1 // SPDX-License-Identifier: GPL-2.0
2 /******************************************************************************
3  * rtl871x_xmit.c
4  *
5  * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
6  * Linux device driver for RTL8192SU
7  *
8  * Modifications for inclusion into the Linux staging tree are
9  * Copyright(c) 2010 Larry Finger. All rights reserved.
10  *
11  * Contact information:
12  * WLAN FAE <wlanfae@realtek.com>
13  * Larry Finger <Larry.Finger@lwfinger.net>
14  *
15  ******************************************************************************/
16 
17 #define _RTL871X_XMIT_C_
18 
19 #include "osdep_service.h"
20 #include "drv_types.h"
21 #include "wifi.h"
22 #include "osdep_intf.h"
23 #include "usb_ops.h"
24 
25 
26 static const u8 P802_1H_OUI[P80211_OUI_LEN] = {0x00, 0x00, 0xf8};
27 static const u8 RFC1042_OUI[P80211_OUI_LEN] = {0x00, 0x00, 0x00};
28 static void init_hwxmits(struct hw_xmit *phwxmit, sint entry);
29 static void alloc_hwxmits(struct _adapter *padapter);
30 static void free_hwxmits(struct _adapter *padapter);
31 
32 static void _init_txservq(struct tx_servq *ptxservq)
33 {
34 	INIT_LIST_HEAD(&ptxservq->tx_pending);
35 	_init_queue(&ptxservq->sta_pending);
36 	ptxservq->qcnt = 0;
37 }
38 
39 void _r8712_init_sta_xmit_priv(struct sta_xmit_priv *psta_xmitpriv)
40 {
41 	memset((unsigned char *)psta_xmitpriv, 0,
42 		 sizeof(struct sta_xmit_priv));
43 	spin_lock_init(&psta_xmitpriv->lock);
44 	_init_txservq(&psta_xmitpriv->be_q);
45 	_init_txservq(&psta_xmitpriv->bk_q);
46 	_init_txservq(&psta_xmitpriv->vi_q);
47 	_init_txservq(&psta_xmitpriv->vo_q);
48 	INIT_LIST_HEAD(&psta_xmitpriv->legacy_dz);
49 	INIT_LIST_HEAD(&psta_xmitpriv->apsd);
50 }
51 
52 int _r8712_init_xmit_priv(struct xmit_priv *pxmitpriv,
53 			  struct _adapter *padapter)
54 {
55 	sint i;
56 	struct xmit_buf *pxmitbuf;
57 	struct xmit_frame *pxframe;
58 
59 	memset((unsigned char *)pxmitpriv, 0, sizeof(struct xmit_priv));
60 	spin_lock_init(&pxmitpriv->lock);
61 	/*
62 	 *Please insert all the queue initialization using _init_queue below
63 	 */
64 	pxmitpriv->adapter = padapter;
65 	_init_queue(&pxmitpriv->be_pending);
66 	_init_queue(&pxmitpriv->bk_pending);
67 	_init_queue(&pxmitpriv->vi_pending);
68 	_init_queue(&pxmitpriv->vo_pending);
69 	_init_queue(&pxmitpriv->bm_pending);
70 	_init_queue(&pxmitpriv->legacy_dz_queue);
71 	_init_queue(&pxmitpriv->apsd_queue);
72 	_init_queue(&pxmitpriv->free_xmit_queue);
73 	/*
74 	 * Please allocate memory with sz = (struct xmit_frame) * NR_XMITFRAME,
75 	 * and initialize free_xmit_frame below.
76 	 * Please also apply  free_txobj to link_up all the xmit_frames...
77 	 */
78 	pxmitpriv->pallocated_frame_buf =
79 		kmalloc(NR_XMITFRAME * sizeof(struct xmit_frame) + 4,
80 			GFP_ATOMIC);
81 	if (!pxmitpriv->pallocated_frame_buf) {
82 		pxmitpriv->pxmit_frame_buf = NULL;
83 		return -ENOMEM;
84 	}
85 	pxmitpriv->pxmit_frame_buf = pxmitpriv->pallocated_frame_buf + 4 -
86 			((addr_t) (pxmitpriv->pallocated_frame_buf) & 3);
87 	pxframe = (struct xmit_frame *) pxmitpriv->pxmit_frame_buf;
88 	for (i = 0; i < NR_XMITFRAME; i++) {
89 		INIT_LIST_HEAD(&(pxframe->list));
90 		pxframe->padapter = padapter;
91 		pxframe->frame_tag = DATA_FRAMETAG;
92 		pxframe->pkt = NULL;
93 		pxframe->buf_addr = NULL;
94 		pxframe->pxmitbuf = NULL;
95 		list_add_tail(&(pxframe->list),
96 				 &(pxmitpriv->free_xmit_queue.queue));
97 		pxframe++;
98 	}
99 	pxmitpriv->free_xmitframe_cnt = NR_XMITFRAME;
100 	/*
101 	 * init xmit hw_txqueue
102 	 */
103 	_r8712_init_hw_txqueue(&pxmitpriv->be_txqueue, BE_QUEUE_INX);
104 	_r8712_init_hw_txqueue(&pxmitpriv->bk_txqueue, BK_QUEUE_INX);
105 	_r8712_init_hw_txqueue(&pxmitpriv->vi_txqueue, VI_QUEUE_INX);
106 	_r8712_init_hw_txqueue(&pxmitpriv->vo_txqueue, VO_QUEUE_INX);
107 	_r8712_init_hw_txqueue(&pxmitpriv->bmc_txqueue, BMC_QUEUE_INX);
108 	pxmitpriv->frag_len = MAX_FRAG_THRESHOLD;
109 	pxmitpriv->txirp_cnt = 1;
110 	/*per AC pending irp*/
111 	pxmitpriv->beq_cnt = 0;
112 	pxmitpriv->bkq_cnt = 0;
113 	pxmitpriv->viq_cnt = 0;
114 	pxmitpriv->voq_cnt = 0;
115 	/*init xmit_buf*/
116 	_init_queue(&pxmitpriv->free_xmitbuf_queue);
117 	_init_queue(&pxmitpriv->pending_xmitbuf_queue);
118 	pxmitpriv->pallocated_xmitbuf =
119 		kmalloc(NR_XMITBUFF * sizeof(struct xmit_buf) + 4, GFP_ATOMIC);
120 	if (!pxmitpriv->pallocated_xmitbuf) {
121 		kfree(pxmitpriv->pallocated_frame_buf);
122 		pxmitpriv->pallocated_frame_buf = NULL;
123 		return -ENOMEM;
124 	}
125 	pxmitpriv->pxmitbuf = pxmitpriv->pallocated_xmitbuf + 4 -
126 			      ((addr_t)(pxmitpriv->pallocated_xmitbuf) & 3);
127 	pxmitbuf = (struct xmit_buf *)pxmitpriv->pxmitbuf;
128 	for (i = 0; i < NR_XMITBUFF; i++) {
129 		INIT_LIST_HEAD(&pxmitbuf->list);
130 		pxmitbuf->pallocated_buf =
131 			kmalloc(MAX_XMITBUF_SZ + XMITBUF_ALIGN_SZ, GFP_ATOMIC);
132 		if (!pxmitbuf->pallocated_buf)
133 			return -ENOMEM;
134 		pxmitbuf->pbuf = pxmitbuf->pallocated_buf + XMITBUF_ALIGN_SZ -
135 				 ((addr_t) (pxmitbuf->pallocated_buf) &
136 				 (XMITBUF_ALIGN_SZ - 1));
137 		if (r8712_xmit_resource_alloc(padapter, pxmitbuf))
138 			return -ENOMEM;
139 		list_add_tail(&pxmitbuf->list,
140 				 &(pxmitpriv->free_xmitbuf_queue.queue));
141 		pxmitbuf++;
142 	}
143 	pxmitpriv->free_xmitbuf_cnt = NR_XMITBUFF;
144 	INIT_WORK(&padapter->wk_filter_rx_ff0, r8712_SetFilter);
145 	alloc_hwxmits(padapter);
146 	init_hwxmits(pxmitpriv->hwxmits, pxmitpriv->hwxmit_entry);
147 	tasklet_init(&pxmitpriv->xmit_tasklet, r8712_xmit_bh,
148 		     (unsigned long)padapter);
149 	return 0;
150 }
151 
152 void _free_xmit_priv(struct xmit_priv *pxmitpriv)
153 {
154 	int i;
155 	struct _adapter *padapter = pxmitpriv->adapter;
156 	struct xmit_frame *pxmitframe = (struct xmit_frame *)
157 					pxmitpriv->pxmit_frame_buf;
158 	struct xmit_buf *pxmitbuf = (struct xmit_buf *)pxmitpriv->pxmitbuf;
159 
160 	if (pxmitpriv->pxmit_frame_buf == NULL)
161 		return;
162 	for (i = 0; i < NR_XMITFRAME; i++) {
163 		r8712_xmit_complete(padapter, pxmitframe);
164 		pxmitframe++;
165 	}
166 	for (i = 0; i < NR_XMITBUFF; i++) {
167 		r8712_xmit_resource_free(padapter, pxmitbuf);
168 		kfree(pxmitbuf->pallocated_buf);
169 		pxmitbuf++;
170 	}
171 	kfree(pxmitpriv->pallocated_frame_buf);
172 	kfree(pxmitpriv->pallocated_xmitbuf);
173 	free_hwxmits(padapter);
174 }
175 
176 int r8712_update_attrib(struct _adapter *padapter, _pkt *pkt,
177 			struct pkt_attrib *pattrib)
178 {
179 	struct pkt_file pktfile;
180 	struct sta_info *psta = NULL;
181 	struct ethhdr etherhdr;
182 
183 	struct tx_cmd txdesc;
184 
185 	bool bmcast;
186 	struct sta_priv		*pstapriv = &padapter->stapriv;
187 	struct security_priv	*psecuritypriv = &padapter->securitypriv;
188 	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
189 	struct qos_priv		*pqospriv = &pmlmepriv->qospriv;
190 
191 	_r8712_open_pktfile(pkt, &pktfile);
192 
193 	_r8712_pktfile_read(&pktfile, (unsigned char *)&etherhdr, ETH_HLEN);
194 
195 	pattrib->ether_type = ntohs(etherhdr.h_proto);
196 
197 	/*
198 	 * If driver xmit ARP packet, driver can set ps mode to initial
199 	 * setting. It stands for getting DHCP or fix IP.
200 	 */
201 	if (pattrib->ether_type == 0x0806) {
202 		if (padapter->pwrctrlpriv.pwr_mode !=
203 		    padapter->registrypriv.power_mgnt) {
204 			del_timer_sync(&pmlmepriv->dhcp_timer);
205 			r8712_set_ps_mode(padapter,
206 					  padapter->registrypriv.power_mgnt,
207 					  padapter->registrypriv.smart_ps);
208 		}
209 	}
210 
211 	memcpy(pattrib->dst, &etherhdr.h_dest, ETH_ALEN);
212 	memcpy(pattrib->src, &etherhdr.h_source, ETH_ALEN);
213 	pattrib->pctrl = 0;
214 	if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) ||
215 	    check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) {
216 		memcpy(pattrib->ra, pattrib->dst, ETH_ALEN);
217 		memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
218 	} else if (check_fwstate(pmlmepriv, WIFI_STATION_STATE)) {
219 		memcpy(pattrib->ra, get_bssid(pmlmepriv), ETH_ALEN);
220 		memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
221 	} else if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
222 		memcpy(pattrib->ra, pattrib->dst, ETH_ALEN);
223 		memcpy(pattrib->ta, get_bssid(pmlmepriv), ETH_ALEN);
224 	} else if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) {
225 		/*firstly, filter packet not belongs to mp*/
226 		if (pattrib->ether_type != 0x8712)
227 			return -EINVAL;
228 		/* for mp storing the txcmd per packet,
229 		 * according to the info of txcmd to update pattrib
230 		 */
231 		/*get MP_TXDESC_SIZE bytes txcmd per packet*/
232 		_r8712_pktfile_read(&pktfile, (u8 *)&txdesc, TXDESC_SIZE);
233 		memcpy(pattrib->ra, pattrib->dst, ETH_ALEN);
234 		memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
235 		pattrib->pctrl = 1;
236 	}
237 	/* r8712_xmitframe_coalesce() overwrite this!*/
238 	pattrib->pktlen = pktfile.pkt_len;
239 	if (pattrib->ether_type == ETH_P_IP) {
240 		/* The following is for DHCP and ARP packet, we use cck1M to
241 		 * tx these packets and let LPS awake some time
242 		 * to prevent DHCP protocol fail
243 		 */
244 		u8 tmp[24];
245 
246 		_r8712_pktfile_read(&pktfile, &tmp[0], 24);
247 		pattrib->dhcp_pkt = 0;
248 		if (pktfile.pkt_len > 282) {/*MINIMUM_DHCP_PACKET_SIZE)*/
249 			if (pattrib->ether_type == ETH_P_IP) {/* IP header*/
250 				if (((tmp[21] == 68) && (tmp[23] == 67)) ||
251 					((tmp[21] == 67) && (tmp[23] == 68))) {
252 					/* 68 : UDP BOOTP client
253 					 * 67 : UDP BOOTP server
254 					 * Use low rate to send DHCP packet.
255 					 */
256 					pattrib->dhcp_pkt = 1;
257 				}
258 			}
259 		}
260 	}
261 	bmcast = is_multicast_ether_addr(pattrib->ra);
262 	/* get sta_info*/
263 	if (bmcast) {
264 		psta = r8712_get_bcmc_stainfo(padapter);
265 		pattrib->mac_id = 4;
266 	} else {
267 		if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) {
268 			psta = r8712_get_stainfo(pstapriv,
269 						 get_bssid(pmlmepriv));
270 			pattrib->mac_id = 5;
271 		} else {
272 			psta = r8712_get_stainfo(pstapriv, pattrib->ra);
273 			if (psta == NULL)  /* drop the pkt */
274 				return -ENOMEM;
275 			if (check_fwstate(pmlmepriv, WIFI_STATION_STATE))
276 				pattrib->mac_id = 5;
277 			else
278 				pattrib->mac_id = psta->mac_id;
279 		}
280 	}
281 
282 	if (psta) {
283 		pattrib->psta = psta;
284 	} else {
285 		/* if we cannot get psta => drrp the pkt */
286 		return -ENOMEM;
287 	}
288 
289 	pattrib->ack_policy = 0;
290 	/* get ether_hdr_len */
291 	pattrib->pkt_hdrlen = ETH_HLEN;
292 
293 	if (pqospriv->qos_option) {
294 		r8712_set_qos(&pktfile, pattrib);
295 	} else {
296 		pattrib->hdrlen = WLAN_HDR_A3_LEN;
297 		pattrib->subtype = WIFI_DATA_TYPE;
298 		pattrib->priority = 0;
299 	}
300 	if (psta->ieee8021x_blocked) {
301 		pattrib->encrypt = 0;
302 		if ((pattrib->ether_type != 0x888e) &&
303 		    !check_fwstate(pmlmepriv, WIFI_MP_STATE))
304 			return -EINVAL;
305 	} else {
306 		GET_ENCRY_ALGO(psecuritypriv, psta, pattrib->encrypt, bmcast);
307 	}
308 	switch (pattrib->encrypt) {
309 	case _WEP40_:
310 	case _WEP104_:
311 		pattrib->iv_len = 4;
312 		pattrib->icv_len = 4;
313 		break;
314 	case _TKIP_:
315 		pattrib->iv_len = 8;
316 		pattrib->icv_len = 4;
317 		if (padapter->securitypriv.busetkipkey == _FAIL)
318 			return -EINVAL;
319 		break;
320 	case _AES_:
321 		pattrib->iv_len = 8;
322 		pattrib->icv_len = 8;
323 		break;
324 	default:
325 		pattrib->iv_len = 0;
326 		pattrib->icv_len = 0;
327 		break;
328 	}
329 
330 	if (pattrib->encrypt &&
331 	    (padapter->securitypriv.sw_encrypt ||
332 	    !psecuritypriv->hw_decrypted))
333 		pattrib->bswenc = true;
334 	else
335 		pattrib->bswenc = false;
336 	/* if in MP_STATE, update pkt_attrib from mp_txcmd, and overwrite
337 	 * some settings above.
338 	 */
339 	if (check_fwstate(pmlmepriv, WIFI_MP_STATE))
340 		pattrib->priority =
341 		    (le32_to_cpu(txdesc.txdw1) >> QSEL_SHT) & 0x1f;
342 	return 0;
343 }
344 
345 static int xmitframe_addmic(struct _adapter *padapter,
346 			    struct xmit_frame *pxmitframe)
347 {
348 	u32	curfragnum, length;
349 	u8	*pframe, *payload, mic[8];
350 	struct	mic_data micdata;
351 	struct	sta_info *stainfo;
352 	struct	qos_priv *pqospriv = &(padapter->mlmepriv.qospriv);
353 	struct	pkt_attrib  *pattrib = &pxmitframe->attrib;
354 	struct	security_priv *psecpriv = &padapter->securitypriv;
355 	struct	xmit_priv *pxmitpriv = &padapter->xmitpriv;
356 	u8 priority[4] = {0x0, 0x0, 0x0, 0x0};
357 	bool bmcst = is_multicast_ether_addr(pattrib->ra);
358 
359 	if (pattrib->psta)
360 		stainfo = pattrib->psta;
361 	else
362 		stainfo = r8712_get_stainfo(&padapter->stapriv,
363 					    &pattrib->ra[0]);
364 	if (pattrib->encrypt == _TKIP_) {
365 		/*encode mic code*/
366 		if (stainfo != NULL) {
367 			u8 null_key[16] = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
368 					   0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
369 					   0x0, 0x0};
370 			pframe = pxmitframe->buf_addr + TXDESC_OFFSET;
371 			if (bmcst) {
372 				if (!memcmp(psecpriv->XGrptxmickey
373 				   [psecpriv->XGrpKeyid].skey,
374 				   null_key, 16))
375 					return -ENOMEM;
376 				/*start to calculate the mic code*/
377 				r8712_secmicsetkey(&micdata,
378 					psecpriv->XGrptxmickey
379 					[psecpriv->XGrpKeyid].skey);
380 			} else {
381 				if (!memcmp(&stainfo->tkiptxmickey.skey[0],
382 					    null_key, 16))
383 					return -ENOMEM;
384 				/* start to calculate the mic code */
385 				r8712_secmicsetkey(&micdata,
386 					     &stainfo->tkiptxmickey.skey[0]);
387 			}
388 			if (pframe[1] & 1) {   /* ToDS==1 */
389 				r8712_secmicappend(&micdata,
390 						   &pframe[16], 6); /*DA*/
391 				if (pframe[1] & 2)  /* From Ds==1 */
392 					r8712_secmicappend(&micdata,
393 							   &pframe[24], 6);
394 				else
395 					r8712_secmicappend(&micdata,
396 							   &pframe[10], 6);
397 			} else {	/* ToDS==0 */
398 				r8712_secmicappend(&micdata,
399 						   &pframe[4], 6); /* DA */
400 				if (pframe[1] & 2)  /* From Ds==1 */
401 					r8712_secmicappend(&micdata,
402 							   &pframe[16], 6);
403 				else
404 					r8712_secmicappend(&micdata,
405 							   &pframe[10], 6);
406 			}
407 			if (pqospriv->qos_option == 1)
408 				priority[0] = (u8)pxmitframe->attrib.priority;
409 			r8712_secmicappend(&micdata, &priority[0], 4);
410 			payload = pframe;
411 			for (curfragnum = 0; curfragnum < pattrib->nr_frags;
412 			     curfragnum++) {
413 				payload = (u8 *)RND4((addr_t)(payload));
414 				payload += pattrib->hdrlen + pattrib->iv_len;
415 				if ((curfragnum + 1) == pattrib->nr_frags) {
416 					length = pattrib->last_txcmdsz -
417 						  pattrib->hdrlen -
418 						  pattrib->iv_len -
419 						  ((psecpriv->sw_encrypt)
420 						  ? pattrib->icv_len : 0);
421 					r8712_secmicappend(&micdata, payload,
422 							   length);
423 					payload = payload + length;
424 				} else {
425 					length = pxmitpriv->frag_len -
426 					    pattrib->hdrlen - pattrib->iv_len -
427 					    ((psecpriv->sw_encrypt) ?
428 					    pattrib->icv_len : 0);
429 					r8712_secmicappend(&micdata, payload,
430 							   length);
431 					payload = payload + length +
432 						  pattrib->icv_len;
433 				}
434 			}
435 			r8712_secgetmic(&micdata, &(mic[0]));
436 			/* add mic code  and add the mic code length in
437 			 * last_txcmdsz
438 			 */
439 			memcpy(payload, &(mic[0]), 8);
440 			pattrib->last_txcmdsz += 8;
441 			payload = payload - pattrib->last_txcmdsz + 8;
442 		}
443 	}
444 	return 0;
445 }
446 
447 static sint xmitframe_swencrypt(struct _adapter *padapter,
448 				struct xmit_frame *pxmitframe)
449 {
450 	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
451 
452 	if (pattrib->bswenc) {
453 		switch (pattrib->encrypt) {
454 		case _WEP40_:
455 		case _WEP104_:
456 			r8712_wep_encrypt(padapter, (u8 *)pxmitframe);
457 			break;
458 		case _TKIP_:
459 			r8712_tkip_encrypt(padapter, (u8 *)pxmitframe);
460 			break;
461 		case _AES_:
462 			r8712_aes_encrypt(padapter, (u8 *)pxmitframe);
463 			break;
464 		default:
465 				break;
466 		}
467 	}
468 	return _SUCCESS;
469 }
470 
471 static int make_wlanhdr(struct _adapter *padapter, u8 *hdr,
472 			struct pkt_attrib *pattrib)
473 {
474 	u16 *qc;
475 
476 	struct ieee80211_hdr *pwlanhdr = (struct ieee80211_hdr *)hdr;
477 	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
478 	struct qos_priv *pqospriv = &pmlmepriv->qospriv;
479 	__le16 *fctrl = &pwlanhdr->frame_control;
480 	u8 *bssid;
481 
482 	memset(hdr, 0, WLANHDR_OFFSET);
483 	SetFrameSubType(fctrl, pattrib->subtype);
484 	if (!(pattrib->subtype & WIFI_DATA_TYPE))
485 		return 0;
486 
487 	bssid = get_bssid(pmlmepriv);
488 
489 	if (check_fwstate(pmlmepriv,  WIFI_STATION_STATE)) {
490 		/* to_ds = 1, fr_ds = 0; */
491 		SetToDs(fctrl);
492 		ether_addr_copy(pwlanhdr->addr1, bssid);
493 		ether_addr_copy(pwlanhdr->addr2, pattrib->src);
494 		ether_addr_copy(pwlanhdr->addr3, pattrib->dst);
495 	} else if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
496 		/* to_ds = 0, fr_ds = 1; */
497 		SetFrDs(fctrl);
498 		ether_addr_copy(pwlanhdr->addr1, pattrib->dst);
499 		ether_addr_copy(pwlanhdr->addr2, bssid);
500 		ether_addr_copy(pwlanhdr->addr3, pattrib->src);
501 	} else if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) ||
502 		   check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) {
503 		ether_addr_copy(pwlanhdr->addr1, pattrib->dst);
504 		ether_addr_copy(pwlanhdr->addr2, pattrib->src);
505 		ether_addr_copy(pwlanhdr->addr3, bssid);
506 	} else if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) {
507 		ether_addr_copy(pwlanhdr->addr1, pattrib->dst);
508 		ether_addr_copy(pwlanhdr->addr2, pattrib->src);
509 		ether_addr_copy(pwlanhdr->addr3, bssid);
510 	} else {
511 		return -EINVAL;
512 	}
513 
514 	if (pattrib->encrypt)
515 		SetPrivacy(fctrl);
516 	if (pqospriv->qos_option) {
517 		qc = (unsigned short *)(hdr + pattrib->hdrlen - 2);
518 		if (pattrib->priority)
519 			SetPriority(qc, pattrib->priority);
520 		SetAckpolicy(qc, pattrib->ack_policy);
521 	}
522 	/* TODO: fill HT Control Field */
523 	/* Update Seq Num will be handled by f/w */
524 	{
525 		struct sta_info *psta;
526 		bool bmcst = is_multicast_ether_addr(pattrib->ra);
527 
528 		if (pattrib->psta)
529 			psta = pattrib->psta;
530 		else if (bmcst)
531 			psta = r8712_get_bcmc_stainfo(padapter);
532 		else
533 			psta = r8712_get_stainfo(&padapter->stapriv,
534 						 pattrib->ra);
535 
536 		if (psta) {
537 			u16 *txtid = psta->sta_xmitpriv.txseq_tid;
538 
539 			txtid[pattrib->priority]++;
540 			txtid[pattrib->priority] &= 0xFFF;
541 			pattrib->seqnum = txtid[pattrib->priority];
542 			SetSeqNum(hdr, pattrib->seqnum);
543 		}
544 	}
545 
546 	return 0;
547 }
548 
549 static sint r8712_put_snap(u8 *data, u16 h_proto)
550 {
551 	struct ieee80211_snap_hdr *snap;
552 	const u8 *oui;
553 
554 	snap = (struct ieee80211_snap_hdr *)data;
555 	snap->dsap = 0xaa;
556 	snap->ssap = 0xaa;
557 	snap->ctrl = 0x03;
558 	if (h_proto == 0x8137 || h_proto == 0x80f3)
559 		oui = P802_1H_OUI;
560 	else
561 		oui = RFC1042_OUI;
562 	snap->oui[0] = oui[0];
563 	snap->oui[1] = oui[1];
564 	snap->oui[2] = oui[2];
565 	*(__be16 *)(data + SNAP_SIZE) = htons(h_proto);
566 	return SNAP_SIZE + sizeof(u16);
567 }
568 
569 /*
570  * This sub-routine will perform all the following:
571  * 1. remove 802.3 header.
572  * 2. create wlan_header, based on the info in pxmitframe
573  * 3. append sta's iv/ext-iv
574  * 4. append LLC
575  * 5. move frag chunk from pframe to pxmitframe->mem
576  * 6. apply sw-encrypt, if necessary.
577  */
578 sint r8712_xmitframe_coalesce(struct _adapter *padapter, _pkt *pkt,
579 			struct xmit_frame *pxmitframe)
580 {
581 	struct pkt_file pktfile;
582 
583 	sint	frg_len, mpdu_len, llc_sz;
584 	u32	mem_sz;
585 	u8	frg_inx;
586 	addr_t addr;
587 	u8 *pframe, *mem_start, *ptxdesc;
588 	struct sta_info		*psta;
589 	struct security_priv	*psecpriv = &padapter->securitypriv;
590 	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
591 	struct xmit_priv	*pxmitpriv = &padapter->xmitpriv;
592 	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
593 	u8 *pbuf_start;
594 	bool bmcst = is_multicast_ether_addr(pattrib->ra);
595 
596 	if (pattrib->psta == NULL)
597 		return _FAIL;
598 	psta = pattrib->psta;
599 	if (pxmitframe->buf_addr == NULL)
600 		return _FAIL;
601 	pbuf_start = pxmitframe->buf_addr;
602 	ptxdesc = pbuf_start;
603 	mem_start = pbuf_start + TXDESC_OFFSET;
604 	if (make_wlanhdr(padapter, mem_start, pattrib))
605 		return _FAIL;
606 	_r8712_open_pktfile(pkt, &pktfile);
607 	_r8712_pktfile_read(&pktfile, NULL, (uint) pattrib->pkt_hdrlen);
608 	if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) {
609 		/* truncate TXDESC_SIZE bytes txcmd if at mp mode for 871x */
610 		if (pattrib->ether_type == 0x8712) {
611 			/* take care -  update_txdesc overwrite this */
612 			_r8712_pktfile_read(&pktfile, ptxdesc, TXDESC_SIZE);
613 		}
614 	}
615 	pattrib->pktlen = pktfile.pkt_len;
616 	frg_inx = 0;
617 	frg_len = pxmitpriv->frag_len - 4;
618 	while (1) {
619 		llc_sz = 0;
620 		mpdu_len = frg_len;
621 		pframe = mem_start;
622 		SetMFrag(mem_start);
623 		pframe += pattrib->hdrlen;
624 		mpdu_len -= pattrib->hdrlen;
625 		/* adding icv, if necessary...*/
626 		if (pattrib->iv_len) {
627 			if (psta != NULL) {
628 				switch (pattrib->encrypt) {
629 				case _WEP40_:
630 				case _WEP104_:
631 					WEP_IV(pattrib->iv, psta->txpn,
632 					       (u8)psecpriv->PrivacyKeyIndex);
633 					break;
634 				case _TKIP_:
635 					if (bmcst)
636 						TKIP_IV(pattrib->iv,
637 						    psta->txpn,
638 						    (u8)psecpriv->XGrpKeyid);
639 					else
640 						TKIP_IV(pattrib->iv, psta->txpn,
641 							0);
642 					break;
643 				case _AES_:
644 					if (bmcst)
645 						AES_IV(pattrib->iv, psta->txpn,
646 						    (u8)psecpriv->XGrpKeyid);
647 					else
648 						AES_IV(pattrib->iv, psta->txpn,
649 						       0);
650 					break;
651 				}
652 			}
653 			memcpy(pframe, pattrib->iv, pattrib->iv_len);
654 			pframe += pattrib->iv_len;
655 			mpdu_len -= pattrib->iv_len;
656 		}
657 		if (frg_inx == 0) {
658 			llc_sz = r8712_put_snap(pframe, pattrib->ether_type);
659 			pframe += llc_sz;
660 			mpdu_len -= llc_sz;
661 		}
662 		if ((pattrib->icv_len > 0) && (pattrib->bswenc))
663 			mpdu_len -= pattrib->icv_len;
664 		if (bmcst)
665 			mem_sz = _r8712_pktfile_read(&pktfile, pframe,
666 				 pattrib->pktlen);
667 		else
668 			mem_sz = _r8712_pktfile_read(&pktfile, pframe,
669 				 mpdu_len);
670 		pframe += mem_sz;
671 		if ((pattrib->icv_len > 0) && (pattrib->bswenc)) {
672 			memcpy(pframe, pattrib->icv, pattrib->icv_len);
673 			pframe += pattrib->icv_len;
674 		}
675 		frg_inx++;
676 		if (bmcst || r8712_endofpktfile(&pktfile)) {
677 			pattrib->nr_frags = frg_inx;
678 			pattrib->last_txcmdsz = pattrib->hdrlen +
679 						pattrib->iv_len +
680 						((pattrib->nr_frags == 1) ?
681 						llc_sz : 0) +
682 						((pattrib->bswenc) ?
683 						pattrib->icv_len : 0) + mem_sz;
684 			ClearMFrag(mem_start);
685 			break;
686 		}
687 		addr = (addr_t)(pframe);
688 		mem_start = (unsigned char *)RND4(addr) + TXDESC_OFFSET;
689 		memcpy(mem_start, pbuf_start + TXDESC_OFFSET, pattrib->hdrlen);
690 	}
691 
692 	if (xmitframe_addmic(padapter, pxmitframe))
693 		return _FAIL;
694 	xmitframe_swencrypt(padapter, pxmitframe);
695 	return _SUCCESS;
696 }
697 
698 void r8712_update_protection(struct _adapter *padapter, u8 *ie, uint ie_len)
699 {
700 	uint	protection;
701 	u8	*perp;
702 	uint	erp_len;
703 	struct	xmit_priv *pxmitpriv = &padapter->xmitpriv;
704 	struct	registry_priv *pregistrypriv = &padapter->registrypriv;
705 
706 	switch (pxmitpriv->vcs_setting) {
707 	case DISABLE_VCS:
708 		pxmitpriv->vcs = NONE_VCS;
709 		break;
710 	case ENABLE_VCS:
711 		break;
712 	case AUTO_VCS:
713 	default:
714 		perp = r8712_get_ie(ie, _ERPINFO_IE_, &erp_len, ie_len);
715 		if (perp == NULL) {
716 			pxmitpriv->vcs = NONE_VCS;
717 		} else {
718 			protection = (*(perp + 2)) & BIT(1);
719 			if (protection) {
720 				if (pregistrypriv->vcs_type == RTS_CTS)
721 					pxmitpriv->vcs = RTS_CTS;
722 				else
723 					pxmitpriv->vcs = CTS_TO_SELF;
724 			} else {
725 				pxmitpriv->vcs = NONE_VCS;
726 			}
727 		}
728 		break;
729 	}
730 }
731 
732 struct xmit_buf *r8712_alloc_xmitbuf(struct xmit_priv *pxmitpriv)
733 {
734 	unsigned long irqL;
735 	struct xmit_buf *pxmitbuf;
736 	struct  __queue *pfree_xmitbuf_queue = &pxmitpriv->free_xmitbuf_queue;
737 
738 	spin_lock_irqsave(&pfree_xmitbuf_queue->lock, irqL);
739 	pxmitbuf = list_first_entry_or_null(&pfree_xmitbuf_queue->queue,
740 					    struct xmit_buf, list);
741 	if (pxmitbuf) {
742 		list_del_init(&pxmitbuf->list);
743 		pxmitpriv->free_xmitbuf_cnt--;
744 	}
745 	spin_unlock_irqrestore(&pfree_xmitbuf_queue->lock, irqL);
746 	return pxmitbuf;
747 }
748 
749 void r8712_free_xmitbuf(struct xmit_priv *pxmitpriv, struct xmit_buf *pxmitbuf)
750 {
751 	unsigned long irqL;
752 	struct  __queue *pfree_xmitbuf_queue = &pxmitpriv->free_xmitbuf_queue;
753 
754 	if (pxmitbuf == NULL)
755 		return;
756 	spin_lock_irqsave(&pfree_xmitbuf_queue->lock, irqL);
757 	list_del_init(&pxmitbuf->list);
758 	list_add_tail(&(pxmitbuf->list), &pfree_xmitbuf_queue->queue);
759 	pxmitpriv->free_xmitbuf_cnt++;
760 	spin_unlock_irqrestore(&pfree_xmitbuf_queue->lock, irqL);
761 }
762 
763 /*
764  * Calling context:
765  * 1. OS_TXENTRY
766  * 2. RXENTRY (rx_thread or RX_ISR/RX_CallBack)
767  *
768  * If we turn on USE_RXTHREAD, then, no need for critical section.
769  * Otherwise, we must use _enter/_exit critical to protect free_xmit_queue...
770  *
771  * Must be very very cautious...
772  *
773  */
774 struct xmit_frame *r8712_alloc_xmitframe(struct xmit_priv *pxmitpriv)
775 {
776 	/*
777 	 * Please remember to use all the osdep_service api,
778 	 * and lock/unlock or _enter/_exit critical to protect
779 	 * pfree_xmit_queue
780 	 */
781 	unsigned long irqL;
782 	struct xmit_frame *pxframe;
783 	struct  __queue *pfree_xmit_queue = &pxmitpriv->free_xmit_queue;
784 
785 	spin_lock_irqsave(&pfree_xmit_queue->lock, irqL);
786 	pxframe = list_first_entry_or_null(&pfree_xmit_queue->queue,
787 					   struct xmit_frame, list);
788 	if (pxframe) {
789 		list_del_init(&pxframe->list);
790 		pxmitpriv->free_xmitframe_cnt--;
791 		pxframe->buf_addr = NULL;
792 		pxframe->pxmitbuf = NULL;
793 		pxframe->attrib.psta = NULL;
794 		pxframe->pkt = NULL;
795 	}
796 	spin_unlock_irqrestore(&pfree_xmit_queue->lock, irqL);
797 	return pxframe;
798 }
799 
800 void r8712_free_xmitframe(struct xmit_priv *pxmitpriv,
801 			  struct xmit_frame *pxmitframe)
802 {
803 	unsigned long irqL;
804 	struct  __queue *pfree_xmit_queue = &pxmitpriv->free_xmit_queue;
805 	struct _adapter *padapter = pxmitpriv->adapter;
806 
807 	if (pxmitframe == NULL)
808 		return;
809 	spin_lock_irqsave(&pfree_xmit_queue->lock, irqL);
810 	list_del_init(&pxmitframe->list);
811 	if (pxmitframe->pkt)
812 		pxmitframe->pkt = NULL;
813 	list_add_tail(&pxmitframe->list, &pfree_xmit_queue->queue);
814 	pxmitpriv->free_xmitframe_cnt++;
815 	spin_unlock_irqrestore(&pfree_xmit_queue->lock, irqL);
816 	if (netif_queue_stopped(padapter->pnetdev))
817 		netif_wake_queue(padapter->pnetdev);
818 }
819 
820 void r8712_free_xmitframe_ex(struct xmit_priv *pxmitpriv,
821 		      struct xmit_frame *pxmitframe)
822 {
823 	if (pxmitframe == NULL)
824 		return;
825 	if (pxmitframe->frame_tag == DATA_FRAMETAG)
826 		r8712_free_xmitframe(pxmitpriv, pxmitframe);
827 }
828 
829 void r8712_free_xmitframe_queue(struct xmit_priv *pxmitpriv,
830 				struct  __queue *pframequeue)
831 {
832 	unsigned long irqL;
833 	struct list_head *plist, *phead;
834 	struct	xmit_frame	*pxmitframe;
835 
836 	spin_lock_irqsave(&(pframequeue->lock), irqL);
837 	phead = &pframequeue->queue;
838 	plist = phead->next;
839 	while (!end_of_queue_search(phead, plist)) {
840 		pxmitframe = container_of(plist, struct xmit_frame, list);
841 		plist = plist->next;
842 		r8712_free_xmitframe(pxmitpriv, pxmitframe);
843 	}
844 	spin_unlock_irqrestore(&(pframequeue->lock), irqL);
845 }
846 
847 static inline struct tx_servq *get_sta_pending(struct _adapter *padapter,
848 					       struct  __queue **ppstapending,
849 					       struct sta_info *psta, sint up)
850 {
851 
852 	struct tx_servq *ptxservq;
853 	struct hw_xmit *phwxmits =  padapter->xmitpriv.hwxmits;
854 
855 	switch (up) {
856 	case 1:
857 	case 2:
858 		ptxservq = &(psta->sta_xmitpriv.bk_q);
859 		*ppstapending = &padapter->xmitpriv.bk_pending;
860 		(phwxmits + 3)->accnt++;
861 		break;
862 	case 4:
863 	case 5:
864 		ptxservq = &(psta->sta_xmitpriv.vi_q);
865 		*ppstapending = &padapter->xmitpriv.vi_pending;
866 		(phwxmits + 1)->accnt++;
867 		break;
868 	case 6:
869 	case 7:
870 		ptxservq = &(psta->sta_xmitpriv.vo_q);
871 		*ppstapending = &padapter->xmitpriv.vo_pending;
872 		(phwxmits + 0)->accnt++;
873 		break;
874 	case 0:
875 	case 3:
876 	default:
877 		ptxservq = &(psta->sta_xmitpriv.be_q);
878 		*ppstapending = &padapter->xmitpriv.be_pending;
879 		(phwxmits + 2)->accnt++;
880 		break;
881 	}
882 	return ptxservq;
883 }
884 
885 /*
886  * Will enqueue pxmitframe to the proper queue, and indicate it
887  * to xx_pending list.....
888  */
889 int r8712_xmit_classifier(struct _adapter *padapter,
890 			  struct xmit_frame *pxmitframe)
891 {
892 	unsigned long irqL0;
893 	struct  __queue *pstapending;
894 	struct sta_info	*psta;
895 	struct tx_servq	*ptxservq;
896 	struct pkt_attrib *pattrib = &pxmitframe->attrib;
897 	struct sta_priv *pstapriv = &padapter->stapriv;
898 	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
899 	bool bmcst = is_multicast_ether_addr(pattrib->ra);
900 
901 	if (pattrib->psta) {
902 		psta = pattrib->psta;
903 	} else {
904 		if (bmcst) {
905 			psta = r8712_get_bcmc_stainfo(padapter);
906 		} else {
907 			if (check_fwstate(pmlmepriv, WIFI_MP_STATE))
908 				psta = r8712_get_stainfo(pstapriv,
909 				       get_bssid(pmlmepriv));
910 			else
911 				psta = r8712_get_stainfo(pstapriv, pattrib->ra);
912 		}
913 	}
914 	if (psta == NULL)
915 		return -EINVAL;
916 	ptxservq = get_sta_pending(padapter, &pstapending,
917 		   psta, pattrib->priority);
918 	spin_lock_irqsave(&pstapending->lock, irqL0);
919 	if (list_empty(&ptxservq->tx_pending))
920 		list_add_tail(&ptxservq->tx_pending, &pstapending->queue);
921 	list_add_tail(&pxmitframe->list, &ptxservq->sta_pending.queue);
922 	ptxservq->qcnt++;
923 	spin_unlock_irqrestore(&pstapending->lock, irqL0);
924 	return 0;
925 }
926 
927 static void alloc_hwxmits(struct _adapter *padapter)
928 {
929 	struct hw_xmit *hwxmits;
930 	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
931 
932 	pxmitpriv->hwxmit_entry = HWXMIT_ENTRY;
933 	pxmitpriv->hwxmits = kmalloc_array(pxmitpriv->hwxmit_entry,
934 				sizeof(struct hw_xmit), GFP_ATOMIC);
935 	if (!pxmitpriv->hwxmits)
936 		return;
937 	hwxmits = pxmitpriv->hwxmits;
938 	if (pxmitpriv->hwxmit_entry == 5) {
939 		pxmitpriv->bmc_txqueue.head = 0;
940 		hwxmits[0] .phwtxqueue = &pxmitpriv->bmc_txqueue;
941 		hwxmits[0] .sta_queue = &pxmitpriv->bm_pending;
942 		pxmitpriv->vo_txqueue.head = 0;
943 		hwxmits[1] .phwtxqueue = &pxmitpriv->vo_txqueue;
944 		hwxmits[1] .sta_queue = &pxmitpriv->vo_pending;
945 		pxmitpriv->vi_txqueue.head = 0;
946 		hwxmits[2] .phwtxqueue = &pxmitpriv->vi_txqueue;
947 		hwxmits[2] .sta_queue = &pxmitpriv->vi_pending;
948 		pxmitpriv->bk_txqueue.head = 0;
949 		hwxmits[3] .phwtxqueue = &pxmitpriv->bk_txqueue;
950 		hwxmits[3] .sta_queue = &pxmitpriv->bk_pending;
951 		pxmitpriv->be_txqueue.head = 0;
952 		hwxmits[4] .phwtxqueue = &pxmitpriv->be_txqueue;
953 		hwxmits[4] .sta_queue = &pxmitpriv->be_pending;
954 	} else if (pxmitpriv->hwxmit_entry == 4) {
955 		pxmitpriv->vo_txqueue.head = 0;
956 		hwxmits[0] .phwtxqueue = &pxmitpriv->vo_txqueue;
957 		hwxmits[0] .sta_queue = &pxmitpriv->vo_pending;
958 		pxmitpriv->vi_txqueue.head = 0;
959 		hwxmits[1] .phwtxqueue = &pxmitpriv->vi_txqueue;
960 		hwxmits[1] .sta_queue = &pxmitpriv->vi_pending;
961 		pxmitpriv->be_txqueue.head = 0;
962 		hwxmits[2] .phwtxqueue = &pxmitpriv->be_txqueue;
963 		hwxmits[2] .sta_queue = &pxmitpriv->be_pending;
964 		pxmitpriv->bk_txqueue.head = 0;
965 		hwxmits[3] .phwtxqueue = &pxmitpriv->bk_txqueue;
966 		hwxmits[3] .sta_queue = &pxmitpriv->bk_pending;
967 	}
968 }
969 
970 static void free_hwxmits(struct _adapter *padapter)
971 {
972 	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
973 
974 	kfree(pxmitpriv->hwxmits);
975 }
976 
977 static void init_hwxmits(struct hw_xmit *phwxmit, sint entry)
978 {
979 	sint i;
980 
981 	for (i = 0; i < entry; i++, phwxmit++) {
982 		spin_lock_init(&phwxmit->xmit_lock);
983 		INIT_LIST_HEAD(&phwxmit->pending);
984 		phwxmit->txcmdcnt = 0;
985 		phwxmit->accnt = 0;
986 	}
987 }
988 
989 void xmitframe_xmitbuf_attach(struct xmit_frame *pxmitframe,
990 			struct xmit_buf *pxmitbuf)
991 {
992 	/* pxmitbuf attach to pxmitframe */
993 	pxmitframe->pxmitbuf = pxmitbuf;
994 	/* urb and irp connection */
995 	pxmitframe->pxmit_urb[0] = pxmitbuf->pxmit_urb[0];
996 	/* buffer addr assoc */
997 	pxmitframe->buf_addr = pxmitbuf->pbuf;
998 	/* pxmitframe attach to pxmitbuf */
999 	pxmitbuf->priv_data = pxmitframe;
1000 }
1001 
1002 /*
1003  * tx_action == 0 == no frames to transmit
1004  * tx_action > 0 ==> we have frames to transmit
1005  * tx_action < 0 ==> we have frames to transmit, but TXFF is not even enough
1006  *						 to transmit 1 frame.
1007  */
1008 
1009 int r8712_pre_xmit(struct _adapter *padapter, struct xmit_frame *pxmitframe)
1010 {
1011 	unsigned long irqL;
1012 	int ret;
1013 	struct xmit_buf *pxmitbuf = NULL;
1014 	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
1015 	struct pkt_attrib *pattrib = &pxmitframe->attrib;
1016 
1017 	r8712_do_queue_select(padapter, pattrib);
1018 	spin_lock_irqsave(&pxmitpriv->lock, irqL);
1019 	if (r8712_txframes_sta_ac_pending(padapter, pattrib) > 0) {
1020 		ret = false;
1021 		r8712_xmit_enqueue(padapter, pxmitframe);
1022 		spin_unlock_irqrestore(&pxmitpriv->lock, irqL);
1023 		return ret;
1024 	}
1025 	pxmitbuf = r8712_alloc_xmitbuf(pxmitpriv);
1026 	if (pxmitbuf == NULL) { /*enqueue packet*/
1027 		ret = false;
1028 		r8712_xmit_enqueue(padapter, pxmitframe);
1029 		spin_unlock_irqrestore(&pxmitpriv->lock, irqL);
1030 	} else { /*dump packet directly*/
1031 		spin_unlock_irqrestore(&pxmitpriv->lock, irqL);
1032 		ret = true;
1033 		xmitframe_xmitbuf_attach(pxmitframe, pxmitbuf);
1034 		r8712_xmit_direct(padapter, pxmitframe);
1035 	}
1036 	return ret;
1037 }
1038