 0;
 		break;
 	case NL80211_IFTYPE_MONITOR:
 		/* take everything */
 		break;
 	case NL80211_IFTYPE_UNSPECIFIED:
 	case __NL80211_IFTYPE_AFTER_LAST:
 		/* should never get here */
 		WARN_ON(1);
 		break;
 	}
 	return 1;
 }
 /*
  * This is the actual Rx frames handler. as it blongs to Rx path it must
  * be called with rcu_read_lock protection.
  */
 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
 					 struct sk_buff *skb,
 					 struct ieee80211_rx_status *status,
 					 struct ieee80211_rate *rate)
 {
 	struct ieee80211_local *local = hw_to_local(hw);
 	struct ieee80211_sub_if_data *sdata;
 	struct ieee80211_hdr *hdr;
 	struct ieee80211_rx_data rx;
 	int prepares;
 	struct ieee80211_sub_if_data *prev = NULL;
 	struct sk_buff *skb_new;
 	u8 *bssid;
 	hdr = (struct ieee80211_hdr *)skb->data;
 	memset(&rx, 0, sizeof(rx));
 	rx.skb = skb;
 	rx.local = local;
 	rx.status = status;
 	rx.rate = rate;
 	if (ieee80211_is_data(hdr->frame_control) || ieee80211_is_mgmt(hdr->frame_control))
 		local->dot11ReceivedFragmentCount++;
 	rx.sta = sta_info_get(local, hdr->addr2);
 	if (rx.sta) {
 		rx.sdata = rx.sta->sdata;
 		rx.dev = rx.sta->sdata->dev;
 	}
 	if ((status->flag & RX_FLAG_MMIC_ERROR)) {
 		ieee80211_rx_michael_mic_report(local->mdev, hdr, &rx);
 		return;
 	}
 	if (unlikely(local->sw_scanning || local->hw_scanning))
 		rx.flags |= IEEE80211_RX_IN_SCAN;
 	ieee80211_parse_qos(&rx);
 	ieee80211_verify_alignment(&rx);
 	skb = rx.skb;
 	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
 		if (!netif_running(sdata->dev))
 			continue;
 		if (sdata->vif.type == NL80211_IFTYPE_MONITOR)
 			continue;
 		bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
 		rx.flags |= IEEE80211_RX_RA_MATCH;
 		prepares = prepare_for_handlers(sdata, bssid, &rx, hdr);
 		if (!prepares)
 			continue;
 		/*
 		 * frame is destined for this interface, but if it's not
 		 * also for the previous one we handle that after the
 		 * loop to avoid copying the SKB once too much
 		 */
 		if (!prev) {
 			prev = sdata;
 			continue;
 		}
 		/*
 		 * frame was destined for the previous interface
 		 * so invoke RX handlers for it
 		 */
 		skb_new = skb_copy(skb, GFP_ATOMIC);
 		if (!skb_new) {
 			if (net_ratelimit())
 				printk(KERN_DEBUG "%s: failed to copy "
 				       "multicast frame for %s\n",
 				       wiphy_name(local->hw.wiphy),
 				       prev->dev->name);
 			continue;
 		}
 		ieee80211_invoke_rx_handlers(prev, &rx, skb_new);
 		prev = sdata;
 	}
 	if (prev)
 		ieee80211_invoke_rx_handlers(prev, &rx, skb);
 	else
 		dev_kfree_skb(skb);
 }
 #define SEQ_MODULO 0x1000
 #define SEQ_MASK   0xfff
 static inline int seq_less(u16 sq1, u16 sq2)
 {
 	return ((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1);
 }
 static inline u16 seq_inc(u16 sq)
 {
 	return (sq + 1) & SEQ_MASK;
 }
 static inline u16 seq_sub(u16 sq1, u16 sq2)
 {
 	return (sq1 - sq2) & SEQ_MASK;
 }
 /*
  * As it function blongs to Rx path it must be called with
  * the proper rcu_read_lock protection for its flow.
  */
 static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
 					   struct tid_ampdu_rx *tid_agg_rx,
 					   struct sk_buff *skb,
 					   u16 mpdu_seq_num,
 					   int bar_req)
 {
 	struct ieee80211_local *local = hw_to_local(hw);
 	struct ieee80211_rx_status status;
 	u16 head_seq_num, buf_size;
 	int index;
 	struct ieee80211_supported_band *sband;
 	struct ieee80211_rate *rate;
 	buf_size = tid_agg_rx->buf_size;
 	head_seq_num = tid_agg_rx->head_seq_num;
 	/* frame with out of date sequence number */
 	if (seq_less(mpdu_seq_num, head_seq_num)) {
 		dev_kfree_skb(skb);
 		return 1;
 	}
 	/* if frame sequence number exceeds our buffering window size or
 	 * block Ack Request arrived - release stored frames */
 	if ((!seq_less(mpdu_seq_num, head_seq_num + buf_size)) || (bar_req)) {
 		/* new head to the ordering buffer */
 		if (bar_req)
 			head_seq_num = mpdu_seq_num;
 		else
 			head_seq_num =
 				seq_inc(seq_sub(mpdu_seq_num, buf_size));
 		/* release stored frames up to new head to stack */
 		while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
 			index = seq_sub(tid_agg_rx->head_seq_num,
 				tid_agg_rx->ssn)
 				% tid_agg_rx->buf_size;
 			if (tid_agg_rx->reorder_buf[index]) {
 				/* release the reordered frames to stack */
 				memcpy(&status,
 					tid_agg_rx->reorder_buf[index]->cb,
 					sizeof(status));
 				sband = local->hw.wiphy->bands[status.band];
 				if (status.flag & RX_FLAG_HT) {
 					/* TODO: HT rates */
 					rate = sband->bitrates;
 				} else {
 					rate = &sband->bitrates
 						[status.rate_idx];
 				}
 				__ieee80211_rx_handle_packet(hw,
 					tid_agg_rx->reorder_buf[index],
 					&status, rate);
 				tid_agg_rx->stored_mpdu_num--;
 				tid_agg_rx->reorder_buf[index] = NULL;
 			}
 			tid_agg_rx->head_seq_num =
 				seq_inc(tid_agg_rx->head_seq_num);
 		}
 		if (bar_req)
 			return 1;
 	}
 	/* now the new frame is always in the range of the reordering */
 	/* buffer window */
 	index = seq_sub(mpdu_seq_num, tid_agg_rx->ssn)
 				% tid_agg_rx->buf_size;
 	/* check if we already stored this frame */
 	if (tid_agg_rx->reorder_buf[index]) {
 		dev_kfree_skb(skb);
 		return 1;
 	}
 	/* if arrived mpdu is in the right order and nothing else stored */
 	/* release it immediately */
 	if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
 			tid_agg_rx->stored_mpdu_num == 0) {
 		tid_agg_rx->head_seq_num =
 			seq_inc(tid_agg_rx->head_seq_num);
 		return 0;
 	}
 	/* put the frame in the reordering buffer */
 	tid_agg_rx->reorder_buf[index] = skb;
 	tid_agg_rx->stored_mpdu_num++;
 	/* release the buffer until next missing frame */
 	index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn)
 						% tid_agg_rx->buf_size;
 	while (tid_agg_rx->reorder_buf[index]) {
 		/* release the reordered frame back to stack */
 		memcpy(&status, tid_agg_rx->reorder_buf[index]->cb,
 			sizeof(status));
 		sband = local->hw.wiphy->bands[status.band];
 		if (status.flag & RX_FLAG_HT)
 			rate = sband->bitrates; /* TODO: HT rates */
 		else
 			rate = &sband->bitrates[status.rate_idx];
 		__ieee80211_rx_handle_packet(hw, tid_agg_rx->reorder_buf[index],
 					     &status, rate);
 		tid_agg_rx->stored_mpdu_num--;
 		tid_agg_rx->reorder_buf[index] = NULL;
 		tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
 		index =	seq_sub(tid_agg_rx->head_seq_num,
 			tid_agg_rx->ssn) % tid_agg_rx->buf_size;
 	}
 	return 1;
 }
 static u8 ieee80211_rx_reorder_ampdu(struct ieee80211_local *local,
 				     struct sk_buff *skb)
 {
 	struct ieee80211_hw *hw = &local->hw;
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 	struct sta_info *sta;
 	struct tid_ampdu_rx *tid_agg_rx;
 	u16 sc;
 	u16 mpdu_seq_num;
 	u8 ret = 0;
 	int tid;
 	sta = sta_info_get(local, hdr->addr2);
 	if (!sta)
 		return ret;
 	/* filter the QoS data rx stream according to
 	 * STA/TID and check if this STA/TID is on aggregation */
 	if (!ieee80211_is_data_qos(hdr->frame_control))
 		goto end_reorder;
 	tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
 	if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_OPERATIONAL)
 		goto end_reorder;
 	tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
 	/* qos null data frames are excluded */
 	if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
 		goto end_reorder;
 	/* new un-ordered ampdu frame - process it */
 	/* reset session timer */
 	if (tid_agg_rx->timeout) {
 		unsigned long expires =
 			jiffies + (tid_agg_rx->timeout / 1000) * HZ;
 		mod_timer(&tid_agg_rx->session_timer, expires);
 	}
 	/* if this mpdu is fragmented - terminate rx aggregation session */
 	sc = le16_to_cpu(hdr->seq_ctrl);
 	if (sc & IEEE80211_SCTL_FRAG) {
 		ieee80211_sta_stop_rx_ba_session(sta->sdata, sta->sta.addr,
 			tid, 0, WLAN_REASON_QSTA_REQUIRE_SETUP);
 		ret = 1;
 		goto end_reorder;
 	}
 	/* according to mpdu sequence number deal with reordering buffer */
 	mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
 	ret = ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb,
 						mpdu_seq_num, 0);
  end_reorder:
 	return ret;
 }
 /*
  * This is the receive path handler. It is called by a low level driver when an
  * 802.11 MPDU is received from the hardware.
  */
 void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
 		    struct ieee80211_rx_status *status)
 {
 	struct ieee80211_local *local = hw_to_local(hw);
 	struct ieee80211_rate *rate = NULL;
 	struct ieee80211_supported_band *sband;
 	if (status->band < 0 ||
 	    status->band >= IEEE80211_NUM_BANDS) {
 		WARN_ON(1);
 		return;
 	}
 	sband = local->hw.wiphy->bands[status->band];
 	if (!sband) {
 		WARN_ON(1);
 		return;
 	}
 	if (status->flag & RX_FLAG_HT) {
 		/* rate_idx is MCS index */
 		if (WARN_ON(status->rate_idx < 0 ||
 			    status->rate_idx >= 76))
 			return;
 		/* HT rates are not in the table - use the highest legacy rate
 		 * for now since other parts of mac80211 may not yet be fully
 		 * MCS aware. */
 		rate = &sband->bitrates[sband->n_bitrates - 1];
 	} else {
 		if (WARN_ON(status->rate_idx < 0 ||
 			    status->rate_idx >= sband->n_bitrates))
 			return;
 		rate = &sband->bitrates[status->rate_idx];
 	}
 	/*
 	 * key references and virtual interfaces are protected using RCU
 	 * and this requires that we are in a read-side RCU section during
 	 * receive processing
 	 */
 	rcu_read_lock();
 	/*
 	 * Frames with failed FCS/PLCP checksum are not returned,
 	 * all other frames are returned without radiotap header
 	 * if it was previously present.
 	 * Also, frames with less than 16 bytes are dropped.
 	 */
 	skb = ieee80211_rx_monitor(local, skb, status, rate);
 	if (!skb) {
 		rcu_read_unlock();
 		return;
 	}
 	if (!ieee80211_rx_reorder_ampdu(local, skb))
 		__ieee80211_rx_handle_packet(hw, skb, status, rate);
 	rcu_read_unlock();
 }
 EXPORT_SYMBOL(__ieee80211_rx);
 /* This is a version of the rx handler that can be called from hard irq
  * context. Post the skb on the queue and schedule the tasklet */
 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb,
 			  struct ieee80211_rx_status *status)
 {
 	struct ieee80211_local *local = hw_to_local(hw);
 	BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
 	skb->dev = local->mdev;
 	/* copy status into skb->cb for use by tasklet */
 	memcpy(skb->cb, status, sizeof(*status));
 	skb->pkt_type = IEEE80211_RX_MSG;
 	skb_queue_tail(&local->skb_queue, skb);
 	tasklet_schedule(&local->tasklet);
 }
 EXPORT_SYMBOL(ieee80211_rx_irqsafe);

net/mac80211/tx.c

Diff comments View file @ 3cfcf6a

 /*
  * Copyright 2002-2005, Instant802 Networks, Inc.
  * Copyright 2005-2006, Devicescape Software, Inc.
  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
  * Copyright 2007	Johannes Berg <johannes@sipsolutions.net>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  *
  *
  * Transmit and frame generation functions.
  */
 #include <linux/kernel.h>
 #include <linux/slab.h>
 #include <linux/skbuff.h>
 #include <linux/etherdevice.h>
 #include <linux/bitmap.h>
 #include <linux/rcupdate.h>
 #include <net/net_namespace.h>
 #include <net/ieee80211_radiotap.h>
 #include <net/cfg80211.h>
 #include <net/mac80211.h>
 #include <asm/unaligned.h>
 #include "ieee80211_i.h"
 #include "led.h"
 #include "mesh.h"
 #include "wep.h"
 #include "wpa.h"
 #include "wme.h"
 #include "rate.h"
 #define IEEE80211_TX_OK		0
 #define IEEE80211_TX_AGAIN	1
 #define IEEE80211_TX_FRAG_AGAIN	2
 /* misc utils */
 static __le16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
 				 int next_frag_len)
 {
 	int rate, mrate, erp, dur, i;
 	struct ieee80211_rate *txrate;
 	struct ieee80211_local *local = tx->local;
 	struct ieee80211_supported_band *sband;
 	struct ieee80211_hdr *hdr;
 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
 	/* assume HW handles this */
 	if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS)
 		return 0;
 	/* uh huh? */
 	if (WARN_ON_ONCE(info->control.rates[0].idx < 0))
 		return 0;
 	sband = local->hw.wiphy->bands[tx->channel->band];
 	txrate = &sband->bitrates[info->control.rates[0].idx];
 	erp = txrate->flags & IEEE80211_RATE_ERP_G;
 	/*
 	 * data and mgmt (except PS Poll):
 	 * - during CFP: 32768
 	 * - during contention period:
 	 *   if addr1 is group address: 0
 	 *   if more fragments = 0 and addr1 is individual address: time to
 	 *      transmit one ACK plus SIFS
 	 *   if more fragments = 1 and addr1 is individual address: time to
 	 *      transmit next fragment plus 2 x ACK plus 3 x SIFS
 	 *
 	 * IEEE 802.11, 9.6:
 	 * - control response frame (CTS or ACK) shall be transmitted using the
 	 *   same rate as the immediately previous frame in the frame exchange
 	 *   sequence, if this rate belongs to the PHY mandatory rates, or else
 	 *   at the highest possible rate belonging to the PHY rates in the
 	 *   BSSBasicRateSet
 	 */
 	hdr = (struct ieee80211_hdr *)tx->skb->data;
 	if (ieee80211_is_ctl(hdr->frame_control)) {
 		/* TODO: These control frames are not currently sent by
 		 * mac80211, but should they be implemented, this function
 		 * needs to be updated to support duration field calculation.
 		 *
 		 * RTS: time needed to transmit pending data/mgmt frame plus
 		 *    one CTS frame plus one ACK frame plus 3 x SIFS
 		 * CTS: duration of immediately previous RTS minus time
 		 *    required to transmit CTS and its SIFS
 		 * ACK: 0 if immediately previous directed data/mgmt had
 		 *    more=0, with more=1 duration in ACK frame is duration
 		 *    from previous frame minus time needed to transmit ACK
 		 *    and its SIFS
 		 * PS Poll: BIT(15) | BIT(14) | aid
 		 */
 		return 0;
 	}
 	/* data/mgmt */
 	if (0 /* FIX: data/mgmt during CFP */)
 		return cpu_to_le16(32768);
 	if (group_addr) /* Group address as the destination - no ACK */
 		return 0;
 	/* Individual destination address:
 	 * IEEE 802.11, Ch. 9.6 (after IEEE 802.11g changes)
 	 * CTS and ACK frames shall be transmitted using the highest rate in
 	 * basic rate set that is less than or equal to the rate of the
 	 * immediately previous frame and that is using the same modulation
 	 * (CCK or OFDM). If no basic rate set matches with these requirements,
 	 * the highest mandatory rate of the PHY that is less than or equal to
 	 * the rate of the previous frame is used.
 	 * Mandatory rates for IEEE 802.11g PHY: 1, 2, 5.5, 11, 6, 12, 24 Mbps
 	 */
 	rate = -1;
 	/* use lowest available if everything fails */
 	mrate = sband->bitrates[0].bitrate;
 	for (i = 0; i < sband->n_bitrates; i++) {
 		struct ieee80211_rate *r = &sband->bitrates[i];
 		if (r->bitrate > txrate->bitrate)
 			break;
 		if (tx->sdata->vif.bss_conf.basic_rates & BIT(i))
 			rate = r->bitrate;
 		switch (sband->band) {
 		case IEEE80211_BAND_2GHZ: {
 			u32 flag;
 			if (tx->sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
 				flag = IEEE80211_RATE_MANDATORY_G;
 			else
 				flag = IEEE80211_RATE_MANDATORY_B;
 			if (r->flags & flag)
 				mrate = r->bitrate;
 			break;
 		}
 		case IEEE80211_BAND_5GHZ:
 			if (r->flags & IEEE80211_RATE_MANDATORY_A)
 				mrate = r->bitrate;
 			break;
 		case IEEE80211_NUM_BANDS:
 			WARN_ON(1);
 			break;
 		}
 	}
 	if (rate == -1) {
 		/* No matching basic rate found; use highest suitable mandatory
 		 * PHY rate */
 		rate = mrate;
 	}
 	/* Time needed to transmit ACK
 	 * (10 bytes + 4-byte FCS = 112 bits) plus SIFS; rounded up
 	 * to closest integer */
 	dur = ieee80211_frame_duration(local, 10, rate, erp,
 				tx->sdata->vif.bss_conf.use_short_preamble);
 	if (next_frag_len) {
 		/* Frame is fragmented: duration increases with time needed to
 		 * transmit next fragment plus ACK and 2 x SIFS. */
 		dur *= 2; /* ACK + SIFS */
 		/* next fragment */
 		dur += ieee80211_frame_duration(local, next_frag_len,
 				txrate->bitrate, erp,
 				tx->sdata->vif.bss_conf.use_short_preamble);
 	}
 	return cpu_to_le16(dur);
 }
 static int inline is_ieee80211_device(struct ieee80211_local *local,
 				      struct net_device *dev)
 {
 	return local == wdev_priv(dev->ieee80211_ptr);
 }
 /* tx handlers */
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
 {
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
 	u32 sta_flags;
 	if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED))
 		return TX_CONTINUE;
 	if (unlikely(tx->local->sw_scanning) &&
 	    !ieee80211_is_probe_req(hdr->frame_control))
 		return TX_DROP;
 	if (tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
 		return TX_CONTINUE;
 	if (tx->flags & IEEE80211_TX_PS_BUFFERED)
 		return TX_CONTINUE;
 	sta_flags = tx->sta ? get_sta_flags(tx->sta) : 0;
 	if (likely(tx->flags & IEEE80211_TX_UNICAST)) {
 		if (unlikely(!(sta_flags & WLAN_STA_ASSOC) &&
 			     tx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
 			     ieee80211_is_data(hdr->frame_control))) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
 			printk(KERN_DEBUG "%s: dropped data frame to not "
 			       "associated station %pM\n",
 			       tx->dev->name, hdr->addr1);
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
 			I802_DEBUG_INC(tx->local->tx_handlers_drop_not_assoc);
 			return TX_DROP;
 		}
 	} else {
 		if (unlikely(ieee80211_is_data(hdr->frame_control) &&
 			     tx->local->num_sta == 0 &&
 			     tx->sdata->vif.type != NL80211_IFTYPE_ADHOC)) {
 			/*
 			 * No associated STAs - no need to send multicast
 			 * frames.
 			 */
 			return TX_DROP;
 		}
 		return TX_CONTINUE;
 	}
 	return TX_CONTINUE;
 }
 /* This function is called whenever the AP is about to exceed the maximum limit
  * of buffered frames for power saving STAs. This situation should not really
  * happen often during normal operation, so dropping the oldest buffered packet
  * from each queue should be OK to make some room for new frames. */
 static void purge_old_ps_buffers(struct ieee80211_local *local)
 {
 	int total = 0, purged = 0;
 	struct sk_buff *skb;
 	struct ieee80211_sub_if_data *sdata;
 	struct sta_info *sta;
 	/*
 	 * virtual interfaces are protected by RCU
 	 */
 	rcu_read_lock();
 	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
 		struct ieee80211_if_ap *ap;
 		if (sdata->vif.type != NL80211_IFTYPE_AP)
 			continue;
 		ap = &sdata->u.ap;
 		skb = skb_dequeue(&ap->ps_bc_buf);
 		if (skb) {
 			purged++;
 			dev_kfree_skb(skb);
 		}
 		total += skb_queue_len(&ap->ps_bc_buf);
 	}
 	list_for_each_entry_rcu(sta, &local->sta_list, list) {
 		skb = skb_dequeue(&sta->ps_tx_buf);
 		if (skb) {
 			purged++;
 			dev_kfree_skb(skb);
 		}
 		total += skb_queue_len(&sta->ps_tx_buf);
 	}
 	rcu_read_unlock();
 	local->total_ps_buffered = total;
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
 	printk(KERN_DEBUG "%s: PS buffers full - purged %d frames\n",
 	       wiphy_name(local->hw.wiphy), purged);
 #endif
 }
 static ieee80211_tx_result
 ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
 {
 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
 	/*
 	 * broadcast/multicast frame
 	 *
 	 * If any of the associated stations is in power save mode,
 	 * the frame is buffered to be sent after DTIM beacon frame.
 	 * This is done either by the hardware or us.
 	 */
 	/* powersaving STAs only in AP/VLAN mode */
 	if (!tx->sdata->bss)
 		return TX_CONTINUE;
 	/* no buffering for ordered frames */
 	if (ieee80211_has_order(hdr->frame_control))
 		return TX_CONTINUE;
 	/* no stations in PS mode */
 	if (!atomic_read(&tx->sdata->bss->num_sta_ps))
 		return TX_CONTINUE;
 	/* buffered in mac80211 */
 	if (tx->local->hw.flags & IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING) {
 		if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
 			purge_old_ps_buffers(tx->local);
 		if (skb_queue_len(&tx->sdata->bss->ps_bc_buf) >=
 		    AP_MAX_BC_BUFFER) {
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
 			if (net_ratelimit()) {
 				printk(KERN_DEBUG "%s: BC TX buffer full - "
 				       "dropping the oldest frame\n",
 				       tx->dev->name);
 			}
 #endif
 			dev_kfree_skb(skb_dequeue(&tx->sdata->bss->ps_bc_buf));
 		} else
 			tx->local->total_ps_buffered++;
 		skb_queue_tail(&tx->sdata->bss->ps_bc_buf, tx->skb);
 		return TX_QUEUED;
 	}
 	/* buffered in hardware */
 	info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM;
 	return TX_CONTINUE;
 }
 static int ieee80211_use_mfp(__le16 fc, struct sta_info *sta,
 			     struct sk_buff *skb)
 {
 	if (!ieee80211_is_mgmt(fc))
 		return 0;
 	if (sta == NULL || !test_sta_flags(sta, WLAN_STA_MFP))
 		return 0;
 	if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *)
 					    skb->data))
 		return 0;
 	return 1;
 }
 static ieee80211_tx_result
 ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
 {
 	struct sta_info *sta = tx->sta;
 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
 	u32 staflags;
 	if (unlikely(!sta || ieee80211_is_probe_resp(hdr->frame_control)))
 		return TX_CONTINUE;
 	staflags = get_sta_flags(sta);
 	if (unlikely((staflags & WLAN_STA_PS) &&
 		     !(staflags & WLAN_STA_PSPOLL))) {
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
 		printk(KERN_DEBUG "STA %pM aid %d: PS buffer (entries "
 		       "before %d)\n",
 		       sta->sta.addr, sta->sta.aid,
 		       skb_queue_len(&sta->ps_tx_buf));
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 		if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
 			purge_old_ps_buffers(tx->local);
 		if (skb_queue_len(&sta->ps_tx_buf) >= STA_MAX_TX_BUFFER) {
 			struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf);
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
 			if (net_ratelimit()) {
 				printk(KERN_DEBUG "%s: STA %pM TX "
 				       "buffer full - dropping oldest frame\n",
 				       tx->dev->name, sta->sta.addr);
 			}
 #endif
 			dev_kfree_skb(old);
 		} else
 			tx->local->total_ps_buffered++;
 		/* Queue frame to be sent after STA sends an PS Poll frame */
 		if (skb_queue_empty(&sta->ps_tx_buf))
 			sta_info_set_tim_bit(sta);
 		info->control.jiffies = jiffies;
 		skb_queue_tail(&sta->ps_tx_buf, tx->skb);
 		return TX_QUEUED;
 	}
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
 	else if (unlikely(test_sta_flags(sta, WLAN_STA_PS))) {
 		printk(KERN_DEBUG "%s: STA %pM in PS mode, but pspoll "
 		       "set -> send frame\n", tx->dev->name,
 		       sta->sta.addr);
 	}
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 	clear_sta_flags(sta, WLAN_STA_PSPOLL);
 	return TX_CONTINUE;
 }
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_ps_buf(struct ieee80211_tx_data *tx)
 {
 	if (unlikely(tx->flags & IEEE80211_TX_PS_BUFFERED))
 		return TX_CONTINUE;
 	if (tx->flags & IEEE80211_TX_UNICAST)
 		return ieee80211_tx_h_unicast_ps_buf(tx);
 	else
 		return ieee80211_tx_h_multicast_ps_buf(tx);
 }
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
 {
 	struct ieee80211_key *key;
 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
 	if (unlikely(tx->skb->do_not_encrypt))
 		tx->key = NULL;
 	else if (tx->sta && (key = rcu_dereference(tx->sta->key)))
 		tx->key = key;
+	else if (ieee80211_is_mgmt(hdr->frame_control) &&
+		 (key = rcu_dereference(tx->sdata->default_mgmt_key)))
+		tx->key = key;
 	else if ((key = rcu_dereference(tx->sdata->default_key)))
 		tx->key = key;
 	else if (tx->sdata->drop_unencrypted &&
 		 (tx->skb->protocol != cpu_to_be16(ETH_P_PAE)) &&
 		 !(info->flags & IEEE80211_TX_CTL_INJECTED)) {
 		I802_DEBUG_INC(tx->local->tx_handlers_drop_unencrypted);
 		return TX_DROP;
 	} else
 		tx->key = NULL;
 	if (tx->key) {
 		tx->key->tx_rx_count++;
 		/* TODO: add threshold stuff again */
 		switch (tx->key->conf.alg) {
 		case ALG_WEP:
 			if (ieee80211_is_auth(hdr->frame_control))
 				break;
 		case ALG_TKIP:
 			if (!ieee80211_is_data_present(hdr->frame_control))
 				tx->key = NULL;
 			break;
 		case ALG_CCMP:
 			if (!ieee80211_is_data_present(hdr->frame_control) &&
 			    !ieee80211_use_mfp(hdr->frame_control, tx->sta,
 					       tx->skb))
 				tx->key = NULL;
 			break;
+		case ALG_AES_CMAC:
+			if (!ieee80211_is_mgmt(hdr->frame_control))
+				tx->key = NULL;
+			break;
 		}
 	}
 	if (!tx->key || !(tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
 		tx->skb->do_not_encrypt = 1;
 	return TX_CONTINUE;
 }
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
 {
 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
 	struct ieee80211_hdr *hdr = (void *)tx->skb->data;
 	struct ieee80211_supported_band *sband;
 	struct ieee80211_rate *rate;
 	int i, len;
 	bool inval = false, rts = false, short_preamble = false;
 	struct ieee80211_tx_rate_control txrc;
 	memset(&txrc, 0, sizeof(txrc));
 	sband = tx->local->hw.wiphy->bands[tx->channel->band];
 	len = min_t(int, tx->skb->len + FCS_LEN,
 			 tx->local->fragmentation_threshold);
 	/* set up the tx rate control struct we give the RC algo */
 	txrc.hw = local_to_hw(tx->local);
 	txrc.sband = sband;
 	txrc.bss_conf = &tx->sdata->vif.bss_conf;
 	txrc.skb = tx->skb;
 	txrc.reported_rate.idx = -1;
 	txrc.max_rate_idx = tx->sdata->max_ratectrl_rateidx;
 	/* set up RTS protection if desired */
 	if (tx->local->rts_threshold < IEEE80211_MAX_RTS_THRESHOLD &&
 	    len > tx->local->rts_threshold) {
 		txrc.rts = rts = true;
 	}
 	/*
 	 * Use short preamble if the BSS can handle it, but not for
 	 * management frames unless we know the receiver can handle
 	 * that -- the management frame might be to a station that
 	 * just wants a probe response.
 	 */
 	if (tx->sdata->vif.bss_conf.use_short_preamble &&
 	    (ieee80211_is_data(hdr->frame_control) ||
 	     (tx->sta && test_sta_flags(tx->sta, WLAN_STA_SHORT_PREAMBLE))))
 		txrc.short_preamble = short_preamble = true;
 	rate_control_get_rate(tx->sdata, tx->sta, &txrc);
 	if (unlikely(info->control.rates[0].idx < 0))
 		return TX_DROP;
 	if (txrc.reported_rate.idx < 0)
 		txrc.reported_rate = info->control.rates[0];
 	if (tx->sta)
 		tx->sta->last_tx_rate = txrc.reported_rate;
 	if (unlikely(!info->control.rates[0].count))
 		info->control.rates[0].count = 1;
 	if (is_multicast_ether_addr(hdr->addr1)) {
 		/*
 		 * XXX: verify the rate is in the basic rateset
 		 */
 		return TX_CONTINUE;
 	}
 	/*
 	 * set up the RTS/CTS rate as the fastest basic rate
 	 * that is not faster than the data rate
 	 *
 	 * XXX: Should this check all retry rates?
 	 */
 	if (!(info->control.rates[0].flags & IEEE80211_TX_RC_MCS)) {
 		s8 baserate = 0;
 		rate = &sband->bitrates[info->control.rates[0].idx];
 		for (i = 0; i < sband->n_bitrates; i++) {
 			/* must be a basic rate */
 			if (!(tx->sdata->vif.bss_conf.basic_rates & BIT(i)))
 				continue;
 			/* must not be faster than the data rate */
 			if (sband->bitrates[i].bitrate > rate->bitrate)
 				continue;
 			/* maximum */
 			if (sband->bitrates[baserate].bitrate <
 			     sband->bitrates[i].bitrate)
 				baserate = i;
 		}
 		info->control.rts_cts_rate_idx = baserate;
 	}
 	for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
 		/*
 		 * make sure there's no valid rate following
 		 * an invalid one, just in case drivers don't
 		 * take the API seriously to stop at -1.
 		 */
 		if (inval) {
 			info->control.rates[i].idx = -1;
 			continue;
 		}
 		if (info->control.rates[i].idx < 0) {
 			inval = true;
 			continue;
 		}
 		/*
 		 * For now assume MCS is already set up correctly, this
 		 * needs to be fixed.
 		 */
 		if (info->control.rates[i].flags & IEEE80211_TX_RC_MCS) {
 			WARN_ON(info->control.rates[i].idx > 76);
 			continue;
 		}
 		/* set up RTS protection if desired */
 		if (rts)
 			info->control.rates[i].flags |=
 				IEEE80211_TX_RC_USE_RTS_CTS;
 		/* RC is busted */
 		if (WARN_ON_ONCE(info->control.rates[i].idx >=
 				 sband->n_bitrates)) {
 			info->control.rates[i].idx = -1;
 			continue;
 		}
 		rate = &sband->bitrates[info->control.rates[i].idx];
 		/* set up short preamble */
 		if (short_preamble &&
 		    rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 			info->control.rates[i].flags |=
 				IEEE80211_TX_RC_USE_SHORT_PREAMBLE;
 		/* set up G protection */
 		if (!rts && tx->sdata->vif.bss_conf.use_cts_prot &&
 		    rate->flags & IEEE80211_RATE_ERP_G)
 			info->control.rates[i].flags |=
 				IEEE80211_TX_RC_USE_CTS_PROTECT;
 	}
 	return TX_CONTINUE;
 }
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_misc(struct ieee80211_tx_data *tx)
 {
 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
 	if (tx->sta)
 		info->control.sta = &tx->sta->sta;
 	return TX_CONTINUE;
 }
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
 {
 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
 	u16 *seq;
 	u8 *qc;
 	int tid;
 	/*
 	 * Packet injection may want to control the sequence
 	 * number, if we have no matching interface then we
 	 * neither assign one ourselves nor ask the driver to.
 	 */
 	if (unlikely(!info->control.vif))
 		return TX_CONTINUE;
 	if (unlikely(ieee80211_is_ctl(hdr->frame_control)))
 		return TX_CONTINUE;
 	if (ieee80211_hdrlen(hdr->frame_control) < 24)
 		return TX_CONTINUE;
 	/*
 	 * Anything but QoS data that has a sequence number field
 	 * (is long enough) gets a sequence number from the global
 	 * counter.
 	 */
 	if (!ieee80211_is_data_qos(hdr->frame_control)) {
 		/* driver should assign sequence number */
 		info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
 		/* for pure STA mode without beacons, we can do it */
 		hdr->seq_ctrl = cpu_to_le16(tx->sdata->sequence_number);
 		tx->sdata->sequence_number += 0x10;
 		tx->sdata->sequence_number &= IEEE80211_SCTL_SEQ;
 		return TX_CONTINUE;
 	}
 	/*
 	 * This should be true for injected/management frames only, for
 	 * management frames we have set the IEEE80211_TX_CTL_ASSIGN_SEQ
 	 * above since they are not QoS-data frames.
 	 */
 	if (!tx->sta)
 		return TX_CONTINUE;
 	/* include per-STA, per-TID sequence counter */
 	qc = ieee80211_get_qos_ctl(hdr);
 	tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
 	seq = &tx->sta->tid_seq[tid];
 	hdr->seq_ctrl = cpu_to_le16(*seq);
 	/* Increase the sequence number. */
 	*seq = (*seq + 0x10) & IEEE80211_SCTL_SEQ;
 	return TX_CONTINUE;
 }
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
 {
 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
 	size_t hdrlen, per_fragm, num_fragm, payload_len, left;
 	struct sk_buff **frags, *first, *frag;
 	int i;
 	u16 seq;
 	u8 *pos;
 	int frag_threshold = tx->local->fragmentation_threshold;
 	if (!(tx->flags & IEEE80211_TX_FRAGMENTED))
 		return TX_CONTINUE;
 	/*
 	 * Warn when submitting a fragmented A-MPDU frame and drop it.
 	 * This scenario is handled in __ieee80211_tx_prepare but extra
 	 * caution taken here as fragmented ampdu may cause Tx stop.
 	 */
 	if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU))
 		return TX_DROP;
 	first = tx->skb;
 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
 	payload_len = first->len - hdrlen;
 	per_fragm = frag_threshold - hdrlen - FCS_LEN;
 	num_fragm = DIV_ROUND_UP(payload_len, per_fragm);
 	frags = kzalloc(num_fragm * sizeof(struct sk_buff *), GFP_ATOMIC);
 	if (!frags)
 		goto fail;
 	hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREFRAGS);
 	seq = le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_SEQ;
 	pos = first->data + hdrlen + per_fragm;
 	left = payload_len - per_fragm;
 	for (i = 0; i < num_fragm - 1; i++) {
 		struct ieee80211_hdr *fhdr;
 		size_t copylen;
 		if (left <= 0)
 			goto fail;
 		/* reserve enough extra head and tail room for possible
 		 * encryption */
 		frag = frags[i] =
 			dev_alloc_skb(tx->local->tx_headroom +
 				      frag_threshold +
 				      IEEE80211_ENCRYPT_HEADROOM +
 				      IEEE80211_ENCRYPT_TAILROOM);
 		if (!frag)
 			goto fail;
 		/* Make sure that all fragments use the same priority so
 		 * that they end up using the same TX queue */
 		frag->priority = first->priority;
 		skb_reserve(frag, tx->local->tx_headroom +
 				  IEEE80211_ENCRYPT_HEADROOM);
 		/* copy TX information */
 		info = IEEE80211_SKB_CB(frag);
 		memcpy(info, first->cb, sizeof(frag->cb));
 		/* copy/fill in 802.11 header */
 		fhdr = (struct ieee80211_hdr *) skb_put(frag, hdrlen);
 		memcpy(fhdr, first->data, hdrlen);
 		fhdr->seq_ctrl = cpu_to_le16(seq | ((i + 1) & IEEE80211_SCTL_FRAG));
 		if (i == num_fragm - 2) {
 			/* clear MOREFRAGS bit for the last fragment */
 			fhdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREFRAGS);
 		} else {
 			/*
 			 * No multi-rate retries for fragmented frames, that
 			 * would completely throw off the NAV at other STAs.
 			 */
 			info->control.rates[1].idx = -1;
 			info->control.rates[2].idx = -1;
 			info->control.rates[3].idx = -1;
 			info->control.rates[4].idx = -1;
 			BUILD_BUG_ON(IEEE80211_TX_MAX_RATES != 5);
 			info->flags &= ~IEEE80211_TX_CTL_RATE_CTRL_PROBE;
 		}
 		/* copy data */
 		copylen = left > per_fragm ? per_fragm : left;
 		memcpy(skb_put(frag, copylen), pos, copylen);
 		skb_copy_queue_mapping(frag, first);
 		frag->do_not_encrypt = first->do_not_encrypt;
 		pos += copylen;
 		left -= copylen;
 	}
 	skb_trim(first, hdrlen + per_fragm);
 	tx->num_extra_frag = num_fragm - 1;
 	tx->extra_frag = frags;
 	return TX_CONTINUE;
  fail:
 	if (frags) {
 		for (i = 0; i < num_fragm - 1; i++)
 			if (frags[i])
 				dev_kfree_skb(frags[i]);
 		kfree(frags);
 	}
 	I802_DEBUG_INC(tx->local->tx_handlers_drop_fragment);
 	return TX_DROP;
 }
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
 {
 	if (!tx->key)
 		return TX_CONTINUE;
 	switch (tx->key->conf.alg) {
 	case ALG_WEP:
 		return ieee80211_crypto_wep_encrypt(tx);
 	case ALG_TKIP:
 		return ieee80211_crypto_tkip_encrypt(tx);
 	case ALG_CCMP:
 		return ieee80211_crypto_ccmp_encrypt(tx);
+	case ALG_AES_CMAC:
+		return ieee80211_crypto_aes_cmac_encrypt(tx);
 	}
 	/* not reached */
 	WARN_ON(1);
 	return TX_DROP;
 }
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_calculate_duration(struct ieee80211_tx_data *tx)
 {
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
 	int next_len, i;
 	int group_addr = is_multicast_ether_addr(hdr->addr1);
 	if (!(tx->flags & IEEE80211_TX_FRAGMENTED)) {
 		hdr->duration_id = ieee80211_duration(tx, group_addr, 0);
 		return TX_CONTINUE;
 	}
 	hdr->duration_id = ieee80211_duration(tx, group_addr,
 					      tx->extra_frag[0]->len);
 	for (i = 0; i < tx->num_extra_frag; i++) {
 		if (i + 1 < tx->num_extra_frag)
 			next_len = tx->extra_frag[i + 1]->len;
 		else
 			next_len = 0;
 		hdr = (struct ieee80211_hdr *)tx->extra_frag[i]->data;
 		hdr->duration_id = ieee80211_duration(tx, 0, next_len);
 	}
 	return TX_CONTINUE;
 }
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
 {
 	int i;
 	if (!tx->sta)
 		return TX_CONTINUE;
 	tx->sta->tx_packets++;
 	tx->sta->tx_fragments++;
 	tx->sta->tx_bytes += tx->skb->len;
 	if (tx->extra_frag) {
 		tx->sta->tx_fragments += tx->num_extra_frag;
 		for (i = 0; i < tx->num_extra_frag; i++)
 			tx->sta->tx_bytes += tx->extra_frag[i]->len;
 	}
 	return TX_CONTINUE;
 }
 /* actual transmit path */
 /*
  * deal with packet injection down monitor interface
  * with Radiotap Header -- only called for monitor mode interface
  */
 static ieee80211_tx_result
 __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
 			      struct sk_buff *skb)
 {
 	/*
 	 * this is the moment to interpret and discard the radiotap header that
 	 * must be at the start of the packet injected in Monitor mode
 	 *
 	 * Need to take some care with endian-ness since radiotap
 	 * args are little-endian
 	 */
 	struct ieee80211_radiotap_iterator iterator;
 	struct ieee80211_radiotap_header *rthdr =
 		(struct ieee80211_radiotap_header *) skb->data;
 	struct ieee80211_supported_band *sband;
 	int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len);
 	sband = tx->local->hw.wiphy->bands[tx->channel->band];
 	skb->do_not_encrypt = 1;
 	tx->flags &= ~IEEE80211_TX_FRAGMENTED;
 	/*
 	 * for every radiotap entry that is present
 	 * (ieee80211_radiotap_iterator_next returns -ENOENT when no more
 	 * entries present, or -EINVAL on error)
 	 */
 	while (!ret) {
 		ret = ieee80211_radiotap_iterator_next(&iterator);
 		if (ret)
 			continue;
 		/* see if this argument is something we can use */
 		switch (iterator.this_arg_index) {
 		/*
 		 * You must take care when dereferencing iterator.this_arg
 		 * for multibyte types... the pointer is not aligned.  Use
 		 * get_unaligned((type *)iterator.this_arg) to dereference
 		 * iterator.this_arg for type "type" safely on all arches.
 		*/
 		case IEEE80211_RADIOTAP_FLAGS:
 			if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FCS) {
 				/*
 				 * this indicates that the skb we have been
 				 * handed has the 32-bit FCS CRC at the end...
 				 * we should react to that by snipping it off
 				 * because it will be recomputed and added
 				 * on transmission
 				 */
 				if (skb->len < (iterator.max_length + FCS_LEN))
 					return TX_DROP;
 				skb_trim(skb, skb->len - FCS_LEN);
 			}
 			if (*iterator.this_arg & IEEE80211_RADIOTAP_F_WEP)
 				tx->skb->do_not_encrypt = 0;
 			if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FRAG)
 				tx->flags |= IEEE80211_TX_FRAGMENTED;
 			break;
 		/*
 		 * Please update the file
 		 * Documentation/networking/mac80211-injection.txt
 		 * when parsing new fields here.
 		 */
 		default:
 			break;
 		}
 	}
 	if (ret != -ENOENT) /* ie, if we didn't simply run out of fields */
 		return TX_DROP;
 	/*
 	 * remove the radiotap header
 	 * iterator->max_length was sanity-checked against
 	 * skb->len by iterator init
 	 */
 	skb_pull(skb, iterator.max_length);
 	return TX_CONTINUE;
 }
 /*
  * initialises @tx
  */
 static ieee80211_tx_result
 __ieee80211_tx_prepare(struct ieee80211_tx_data *tx,
 		       struct sk_buff *skb,
 		       struct net_device *dev)
 {
 	struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 	struct ieee80211_hdr *hdr;
 	struct ieee80211_sub_if_data *sdata;
 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 	int hdrlen, tid;
 	u8 *qc, *state;
 	memset(tx, 0, sizeof(*tx));
 	tx->skb = skb;
 	tx->dev = dev; /* use original interface */
 	tx->local = local;
 	tx->sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 	tx->channel = local->hw.conf.channel;
 	/*
 	 * Set this flag (used below to indicate "automatic fragmentation"),
 	 * it will be cleared/left by radiotap as desired.
 	 */
 	tx->flags |= IEEE80211_TX_FRAGMENTED;
 	/* process and remove the injection radiotap header */
 	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 	if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED)) {
 		if (__ieee80211_parse_tx_radiotap(tx, skb) == TX_DROP)
 			return TX_DROP;
 		/*
 		 * __ieee80211_parse_tx_radiotap has now removed
 		 * the radiotap header that was present and pre-filled
 		 * 'tx' with tx control information.
 		 */
 	}
 	hdr = (struct ieee80211_hdr *) skb->data;
 	tx->sta = sta_info_get(local, hdr->addr1);
 	if (tx->sta && ieee80211_is_data_qos(hdr->frame_control)) {
 		qc = ieee80211_get_qos_ctl(hdr);
 		tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
 		state = &tx->sta->ampdu_mlme.tid_state_tx[tid];
 		if (*state == HT_AGG_STATE_OPERATIONAL)
 			info->flags |= IEEE80211_TX_CTL_AMPDU;
 	}
 	if (is_multicast_ether_addr(hdr->addr1)) {
 		tx->flags &= ~IEEE80211_TX_UNICAST;
 		info->flags |= IEEE80211_TX_CTL_NO_ACK;
 	} else {
 		tx->flags |= IEEE80211_TX_UNICAST;
 		info->flags &= ~IEEE80211_TX_CTL_NO_ACK;
 	}
 	if (tx->flags & IEEE80211_TX_FRAGMENTED) {
 		if ((tx->flags & IEEE80211_TX_UNICAST) &&
 		    skb->len + FCS_LEN > local->fragmentation_threshold &&
 		    !(info->flags & IEEE80211_TX_CTL_AMPDU))
 			tx->flags |= IEEE80211_TX_FRAGMENTED;
 		else
 			tx->flags &= ~IEEE80211_TX_FRAGMENTED;
 	}
 	if (!tx->sta)
 		info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
 	else if (test_and_clear_sta_flags(tx->sta, WLAN_STA_CLEAR_PS_FILT))
 		info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
 	if (skb->len > hdrlen + sizeof(rfc1042_header) + 2) {
 		u8 *pos = &skb->data[hdrlen + sizeof(rfc1042_header)];
 		tx->ethertype = (pos[0] << 8) | pos[1];
 	}
 	info->flags |= IEEE80211_TX_CTL_FIRST_FRAGMENT;
 	return TX_CONTINUE;
 }
 /*
  * NB: @tx is uninitialised when passed in here
  */
 static int ieee80211_tx_prepare(struct ieee80211_local *local,
 				struct ieee80211_tx_data *tx,
 				struct sk_buff *skb)
 {
 	struct net_device *dev;
 	dev = dev_get_by_index(&init_net, skb->iif);
 	if (unlikely(dev && !is_ieee80211_device(local, dev))) {
 		dev_put(dev);
 		dev = NULL;
 	}
 	if (unlikely(!dev))
 		return -ENODEV;
 	/* initialises tx with control */
 	__ieee80211_tx_prepare(tx, skb, dev);
 	dev_put(dev);
 	return 0;
 }
 static int __ieee80211_tx(struct ieee80211_local *local, struct sk_buff *skb,
 			  struct ieee80211_tx_data *tx)
 {
 	struct ieee80211_tx_info *info;
 	int ret, i;
 	if (skb) {
 		if (netif_subqueue_stopped(local->mdev, skb))
 			return IEEE80211_TX_AGAIN;
 		ret = local->ops->tx(local_to_hw(local), skb);
 		if (ret)
 			return IEEE80211_TX_AGAIN;
 		local->mdev->trans_start = jiffies;
 		ieee80211_led_tx(local, 1);
 	}
 	if (tx->extra_frag) {
 		for (i = 0; i < tx->num_extra_frag; i++) {
 			if (!tx->extra_frag[i])
 				continue;
 			info = IEEE80211_SKB_CB(tx->extra_frag[i]);
 			info->flags &= ~(IEEE80211_TX_CTL_CLEAR_PS_FILT |
 					 IEEE80211_TX_CTL_FIRST_FRAGMENT);
 			if (netif_subqueue_stopped(local->mdev,
 						   tx->extra_frag[i]))
 				return IEEE80211_TX_FRAG_AGAIN;
 			ret = local->ops->tx(local_to_hw(local),
 					    tx->extra_frag[i]);
 			if (ret)
 				return IEEE80211_TX_FRAG_AGAIN;
 			local->mdev->trans_start = jiffies;
 			ieee80211_led_tx(local, 1);
 			tx->extra_frag[i] = NULL;
 		}
 		kfree(tx->extra_frag);
 		tx->extra_frag = NULL;
 	}
 	return IEEE80211_TX_OK;
 }
 /*
  * Invoke TX handlers, return 0 on success and non-zero if the
  * frame was dropped or queued.
  */
 static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
 {
 	struct sk_buff *skb = tx->skb;
 	ieee80211_tx_result res = TX_DROP;
 	int i;
 #define CALL_TXH(txh)		\
 	res = txh(tx);		\
 	if (res != TX_CONTINUE)	\
 		goto txh_done;
 	CALL_TXH(ieee80211_tx_h_check_assoc)
 	CALL_TXH(ieee80211_tx_h_ps_buf)
 	CALL_TXH(ieee80211_tx_h_select_key)
 	CALL_TXH(ieee80211_tx_h_michael_mic_add)
 	CALL_TXH(ieee80211_tx_h_rate_ctrl)
 	CALL_TXH(ieee80211_tx_h_misc)
 	CALL_TXH(ieee80211_tx_h_sequence)
 	CALL_TXH(ieee80211_tx_h_fragment)
 	/* handlers after fragment must be aware of tx info fragmentation! */
 	CALL_TXH(ieee80211_tx_h_encrypt)
 	CALL_TXH(ieee80211_tx_h_calculate_duration)
 	CALL_TXH(ieee80211_tx_h_stats)
 #undef CALL_TXH
  txh_done:
 	if (unlikely(res == TX_DROP)) {
 		I802_DEBUG_INC(tx->local->tx_handlers_drop);
 		dev_kfree_skb(skb);
 		for (i = 0; i < tx->num_extra_frag; i++)
 			if (tx->extra_frag[i])
 				dev_kfree_skb(tx->extra_frag[i]);
 		kfree(tx->extra_frag);
 		return -1;
 	} else if (unlikely(res == TX_QUEUED)) {
 		I802_DEBUG_INC(tx->local->tx_handlers_queued);
 		return -1;
 	}
 	return 0;
 }
 static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb)
 {
 	struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 	struct sta_info *sta;
 	struct ieee80211_tx_data tx;
 	ieee80211_tx_result res_prepare;
 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 	int ret, i;
 	u16 queue;
 	queue = skb_get_queue_mapping(skb);
 	WARN_ON(test_bit(queue, local->queues_pending));
 	if (unlikely(skb->len < 10)) {
 		dev_kfree_skb(skb);
 		return 0;
 	}
 	rcu_read_lock();
 	/* initialises tx */
 	res_prepare = __ieee80211_tx_prepare(&tx, skb, dev);
 	if (res_prepare == TX_DROP) {
 		dev_kfree_skb(skb);
 		rcu_read_unlock();
 		return 0;
 	}
 	sta = tx.sta;
 	tx.channel = local->hw.conf.channel;
 	info->band = tx.channel->band;
 	if (invoke_tx_handlers(&tx))
 		goto out;
 retry:
 	ret = __ieee80211_tx(local, skb, &tx);
 	if (ret) {
 		struct ieee80211_tx_stored_packet *store;
 		/*
 		 * Since there are no fragmented frames on A-MPDU
 		 * queues, there's no reason for a driver to reject
 		 * a frame there, warn and drop it.
 		 */
 		if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU))
 			goto drop;
 		store = &local->pending_packet[queue];
 		if (ret == IEEE80211_TX_FRAG_AGAIN)
 			skb = NULL;
 		set_bit(queue, local->queues_pending);
 		smp_mb();
 		/*
 		 * When the driver gets out of buffers during sending of
 		 * fragments and calls ieee80211_stop_queue, the netif
 		 * subqueue is stopped. There is, however, a small window
 		 * in which the PENDING bit is not yet set. If a buffer
 		 * gets available in that window (i.e. driver calls
 		 * ieee80211_wake_queue), we would end up with ieee80211_tx
 		 * called with the PENDING bit still set. Prevent this by
 		 * continuing transmitting here when that situation is
 		 * possible to have happened.
 		 */
 		if (!__netif_subqueue_stopped(local->mdev, queue)) {
 			clear_bit(queue, local->queues_pending);
 			goto retry;
 		}
 		store->skb = skb;
 		store->extra_frag = tx.extra_frag;
 		store->num_extra_frag = tx.num_extra_frag;
 	}
  out:
 	rcu_read_unlock();
 	return 0;
  drop:
 	if (skb)
 		dev_kfree_skb(skb);
 	for (i = 0; i < tx.num_extra_frag; i++)
 		if (tx.extra_frag[i])
 			dev_kfree_skb(tx.extra_frag[i]);
 	kfree(tx.extra_frag);
 	rcu_read_unlock();
 	return 0;
 }
 /* device xmit handlers */
 static int ieee80211_skb_resize(struct ieee80211_local *local,
 				struct sk_buff *skb,
 				int head_need, bool may_encrypt)
 {
 	int tail_need = 0;
 	/*
 	 * This could be optimised, devices that do full hardware
 	 * crypto (including TKIP MMIC) need no tailroom... But we
 	 * have no drivers for such devices currently.
 	 */
 	if (may_encrypt) {
 		tail_need = IEEE80211_ENCRYPT_TAILROOM;
 		tail_need -= skb_tailroom(skb);
 		tail_need = max_t(int, tail_need, 0);
 	}
 	if (head_need || tail_need) {
 		/* Sorry. Can't account for this any more */
 		skb_orphan(skb);
 	}
 	if (skb_header_cloned(skb))
 		I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
 	else
 		I802_DEBUG_INC(local->tx_expand_skb_head);
 	if (pskb_expand_head(skb, head_need, tail_need, GFP_ATOMIC)) {
 		printk(KERN_DEBUG "%s: failed to reallocate TX buffer\n",
 		       wiphy_name(local->hw.wiphy));
 		return -ENOMEM;
 	}
 	/* update truesize too */
 	skb->truesize += head_need + tail_need;
 	return 0;
 }
 int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
 	struct ieee80211_master_priv *mpriv = netdev_priv(dev);
 	struct ieee80211_local *local = mpriv->local;
 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 	struct net_device *odev = NULL;
 	struct ieee80211_sub_if_data *osdata;
 	int headroom;
 	bool may_encrypt;
 	enum {
 		NOT_MONITOR,
 		FOUND_SDATA,
 		UNKNOWN_ADDRESS,
 	} monitor_iface = NOT_MONITOR;
 	int ret;
 	if (skb->iif)
 		odev = dev_get_by_index(&init_net, skb->iif);
 	if (unlikely(odev && !is_ieee80211_device(local, odev))) {
 		dev_put(odev);
 		odev = NULL;
 	}
 	if (unlikely(!odev)) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
 		printk(KERN_DEBUG "%s: Discarded packet with nonexistent "
 		       "originating device\n", dev->name);
 #endif
 		dev_kfree_skb(skb);
 		return 0;
 	}
 	if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
 	    local->hw.conf.dynamic_ps_timeout > 0) {
 		if (local->hw.conf.flags & IEEE80211_CONF_PS) {
 			ieee80211_stop_queues_by_reason(&local->hw,
 					IEEE80211_QUEUE_STOP_REASON_PS);
 			queue_work(local->hw.workqueue,
 					&local->dynamic_ps_disable_work);
 		}
 		mod_timer(&local->dynamic_ps_timer, jiffies +
 		        msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
 	}
 	memset(info, 0, sizeof(*info));
 	info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
 	osdata = IEEE80211_DEV_TO_SUB_IF(odev);
 	if (ieee80211_vif_is_mesh(&osdata->vif) &&
 	    ieee80211_is_data(hdr->frame_control)) {
 		if (is_multicast_ether_addr(hdr->addr3))
 			memcpy(hdr->addr1, hdr->addr3, ETH_ALEN);
 		else
 			if (mesh_nexthop_lookup(skb, osdata)) {
 				dev_put(odev);
 				return 0;
 			}
 		if (memcmp(odev->dev_addr, hdr->addr4, ETH_ALEN) != 0)
 			IEEE80211_IFSTA_MESH_CTR_INC(&osdata->u.mesh,
 							    fwded_frames);
 	} else if (unlikely(osdata->vif.type == NL80211_IFTYPE_MONITOR)) {
 		struct ieee80211_sub_if_data *sdata;
 		int hdrlen;
 		u16 len_rthdr;
 		info->flags |= IEEE80211_TX_CTL_INJECTED;
 		monitor_iface = UNKNOWN_ADDRESS;
 		len_rthdr = ieee80211_get_radiotap_len(skb->data);
 		hdr = (struct ieee80211_hdr *)skb->data + len_rthdr;
 		hdrlen = ieee80211_hdrlen(hdr->frame_control);
 		/* check the header is complete in the frame */
 		if (likely(skb->len >= len_rthdr + hdrlen)) {
 			/*
 			 * We process outgoing injected frames that have a
 			 * local address we handle as though they are our
 			 * own frames.
 			 * This code here isn't entirely correct, the local
 			 * MAC address is not necessarily enough to find
 			 * the interface to use; for that proper VLAN/WDS
 			 * support we will need a different mechanism.
 			 */
 			rcu_read_lock();
 			list_for_each_entry_rcu(sdata, &local->interfaces,
 						list) {
 				if (!netif_running(sdata->dev))
 					continue;
 				if (compare_ether_addr(sdata->dev->dev_addr,
 						       hdr->addr2)) {
 					dev_hold(sdata->dev);
 					dev_put(odev);
 					osdata = sdata;
 					odev = osdata->dev;
 					skb->iif = sdata->dev->ifindex;
 					monitor_iface = FOUND_SDATA;
 					break;
 				}
 			}
 			rcu_read_unlock();
 		}
 	}
 	may_encrypt = !skb->do_not_encrypt;
 	headroom = osdata->local->tx_headroom;
 	if (may_encrypt)
 		headroom += IEEE80211_ENCRYPT_HEADROOM;
 	headroom -= skb_headroom(skb);
 	headroom = max_t(int, 0, headroom);
 	if (ieee80211_skb_resize(osdata->local, skb, headroom, may_encrypt)) {
 		dev_kfree_skb(skb);
 		dev_put(odev);
 		return 0;
 	}
 	if (osdata->vif.type == NL80211_IFTYPE_AP_VLAN)
 		osdata = container_of(osdata->bss,
 				      struct ieee80211_sub_if_data,
 				      u.ap);
 	if (likely(monitor_iface != UNKNOWN_ADDRESS))
 		info->control.vif = &osdata->vif;
 	ret = ieee80211_tx(odev, skb);
 	dev_put(odev);
 	return ret;
 }
 int ieee80211_monitor_start_xmit(struct sk_buff *skb,
 				 struct net_device *dev)
 {
 	struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 	struct ieee80211_radiotap_header *prthdr =
 		(struct ieee80211_radiotap_header *)skb->data;
 	u16 len_rthdr;
 	/* check for not even having the fixed radiotap header part */
 	if (unlikely(skb->len < sizeof(struct ieee80211_radiotap_header)))
 		goto fail; /* too short to be possibly valid */
 	/* is it a header version we can trust to find length from? */
 	if (unlikely(prthdr->it_version))
 		goto fail; /* only version 0 is supported */
 	/* then there must be a radiotap header with a length we can use */
 	len_rthdr = ieee80211_get_radiotap_len(skb->data);
 	/* does the skb contain enough to deliver on the alleged length? */
 	if (unlikely(skb->len < len_rthdr))
 		goto fail; /* skb too short for claimed rt header extent */
 	skb->dev = local->mdev;
 	/* needed because we set skb device to master */
 	skb->iif = dev->ifindex;
 	/* sometimes we do encrypt injected frames, will be fixed
 	 * up in radiotap parser if not wanted */
 	skb->do_not_encrypt = 0;
 	/*
 	 * fix up the pointers accounting for the radiotap
 	 * header still being in there.  We are being given
 	 * a precooked IEEE80211 header so no need for
 	 * normal processing
 	 */
 	skb_set_mac_header(skb, len_rthdr);
 	/*
 	 * these are just fixed to the end of the rt area since we
 	 * don't have any better information and at this point, nobody cares
 	 */
 	skb_set_network_header(skb, len_rthdr);
 	skb_set_transport_header(skb, len_rthdr);
 	/* pass the radiotap header up to the next stage intact */
 	dev_queue_xmit(skb);
 	return NETDEV_TX_OK;
 fail:
 	dev_kfree_skb(skb);
 	return NETDEV_TX_OK; /* meaning, we dealt with the skb */
 }
 /**
  * ieee80211_subif_start_xmit - netif start_xmit function for Ethernet-type
  * subinterfaces (wlan#, WDS, and VLAN interfaces)
  * @skb: packet to be sent
  * @dev: incoming interface
  *
  * Returns: 0 on success (and frees skb in this case) or 1 on failure (skb will
  * not be freed, and caller is responsible for either retrying later or freeing
  * skb).
  *
  * This function takes in an Ethernet header and encapsulates it with suitable
  * IEEE 802.11 header based on which interface the packet is coming in. The
  * encapsulated packet will then be passed to master interface, wlan#.11, for
  * transmission (through low-level driver).
  */
 int ieee80211_subif_start_xmit(struct sk_buff *skb,
 			       struct net_device *dev)
 {
 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 	struct ieee80211_local *local = sdata->local;
 	int ret = 1, head_need;
 	u16 ethertype, hdrlen,  meshhdrlen = 0;
 	__le16 fc;
 	struct ieee80211_hdr hdr;
 	struct ieee80211s_hdr mesh_hdr;
 	const u8 *encaps_data;
 	int encaps_len, skip_header_bytes;
 	int nh_pos, h_pos;
 	struct sta_info *sta;
 	u32 sta_flags = 0;
 	if (unlikely(skb->len < ETH_HLEN)) {
 		ret = 0;
 		goto fail;
 	}
 	nh_pos = skb_network_header(skb) - skb->data;
 	h_pos = skb_transport_header(skb) - skb->data;
 	/* convert Ethernet header to proper 802.11 header (based on
 	 * operation mode) */
 	ethertype = (skb->data[12] << 8) | skb->data[13];
 	fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA);
 	switch (sdata->vif.type) {
 	case NL80211_IFTYPE_AP:
 	case NL80211_IFTYPE_AP_VLAN:
 		fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
 		/* DA BSSID SA */
 		memcpy(hdr.addr1, skb->data, ETH_ALEN);
 		memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
 		memcpy(hdr.addr3, skb->data + ETH_ALEN, ETH_ALEN);
 		hdrlen = 24;
 		break;
 	case NL80211_IFTYPE_WDS:
 		fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
 		/* RA TA DA SA */
 		memcpy(hdr.addr1, sdata->u.wds.remote_addr, ETH_ALEN);
 		memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
 		memcpy(hdr.addr3, skb->data, ETH_ALEN);
 		memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
 		hdrlen = 30;
 		break;
 #ifdef CONFIG_MAC80211_MESH
 	case NL80211_IFTYPE_MESH_POINT:
 		fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
 		if (!sdata->u.mesh.mshcfg.dot11MeshTTL) {
 			/* Do not send frames with mesh_ttl == 0 */
 			sdata->u.mesh.mshstats.dropped_frames_ttl++;
 			ret = 0;
 			goto fail;
 		}
 		memset(&mesh_hdr, 0, sizeof(mesh_hdr));
 		if (compare_ether_addr(dev->dev_addr,
 					  skb->data + ETH_ALEN) == 0) {
 			/* RA TA DA SA */
 			memset(hdr.addr1, 0, ETH_ALEN);
 			memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
 			memcpy(hdr.addr3, skb->data, ETH_ALEN);
 			memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
 			meshhdrlen = ieee80211_new_mesh_header(&mesh_hdr, sdata);
 		} else {
 			/* packet from other interface */
 			struct mesh_path *mppath;
 			memset(hdr.addr1, 0, ETH_ALEN);
 			memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
 			memcpy(hdr.addr4, dev->dev_addr, ETH_ALEN);
 			if (is_multicast_ether_addr(skb->data))
 				memcpy(hdr.addr3, skb->data, ETH_ALEN);
 			else {
 				rcu_read_lock();
 				mppath = mpp_path_lookup(skb->data, sdata);
 				if (mppath)
 					memcpy(hdr.addr3, mppath->mpp, ETH_ALEN);
 				else
 					memset(hdr.addr3, 0xff, ETH_ALEN);
 				rcu_read_unlock();
 			}
 			mesh_hdr.flags |= MESH_FLAGS_AE_A5_A6;
 			mesh_hdr.ttl = sdata->u.mesh.mshcfg.dot11MeshTTL;
 			put_unaligned(cpu_to_le32(sdata->u.mesh.mesh_seqnum), &mesh_hdr.seqnum);
 			memcpy(mesh_hdr.eaddr1, skb->data, ETH_ALEN);
 			memcpy(mesh_hdr.eaddr2, skb->data + ETH_ALEN, ETH_ALEN);
 			sdata->u.mesh.mesh_seqnum++;
 			meshhdrlen = 18;
 		}
 		hdrlen = 30;
 		break;
 #endif
 	case NL80211_IFTYPE_STATION:
 		fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
 		/* BSSID SA DA */
 		memcpy(hdr.addr1, sdata->u.sta.bssid, ETH_ALEN);
 		memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
 		memcpy(hdr.addr3, skb->data, ETH_ALEN);
 		hdrlen = 24;
 		break;
 	case NL80211_IFTYPE_ADHOC:
 		/* DA SA BSSID */
 		memcpy(hdr.addr1, skb->data, ETH_ALEN);
 		memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
 		memcpy(hdr.addr3, sdata->u.sta.bssid, ETH_ALEN);
 		hdrlen = 24;
 		break;
 	default:
 		ret = 0;
 		goto fail;
 	}
 	/*
 	 * There's no need to try to look up the destination
 	 * if it is a multicast address (which can only happen
 	 * in AP mode)
 	 */
 	if (!is_multicast_ether_addr(hdr.addr1)) {
 		rcu_read_lock();
 		sta = sta_info_get(local, hdr.addr1);
 		if (sta)
 			sta_flags = get_sta_flags(sta);
 		rcu_read_unlock();
 	}
 	/* receiver and we are QoS enabled, use a QoS type frame */
 	if (sta_flags & WLAN_STA_WME &&
 	    ieee80211_num_regular_queues(&local->hw) >= 4) {
 		fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
 		hdrlen += 2;
 	}
 	/*
 	 * Drop unicast frames to unauthorised stations unless they are
 	 * EAPOL frames from the local station.
 	 */
 	if (!ieee80211_vif_is_mesh(&sdata->vif) &&
 		unlikely(!is_multicast_ether_addr(hdr.addr1) &&
 		      !(sta_flags & WLAN_STA_AUTHORIZED) &&
 		      !(ethertype == ETH_P_PAE &&
 		       compare_ether_addr(dev->dev_addr,
 					  skb->data + ETH_ALEN) == 0))) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
 		if (net_ratelimit())
 			printk(KERN_DEBUG "%s: dropped frame to %pM"
 			       " (unauthorized port)\n", dev->name,
 			       hdr.addr1);
 #endif
 		I802_DEBUG_INC(local->tx_handlers_drop_unauth_port);
 		ret = 0;
 		goto fail;
 	}
 	hdr.frame_control = fc;
 	hdr.duration_id = 0;
 	hdr.seq_ctrl = 0;
 	skip_header_bytes = ETH_HLEN;
 	if (ethertype == ETH_P_AARP || ethertype == ETH_P_IPX) {
 		encaps_data = bridge_tunnel_header;
 		encaps_len = sizeof(bridge_tunnel_header);
 		skip_header_bytes -= 2;
 	} else if (ethertype >= 0x600) {
 		encaps_data = rfc1042_header;
 		encaps_len = sizeof(rfc1042_header);
 		skip_header_bytes -= 2;
 	} else {
 		encaps_data = NULL;
 		encaps_len = 0;
 	}
 	skb_pull(skb, skip_header_bytes);
 	nh_pos -= skip_header_bytes;
 	h_pos -= skip_header_bytes;
 	head_need = hdrlen + encaps_len + meshhdrlen - skb_headroom(skb);
 	/*
 	 * So we need to modify the skb header and hence need a copy of
 	 * that. The head_need variable above doesn't, so far, include
 	 * the needed header space that we don't need right away. If we
 	 * can, then we don't reallocate right now but only after the
 	 * frame arrives at the master device (if it does...)
 	 *
 	 * If we cannot, however, then we will reallocate to include all
 	 * the ever needed space. Also, if we need to reallocate it anyway,
 	 * make it big enough for everything we may ever need.
 	 */
 	if (head_need > 0 || skb_cloned(skb)) {
 		head_need += IEEE80211_ENCRYPT_HEADROOM;
 		head_need += local->tx_headroom;
 		head_need = max_t(int, 0, head_need);
 		if (ieee80211_skb_resize(local, skb, head_need, true))
 			goto fail;
 	}
 	if (encaps_data) {
 		memcpy(skb_push(skb, encaps_len), encaps_data, encaps_len);
 		nh_pos += encaps_len;
 		h_pos += encaps_len;
 	}
 	if (meshhdrlen > 0) {
 		memcpy(skb_push(skb, meshhdrlen), &mesh_hdr, meshhdrlen);
 		nh_pos += meshhdrlen;
 		h_pos += meshhdrlen;
 	}
 	if (ieee80211_is_data_qos(fc)) {
 		__le16 *qos_control;
 		qos_control = (__le16*) skb_push(skb, 2);
 		memcpy(skb_push(skb, hdrlen - 2), &hdr, hdrlen - 2);
 		/*
 		 * Maybe we could actually set some fields here, for now just
 		 * initialise to zero to indicate no special operation.
 		 */
 		*qos_control = 0;
 	} else
 		memcpy(skb_push(skb, hdrlen), &hdr, hdrlen);
 	nh_pos += hdrlen;
 	h_pos += hdrlen;
 	skb->iif = dev->ifindex;
 	skb->dev = local->mdev;
 	dev->stats.tx_packets++;
 	dev->stats.tx_bytes += skb->len;
 	/* Update skb pointers to various headers since this modified frame
 	 * is going to go through Linux networking code that may potentially
 	 * need things like pointer to IP header. */
 	skb_set_mac_header(skb, 0);
 	skb_set_network_header(skb, nh_pos);
 	skb_set_transport_header(skb, h_pos);
 	dev->trans_start = jiffies;
 	dev_queue_xmit(skb);
 	return 0;
  fail:
 	if (!ret)
 		dev_kfree_skb(skb);
 	return ret;
 }
 /*
  * ieee80211_clear_tx_pending may not be called in a context where
  * it is possible that it packets could come in again.
  */
 void ieee80211_clear_tx_pending(struct ieee80211_local *local)
 {
 	int i, j;
 	struct ieee80211_tx_stored_packet *store;
 	for (i = 0; i < ieee80211_num_regular_queues(&local->hw); i++) {
 		if (!test_bit(i, local->queues_pending))
 			continue;
 		store = &local->pending_packet[i];
 		kfree_skb(store->skb);
 		for (j = 0; j < store->num_extra_frag; j++)
 			kfree_skb(store->extra_frag[j]);
 		kfree(store->extra_frag);
 		clear_bit(i, local->queues_pending);
 	}
 }
 /*
  * Transmit all pending packets. Called from tasklet, locks master device
  * TX lock so that no new packets can come in.
  */
 void ieee80211_tx_pending(unsigned long data)
 {
 	struct ieee80211_local *local = (struct ieee80211_local *)data;
 	struct net_device *dev = local->mdev;
 	struct ieee80211_tx_stored_packet *store;
 	struct ieee80211_tx_data tx;
 	int i, ret;
 	netif_tx_lock_bh(dev);
 	for (i = 0; i < ieee80211_num_regular_queues(&local->hw); i++) {
 		/* Check that this queue is ok */
 		if (__netif_subqueue_stopped(local->mdev, i) &&
 		    !test_bit(i, local->queues_pending_run))
 			continue;
 		if (!test_bit(i, local->queues_pending)) {
 			clear_bit(i, local->queues_pending_run);
 			ieee80211_wake_queue(&local->hw, i);
 			continue;
 		}
 		clear_bit(i, local->queues_pending_run);
 		netif_start_subqueue(local->mdev, i);
 		store = &local->pending_packet[i];
 		tx.extra_frag = store->extra_frag;
 		tx.num_extra_frag = store->num_extra_frag;
 		tx.flags = 0;
 		ret = __ieee80211_tx(local, store->skb, &tx);
 		if (ret) {
 			if (ret == IEEE80211_TX_FRAG_AGAIN)
 				store->skb = NULL;
 		} else {
 			clear_bit(i, local->queues_pending);
 			ieee80211_wake_queue(&local->hw, i);
 		}
 	}
 	netif_tx_unlock_bh(dev);
 }
 /* functions for drivers to get certain frames */
 static void ieee80211_beacon_add_tim(struct ieee80211_if_ap *bss,
 				     struct sk_buff *skb,
 				     struct beacon_data *beacon)
 {
 	u8 *pos, *tim;
 	int aid0 = 0;
 	int i, have_bits = 0, n1, n2;
 	/* Generate bitmap for TIM only if there are any STAs in power save
 	 * mode. */
 	if (atomic_read(&bss->num_sta_ps) > 0)
 		/* in the hope that this is faster than
 		 * checking byte-for-byte */
 		have_bits = !bitmap_empty((unsigned long*)bss->tim,
 					  IEEE80211_MAX_AID+1);
 	if (bss->dtim_count == 0)
 		bss->dtim_count = beacon->dtim_period - 1;
 	else
 		bss->dtim_count--;
 	tim = pos = (u8 *) skb_put(skb, 6);
 	*pos++ = WLAN_EID_TIM;
 	*pos++ = 4;
 	*pos++ = bss->dtim_count;
 	*pos++ = beacon->dtim_period;
 	if (bss->dtim_count == 0 && !skb_queue_empty(&bss->ps_bc_buf))
 		aid0 = 1;
 	if (have_bits) {
 		/* Find largest even number N1 so that bits numbered 1 through
 		 * (N1 x 8) - 1 in the bitmap are 0 and number N2 so that bits
 		 * (N2 + 1) x 8 through 2007 are 0. */
 		n1 = 0;
 		for (i = 0; i < IEEE80211_MAX_TIM_LEN; i++) {
 			if (bss->tim[i]) {
 				n1 = i & 0xfe;
 				break;
 			}
 		}
 		n2 = n1;
 		for (i = IEEE80211_MAX_TIM_LEN - 1; i >= n1; i--) {
 			if (bss->tim[i]) {
 				n2 = i;
 				break;
 			}
 		}
 		/* Bitmap control */
 		*pos++ = n1 | aid0;
 		/* Part Virt Bitmap */
 		memcpy(pos, bss->tim + n1, n2 - n1 + 1);
 		tim[1] = n2 - n1 + 4;
 		skb_put(skb, n2 - n1);
 	} else {
 		*pos++ = aid0; /* Bitmap control */
 		*pos++ = 0; /* Part Virt Bitmap */
 	}
 }
 struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
 				     struct ieee80211_vif *vif)
 {
 	struct ieee80211_local *local = hw_to_local(hw);
 	struct sk_buff *skb = NULL;
 	struct ieee80211_tx_info *info;
 	struct ieee80211_sub_if_data *sdata = NULL;
 	struct ieee80211_if_ap *ap = NULL;
 	struct ieee80211_if_sta *ifsta = NULL;
 	struct beacon_data *beacon;
 	struct ieee80211_supported_band *sband;
 	enum ieee80211_band band = local->hw.conf.channel->band;
 	sband = local->hw.wiphy->bands[band];
 	rcu_read_lock();
 	sdata = vif_to_sdata(vif);
 	if (sdata->vif.type == NL80211_IFTYPE_AP) {
 		ap = &sdata->u.ap;
 		beacon = rcu_dereference(ap->beacon);
 		if (ap && beacon) {
 			/*
 			 * headroom, head length,
 			 * tail length and maximum TIM length
 			 */
 			skb = dev_alloc_skb(local->tx_headroom +
 					    beacon->head_len +
 					    beacon->tail_len + 256);
 			if (!skb)
 				goto out;
 			skb_reserve(skb, local->tx_headroom);
 			memcpy(skb_put(skb, beacon->head_len), beacon->head,
 			       beacon->head_len);
 			/*
 			 * Not very nice, but we want to allow the driver to call
 			 * ieee80211_beacon_get() as a response to the set_tim()
 			 * callback. That, however, is already invoked under the
 			 * sta_lock to guarantee consistent and race-free update
 			 * of the tim bitmap in mac80211 and the driver.
 			 */
 			if (local->tim_in_locked_section) {
 				ieee80211_beacon_add_tim(ap, skb, beacon);
 			} else {
 				unsigned long flags;
 				spin_lock_irqsave(&local->sta_lock, flags);
 				ieee80211_beacon_add_tim(ap, skb, beacon);
 				spin_unlock_irqrestore(&local->sta_lock, flags);
 			}
 			if (beacon->tail)
 				memcpy(skb_put(skb, beacon->tail_len),
 				       beacon->tail, beacon->tail_len);
 		} else
 			goto out;
 	} else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
 		struct ieee80211_hdr *hdr;
 		ifsta = &sdata->u.sta;
 		if (!ifsta->probe_resp)
 			goto out;
 		skb = skb_copy(ifsta->probe_resp, GFP_ATOMIC);
 		if (!skb)
 			goto out;
 		hdr = (struct ieee80211_hdr *) skb->data;
 		hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
 						 IEEE80211_STYPE_BEACON);
 	} else if (ieee80211_vif_is_mesh(&sdata->vif)) {
 		struct ieee80211_mgmt *mgmt;
 		u8 *pos;
 		/* headroom, head length, tail length and maximum TIM length */
 		skb = dev_alloc_skb(local->tx_headroom + 400);
 		if (!skb)
 			goto out;
 		skb_reserve(skb, local->hw.extra_tx_headroom);
 		mgmt = (struct ieee80211_mgmt *)
 			skb_put(skb, 24 + sizeof(mgmt->u.beacon));
 		memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
 		mgmt->frame_control =
 		    cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON);
 		memset(mgmt->da, 0xff, ETH_ALEN);
 		memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
 		/* BSSID is left zeroed, wildcard value */
 		mgmt->u.beacon.beacon_int =
 			cpu_to_le16(local->hw.conf.beacon_int);
 		mgmt->u.beacon.capab_info = 0x0; /* 0x0 for MPs */
 		pos = skb_put(skb, 2);
 		*pos++ = WLAN_EID_SSID;
 		*pos++ = 0x0;
 		mesh_mgmt_ies_add(skb, sdata);
 	} else {
 		WARN_ON(1);
 		goto out;
 	}
 	info = IEEE80211_SKB_CB(skb);
 	skb->do_not_encrypt = 1;
 	info->band = band;
 	/*
 	 * XXX: For now, always use the lowest rate
 	 */
 	info->control.rates[0].idx = 0;
 	info->control.rates[0].count = 1;
 	info->control.rates[1].idx = -1;
 	info->control.rates[2].idx = -1;
 	info->control.rates[3].idx = -1;
 	info->control.rates[4].idx = -1;
 	BUILD_BUG_ON(IEEE80211_TX_MAX_RATES != 5);
 	info->control.vif = vif;
 	info->flags |= IEEE80211_TX_CTL_NO_ACK;
 	info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
 	info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
  out:
 	rcu_read_unlock();
 	return skb;
 }
 EXPORT_SYMBOL(ieee80211_beacon_get);
 void ieee80211_rts_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 		       const void *frame, size_t frame_len,
 		       const struct ieee80211_tx_info *frame_txctl,
 		       struct ieee80211_rts *rts)
 {
 	const struct ieee80211_hdr *hdr = frame;
 	rts->frame_control =
 	    cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_RTS);
 	rts->duration = ieee80211_rts_duration(hw, vif, frame_len,
 					       frame_txctl);
 	memcpy(rts->ra, hdr->addr1, sizeof(rts->ra));
 	memcpy(rts->ta, hdr->addr2, sizeof(rts->ta));
 }
 EXPORT_SYMBOL(ieee80211_rts_get);
 void ieee80211_ctstoself_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 			     const void *frame, size_t frame_len,
 			     const struct ieee80211_tx_info *frame_txctl,
 			     struct ieee80211_cts *cts)
 {
 	const struct ieee80211_hdr *hdr = frame;
 	cts->frame_control =
 	    cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_CTS);
 	cts->duration = ieee80211_ctstoself_duration(hw, vif,
 						     frame_len, frame_txctl);
 	memcpy(cts->ra, hdr->addr1, sizeof(cts->ra));
 }
 EXPORT_SYMBOL(ieee80211_ctstoself_get);
 struct sk_buff *
 ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
 			  struct ieee80211_vif *vif)
 {
 	struct ieee80211_local *local = hw_to_local(hw);
 	struct sk_buff *skb = NULL;
 	struct sta_info *sta;
 	struct ieee80211_tx_data tx;
 	struct ieee80211_sub_if_data *sdata;
 	struct ieee80211_if_ap *bss = NULL;
 	struct beacon_data *beacon;
 	struct ieee80211_tx_info *info;
 	sdata = vif_to_sdata(vif);
 	bss = &sdata->u.ap;
 	if (!bss)
 		return NULL;
 	rcu_read_lock();
 	beacon = rcu_dereference(bss->beacon);
 	if (sdata->vif.type != NL80211_IFTYPE_AP || !beacon || !beacon->head)
 		goto out;
 	if (bss->dtim_count != 0)
 		goto out; /* send buffered bc/mc only after DTIM beacon */
 	while (1) {
 		skb = skb_dequeue(&bss->ps_bc_buf);
 		if (!skb)
 			goto out;
 		local->total_ps_buffered--;
 		if (!skb_queue_empty(&bss->ps_bc_buf) && skb->len >= 2) {
 			struct ieee80211_hdr *hdr =
 				(struct ieee80211_hdr *) skb->data;
 			/* more buffered multicast/broadcast frames ==> set
 			 * MoreData flag in IEEE 802.11 header to inform PS
 			 * STAs */
 			hdr->frame_control |=
 				cpu_to_le16(IEEE80211_FCTL_MOREDATA);
 		}
 		if (!ieee80211_tx_prepare(local, &tx, skb))
 			break;
 		dev_kfree_skb_any(skb);
 	}
 	info = IEEE80211_SKB_CB(skb);
 	sta = tx.sta;
 	tx.flags |= IEEE80211_TX_PS_BUFFERED;
 	tx.channel = local->hw.conf.channel;
 	info->band = tx.channel->band;
 	if (invoke_tx_handlers(&tx))
 		skb = NULL;
  out:
 	rcu_read_unlock();
 	return skb;
 }
 EXPORT_SYMBOL(ieee80211_get_buffered_bc);

net/wireless/nl80211.c

Diff comments View file @ 3cfcf6a

 /*
  * This is the new netlink-based wireless configuration interface.
  *
  * Copyright 2006, 2007	Johannes Berg <johannes@sipsolutions.net>
  */
 #include <linux/if.h>
 #include <linux/module.h>
 #include <linux/err.h>
 #include <linux/mutex.h>
 #include <linux/list.h>
 #include <linux/if_ether.h>
 #include <linux/ieee80211.h>
 #include <linux/nl80211.h>
 #include <linux/rtnetlink.h>
 #include <linux/netlink.h>
 #include <net/genetlink.h>
 #include <net/cfg80211.h>
 #include "core.h"
 #include "nl80211.h"
 #include "reg.h"
 /* the netlink family */
 static struct genl_family nl80211_fam = {
 	.id = GENL_ID_GENERATE,	/* don't bother with a hardcoded ID */
 	.name = "nl80211",	/* have users key off the name instead */
 	.hdrsize = 0,		/* no private header */
 	.version = 1,		/* no particular meaning now */
 	.maxattr = NL80211_ATTR_MAX,
 };
 /* internal helper: get drv and dev */
 static int get_drv_dev_by_info_ifindex(struct nlattr **attrs,
 				       struct cfg80211_registered_device **drv,
 				       struct net_device **dev)
 {
 	int ifindex;
 	if (!attrs[NL80211_ATTR_IFINDEX])
 		return -EINVAL;
 	ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 	*dev = dev_get_by_index(&init_net, ifindex);
 	if (!*dev)
 		return -ENODEV;
 	*drv = cfg80211_get_dev_from_ifindex(ifindex);
 	if (IS_ERR(*drv)) {
 		dev_put(*dev);
 		return PTR_ERR(*drv);
 	}
 	return 0;
 }
 /* policy for the attributes */
 static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
 	[NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 	[NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 				      .len = BUS_ID_SIZE-1 },
 	[NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 	[NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 	[NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 	[NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 	[NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 	[NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 	[NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
 	[NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 				    .len = WLAN_MAX_KEY_LEN },
 	[NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 	[NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 	[NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 	[NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 	[NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 	[NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 				       .len = IEEE80211_MAX_DATA_LEN },
 	[NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 				       .len = IEEE80211_MAX_DATA_LEN },
 	[NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 	[NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 	[NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 	[NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 					       .len = NL80211_MAX_SUPP_RATES },
 	[NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 	[NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 	[NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 	[NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 				.len = IEEE80211_MAX_MESH_ID_LEN },
 	[NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 	[NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 	[NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 	[NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 	[NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 	[NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 	[NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 					   .len = NL80211_MAX_SUPP_RATES },
 	[NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 	[NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 					 .len = NL80211_HT_CAPABILITY_LEN },
 };
 /* message building helper */
 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 				   int flags, u8 cmd)
 {
 	/* since there is no private header just add the generic one */
 	return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 }
 /* netlink command implementations */
 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 			      struct cfg80211_registered_device *dev)
 {
 	void *hdr;
 	struct nlattr *nl_bands, *nl_band;
 	struct nlattr *nl_freqs, *nl_freq;
 	struct nlattr *nl_rates, *nl_rate;
 	struct nlattr *nl_modes;
 	enum ieee80211_band band;
 	struct ieee80211_channel *chan;
 	struct ieee80211_rate *rate;
 	int i;
 	u16 ifmodes = dev->wiphy.interface_modes;
 	hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 	if (!hdr)
 		return -1;
 	NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->idx);
 	NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 	nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 	if (!nl_modes)
 		goto nla_put_failure;
 	i = 0;
 	while (ifmodes) {
 		if (ifmodes & 1)
 			NLA_PUT_FLAG(msg, i);
 		ifmodes >>= 1;
 		i++;
 	}
 	nla_nest_end(msg, nl_modes);
 	nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 	if (!nl_bands)
 		goto nla_put_failure;
 	for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 		if (!dev->wiphy.bands[band])
 			continue;
 		nl_band = nla_nest_start(msg, band);
 		if (!nl_band)
 			goto nla_put_failure;
 		/* add HT info */
 		if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 			NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 				sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 				&dev->wiphy.bands[band]->ht_cap.mcs);
 			NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 				dev->wiphy.bands[band]->ht_cap.cap);
 			NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 				dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 			NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 				dev->wiphy.bands[band]->ht_cap.ampdu_density);
 		}
 		/* add frequencies */
 		nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 		if (!nl_freqs)
 			goto nla_put_failure;
 		for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 			nl_freq = nla_nest_start(msg, i);
 			if (!nl_freq)
 				goto nla_put_failure;
 			chan = &dev->wiphy.bands[band]->channels[i];
 			NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 				    chan->center_freq);
 			if (chan->flags & IEEE80211_CHAN_DISABLED)
 				NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 			if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 				NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 			if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 				NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 			if (chan->flags & IEEE80211_CHAN_RADAR)
 				NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 			NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 				    DBM_TO_MBM(chan->max_power));
 			nla_nest_end(msg, nl_freq);
 		}
 		nla_nest_end(msg, nl_freqs);
 		/* add bitrates */
 		nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 		if (!nl_rates)
 			goto nla_put_failure;
 		for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 			nl_rate = nla_nest_start(msg, i);
 			if (!nl_rate)
 				goto nla_put_failure;
 			rate = &dev->wiphy.bands[band]->bitrates[i];
 			NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 				    rate->bitrate);
 			if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 				NLA_PUT_FLAG(msg,
 					NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 			nla_nest_end(msg, nl_rate);
 		}
 		nla_nest_end(msg, nl_rates);
 		nla_nest_end(msg, nl_band);
 	}
 	nla_nest_end(msg, nl_bands);
 	return genlmsg_end(msg, hdr);
  nla_put_failure:
 	genlmsg_cancel(msg, hdr);
 	return -EMSGSIZE;
 }
 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 {
 	int idx = 0;
 	int start = cb->args[0];
 	struct cfg80211_registered_device *dev;
 	mutex_lock(&cfg80211_drv_mutex);
 	list_for_each_entry(dev, &cfg80211_drv_list, list) {
 		if (++idx <= start)
 			continue;
 		if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 				       cb->nlh->nlmsg_seq, NLM_F_MULTI,
 				       dev) < 0) {
 			idx--;
 			break;
 		}
 	}
 	mutex_unlock(&cfg80211_drv_mutex);
 	cb->args[0] = idx;
 	return skb->len;
 }
 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 {
 	struct sk_buff *msg;
 	struct cfg80211_registered_device *dev;
 	dev = cfg80211_get_dev_from_info(info);
 	if (IS_ERR(dev))
 		return PTR_ERR(dev);
 	msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 	if (!msg)
 		goto out_err;
 	if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 		goto out_free;
 	cfg80211_put_dev(dev);
 	return genlmsg_unicast(msg, info->snd_pid);
  out_free:
 	nlmsg_free(msg);
  out_err:
 	cfg80211_put_dev(dev);
 	return -ENOBUFS;
 }
 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 	[NL80211_TXQ_ATTR_QUEUE]		= { .type = NLA_U8 },
 	[NL80211_TXQ_ATTR_TXOP]			= { .type = NLA_U16 },
 	[NL80211_TXQ_ATTR_CWMIN]		= { .type = NLA_U16 },
 	[NL80211_TXQ_ATTR_CWMAX]		= { .type = NLA_U16 },
 	[NL80211_TXQ_ATTR_AIFS]			= { .type = NLA_U8 },
 };
 static int parse_txq_params(struct nlattr *tb[],
 			    struct ieee80211_txq_params *txq_params)
 {
 	if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 	    !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 	    !tb[NL80211_TXQ_ATTR_AIFS])
 		return -EINVAL;
 	txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 	txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 	txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 	txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 	txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 	return 0;
 }
 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 {
 	struct cfg80211_registered_device *rdev;
 	int result = 0, rem_txq_params = 0;
 	struct nlattr *nl_txq_params;
 	rdev = cfg80211_get_dev_from_info(info);
 	if (IS_ERR(rdev))
 		return PTR_ERR(rdev);
 	if (info->attrs[NL80211_ATTR_WIPHY_NAME]) {
 		result = cfg80211_dev_rename(
 			rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 		if (result)
 			goto bad_res;
 	}
 	if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 		struct ieee80211_txq_params txq_params;
 		struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 		if (!rdev->ops->set_txq_params) {
 			result = -EOPNOTSUPP;
 			goto bad_res;
 		}
 		nla_for_each_nested(nl_txq_params,
 				    info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 				    rem_txq_params) {
 			nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 				  nla_data(nl_txq_params),
 				  nla_len(nl_txq_params),
 				  txq_params_policy);
 			result = parse_txq_params(tb, &txq_params);
 			if (result)
 				goto bad_res;
 			result = rdev->ops->set_txq_params(&rdev->wiphy,
 							   &txq_params);
 			if (result)
 				goto bad_res;
 		}
 	}
 	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 		enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 		struct ieee80211_channel *chan;
 		struct ieee80211_sta_ht_cap *ht_cap;
 		u32 freq, sec_freq;
 		if (!rdev->ops->set_channel) {
 			result = -EOPNOTSUPP;
 			goto bad_res;
 		}
 		result = -EINVAL;
 		if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 			channel_type = nla_get_u32(info->attrs[
 					   NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 			if (channel_type != NL80211_CHAN_NO_HT &&
 			    channel_type != NL80211_CHAN_HT20 &&
 			    channel_type != NL80211_CHAN_HT40PLUS &&
 			    channel_type != NL80211_CHAN_HT40MINUS)
 				goto bad_res;
 		}
 		freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 		chan = ieee80211_get_channel(&rdev->wiphy, freq);
 		/* Primary channel not allowed */
 		if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 			goto bad_res;
 		if (channel_type == NL80211_CHAN_HT40MINUS)
 			sec_freq = freq - 20;
 		else if (channel_type == NL80211_CHAN_HT40PLUS)
 			sec_freq = freq + 20;
 		else
 			sec_freq = 0;
 		ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
 		/* no HT capabilities */
 		if (channel_type != NL80211_CHAN_NO_HT &&
 		    !ht_cap->ht_supported)
 			goto bad_res;
 		if (sec_freq) {
 			struct ieee80211_channel *schan;
 			/* no 40 MHz capabilities */
 			if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
 			    (ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT))
 				goto bad_res;
 			schan = ieee80211_get_channel(&rdev->wiphy, sec_freq);
 			/* Secondary channel not allowed */
 			if (!schan || schan->flags & IEEE80211_CHAN_DISABLED)
 				goto bad_res;
 		}
 		result = rdev->ops->set_channel(&rdev->wiphy, chan,
 						channel_type);
 		if (result)
 			goto bad_res;
 	}
  bad_res:
 	cfg80211_put_dev(rdev);
 	return result;
 }
 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 			      struct net_device *dev)
 {
 	void *hdr;
 	hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
 	if (!hdr)
 		return -1;
 	NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 	NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 	NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 	return genlmsg_end(msg, hdr);
  nla_put_failure:
 	genlmsg_cancel(msg, hdr);
 	return -EMSGSIZE;
 }
 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 {
 	int wp_idx = 0;
 	int if_idx = 0;
 	int wp_start = cb->args[0];
 	int if_start = cb->args[1];
 	struct cfg80211_registered_device *dev;
 	struct wireless_dev *wdev;
 	mutex_lock(&cfg80211_drv_mutex);
 	list_for_each_entry(dev, &cfg80211_drv_list, list) {
 		if (wp_idx < wp_start) {
 			wp_idx++;
 			continue;
 		}
 		if_idx = 0;
 		mutex_lock(&dev->devlist_mtx);
 		list_for_each_entry(wdev, &dev->netdev_list, list) {
 			if (if_idx < if_start) {
 				if_idx++;
 				continue;
 			}
 			if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
 					       cb->nlh->nlmsg_seq, NLM_F_MULTI,
 					       wdev->netdev) < 0) {
 				mutex_unlock(&dev->devlist_mtx);
 				goto out;
 			}
 			if_idx++;
 		}
 		mutex_unlock(&dev->devlist_mtx);
 		wp_idx++;
 	}
  out:
 	mutex_unlock(&cfg80211_drv_mutex);
 	cb->args[0] = wp_idx;
 	cb->args[1] = if_idx;
 	return skb->len;
 }
 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 {
 	struct sk_buff *msg;
 	struct cfg80211_registered_device *dev;
 	struct net_device *netdev;
 	int err;
 	err = get_drv_dev_by_info_ifindex(info->attrs, &dev, &netdev);
 	if (err)
 		return err;
 	msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 	if (!msg)
 		goto out_err;
 	if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0, netdev) < 0)
 		goto out_free;
 	dev_put(netdev);
 	cfg80211_put_dev(dev);
 	return genlmsg_unicast(msg, info->snd_pid);
  out_free:
 	nlmsg_free(msg);
  out_err:
 	dev_put(netdev);
 	cfg80211_put_dev(dev);
 	return -ENOBUFS;
 }
 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 	[NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 	[NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 	[NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 	[NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 	[NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 };
 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 {
 	struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 	int flag;
 	*mntrflags = 0;
 	if (!nla)
 		return -EINVAL;
 	if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
 			     nla, mntr_flags_policy))
 		return -EINVAL;
 	for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
 		if (flags[flag])
 			*mntrflags |= (1<<flag);
 	return 0;
 }
 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 {
 	struct cfg80211_registered_device *drv;
 	struct vif_params params;
 	int err, ifindex;
 	enum nl80211_iftype type;
 	struct net_device *dev;
 	u32 _flags, *flags = NULL;
 	memset(&params, 0, sizeof(params));
 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 	if (err)
 		return err;
 	ifindex = dev->ifindex;
 	type = dev->ieee80211_ptr->iftype;
 	dev_put(dev);
 	err = -EINVAL;
 	if (info->attrs[NL80211_ATTR_IFTYPE]) {
 		type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 		if (type > NL80211_IFTYPE_MAX)
 			goto unlock;
 	}
 	if (!drv->ops->change_virtual_intf ||
 	    !(drv->wiphy.interface_modes & (1 << type))) {
 		err = -EOPNOTSUPP;
 		goto unlock;
 	}
 	if (info->attrs[NL80211_ATTR_MESH_ID]) {
 		if (type != NL80211_IFTYPE_MESH_POINT) {
 			err = -EINVAL;
 			goto unlock;
 		}
 		params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 		params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 	}
 	if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
 		if (type != NL80211_IFTYPE_MONITOR) {
 			err = -EINVAL;
 			goto unlock;
 		}
 		err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
 					  &_flags);
 		if (!err)
 			flags = &_flags;
 	}
 	rtnl_lock();
 	err = drv->ops->change_virtual_intf(&drv->wiphy, ifindex,
 					    type, flags, &params);
 	dev = __dev_get_by_index(&init_net, ifindex);
 	WARN_ON(!dev || (!err && dev->ieee80211_ptr->iftype != type));
 	rtnl_unlock();
  unlock:
 	cfg80211_put_dev(drv);
 	return err;
 }
 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
 {
 	struct cfg80211_registered_device *drv;
 	struct vif_params params;
 	int err;
 	enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
 	u32 flags;
 	memset(&params, 0, sizeof(params));
 	if (!info->attrs[NL80211_ATTR_IFNAME])
 		return -EINVAL;
 	if (info->attrs[NL80211_ATTR_IFTYPE]) {
 		type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 		if (type > NL80211_IFTYPE_MAX)
 			return -EINVAL;
 	}
 	drv = cfg80211_get_dev_from_info(info);
 	if (IS_ERR(drv))
 		return PTR_ERR(drv);
 	if (!drv->ops->add_virtual_intf ||
 	    !(drv->wiphy.interface_modes & (1 << type))) {
 		err = -EOPNOTSUPP;
 		goto unlock;
 	}
 	if (type == NL80211_IFTYPE_MESH_POINT &&
 	    info->attrs[NL80211_ATTR_MESH_ID]) {
 		params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 		params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 	}
 	rtnl_lock();
 	err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
 				  info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
 				  &flags);
 	err = drv->ops->add_virtual_intf(&drv->wiphy,
 		nla_data(info->attrs[NL80211_ATTR_IFNAME]),
 		type, err ? NULL : &flags, &params);
 	rtnl_unlock();
  unlock:
 	cfg80211_put_dev(drv);
 	return err;
 }
 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
 {
 	struct cfg80211_registered_device *drv;
 	int ifindex, err;
 	struct net_device *dev;
 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 	if (err)
 		return err;
 	ifindex = dev->ifindex;
 	dev_put(dev);
 	if (!drv->ops->del_virtual_intf) {
 		err = -EOPNOTSUPP;
 		goto out;
 	}
 	rtnl_lock();
 	err = drv->ops->del_virtual_intf(&drv->wiphy, ifindex);
 	rtnl_unlock();
  out:
 	cfg80211_put_dev(drv);
 	return err;
 }
 struct get_key_cookie {
 	struct sk_buff *msg;
 	int error;
 };
 static void get_key_callback(void *c, struct key_params *params)
 {
 	struct get_key_cookie *cookie = c;
 	if (params->key)
 		NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
 			params->key_len, params->key);
 	if (params->seq)
 		NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
 			params->seq_len, params->seq);
 	if (params->cipher)
 		NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
 			    params->cipher);
 	return;
  nla_put_failure:
 	cookie->error = 1;
 }
 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 {
 	struct cfg80211_registered_device *drv;
 	int err;
 	struct net_device *dev;
 	u8 key_idx = 0;
 	u8 *mac_addr = NULL;
 	struct get_key_cookie cookie = {
 		.error = 0,
 	};
 	void *hdr;
 	struct sk_buff *msg;
 	if (info->attrs[NL80211_ATTR_KEY_IDX])
 		key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
-	if (key_idx > 3)
+	if (key_idx > 5)
 		return -EINVAL;
 	if (info->attrs[NL80211_ATTR_MAC])
 		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 	if (err)
 		return err;
 	if (!drv->ops->get_key) {
 		err = -EOPNOTSUPP;
 		goto out;
 	}
 	msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 	if (!msg) {
 		err = -ENOMEM;
 		goto out;
 	}
 	hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
 			     NL80211_CMD_NEW_KEY);
 	if (IS_ERR(hdr)) {
 		err = PTR_ERR(hdr);
 		goto out;
 	}
 	cookie.msg = msg;
 	NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 	NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
 	if (mac_addr)
 		NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
 	rtnl_lock();
 	err = drv->ops->get_key(&drv->wiphy, dev, key_idx, mac_addr,
 				&cookie, get_key_callback);
 	rtnl_unlock();
 	if (err)
 		goto out;
 	if (cookie.error)
 		goto nla_put_failure;
 	genlmsg_end(msg, hdr);
 	err = genlmsg_unicast(msg, info->snd_pid);
 	goto out;
  nla_put_failure:
 	err = -ENOBUFS;
 	nlmsg_free(msg);
  out:
 	cfg80211_put_dev(drv);
 	dev_put(dev);
 	return err;
 }
 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
 {
 	struct cfg80211_registered_device *drv;
 	int err;
 	struct net_device *dev;
 	u8 key_idx;
+	int (*func)(struct wiphy *wiphy, struct net_device *netdev,
+		    u8 key_index);
 	if (!info->attrs[NL80211_ATTR_KEY_IDX])
 		return -EINVAL;
 	key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
-	if (key_idx > 3)
+	if (info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]) {
+		if (key_idx < 4 || key_idx > 5)
+			return -EINVAL;
+	} else if (key_idx > 3)
 		return -EINVAL;
 	/* currently only support setting default key */
-	if (!info->attrs[NL80211_ATTR_KEY_DEFAULT])
+	if (!info->attrs[NL80211_ATTR_KEY_DEFAULT] &&
+	    !info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT])
 		return -EINVAL;
 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 	if (err)
 		return err;
-	if (!drv->ops->set_default_key) {
+	if (info->attrs[NL80211_ATTR_KEY_DEFAULT])
+		func = drv->ops->set_default_key;
+	else
+		func = drv->ops->set_default_mgmt_key;
+	if (!func) {
 		err = -EOPNOTSUPP;
 		goto out;
 	}
 	rtnl_lock();
-	err = drv->ops->set_default_key(&drv->wiphy, dev, key_idx);
+	err = func(&drv->wiphy, dev, key_idx);
 	rtnl_unlock();
  out:
 	cfg80211_put_dev(drv);
 	dev_put(dev);
 	return err;
 }
 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
 {
 	struct cfg80211_registered_device *drv;
 	int err;
 	struct net_device *dev;
 	struct key_params params;
 	u8 key_idx = 0;
 	u8 *mac_addr = NULL;
 	memset(&params, 0, sizeof(params));
 	if (!info->attrs[NL80211_ATTR_KEY_CIPHER])
 		return -EINVAL;
 	if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 		params.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 		params.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 	}
 	if (info->attrs[NL80211_ATTR_KEY_IDX])
 		key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 	params.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 	if (info->attrs[NL80211_ATTR_MAC])
 		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
-	if (key_idx > 3)
+	if (key_idx > 5)
 		return -EINVAL;
 	/*
 	 * Disallow pairwise keys with non-zero index unless it's WEP
 	 * (because current deployments use pairwise WEP keys with
 	 * non-zero indizes but 802.11i clearly specifies to use zero)
 	 */
 	if (mac_addr && key_idx &&
 	    params.cipher != WLAN_CIPHER_SUITE_WEP40 &&
 	    params.cipher != WLAN_CIPHER_SUITE_WEP104)
 		return -EINVAL;
 	/* TODO: add definitions for the lengths to linux/ieee80211.h */
 	switch (params.cipher) {
 	case WLAN_CIPHER_SUITE_WEP40:
 		if (params.key_len != 5)
 			return -EINVAL;
 		break;
 	case WLAN_CIPHER_SUITE_TKIP:
 		if (params.key_len != 32)
 			return -EINVAL;
 		break;
 	case WLAN_CIPHER_SUITE_CCMP:
 		if (params.key_len != 16)
 			return -EINVAL;
 		break;
 	case WLAN_CIPHER_SUITE_WEP104:
 		if (params.key_len != 13)
 			return -EINVAL;
 		break;
+	case WLAN_CIPHER_SUITE_AES_CMAC:
+		if (params.key_len != 16)
+			return -EINVAL;
+		break;
 	default:
 		return -EINVAL;
 	}
 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 	if (err)
 		return err;
 	if (!drv->ops->add_key) {
 		err = -EOPNOTSUPP;
 		goto out;
 	}
 	rtnl_lock();
 	err = drv->ops->add_key(&drv->wiphy, dev, key_idx, mac_addr, &params);
 	rtnl_unlock();
  out:
 	cfg80211_put_dev(drv);
 	dev_put(dev);
 	return err;
 }
 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
 {
 	struct cfg80211_registered_device *drv;
 	int err;
 	struct net_device *dev;
 	u8 key_idx = 0;
 	u8 *mac_addr = NULL;
 	if (info->attrs[NL80211_ATTR_KEY_IDX])
 		key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
-	if (key_idx > 3)
+	if (key_idx > 5)
 		return -EINVAL;
 	if (info->attrs[NL80211_ATTR_MAC])
 		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 	if (err)
 		return err;
 	if (!drv->ops->del_key) {
 		err = -EOPNOTSUPP;
 		goto out;
 	}
 	rtnl_lock();
 	err = drv->ops->del_key(&drv->wiphy, dev, key_idx, mac_addr);
 	rtnl_unlock();
  out:
 	cfg80211_put_dev(drv);
 	dev_put(dev);
 	return err;
 }
 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
 {
         int (*call)(struct wiphy *wiphy, struct net_device *dev,
 		    struct beacon_parameters *info);
 	struct cfg80211_registered_device *drv;
 	int err;
 	struct net_device *dev;
 	struct beacon_parameters params;
 	int haveinfo = 0;
 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 	if (err)
 		return err;
 	switch (info->genlhdr->cmd) {
 	case NL80211_CMD_NEW_BEACON:
 		/* these are required for NEW_BEACON */
 		if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
 		    !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
 		    !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
 			err = -EINVAL;
 			goto out;
 		}
 		call = drv->ops->add_beacon;
 		break;
 	case NL80211_CMD_SET_BEACON:
 		call = drv->ops->set_beacon;
 		break;
 	default:
 		WARN_ON(1);
 		err = -EOPNOTSUPP;
 		goto out;
 	}
 	if (!call) {
 		err = -EOPNOTSUPP;
 		goto out;
 	}
 	memset(&params, 0, sizeof(params));
 	if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
 		params.interval =
 		    nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
 		haveinfo = 1;
 	}
 	if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
 		params.dtim_period =
 		    nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
 		haveinfo = 1;
 	}
 	if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
 		params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
 		params.head_len =
 		    nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
 		haveinfo = 1;
 	}
 	if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
 		params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
 		params.tail_len =
 		    nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
 		haveinfo = 1;
 	}
 	if (!haveinfo) {
 		err = -EINVAL;
 		goto out;
 	}
 	rtnl_lock();
 	err = call(&drv->wiphy, dev, &params);
 	rtnl_unlock();
  out:
 	cfg80211_put_dev(drv);
 	dev_put(dev);
 	return err;
 }
 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
 {
 	struct cfg80211_registered_device *drv;
 	int err;
 	struct net_device *dev;
 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 	if (err)
 		return err;
 	if (!drv->ops->del_beacon) {
 		err = -EOPNOTSUPP;
 		goto out;
 	}
 	rtnl_lock();
 	err = drv->ops->del_beacon(&drv->wiphy, dev);
 	rtnl_unlock();
  out:
 	cfg80211_put_dev(drv);
 	dev_put(dev);
 	return err;
 }
 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
 	[NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
 	[NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
 	[NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
 };
 static int parse_station_flags(struct nlattr *nla, u32 *staflags)
 {
 	struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
 	int flag;
 	*staflags = 0;
 	if (!nla)
 		return 0;
 	if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
 			     nla, sta_flags_policy))
 		return -EINVAL;
 	*staflags = STATION_FLAG_CHANGED;
 	for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
 		if (flags[flag])
 			*staflags |= (1<<flag);
 	return 0;
 }
 static u16 nl80211_calculate_bitrate(struct rate_info *rate)
 {
 	int modulation, streams, bitrate;
 	if (!(rate->flags & RATE_INFO_FLAGS_MCS))
 		return rate->legacy;
 	/* the formula below does only work for MCS values smaller than 32 */
 	if (rate->mcs >= 32)
 		return 0;
 	modulation = rate->mcs & 7;
 	streams = (rate->mcs >> 3) + 1;
 	bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
 			13500000 : 6500000;
 	if (modulation < 4)
 		bitrate *= (modulation + 1);
 	else if (modulation == 4)
 		bitrate *= (modulation + 2);
 	else
 		bitrate *= (modulation + 3);
 	bitrate *= streams;
 	if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
 		bitrate = (bitrate / 9) * 10;
 	/* do NOT round down here */
 	return (bitrate + 50000) / 100000;
 }
 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
 				int flags, struct net_device *dev,
 				u8 *mac_addr, struct station_info *sinfo)
 {
 	void *hdr;
 	struct nlattr *sinfoattr, *txrate;
 	u16 bitrate;
 	hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
 	if (!hdr)
 		return -1;
 	NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 	NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
 	sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
 	if (!sinfoattr)
 		goto nla_put_failure;
 	if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
 		NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
 			    sinfo->inactive_time);
 	if (sinfo->filled & STATION_INFO_RX_BYTES)
 		NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
 			    sinfo->rx_bytes);
 	if (sinfo->filled & STATION_INFO_TX_BYTES)
 		NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
 			    sinfo->tx_bytes);
 	if (sinfo->filled & STATION_INFO_LLID)
 		NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
 			    sinfo->llid);
 	if (sinfo->filled & STATION_INFO_PLID)
 		NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
 			    sinfo->plid);
 	if (sinfo->filled & STATION_INFO_PLINK_STATE)
 		NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
 			    sinfo->plink_state);
 	if (sinfo->filled & STATION_INFO_SIGNAL)
 		NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
 			   sinfo->signal);
 	if (sinfo->filled & STATION_INFO_TX_BITRATE) {
 		txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
 		if (!txrate)
 			goto nla_put_failure;
 		/* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
 		bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
 		if (bitrate > 0)
 			NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
 		if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
 			NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
 				    sinfo->txrate.mcs);
 		if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
 			NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
 		if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
 			NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
 		nla_nest_end(msg, txrate);
 	}
 	nla_nest_end(msg, sinfoattr);
 	return genlmsg_end(msg, hdr);
  nla_put_failure:
 	genlmsg_cancel(msg, hdr);
 	return -EMSGSIZE;
 }
 static int nl80211_dump_station(struct sk_buff *skb,
 				struct netlink_callback *cb)
 {
 	struct station_info sinfo;
 	struct cfg80211_registered_device *dev;
 	struct net_device *netdev;
 	u8 mac_addr[ETH_ALEN];
 	int ifidx = cb->args[0];
 	int sta_idx = cb->args[1];
 	int err;
 	if (!ifidx) {
 		err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 				  nl80211_fam.attrbuf, nl80211_fam.maxattr,
 				  nl80211_policy);
 		if (err)
 			return err;
 		if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 			return -EINVAL;
 		ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 		if (!ifidx)
 			return -EINVAL;
 	}
 	netdev = dev_get_by_index(&init_net, ifidx);
 	if (!netdev)
 		return -ENODEV;
 	dev = cfg80211_get_dev_from_ifindex(ifidx);
 	if (IS_ERR(dev)) {
 		err = PTR_ERR(dev);
 		goto out_put_netdev;
 	}
 	if (!dev->ops->dump_station) {
 		err = -ENOSYS;
 		goto out_err;
 	}
 	rtnl_lock();
 	while (1) {
 		err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
 					     mac_addr, &sinfo);
 		if (err == -ENOENT)
 			break;
 		if (err)
 			goto out_err_rtnl;
 		if (nl80211_send_station(skb,
 				NETLINK_CB(cb->skb).pid,
 				cb->nlh->nlmsg_seq, NLM_F_MULTI,
 				netdev, mac_addr,
 				&sinfo) < 0)
 			goto out;
 		sta_idx++;
 	}
  out:
 	cb->args[1] = sta_idx;
 	err = skb->len;
  out_err_rtnl:
 	rtnl_unlock();
  out_err:
 	cfg80211_put_dev(dev);
  out_put_netdev:
 	dev_put(netdev);
 	return err;
 }
 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
 {
 	struct cfg80211_registered_device *drv;
 	int err;
 	struct net_device *dev;
 	struct station_info sinfo;
 	struct sk_buff *msg;
 	u8 *mac_addr = NULL;
 	memset(&sinfo, 0, sizeof(sinfo));
 	if (!info->attrs[NL80211_ATTR_MAC])
 		return -EINVAL;
 	mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 	if (err)
 		return err;
 	if (!drv->ops->get_station) {
 		err = -EOPNOTSUPP;
 		goto out;
 	}
 	rtnl_lock();
 	err = drv->ops->get_station(&drv->wiphy, dev, mac_addr, &sinfo);
 	rtnl_unlock();
 	if (err)
 		goto out;
 	msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 	if (!msg)
 		goto out;
 	if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
 				 dev, mac_addr, &sinfo) < 0)
 		goto out_free;
 	err = genlmsg_unicast(msg, info->snd_pid);
 	goto out;
  out_free:
 	nlmsg_free(msg);
  out:
 	cfg80211_put_dev(drv);
 	dev_put(dev);
 	return err;
 }
 /*
  * Get vlan interface making sure it is on the right wiphy.
  */
 static int get_vlan(struct nlattr *vlanattr,
 		    struct cfg80211_registered_device *rdev,
 		    struct net_device **vlan)
 {
 	*vlan = NULL;
 	if (vlanattr) {
 		*vlan = dev_get_by_index(&init_net, nla_get_u32(vlanattr));
 		if (!*vlan)
 			return -ENODEV;
 		if (!(*vlan)->ieee80211_ptr)
 			return -EINVAL;
 		if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
 			return -EINVAL;
 	}
 	return 0;
 }
 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
 {
 	struct cfg80211_registered_device *drv;
 	int err;
 	struct net_device *dev;
 	struct station_parameters params;
 	u8 *mac_addr = NULL;
 	memset(&params, 0, sizeof(params));
 	params.listen_interval = -1;
 	if (info->attrs[NL80211_ATTR_STA_AID])
 		return -EINVAL;
 	if (!info->attrs[NL80211_ATTR_MAC])
 		return -EINVAL;
 	mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 	if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
 		params.supported_rates =
 			nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
 		params.supported_rates_len =
 			nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
 	}
 	if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
 		params.listen_interval =
 		    nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
 		params.ht_capa =
 			nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
 	if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
 				&params.station_flags))
 		return -EINVAL;
 	if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
 		params.plink_action =
 		    nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 	if (err)
 		return err;
 	err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
 	if (err)
 		goto out;
 	if (!drv->ops->change_station) {
 		err = -EOPNOTSUPP;
 		goto out;
 	}
 	rtnl_lock();
 	err = drv->ops->change_station(&drv->wiphy, dev, mac_addr, &params);
 	rtnl_unlock();
  out:
 	if (params.vlan)
 		dev_put(params.vlan);
 	cfg80211_put_dev(drv);
 	dev_put(dev);
 	return err;
 }
 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
 {
 	struct cfg80211_registered_device *drv;
 	int err;
 	struct net_device *dev;
 	struct station_parameters params;
 	u8 *mac_addr = NULL;
 	memset(&params, 0, sizeof(params));
 	if (!info->attrs[NL80211_ATTR_MAC])
 		return -EINVAL;
 	if (!info->attrs[NL80211_ATTR_STA_AID])
 		return -EINVAL;
 	if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
 		return -EINVAL;
 	if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
 		return -EINVAL;
 	mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 	params.supported_rates =
 		nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
 	params.supported_rates_len =
 		nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
 	params.listen_interval =
 		nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
 	params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
 		params.ht_capa =
 			nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
 	if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
 				&params.station_flags))
 		return -EINVAL;
 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 	if (err)
 		return err;
 	err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
 	if (err)
 		goto out;
 	if (!drv->ops->add_station) {
 		err = -EOPNOTSUPP;
 		goto out;
 	}
 	rtnl_lock();
 	err = drv->ops->add_station(&drv->wiphy, dev, mac_addr, &params);
 	rtnl_unlock();
  out:
 	if (params.vlan)
 		dev_put(params.vlan);
 	cfg80211_put_dev(drv);
 	dev_put(dev);
 	return err;
 }
 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
 {
 	struct cfg80211_registered_device *drv;
 	int err;
 	struct net_device *dev;
 	u8 *mac_addr = NULL;
 	if (info->attrs[NL80211_ATTR_MAC])
 		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 	if (err)
 		return err;
 	if (!drv->ops->del_station) {
 		err = -EOPNOTSUPP;
 		goto out;
 	}
 	rtnl_lock();
 	err = drv->ops->del_station(&drv->wiphy, dev, mac_addr);
 	rtnl_unlock();
  out:
 	cfg80211_put_dev(drv);
 	dev_put(dev);
 	return err;
 }
 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
 				int flags, struct net_device *dev,
 				u8 *dst, u8 *next_hop,
 				struct mpath_info *pinfo)
 {
 	void *hdr;
 	struct nlattr *pinfoattr;
 	hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
 	if (!hdr)
 		return -1;
 	NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 	NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
 	NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
 	pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
 	if (!pinfoattr)
 		goto nla_put_failure;
 	if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
 		NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
 			    pinfo->frame_qlen);
 	if (pinfo->filled & MPATH_INFO_DSN)
 		NLA_PUT_U32(msg, NL80211_MPATH_INFO_DSN,
 			    pinfo->dsn);
 	if (pinfo->filled & MPATH_INFO_METRIC)
 		NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
 			    pinfo->metric);
 	if (pinfo->filled & MPATH_INFO_EXPTIME)
 		NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
 			    pinfo->exptime);
 	if (pinfo->filled & MPATH_INFO_FLAGS)
 		NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
 			    pinfo->flags);
 	if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
 		NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
 			    pinfo->discovery_timeout);
 	if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
 		NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
 			    pinfo->discovery_retries);
 	nla_nest_end(msg, pinfoattr);
 	return genlmsg_end(msg, hdr);
  nla_put_failure:
 	genlmsg_cancel(msg, hdr);
 	return -EMSGSIZE;
 }
 static int nl80211_dump_mpath(struct sk_buff *skb,
 			      struct netlink_callback *cb)
 {
 	struct mpath_info pinfo;
 	struct cfg80211_registered_device *dev;
 	struct net_device *netdev;
 	u8 dst[ETH_ALEN];
 	u8 next_hop[ETH_ALEN];
 	int ifidx = cb->args[0];
 	int path_idx = cb->args[1];
 	int err;
 	if (!ifidx) {
 		err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 				  nl80211_fam.attrbuf, nl80211_fam.maxattr,
 				  nl80211_policy);
 		if (err)
 			return err;
 		if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 			return -EINVAL;
 		ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 		if (!ifidx)
 			return -EINVAL;
 	}
 	netdev = dev_get_by_index(&init_net, ifidx);
 	if (!netdev)
 		return -ENODEV;
 	dev = cfg80211_get_dev_from_ifindex(ifidx);
 	if (IS_ERR(dev)) {
 		err = PTR_ERR(dev);
 		goto out_put_netdev;
 	}
 	if (!dev->ops->dump_mpath) {
 		err = -ENOSYS;
 		goto out_err;
 	}
 	rtnl_lock();
 	while (1) {
 		err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
 					   dst, next_hop, &pinfo);
 		if (err == -ENOENT)
 			break;
 		if (err)
 			goto out_err_rtnl;
 		if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
 				       cb->nlh->nlmsg_seq, NLM_F_MULTI,
 				       netdev, dst, next_hop,
 				       &pinfo) < 0)
 			goto out;
 		path_idx++;
 	}
  out:
 	cb->args[1] = path_idx;
 	err = skb->len;
  out_err_rtnl:
 	rtnl_unlock();
  out_err:
 	cfg80211_put_dev(dev);
  out_put_netdev:
 	dev_put(netdev);
 	return err;
 }
 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
 {
 	struct cfg80211_registered_device *drv;
 	int err;
 	struct net_device *dev;
 	struct mpath_info pinfo;
 	struct sk_buff *msg;
 	u8 *dst = NULL;
 	u8 next_hop[ETH_ALEN];
 	memset(&pinfo, 0, sizeof(pinfo));
 	if (!info->attrs[NL80211_ATTR_MAC])
 		return -EINVAL;
 	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 	if (err)
 		return err;
 	if (!drv->ops->get_mpath) {
 		err = -EOPNOTSUPP;
 		goto out;
 	}
 	rtnl_lock();
 	err = drv->ops->get_mpath(&drv->wiphy, dev, dst, next_hop, &pinfo);
 	rtnl_unlock();
 	if (err)
 		goto out;
 	msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 	if (!msg)
 		goto out;
 	if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
 				 dev, dst, next_hop, &pinfo) < 0)
 		goto out_free;
 	err = genlmsg_unicast(msg, info->snd_pid);
 	goto out;
  out_free:
 	nlmsg_free(msg);
  out:
 	cfg80211_put_dev(drv);
 	dev_put(dev);
 	return err;
 }
 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
 {
 	struct cfg80211_registered_device *drv;
 	int err;
 	struct net_device *dev;
 	u8 *dst = NULL;
 	u8 *next_hop = NULL;
 	if (!info->attrs[NL80211_ATTR_MAC])
 		return -EINVAL;
 	if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
 		return -EINVAL;
 	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
 	next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 	if (err)
 		return err;
 	if (!drv->ops->change_mpath) {
 		err = -EOPNOTSUPP;
 		goto out;
 	}
 	rtnl_lock();
 	err = drv->ops->change_mpath(&drv->wiphy, dev, dst, next_hop);
 	rtnl_unlock();
  out:
 	cfg80211_put_dev(drv);
 	dev_put(dev);
 	return err;
 }
 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
 {
 	struct cfg80211_registered_device *drv;
 	int err;
 	struct net_device *dev;
 	u8 *dst = NULL;
 	u8 *next_hop = NULL;
 	if (!info->attrs[NL80211_ATTR_MAC])
 		return -EINVAL;
 	if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
 		return -EINVAL;
 	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
 	next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 	if (err)
 		return err;
 	if (!drv->ops->add_mpath) {
 		err = -EOPNOTSUPP;
 		goto out;
 	}
 	rtnl_lock();
 	err = drv->ops->add_mpath(&drv->wiphy, dev, dst, next_hop);
 	rtnl_unlock();
  out:
 	cfg80211_put_dev(drv);
 	dev_put(dev);
 	return err;
 }
 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
 {
 	struct cfg80211_registered_device *drv;
 	int err;
 	struct net_device *dev;
 	u8 *dst = NULL;
 	if (info->attrs[NL80211_ATTR_MAC])
 		dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 	if (err)
 		return err;
 	if (!drv->ops->del_mpath) {
 		err = -EOPNOTSUPP;
 		goto out;
 	}
 	rtnl_lock();
 	err = drv->ops->del_mpath(&drv->wiphy, dev, dst);
 	rtnl_unlock();
  out:
 	cfg80211_put_dev(drv);
 	dev_put(dev);
 	return err;
 }
 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
 {
 	struct cfg80211_registered_device *drv;
 	int err;
 	struct net_device *dev;
 	struct bss_parameters params;
 	memset(&params, 0, sizeof(params));
 	/* default to not changing parameters */
 	params.use_cts_prot = -1;
 	params.use_short_preamble = -1;
 	params.use_short_slot_time = -1;
 	if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
 		params.use_cts_prot =
 		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
 	if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
 		params.use_short_preamble =
 		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
 	if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
 		params.use_short_slot_time =
 		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
 	if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
 		params.basic_rates =
 			nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
 		params.basic_rates_len =
 			nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
 	}
 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 	if (err)
 		return err;
 	if (!drv->ops->change_bss) {
 		err = -EOPNOTSUPP;
 		goto out;
 	}
 	rtnl_lock();
 	err = drv->ops->change_bss(&drv->wiphy, dev, &params);
 	rtnl_unlock();
  out:
 	cfg80211_put_dev(drv);
 	dev_put(dev);
 	return err;
 }
 static const struct nla_policy
 	reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
 	[NL80211_ATTR_REG_RULE_FLAGS]		= { .type = NLA_U32 },
 	[NL80211_ATTR_FREQ_RANGE_START]		= { .type = NLA_U32 },
 	[NL80211_ATTR_FREQ_RANGE_END]		= { .type = NLA_U32 },
 	[NL80211_ATTR_FREQ_RANGE_MAX_BW]	= { .type = NLA_U32 },
 	[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]	= { .type = NLA_U32 },
 	[NL80211_ATTR_POWER_RULE_MAX_EIRP]	= { .type = NLA_U32 },
 };
 static int parse_reg_rule(struct nlattr *tb[],
 	struct ieee80211_reg_rule *reg_rule)
 {
 	struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
 	struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
 	if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
 		return -EINVAL;
 	if (!tb[NL80211_ATTR_FREQ_RANGE_START])
 		return -EINVAL;
 	if (!tb[NL80211_ATTR_FREQ_RANGE_END])
 		return -EINVAL;
 	if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
 		return -EINVAL;
 	if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
 		return -EINVAL;
 	reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
 	freq_range->start_freq_khz =
 		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
 	freq_range->end_freq_khz =
 		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
 	freq_range->max_bandwidth_khz =
 		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
 	power_rule->max_eirp =
 		nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
 	if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
 		power_rule->max_antenna_gain =
 			nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
 	return 0;
 }
 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
 {
 	int r;
 	char *data = NULL;
 	if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
 		return -EINVAL;
 	data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
 #ifdef CONFIG_WIRELESS_OLD_REGULATORY
 	/* We ignore world regdom requests with the old regdom setup */
 	if (is_world_regdom(data))
 		return -EINVAL;
 #endif
 	mutex_lock(&cfg80211_drv_mutex);
 	r = __regulatory_hint(NULL, REGDOM_SET_BY_USER, data, 0, ENVIRON_ANY);
 	mutex_unlock(&cfg80211_drv_mutex);
 	return r;
 }
 static int nl80211_get_mesh_params(struct sk_buff *skb,
 	struct genl_info *info)
 {
 	struct cfg80211_registered_device *drv;
 	struct mesh_config cur_params;
 	int err;
 	struct net_device *dev;
 	void *hdr;
 	struct nlattr *pinfoattr;
 	struct sk_buff *msg;
 	/* Look up our device */
 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 	if (err)
 		return err;
 	/* Get the mesh params */
 	rtnl_lock();
 	err = drv->ops->get_mesh_params(&drv->wiphy, dev, &cur_params);
 	rtnl_unlock();
 	if (err)
 		goto out;
 	/* Draw up a netlink message to send back */
 	msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 	if (!msg) {
 		err = -ENOBUFS;
 		goto out;
 	}
 	hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
 			     NL80211_CMD_GET_MESH_PARAMS);
 	if (!hdr)
 		goto nla_put_failure;
 	pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
 	if (!pinfoattr)
 		goto nla_put_failure;
 	NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 	NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
 			cur_params.dot11MeshRetryTimeout);
 	NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
 			cur_params.dot11MeshConfirmTimeout);
 	NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
 			cur_params.dot11MeshHoldingTimeout);
 	NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
 			cur_params.dot11MeshMaxPeerLinks);
 	NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
 			cur_params.dot11MeshMaxRetries);
 	NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
 			cur_params.dot11MeshTTL);
 	NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
 			cur_params.auto_open_plinks);
 	NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
 			cur_params.dot11MeshHWMPmaxPREQretries);
 	NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
 			cur_params.path_refresh_time);
 	NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
 			cur_params.min_discovery_timeout);
 	NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
 			cur_params.dot11MeshHWMPactivePathTimeout);
 	NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
 			cur_params.dot11MeshHWMPpreqMinInterval);
 	NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
 			cur_params.dot11MeshHWMPnetDiameterTraversalTime);
 	nla_nest_end(msg, pinfoattr);
 	genlmsg_end(msg, hdr);
 	err = genlmsg_unicast(msg, info->snd_pid);
 	goto out;
 nla_put_failure:
 	genlmsg_cancel(msg, hdr);
 	err = -EMSGSIZE;
 out:
 	/* Cleanup */
 	cfg80211_put_dev(drv);
 	dev_put(dev);
 	return err;
 }
 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
 do {\
 	if (table[attr_num]) {\
 		cfg.param = nla_fn(table[attr_num]); \
 		mask |= (1 << (attr_num - 1)); \
 	} \
 } while (0);\
 static struct nla_policy
 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
 	[NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
 	[NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
 	[NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
 	[NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
 	[NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
 	[NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
 	[NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
 	[NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
 	[NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
 	[NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
 	[NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
 	[NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
 	[NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
 };
 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
 {
 	int err;
 	u32 mask;
 	struct cfg80211_registered_device *drv;
 	struct net_device *dev;
 	struct mesh_config cfg;
 	struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
 	struct nlattr *parent_attr;
 	parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
 	if (!parent_attr)
 		return -EINVAL;
 	if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
 			parent_attr, nl80211_meshconf_params_policy))
 		return -EINVAL;
 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 	if (err)
 		return err;
 	/* This makes sure that there aren't more than 32 mesh config
 	 * parameters (otherwise our bitfield scheme would not work.) */
 	BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
 	/* Fill in the params struct */
 	mask = 0;
 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
 			mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
 			mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
 			mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
 			mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
 			mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
 			mask, NL80211_MESHCONF_TTL, nla_get_u8);
 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
 			mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
 			mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
 			nla_get_u8);
 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
 			mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
 			mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
 			nla_get_u16);
 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
 			mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
 			nla_get_u32);
 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
 			mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
 			nla_get_u16);
 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
 			dot11MeshHWMPnetDiameterTraversalTime,
 			mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
 			nla_get_u16);
 	/* Apply changes */
 	rtnl_lock();
 	err = drv->ops->set_mesh_params(&drv->wiphy, dev, &cfg, mask);
 	rtnl_unlock();
 	/* cleanup */
 	cfg80211_put_dev(drv);
 	dev_put(dev);
 	return err;
 }
 #undef FILL_IN_MESH_PARAM_IF_SET
 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
 {
 	struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
 	struct nlattr *nl_reg_rule;
 	char *alpha2 = NULL;
 	int rem_reg_rules = 0, r = 0;
 	u32 num_rules = 0, rule_idx = 0, size_of_regd;
 	struct ieee80211_regdomain *rd = NULL;
 	if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
 		return -EINVAL;
 	if (!info->attrs[NL80211_ATTR_REG_RULES])
 		return -EINVAL;
 	alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
 	nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
 			rem_reg_rules) {
 		num_rules++;
 		if (num_rules > NL80211_MAX_SUPP_REG_RULES)
 			goto bad_reg;
 	}
 	if (!reg_is_valid_request(alpha2))
 		return -EINVAL;
 	size_of_regd = sizeof(struct ieee80211_regdomain) +
 		(num_rules * sizeof(struct ieee80211_reg_rule));
 	rd = kzalloc(size_of_regd, GFP_KERNEL);
 	if (!rd)
 		return -ENOMEM;
 	rd->n_reg_rules = num_rules;
 	rd->alpha2[0] = alpha2[0];
 	rd->alpha2[1] = alpha2[1];
 	nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
 			rem_reg_rules) {
 		nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
 			nla_data(nl_reg_rule), nla_len(nl_reg_rule),
 			reg_rule_policy);
 		r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
 		if (r)
 			goto bad_reg;
 		rule_idx++;
 		if (rule_idx > NL80211_MAX_SUPP_REG_RULES)
 			goto bad_reg;
 	}
 	BUG_ON(rule_idx != num_rules);
 	mutex_lock(&cfg80211_drv_mutex);
 	r = set_regdom(rd);
 	mutex_unlock(&cfg80211_drv_mutex);
 	return r;
  bad_reg:
 	kfree(rd);
 	return -EINVAL;
 }
 static struct genl_ops nl80211_ops[] = {
 	{
 		.cmd = NL80211_CMD_GET_WIPHY,
 		.doit = nl80211_get_wiphy,
 		.dumpit = nl80211_dump_wiphy,
 		.policy = nl80211_policy,
 		/* can be retrieved by unprivileged users */
 	},
 	{
 		.cmd = NL80211_CMD_SET_WIPHY,
 		.doit = nl80211_set_wiphy,
 		.policy = nl80211_policy,
 		.flags = GENL_ADMIN_PERM,
 	},
 	{
 		.cmd = NL80211_CMD_GET_INTERFACE,
 		.doit = nl80211_get_interface,
 		.dumpit = nl80211_dump_interface,
 		.policy = nl80211_policy,
 		/* can be retrieved by unprivileged users */
 	},
 	{
 		.cmd = NL80211_CMD_SET_INTERFACE,
 		.doit = nl80211_set_interface,
 		.policy = nl80211_policy,
 		.flags = GENL_ADMIN_PERM,
 	},
 	{
 		.cmd = NL80211_CMD_NEW_INTERFACE,
 		.doit = nl80211_new_interface,
 		.policy = nl80211_policy,
 		.flags = GENL_ADMIN_PERM,
 	},
 	{
 		.cmd = NL80211_CMD_DEL_INTERFACE,
 		.doit = nl80211_del_interface,
 		.policy = nl80211_policy,
 		.flags = GENL_ADMIN_PERM,
 	},
 	{
 		.cmd = NL80211_CMD_GET_KEY,
 		.doit = nl80211_get_key,
 		.policy = nl80211_policy,
 		.flags = GENL_ADMIN_PERM,
 	},
 	{
 		.cmd = NL80211_CMD_SET_KEY,
 		.doit = nl80211_set_key,
 		.policy = nl80211_policy,
 		.flags = GENL_ADMIN_PERM,
 	},
 	{
 		.cmd = NL80211_CMD_NEW_KEY,
 		.doit = nl80211_new_key,
 		.policy = nl80211_policy,
 		.flags = GENL_ADMIN_PERM,
 	},
 	{
 		.cmd = NL80211_CMD_DEL_KEY,
 		.doit = nl80211_del_key,
 		.policy = nl80211_policy,
 		.flags = GENL_ADMIN_PERM,
 	},
 	{
 		.cmd = NL80211_CMD_SET_BEACON,
 		.policy = nl80211_policy,
 		.flags = GENL_ADMIN_PERM,
 		.doit = nl80211_addset_beacon,
 	},
 	{
 		.cmd = NL80211_CMD_NEW_BEACON,
 		.policy = nl80211_policy,
 		.flags = GENL_ADMIN_PERM,
 		.doit = nl80211_addset_beacon,
 	},
 	{
 		.cmd = NL80211_CMD_DEL_BEACON,
 		.policy = nl80211_policy,
 		.flags = GENL_ADMIN_PERM,
 		.doit = nl80211_del_beacon,
 	},
 	{
 		.cmd = NL80211_CMD_GET_STATION,
 		.doit = nl80211_get_station,
 		.dumpit = nl80211_dump_station,
 		.policy = nl80211_policy,
 		.flags = GENL_ADMIN_PERM,
 	},
 	{
 		.cmd = NL80211_CMD_SET_STATION,
 		.doit = nl80211_set_station,
 		.policy = nl80211_policy,
 		.flags = GENL_ADMIN_PERM,
 	},
 	{
 		.cmd = NL80211_CMD_NEW_STATION,
 		.doit = nl80211_new_station,
 		.policy = nl80211_policy,
 		.flags = GENL_ADMIN_PERM,
 	},
 	{
 		.cmd = NL80211_CMD_DEL_STATION,
 		.doit = nl80211_del_station,
 		.policy = nl80211_policy,
 		.flags = GENL_ADMIN_PERM,
 	},
 	{
 		.cmd = NL80211_CMD_GET_MPATH,
 		.doit = nl80211_get_mpath,
 		.dumpit = nl80211_dump_mpath,
 		.policy = nl80211_policy,
 		.flags = GENL_ADMIN_PERM,
 	},
 	{
 		.cmd = NL80211_CMD_SET_MPATH,
 		.doit = nl80211_set_mpath,
 		.policy = nl80211_policy,
 		.flags = GENL_ADMIN_PERM,
 	},
 	{
 		.cmd = NL80211_CMD_NEW_MPATH,
 		.doit = nl80211_new_mpath,
 		.policy = nl80211_policy,
 		.flags = GENL_ADMIN_PERM,
 	},
 	{
 		.cmd = NL80211_CMD_DEL_MPATH,
 		.doit = nl80211_del_mpath,
 		.policy = nl80211_policy,
 		.flags = GENL_ADMIN_PERM,
 	},
 	{
 		.cmd = NL80211_CMD_SET_BSS,
 		.doit = nl80211_set_bss,
 		.policy = nl80211_policy,
 		.flags = GENL_ADMIN_PERM,
 	},
 	{
 		.cmd = NL80211_CMD_SET_REG,
 		.doit = nl80211_set_reg,
 		.policy = nl80211_policy,
 		.flags = GENL_ADMIN_PERM,
 	},
 	{
 		.cmd = NL80211_CMD_REQ_SET_REG,
 		.doit = nl80211_req_set_reg,
 		.policy = nl80211_policy,
 		.flags = GENL_ADMIN_PERM,
 	},
 	{
 		.cmd = NL80211_CMD_GET_MESH_PARAMS,
 		.doit = nl80211_get_mesh_params,
 		.policy = nl80211_policy,
 		/* can be retrieved by unprivileged users */
 	},
 	{
 		.cmd = NL80211_CMD_SET_MESH_PARAMS,
 		.doit = nl80211_set_mesh_params,
 		.policy = nl80211_policy,
 		.flags = GENL_ADMIN_PERM,
 	},
 };
 /* multicast groups */
 static struct genl_multicast_group nl80211_config_mcgrp = {
 	.name = "config",
 };
 /* notification functions */
 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
 {
 	struct sk_buff *msg;
 	msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 	if (!msg)
 		return;
 	if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
 		nlmsg_free(msg);
 		return;
 	}
 	genlmsg_multicast(msg, 0, nl80211_config_mcgrp.id, GFP_KERNEL);
 }
 /* initialisation/exit functions */
 int nl80211_init(void)
 {
 	int err, i;
 	err = genl_register_family(&nl80211_fam);
 	if (err)
 		return err;
 	for (i = 0; i < ARRAY_SIZE(nl80211_ops); i++) {
 		err = genl_register_ops(&nl80211_fam, &nl80211_ops[i]);
 		if (err)
 			goto err_out;
 	}
 	err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
 	if (err)
 		goto err_out;
 	return 0;
  err_out:
 	genl_unregister_family(&nl80211_fam);
 	return err;
 }
 void nl80211_exit(void)
 {
 	genl_unregister_family(&nl80211_fam);
 }