1 // SPDX-License-Identifier: GPL-2.0
2 /******************************************************************************
3  *
4  * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
5  *
6  ******************************************************************************/
7 #define _RTW_XMIT_C_
8 
9 #include <drv_types.h>
10 #include <rtw_debug.h>
11 
12 static u8 P802_1H_OUI[P80211_OUI_LEN] = { 0x00, 0x00, 0xf8 };
13 static u8 RFC1042_OUI[P80211_OUI_LEN] = { 0x00, 0x00, 0x00 };
14 
15 static void _init_txservq(struct tx_servq *ptxservq)
16 {
17 	INIT_LIST_HEAD(&ptxservq->tx_pending);
18 	_rtw_init_queue(&ptxservq->sta_pending);
19 	ptxservq->qcnt = 0;
20 }
21 
22 void _rtw_init_sta_xmit_priv(struct sta_xmit_priv *psta_xmitpriv)
23 {
24 	memset((unsigned char *)psta_xmitpriv, 0, sizeof(struct sta_xmit_priv));
25 
26 	spin_lock_init(&psta_xmitpriv->lock);
27 
28 	/* for (i = 0 ; i < MAX_NUMBLKS; i++) */
29 	/* 	_init_txservq(&(psta_xmitpriv->blk_q[i])); */
30 
31 	_init_txservq(&psta_xmitpriv->be_q);
32 	_init_txservq(&psta_xmitpriv->bk_q);
33 	_init_txservq(&psta_xmitpriv->vi_q);
34 	_init_txservq(&psta_xmitpriv->vo_q);
35 	INIT_LIST_HEAD(&psta_xmitpriv->legacy_dz);
36 	INIT_LIST_HEAD(&psta_xmitpriv->apsd);
37 }
38 
39 s32	_rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter)
40 {
41 	int i;
42 	struct xmit_buf *pxmitbuf;
43 	struct xmit_frame *pxframe;
44 	sint	res = _SUCCESS;
45 
46 	spin_lock_init(&pxmitpriv->lock);
47 	spin_lock_init(&pxmitpriv->lock_sctx);
48 	sema_init(&pxmitpriv->xmit_sema, 0);
49 	sema_init(&pxmitpriv->terminate_xmitthread_sema, 0);
50 
51 	/*
52 	Please insert all the queue initializaiton using _rtw_init_queue below
53 	*/
54 
55 	pxmitpriv->adapter = padapter;
56 
57 	/* for (i = 0 ; i < MAX_NUMBLKS; i++) */
58 	/* 	_rtw_init_queue(&pxmitpriv->blk_strms[i]); */
59 
60 	_rtw_init_queue(&pxmitpriv->be_pending);
61 	_rtw_init_queue(&pxmitpriv->bk_pending);
62 	_rtw_init_queue(&pxmitpriv->vi_pending);
63 	_rtw_init_queue(&pxmitpriv->vo_pending);
64 	_rtw_init_queue(&pxmitpriv->bm_pending);
65 
66 	/* _rtw_init_queue(&pxmitpriv->legacy_dz_queue); */
67 	/* _rtw_init_queue(&pxmitpriv->apsd_queue); */
68 
69 	_rtw_init_queue(&pxmitpriv->free_xmit_queue);
70 
71 	/*
72 	Please allocate memory with the sz = (struct xmit_frame) * NR_XMITFRAME,
73 	and initialize free_xmit_frame below.
74 	Please also apply  free_txobj to link_up all the xmit_frames...
75 	*/
76 
77 	pxmitpriv->pallocated_frame_buf = vzalloc(NR_XMITFRAME * sizeof(struct xmit_frame) + 4);
78 
79 	if (pxmitpriv->pallocated_frame_buf  == NULL) {
80 		pxmitpriv->pxmit_frame_buf = NULL;
81 		RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("alloc xmit_frame fail!\n"));
82 		res = _FAIL;
83 		goto exit;
84 	}
85 	pxmitpriv->pxmit_frame_buf = (u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(pxmitpriv->pallocated_frame_buf), 4);
86 	/* pxmitpriv->pxmit_frame_buf = pxmitpriv->pallocated_frame_buf + 4 - */
87 	/* 						((SIZE_PTR) (pxmitpriv->pallocated_frame_buf) &3); */
88 
89 	pxframe = (struct xmit_frame *) pxmitpriv->pxmit_frame_buf;
90 
91 	for (i = 0; i < NR_XMITFRAME; i++) {
92 		INIT_LIST_HEAD(&(pxframe->list));
93 
94 		pxframe->padapter = padapter;
95 		pxframe->frame_tag = NULL_FRAMETAG;
96 
97 		pxframe->pkt = NULL;
98 
99 		pxframe->buf_addr = NULL;
100 		pxframe->pxmitbuf = NULL;
101 
102 		list_add_tail(&(pxframe->list), &(pxmitpriv->free_xmit_queue.queue));
103 
104 		pxframe++;
105 	}
106 
107 	pxmitpriv->free_xmitframe_cnt = NR_XMITFRAME;
108 
109 	pxmitpriv->frag_len = MAX_FRAG_THRESHOLD;
110 
111 
112 	/* init xmit_buf */
113 	_rtw_init_queue(&pxmitpriv->free_xmitbuf_queue);
114 	_rtw_init_queue(&pxmitpriv->pending_xmitbuf_queue);
115 
116 	pxmitpriv->pallocated_xmitbuf = vzalloc(NR_XMITBUFF * sizeof(struct xmit_buf) + 4);
117 
118 	if (pxmitpriv->pallocated_xmitbuf  == NULL) {
119 		RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("alloc xmit_buf fail!\n"));
120 		res = _FAIL;
121 		goto exit;
122 	}
123 
124 	pxmitpriv->pxmitbuf = (u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(pxmitpriv->pallocated_xmitbuf), 4);
125 	/* pxmitpriv->pxmitbuf = pxmitpriv->pallocated_xmitbuf + 4 - */
126 	/* 						((SIZE_PTR) (pxmitpriv->pallocated_xmitbuf) &3); */
127 
128 	pxmitbuf = (struct xmit_buf *)pxmitpriv->pxmitbuf;
129 
130 	for (i = 0; i < NR_XMITBUFF; i++) {
131 		INIT_LIST_HEAD(&pxmitbuf->list);
132 
133 		pxmitbuf->priv_data = NULL;
134 		pxmitbuf->padapter = padapter;
135 		pxmitbuf->buf_tag = XMITBUF_DATA;
136 
137 		/* Tx buf allocation may fail sometimes, so sleep and retry. */
138 		res = rtw_os_xmit_resource_alloc(padapter, pxmitbuf, (MAX_XMITBUF_SZ + XMITBUF_ALIGN_SZ), true);
139 		if (res == _FAIL) {
140 			msleep(10);
141 			res = rtw_os_xmit_resource_alloc(padapter, pxmitbuf, (MAX_XMITBUF_SZ + XMITBUF_ALIGN_SZ), true);
142 			if (res == _FAIL)
143 				goto exit;
144 		}
145 
146 		pxmitbuf->phead = pxmitbuf->pbuf;
147 		pxmitbuf->pend = pxmitbuf->pbuf + MAX_XMITBUF_SZ;
148 		pxmitbuf->len = 0;
149 		pxmitbuf->pdata = pxmitbuf->ptail = pxmitbuf->phead;
150 
151 		pxmitbuf->flags = XMIT_VO_QUEUE;
152 
153 		list_add_tail(&pxmitbuf->list, &(pxmitpriv->free_xmitbuf_queue.queue));
154 		#ifdef DBG_XMIT_BUF
155 		pxmitbuf->no = i;
156 		#endif
157 
158 		pxmitbuf++;
159 
160 	}
161 
162 	pxmitpriv->free_xmitbuf_cnt = NR_XMITBUFF;
163 
164 	/* init xframe_ext queue,  the same count as extbuf  */
165 	_rtw_init_queue(&pxmitpriv->free_xframe_ext_queue);
166 
167 	pxmitpriv->xframe_ext_alloc_addr = vzalloc(NR_XMIT_EXTBUFF * sizeof(struct xmit_frame) + 4);
168 
169 	if (pxmitpriv->xframe_ext_alloc_addr  == NULL) {
170 		pxmitpriv->xframe_ext = NULL;
171 		RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("alloc xframe_ext fail!\n"));
172 		res = _FAIL;
173 		goto exit;
174 	}
175 	pxmitpriv->xframe_ext = (u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(pxmitpriv->xframe_ext_alloc_addr), 4);
176 	pxframe = (struct xmit_frame *)pxmitpriv->xframe_ext;
177 
178 	for (i = 0; i < NR_XMIT_EXTBUFF; i++) {
179 		INIT_LIST_HEAD(&(pxframe->list));
180 
181 		pxframe->padapter = padapter;
182 		pxframe->frame_tag = NULL_FRAMETAG;
183 
184 		pxframe->pkt = NULL;
185 
186 		pxframe->buf_addr = NULL;
187 		pxframe->pxmitbuf = NULL;
188 
189 		pxframe->ext_tag = 1;
190 
191 		list_add_tail(&(pxframe->list), &(pxmitpriv->free_xframe_ext_queue.queue));
192 
193 		pxframe++;
194 	}
195 	pxmitpriv->free_xframe_ext_cnt = NR_XMIT_EXTBUFF;
196 
197 	/*  Init xmit extension buff */
198 	_rtw_init_queue(&pxmitpriv->free_xmit_extbuf_queue);
199 
200 	pxmitpriv->pallocated_xmit_extbuf = vzalloc(NR_XMIT_EXTBUFF * sizeof(struct xmit_buf) + 4);
201 
202 	if (pxmitpriv->pallocated_xmit_extbuf  == NULL) {
203 		RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("alloc xmit_extbuf fail!\n"));
204 		res = _FAIL;
205 		goto exit;
206 	}
207 
208 	pxmitpriv->pxmit_extbuf = (u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(pxmitpriv->pallocated_xmit_extbuf), 4);
209 
210 	pxmitbuf = (struct xmit_buf *)pxmitpriv->pxmit_extbuf;
211 
212 	for (i = 0; i < NR_XMIT_EXTBUFF; i++) {
213 		INIT_LIST_HEAD(&pxmitbuf->list);
214 
215 		pxmitbuf->priv_data = NULL;
216 		pxmitbuf->padapter = padapter;
217 		pxmitbuf->buf_tag = XMITBUF_MGNT;
218 
219 		res = rtw_os_xmit_resource_alloc(padapter, pxmitbuf, MAX_XMIT_EXTBUF_SZ + XMITBUF_ALIGN_SZ, true);
220 		if (res == _FAIL) {
221 			res = _FAIL;
222 			goto exit;
223 		}
224 
225 		pxmitbuf->phead = pxmitbuf->pbuf;
226 		pxmitbuf->pend = pxmitbuf->pbuf + MAX_XMIT_EXTBUF_SZ;
227 		pxmitbuf->len = 0;
228 		pxmitbuf->pdata = pxmitbuf->ptail = pxmitbuf->phead;
229 
230 		list_add_tail(&pxmitbuf->list, &(pxmitpriv->free_xmit_extbuf_queue.queue));
231 		#ifdef DBG_XMIT_BUF_EXT
232 		pxmitbuf->no = i;
233 		#endif
234 		pxmitbuf++;
235 
236 	}
237 
238 	pxmitpriv->free_xmit_extbuf_cnt = NR_XMIT_EXTBUFF;
239 
240 	for (i = 0; i < CMDBUF_MAX; i++) {
241 		pxmitbuf = &pxmitpriv->pcmd_xmitbuf[i];
242 		if (pxmitbuf) {
243 			INIT_LIST_HEAD(&pxmitbuf->list);
244 
245 			pxmitbuf->priv_data = NULL;
246 			pxmitbuf->padapter = padapter;
247 			pxmitbuf->buf_tag = XMITBUF_CMD;
248 
249 			res = rtw_os_xmit_resource_alloc(padapter, pxmitbuf, MAX_CMDBUF_SZ+XMITBUF_ALIGN_SZ, true);
250 			if (res == _FAIL) {
251 				res = _FAIL;
252 				goto exit;
253 			}
254 
255 			pxmitbuf->phead = pxmitbuf->pbuf;
256 			pxmitbuf->pend = pxmitbuf->pbuf + MAX_CMDBUF_SZ;
257 			pxmitbuf->len = 0;
258 			pxmitbuf->pdata = pxmitbuf->ptail = pxmitbuf->phead;
259 			pxmitbuf->alloc_sz = MAX_CMDBUF_SZ+XMITBUF_ALIGN_SZ;
260 		}
261 	}
262 
263 	rtw_alloc_hwxmits(padapter);
264 	rtw_init_hwxmits(pxmitpriv->hwxmits, pxmitpriv->hwxmit_entry);
265 
266 	for (i = 0; i < 4; i++) {
267 		pxmitpriv->wmm_para_seq[i] = i;
268 	}
269 
270 	pxmitpriv->ack_tx = false;
271 	mutex_init(&pxmitpriv->ack_tx_mutex);
272 	rtw_sctx_init(&pxmitpriv->ack_tx_ops, 0);
273 
274 	rtw_hal_init_xmit_priv(padapter);
275 
276 exit:
277 	return res;
278 }
279 
280 void _rtw_free_xmit_priv(struct xmit_priv *pxmitpriv)
281 {
282 	int i;
283 	struct adapter *padapter = pxmitpriv->adapter;
284 	struct xmit_frame	*pxmitframe = (struct xmit_frame *) pxmitpriv->pxmit_frame_buf;
285 	struct xmit_buf *pxmitbuf = (struct xmit_buf *)pxmitpriv->pxmitbuf;
286 
287 	rtw_hal_free_xmit_priv(padapter);
288 
289 	if (pxmitpriv->pxmit_frame_buf == NULL)
290 		return;
291 
292 	for (i = 0; i < NR_XMITFRAME; i++) {
293 		rtw_os_xmit_complete(padapter, pxmitframe);
294 
295 		pxmitframe++;
296 	}
297 
298 	for (i = 0; i < NR_XMITBUFF; i++) {
299 		rtw_os_xmit_resource_free(padapter, pxmitbuf, (MAX_XMITBUF_SZ + XMITBUF_ALIGN_SZ), true);
300 
301 		pxmitbuf++;
302 	}
303 
304 	if (pxmitpriv->pallocated_frame_buf)
305 		vfree(pxmitpriv->pallocated_frame_buf);
306 
307 
308 	if (pxmitpriv->pallocated_xmitbuf)
309 		vfree(pxmitpriv->pallocated_xmitbuf);
310 
311 	/* free xframe_ext queue,  the same count as extbuf  */
312 	pxmitframe = (struct xmit_frame *)pxmitpriv->xframe_ext;
313 	if (pxmitframe) {
314 		for (i = 0; i < NR_XMIT_EXTBUFF; i++) {
315 			rtw_os_xmit_complete(padapter, pxmitframe);
316 			pxmitframe++;
317 		}
318 	}
319 	if (pxmitpriv->xframe_ext_alloc_addr)
320 		vfree(pxmitpriv->xframe_ext_alloc_addr);
321 
322 	/*  free xmit extension buff */
323 	pxmitbuf = (struct xmit_buf *)pxmitpriv->pxmit_extbuf;
324 	for (i = 0; i < NR_XMIT_EXTBUFF; i++) {
325 		rtw_os_xmit_resource_free(padapter, pxmitbuf, (MAX_XMIT_EXTBUF_SZ + XMITBUF_ALIGN_SZ), true);
326 
327 		pxmitbuf++;
328 	}
329 
330 	if (pxmitpriv->pallocated_xmit_extbuf) {
331 		vfree(pxmitpriv->pallocated_xmit_extbuf);
332 	}
333 
334 	for (i = 0; i < CMDBUF_MAX; i++) {
335 		pxmitbuf = &pxmitpriv->pcmd_xmitbuf[i];
336 		if (pxmitbuf != NULL)
337 			rtw_os_xmit_resource_free(padapter, pxmitbuf, MAX_CMDBUF_SZ+XMITBUF_ALIGN_SZ, true);
338 	}
339 
340 	rtw_free_hwxmits(padapter);
341 
342 	mutex_destroy(&pxmitpriv->ack_tx_mutex);
343 }
344 
345 u8 query_ra_short_GI(struct sta_info *psta)
346 {
347 	u8 sgi = false, sgi_20m = false, sgi_40m = false, sgi_80m = false;
348 
349 	sgi_20m = psta->htpriv.sgi_20m;
350 	sgi_40m = psta->htpriv.sgi_40m;
351 
352 	switch (psta->bw_mode) {
353 	case CHANNEL_WIDTH_80:
354 		sgi = sgi_80m;
355 		break;
356 	case CHANNEL_WIDTH_40:
357 		sgi = sgi_40m;
358 		break;
359 	case CHANNEL_WIDTH_20:
360 	default:
361 		sgi = sgi_20m;
362 		break;
363 	}
364 
365 	return sgi;
366 }
367 
368 static void update_attrib_vcs_info(struct adapter *padapter, struct xmit_frame *pxmitframe)
369 {
370 	u32 sz;
371 	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
372 	/* struct sta_info *psta = pattrib->psta; */
373 	struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
374 	struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
375 
376 	if (pattrib->nr_frags != 1)
377 		sz = padapter->xmitpriv.frag_len;
378 	else /* no frag */
379 		sz = pattrib->last_txcmdsz;
380 
381 	/*  (1) RTS_Threshold is compared to the MPDU, not MSDU. */
382 	/*  (2) If there are more than one frag in  this MSDU, only the first frag uses protection frame. */
383 	/* 		Other fragments are protected by previous fragment. */
384 	/* 		So we only need to check the length of first fragment. */
385 	if (pmlmeext->cur_wireless_mode < WIRELESS_11_24N  || padapter->registrypriv.wifi_spec) {
386 		if (sz > padapter->registrypriv.rts_thresh)
387 			pattrib->vcs_mode = RTS_CTS;
388 		else{
389 			if (pattrib->rtsen)
390 				pattrib->vcs_mode = RTS_CTS;
391 			else if (pattrib->cts2self)
392 				pattrib->vcs_mode = CTS_TO_SELF;
393 			else
394 				pattrib->vcs_mode = NONE_VCS;
395 		}
396 	} else{
397 		while (true) {
398 			/* IOT action */
399 			if ((pmlmeinfo->assoc_AP_vendor == HT_IOT_PEER_ATHEROS) && (pattrib->ampdu_en == true) &&
400 				(padapter->securitypriv.dot11PrivacyAlgrthm == _AES_)) {
401 				pattrib->vcs_mode = CTS_TO_SELF;
402 				break;
403 			}
404 
405 
406 			/* check ERP protection */
407 			if (pattrib->rtsen || pattrib->cts2self) {
408 				if (pattrib->rtsen)
409 					pattrib->vcs_mode = RTS_CTS;
410 				else if (pattrib->cts2self)
411 					pattrib->vcs_mode = CTS_TO_SELF;
412 
413 				break;
414 			}
415 
416 			/* check HT op mode */
417 			if (pattrib->ht_en) {
418 				u8 HTOpMode = pmlmeinfo->HT_protection;
419 				if ((pmlmeext->cur_bwmode && (HTOpMode == 2 || HTOpMode == 3)) ||
420 					(!pmlmeext->cur_bwmode && HTOpMode == 3)) {
421 					pattrib->vcs_mode = RTS_CTS;
422 					break;
423 				}
424 			}
425 
426 			/* check rts */
427 			if (sz > padapter->registrypriv.rts_thresh) {
428 				pattrib->vcs_mode = RTS_CTS;
429 				break;
430 			}
431 
432 			/* to do list: check MIMO power save condition. */
433 
434 			/* check AMPDU aggregation for TXOP */
435 			if (pattrib->ampdu_en == true) {
436 				pattrib->vcs_mode = RTS_CTS;
437 				break;
438 			}
439 
440 			pattrib->vcs_mode = NONE_VCS;
441 			break;
442 		}
443 	}
444 
445 	/* for debug : force driver control vrtl_carrier_sense. */
446 	if (padapter->driver_vcs_en == 1)
447 		pattrib->vcs_mode = padapter->driver_vcs_type;
448 }
449 
450 static void update_attrib_phy_info(struct adapter *padapter, struct pkt_attrib *pattrib, struct sta_info *psta)
451 {
452 	struct mlme_ext_priv *mlmeext = &padapter->mlmeextpriv;
453 
454 	pattrib->rtsen = psta->rtsen;
455 	pattrib->cts2self = psta->cts2self;
456 
457 	pattrib->mdata = 0;
458 	pattrib->eosp = 0;
459 	pattrib->triggered = 0;
460 	pattrib->ampdu_spacing = 0;
461 
462 	/* qos_en, ht_en, init rate, , bw, ch_offset, sgi */
463 	pattrib->qos_en = psta->qos_option;
464 
465 	pattrib->raid = psta->raid;
466 
467 	if (mlmeext->cur_bwmode < psta->bw_mode)
468 		pattrib->bwmode = mlmeext->cur_bwmode;
469 	else
470 		pattrib->bwmode = psta->bw_mode;
471 
472 	pattrib->sgi = query_ra_short_GI(psta);
473 
474 	pattrib->ldpc = psta->ldpc;
475 	pattrib->stbc = psta->stbc;
476 
477 	pattrib->ht_en = psta->htpriv.ht_option;
478 	pattrib->ch_offset = psta->htpriv.ch_offset;
479 	pattrib->ampdu_en = false;
480 
481 	if (padapter->driver_ampdu_spacing != 0xFF) /* driver control AMPDU Density for peer sta's rx */
482 		pattrib->ampdu_spacing = padapter->driver_ampdu_spacing;
483 	else
484 		pattrib->ampdu_spacing = psta->htpriv.rx_ampdu_min_spacing;
485 
486 	/* if (pattrib->ht_en && psta->htpriv.ampdu_enable) */
487 	/*  */
488 	/* 	if (psta->htpriv.agg_enable_bitmap & BIT(pattrib->priority)) */
489 	/* 		pattrib->ampdu_en = true; */
490 	/*  */
491 
492 
493 	pattrib->retry_ctrl = false;
494 
495 #ifdef CONFIG_AUTO_AP_MODE
496 	if (psta->isrc && psta->pid > 0)
497 		pattrib->pctrl = true;
498 #endif
499 
500 }
501 
502 static s32 update_attrib_sec_info(struct adapter *padapter, struct pkt_attrib *pattrib, struct sta_info *psta)
503 {
504 	sint res = _SUCCESS;
505 	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
506 	struct security_priv *psecuritypriv = &padapter->securitypriv;
507 	sint bmcast = IS_MCAST(pattrib->ra);
508 
509 	memset(pattrib->dot118021x_UncstKey.skey,  0, 16);
510 	memset(pattrib->dot11tkiptxmickey.skey,  0, 16);
511 	pattrib->mac_id = psta->mac_id;
512 
513 	if (psta->ieee8021x_blocked == true) {
514 		RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("\n psta->ieee8021x_blocked == true\n"));
515 
516 		pattrib->encrypt = 0;
517 
518 		if ((pattrib->ether_type != 0x888e) && (check_fwstate(pmlmepriv, WIFI_MP_STATE) == false)) {
519 			RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("\npsta->ieee8021x_blocked == true,  pattrib->ether_type(%.4x) != 0x888e\n", pattrib->ether_type));
520 			#ifdef DBG_TX_DROP_FRAME
521 			DBG_871X("DBG_TX_DROP_FRAME %s psta->ieee8021x_blocked == true,  pattrib->ether_type(%04x) != 0x888e\n", __func__, pattrib->ether_type);
522 			#endif
523 			res = _FAIL;
524 			goto exit;
525 		}
526 	} else{
527 		GET_ENCRY_ALGO(psecuritypriv, psta, pattrib->encrypt, bmcast);
528 
529 		switch (psecuritypriv->dot11AuthAlgrthm) {
530 		case dot11AuthAlgrthm_Open:
531 		case dot11AuthAlgrthm_Shared:
532 		case dot11AuthAlgrthm_Auto:
533 			pattrib->key_idx = (u8)psecuritypriv->dot11PrivacyKeyIndex;
534 			break;
535 		case dot11AuthAlgrthm_8021X:
536 			if (bmcast)
537 				pattrib->key_idx = (u8)psecuritypriv->dot118021XGrpKeyid;
538 			else
539 				pattrib->key_idx = 0;
540 			break;
541 		default:
542 			pattrib->key_idx = 0;
543 			break;
544 		}
545 
546 		/* For WPS 1.0 WEP, driver should not encrypt EAPOL Packet for WPS handshake. */
547 		if (((pattrib->encrypt == _WEP40_) || (pattrib->encrypt == _WEP104_)) && (pattrib->ether_type == 0x888e))
548 			pattrib->encrypt = _NO_PRIVACY_;
549 
550 	}
551 
552 	switch (pattrib->encrypt) {
553 	case _WEP40_:
554 	case _WEP104_:
555 		pattrib->iv_len = 4;
556 		pattrib->icv_len = 4;
557 		WEP_IV(pattrib->iv, psta->dot11txpn, pattrib->key_idx);
558 		break;
559 
560 	case _TKIP_:
561 		pattrib->iv_len = 8;
562 		pattrib->icv_len = 4;
563 
564 		if (psecuritypriv->busetkipkey == _FAIL) {
565 			#ifdef DBG_TX_DROP_FRAME
566 			DBG_871X("DBG_TX_DROP_FRAME %s psecuritypriv->busetkipkey(%d) == _FAIL drop packet\n", __func__, psecuritypriv->busetkipkey);
567 			#endif
568 			res = _FAIL;
569 			goto exit;
570 		}
571 
572 		if (bmcast)
573 			TKIP_IV(pattrib->iv, psta->dot11txpn, pattrib->key_idx);
574 		else
575 			TKIP_IV(pattrib->iv, psta->dot11txpn, 0);
576 
577 
578 		memcpy(pattrib->dot11tkiptxmickey.skey, psta->dot11tkiptxmickey.skey, 16);
579 
580 		break;
581 
582 	case _AES_:
583 
584 		pattrib->iv_len = 8;
585 		pattrib->icv_len = 8;
586 
587 		if (bmcast)
588 			AES_IV(pattrib->iv, psta->dot11txpn, pattrib->key_idx);
589 		else
590 			AES_IV(pattrib->iv, psta->dot11txpn, 0);
591 
592 		break;
593 
594 	default:
595 		pattrib->iv_len = 0;
596 		pattrib->icv_len = 0;
597 		break;
598 	}
599 
600 	if (pattrib->encrypt > 0)
601 		memcpy(pattrib->dot118021x_UncstKey.skey, psta->dot118021x_UncstKey.skey, 16);
602 
603 	RT_TRACE(_module_rtl871x_xmit_c_, _drv_info_,
604 		("update_attrib: encrypt =%d  securitypriv.sw_encrypt =%d\n",
605 		pattrib->encrypt, padapter->securitypriv.sw_encrypt));
606 
607 	if (pattrib->encrypt &&
608 		((padapter->securitypriv.sw_encrypt == true) || (psecuritypriv->hw_decrypted == false))) {
609 		pattrib->bswenc = true;
610 		RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_,
611 			("update_attrib: encrypt =%d securitypriv.hw_decrypted =%d bswenc =true\n",
612 			pattrib->encrypt, padapter->securitypriv.sw_encrypt));
613 	} else {
614 		pattrib->bswenc = false;
615 		RT_TRACE(_module_rtl871x_xmit_c_, _drv_info_, ("update_attrib: bswenc =false\n"));
616 	}
617 
618 exit:
619 
620 	return res;
621 
622 }
623 
624 u8 qos_acm(u8 acm_mask, u8 priority)
625 {
626 	u8 change_priority = priority;
627 
628 	switch (priority) {
629 	case 0:
630 	case 3:
631 		if (acm_mask & BIT(1))
632 			change_priority = 1;
633 		break;
634 	case 1:
635 	case 2:
636 		break;
637 	case 4:
638 	case 5:
639 		if (acm_mask & BIT(2))
640 			change_priority = 0;
641 		break;
642 	case 6:
643 	case 7:
644 		if (acm_mask & BIT(3))
645 			change_priority = 5;
646 		break;
647 	default:
648 		DBG_871X("qos_acm(): invalid pattrib->priority: %d!!!\n", priority);
649 		break;
650 	}
651 
652 	return change_priority;
653 }
654 
655 static void set_qos(struct pkt_file *ppktfile, struct pkt_attrib *pattrib)
656 {
657 	struct ethhdr etherhdr;
658 	struct iphdr ip_hdr;
659 	s32 UserPriority = 0;
660 
661 
662 	_rtw_open_pktfile(ppktfile->pkt, ppktfile);
663 	_rtw_pktfile_read(ppktfile, (unsigned char *)&etherhdr, ETH_HLEN);
664 
665 	/*  get UserPriority from IP hdr */
666 	if (pattrib->ether_type == 0x0800) {
667 		_rtw_pktfile_read(ppktfile, (u8 *)&ip_hdr, sizeof(ip_hdr));
668 /* 		UserPriority = (ntohs(ip_hdr.tos) >> 5) & 0x3; */
669 		UserPriority = ip_hdr.tos >> 5;
670 	}
671 	pattrib->priority = UserPriority;
672 	pattrib->hdrlen = WLAN_HDR_A3_QOS_LEN;
673 	pattrib->subtype = WIFI_QOS_DATA_TYPE;
674 }
675 
676 static s32 update_attrib(struct adapter *padapter, _pkt *pkt, struct pkt_attrib *pattrib)
677 {
678 	uint i;
679 	struct pkt_file pktfile;
680 	struct sta_info *psta = NULL;
681 	struct ethhdr etherhdr;
682 
683 	sint bmcast;
684 	struct sta_priv 	*pstapriv = &padapter->stapriv;
685 	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
686 	struct qos_priv 	*pqospriv = &pmlmepriv->qospriv;
687 	sint res = _SUCCESS;
688 
689 	DBG_COUNTER(padapter->tx_logs.core_tx_upd_attrib);
690 
691 	_rtw_open_pktfile(pkt, &pktfile);
692 	i = _rtw_pktfile_read(&pktfile, (u8 *)&etherhdr, ETH_HLEN);
693 
694 	pattrib->ether_type = ntohs(etherhdr.h_proto);
695 
696 
697 	memcpy(pattrib->dst, &etherhdr.h_dest, ETH_ALEN);
698 	memcpy(pattrib->src, &etherhdr.h_source, ETH_ALEN);
699 
700 
701 	if ((check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == true) ||
702 		(check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == true)) {
703 		memcpy(pattrib->ra, pattrib->dst, ETH_ALEN);
704 		memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
705 		DBG_COUNTER(padapter->tx_logs.core_tx_upd_attrib_adhoc);
706 	} else if (check_fwstate(pmlmepriv, WIFI_STATION_STATE)) {
707 		memcpy(pattrib->ra, get_bssid(pmlmepriv), ETH_ALEN);
708 		memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
709 		DBG_COUNTER(padapter->tx_logs.core_tx_upd_attrib_sta);
710 	} else if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
711 		memcpy(pattrib->ra, pattrib->dst, ETH_ALEN);
712 		memcpy(pattrib->ta, get_bssid(pmlmepriv), ETH_ALEN);
713 		DBG_COUNTER(padapter->tx_logs.core_tx_upd_attrib_ap);
714 	} else
715 		DBG_COUNTER(padapter->tx_logs.core_tx_upd_attrib_unknown);
716 
717 	pattrib->pktlen = pktfile.pkt_len;
718 
719 	if (ETH_P_IP == pattrib->ether_type) {
720 		/*  The following is for DHCP and ARP packet, we use cck1M to tx these packets and let LPS awake some time */
721 		/*  to prevent DHCP protocol fail */
722 
723 		u8 tmp[24];
724 
725 		_rtw_pktfile_read(&pktfile, &tmp[0], 24);
726 
727 		pattrib->dhcp_pkt = 0;
728 		if (pktfile.pkt_len > 282) {/* MINIMUM_DHCP_PACKET_SIZE) { */
729 			if (ETH_P_IP == pattrib->ether_type) {/*  IP header */
730 				if (((tmp[21] == 68) && (tmp[23] == 67)) ||
731 					((tmp[21] == 67) && (tmp[23] == 68))) {
732 					/*  68 : UDP BOOTP client */
733 					/*  67 : UDP BOOTP server */
734 					RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("======================update_attrib: get DHCP Packet\n"));
735 					pattrib->dhcp_pkt = 1;
736 					DBG_COUNTER(padapter->tx_logs.core_tx_upd_attrib_dhcp);
737 				}
738 			}
739 		}
740 
741 		/* for parsing ICMP pakcets */
742 		{
743 			struct iphdr *piphdr = (struct iphdr *)tmp;
744 
745 			pattrib->icmp_pkt = 0;
746 			if (piphdr->protocol == 0x1) { /*  protocol type in ip header 0x1 is ICMP */
747 				pattrib->icmp_pkt = 1;
748 				DBG_COUNTER(padapter->tx_logs.core_tx_upd_attrib_icmp);
749 			}
750 		}
751 
752 
753 	} else if (0x888e == pattrib->ether_type) {
754 		DBG_871X_LEVEL(_drv_always_, "send eapol packet\n");
755 	}
756 
757 	if ((pattrib->ether_type == 0x888e) || (pattrib->dhcp_pkt == 1))
758 		rtw_set_scan_deny(padapter, 3000);
759 
760 	/*  If EAPOL , ARP , OR DHCP packet, driver must be in active mode. */
761 	if (pattrib->icmp_pkt == 1)
762 		rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_LEAVE, 1);
763 	else if (pattrib->dhcp_pkt == 1) {
764 		DBG_COUNTER(padapter->tx_logs.core_tx_upd_attrib_active);
765 		rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_SPECIAL_PACKET, 1);
766 	}
767 
768 	bmcast = IS_MCAST(pattrib->ra);
769 
770 	/*  get sta_info */
771 	if (bmcast) {
772 		psta = rtw_get_bcmc_stainfo(padapter);
773 	} else {
774 		psta = rtw_get_stainfo(pstapriv, pattrib->ra);
775 		if (psta == NULL)	{ /*  if we cannot get psta => drop the pkt */
776 			DBG_COUNTER(padapter->tx_logs.core_tx_upd_attrib_err_ucast_sta);
777 			RT_TRACE(_module_rtl871x_xmit_c_, _drv_alert_, ("\nupdate_attrib => get sta_info fail, ra:" MAC_FMT"\n", MAC_ARG(pattrib->ra)));
778 			#ifdef DBG_TX_DROP_FRAME
779 			DBG_871X("DBG_TX_DROP_FRAME %s get sta_info fail, ra:" MAC_FMT"\n", __func__, MAC_ARG(pattrib->ra));
780 			#endif
781 			res = _FAIL;
782 			goto exit;
783 		} else if ((check_fwstate(pmlmepriv, WIFI_AP_STATE) == true) && (!(psta->state & _FW_LINKED))) {
784 			DBG_COUNTER(padapter->tx_logs.core_tx_upd_attrib_err_ucast_ap_link);
785 			res = _FAIL;
786 			goto exit;
787 		}
788 	}
789 
790 	if (psta == NULL) {
791 		/*  if we cannot get psta => drop the pkt */
792 		DBG_COUNTER(padapter->tx_logs.core_tx_upd_attrib_err_sta);
793 		RT_TRACE(_module_rtl871x_xmit_c_, _drv_alert_, ("\nupdate_attrib => get sta_info fail, ra:" MAC_FMT "\n", MAC_ARG(pattrib->ra)));
794 		#ifdef DBG_TX_DROP_FRAME
795 		DBG_871X("DBG_TX_DROP_FRAME %s get sta_info fail, ra:" MAC_FMT"\n", __func__, MAC_ARG(pattrib->ra));
796 		#endif
797 		res = _FAIL;
798 		goto exit;
799 	}
800 
801 	if (!(psta->state & _FW_LINKED)) {
802 		DBG_COUNTER(padapter->tx_logs.core_tx_upd_attrib_err_link);
803 		DBG_871X("%s, psta("MAC_FMT")->state(0x%x) != _FW_LINKED\n", __func__, MAC_ARG(psta->hwaddr), psta->state);
804 		return _FAIL;
805 	}
806 
807 
808 
809 	/* TODO:_lock */
810 	if (update_attrib_sec_info(padapter, pattrib, psta) == _FAIL) {
811 		DBG_COUNTER(padapter->tx_logs.core_tx_upd_attrib_err_sec);
812 		res = _FAIL;
813 		goto exit;
814 	}
815 
816 	update_attrib_phy_info(padapter, pattrib, psta);
817 
818 	/* DBG_8192C("%s ==> mac_id(%d)\n", __func__, pattrib->mac_id); */
819 
820 	pattrib->psta = psta;
821 	/* TODO:_unlock */
822 
823 	pattrib->pctrl = 0;
824 
825 	pattrib->ack_policy = 0;
826 	/*  get ether_hdr_len */
827 	pattrib->pkt_hdrlen = ETH_HLEN;/* pattrib->ether_type == 0x8100) ? (14 + 4): 14; vlan tag */
828 
829 	pattrib->hdrlen = WLAN_HDR_A3_LEN;
830 	pattrib->subtype = WIFI_DATA_TYPE;
831 	pattrib->priority = 0;
832 
833 	if (check_fwstate(pmlmepriv, WIFI_AP_STATE|WIFI_ADHOC_STATE|WIFI_ADHOC_MASTER_STATE)) {
834 		if (pattrib->qos_en)
835 			set_qos(&pktfile, pattrib);
836 	} else{
837 		if (pqospriv->qos_option) {
838 			set_qos(&pktfile, pattrib);
839 
840 			if (pmlmepriv->acm_mask != 0)
841 				pattrib->priority = qos_acm(pmlmepriv->acm_mask, pattrib->priority);
842 
843 		}
844 	}
845 
846 	/* pattrib->priority = 5; force to used VI queue, for testing */
847 
848 	rtw_set_tx_chksum_offload(pkt, pattrib);
849 
850 exit:
851 	return res;
852 }
853 
854 static s32 xmitframe_addmic(struct adapter *padapter, struct xmit_frame *pxmitframe)
855 {
856 	sint			curfragnum, length;
857 	u8 *pframe, *payload, mic[8];
858 	struct	mic_data		micdata;
859 	/* struct	sta_info 	*stainfo; */
860 	struct	pkt_attrib	 *pattrib = &pxmitframe->attrib;
861 	struct	security_priv *psecuritypriv = &padapter->securitypriv;
862 	struct	xmit_priv 	*pxmitpriv = &padapter->xmitpriv;
863 	u8 priority[4] = {0x0, 0x0, 0x0, 0x0};
864 	u8 hw_hdr_offset = 0;
865 	sint bmcst = IS_MCAST(pattrib->ra);
866 
867 /*
868 	if (pattrib->psta)
869 	{
870 		stainfo = pattrib->psta;
871 	}
872 	else
873 	{
874 		DBG_871X("%s, call rtw_get_stainfo()\n", __func__);
875 		stainfo =rtw_get_stainfo(&padapter->stapriv ,&pattrib->ra[0]);
876 	}
877 
878 	if (stainfo == NULL)
879 	{
880 		DBG_871X("%s, psta ==NUL\n", __func__);
881 		return _FAIL;
882 	}
883 
884 	if (!(stainfo->state &_FW_LINKED))
885 	{
886 		DBG_871X("%s, psta->state(0x%x) != _FW_LINKED\n", __func__, stainfo->state);
887 		return _FAIL;
888 	}
889 */
890 
891 	hw_hdr_offset = TXDESC_OFFSET;
892 
893 	if (pattrib->encrypt == _TKIP_) { /* if (psecuritypriv->dot11PrivacyAlgrthm == _TKIP_PRIVACY_) */
894 		/* encode mic code */
895 		/* if (stainfo!= NULL) */
896 		{
897 			u8 null_key[16] = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0};
898 
899 			pframe = pxmitframe->buf_addr + hw_hdr_offset;
900 
901 			if (bmcst) {
902 				if (!memcmp(psecuritypriv->dot118021XGrptxmickey[psecuritypriv->dot118021XGrpKeyid].skey, null_key, 16)) {
903 					/* DbgPrint("\nxmitframe_addmic:stainfo->dot11tkiptxmickey == 0\n"); */
904 					/* msleep(10); */
905 					return _FAIL;
906 				}
907 				/* start to calculate the mic code */
908 				rtw_secmicsetkey(&micdata, psecuritypriv->dot118021XGrptxmickey[psecuritypriv->dot118021XGrpKeyid].skey);
909 			} else {
910 				if (!memcmp(&pattrib->dot11tkiptxmickey.skey[0], null_key, 16)) {
911 					/* DbgPrint("\nxmitframe_addmic:stainfo->dot11tkiptxmickey == 0\n"); */
912 					/* msleep(10); */
913 					return _FAIL;
914 				}
915 				/* start to calculate the mic code */
916 				rtw_secmicsetkey(&micdata, &pattrib->dot11tkiptxmickey.skey[0]);
917 			}
918 
919 			if (pframe[1]&1) {   /* ToDS == 1 */
920 				rtw_secmicappend(&micdata, &pframe[16], 6);  /* DA */
921 				if (pframe[1]&2)  /* From Ds == 1 */
922 					rtw_secmicappend(&micdata, &pframe[24], 6);
923 				else
924 				rtw_secmicappend(&micdata, &pframe[10], 6);
925 			} else {	/* ToDS == 0 */
926 				rtw_secmicappend(&micdata, &pframe[4], 6);   /* DA */
927 				if (pframe[1]&2)  /* From Ds == 1 */
928 					rtw_secmicappend(&micdata, &pframe[16], 6);
929 				else
930 					rtw_secmicappend(&micdata, &pframe[10], 6);
931 
932 			}
933 
934 			/* if (pqospriv->qos_option == 1) */
935 			if (pattrib->qos_en)
936 				priority[0] = (u8)pxmitframe->attrib.priority;
937 
938 
939 			rtw_secmicappend(&micdata, &priority[0], 4);
940 
941 			payload = pframe;
942 
943 			for (curfragnum = 0; curfragnum < pattrib->nr_frags; curfragnum++) {
944 				payload = (u8 *)RND4((SIZE_PTR)(payload));
945 				RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("===curfragnum =%d, pframe = 0x%.2x, 0x%.2x, 0x%.2x, 0x%.2x, 0x%.2x, 0x%.2x, 0x%.2x, 0x%.2x,!!!\n",
946 					curfragnum, *payload, *(payload+1), *(payload+2), *(payload+3), *(payload+4), *(payload+5), *(payload+6), *(payload+7)));
947 
948 				payload = payload+pattrib->hdrlen+pattrib->iv_len;
949 				RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("curfragnum =%d pattrib->hdrlen =%d pattrib->iv_len =%d", curfragnum, pattrib->hdrlen, pattrib->iv_len));
950 				if ((curfragnum+1) == pattrib->nr_frags) {
951 					length = pattrib->last_txcmdsz-pattrib->hdrlen-pattrib->iv_len-((pattrib->bswenc) ? pattrib->icv_len : 0);
952 					rtw_secmicappend(&micdata, payload, length);
953 					payload = payload+length;
954 				} else{
955 					length = pxmitpriv->frag_len-pattrib->hdrlen-pattrib->iv_len-((pattrib->bswenc) ? pattrib->icv_len : 0);
956 					rtw_secmicappend(&micdata, payload, length);
957 					payload = payload+length+pattrib->icv_len;
958 					RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("curfragnum =%d length =%d pattrib->icv_len =%d", curfragnum, length, pattrib->icv_len));
959 				}
960 			}
961 			rtw_secgetmic(&micdata, &(mic[0]));
962 			RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("xmitframe_addmic: before add mic code!!!\n"));
963 			RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("xmitframe_addmic: pattrib->last_txcmdsz =%d!!!\n", pattrib->last_txcmdsz));
964 			RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("xmitframe_addmic: mic[0]= 0x%.2x , mic[1]= 0x%.2x , mic[2]= 0x%.2x , mic[3]= 0x%.2x\n\
965   mic[4]= 0x%.2x , mic[5]= 0x%.2x , mic[6]= 0x%.2x , mic[7]= 0x%.2x !!!!\n",
966 				mic[0], mic[1], mic[2], mic[3], mic[4], mic[5], mic[6], mic[7]));
967 			/* add mic code  and add the mic code length in last_txcmdsz */
968 
969 			memcpy(payload, &(mic[0]), 8);
970 			pattrib->last_txcmdsz += 8;
971 
972 			RT_TRACE(_module_rtl871x_xmit_c_, _drv_info_, ("\n ========last pkt ========\n"));
973 			payload = payload-pattrib->last_txcmdsz+8;
974 			for (curfragnum = 0; curfragnum < pattrib->last_txcmdsz; curfragnum = curfragnum+8)
975 					RT_TRACE(_module_rtl871x_xmit_c_, _drv_info_, (" %.2x,  %.2x,  %.2x,  %.2x,  %.2x,  %.2x,  %.2x,  %.2x ",
976 					*(payload+curfragnum), *(payload+curfragnum+1), *(payload+curfragnum+2), *(payload+curfragnum+3),
977 					*(payload+curfragnum+4), *(payload+curfragnum+5), *(payload+curfragnum+6), *(payload+curfragnum+7)));
978 			}
979 /*
980 			else {
981 				RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("xmitframe_addmic: rtw_get_stainfo == NULL!!!\n"));
982 			}
983 */
984 	}
985 	return _SUCCESS;
986 }
987 
988 static s32 xmitframe_swencrypt(struct adapter *padapter, struct xmit_frame *pxmitframe)
989 {
990 
991 	struct	pkt_attrib	 *pattrib = &pxmitframe->attrib;
992 	/* struct	security_priv *psecuritypriv =&padapter->securitypriv; */
993 
994 	/* if ((psecuritypriv->sw_encrypt)||(pattrib->bswenc)) */
995 	if (pattrib->bswenc) {
996 		/* DBG_871X("start xmitframe_swencrypt\n"); */
997 		RT_TRACE(_module_rtl871x_xmit_c_, _drv_alert_, ("### xmitframe_swencrypt\n"));
998 		switch (pattrib->encrypt) {
999 		case _WEP40_:
1000 		case _WEP104_:
1001 			rtw_wep_encrypt(padapter, (u8 *)pxmitframe);
1002 			break;
1003 		case _TKIP_:
1004 			rtw_tkip_encrypt(padapter, (u8 *)pxmitframe);
1005 			break;
1006 		case _AES_:
1007 			rtw_aes_encrypt(padapter, (u8 *)pxmitframe);
1008 			break;
1009 		default:
1010 				break;
1011 		}
1012 
1013 	} else
1014 		RT_TRACE(_module_rtl871x_xmit_c_, _drv_notice_, ("### xmitframe_hwencrypt\n"));
1015 
1016 	return _SUCCESS;
1017 }
1018 
1019 s32 rtw_make_wlanhdr(struct adapter *padapter, u8 *hdr, struct pkt_attrib *pattrib)
1020 {
1021 	u16 *qc;
1022 
1023 	struct ieee80211_hdr *pwlanhdr = (struct ieee80211_hdr *)hdr;
1024 	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
1025 	struct qos_priv *pqospriv = &pmlmepriv->qospriv;
1026 	u8 qos_option = false;
1027 	sint res = _SUCCESS;
1028 	__le16 *fctrl = &pwlanhdr->frame_control;
1029 
1030 	memset(hdr, 0, WLANHDR_OFFSET);
1031 
1032 	SetFrameSubType(fctrl, pattrib->subtype);
1033 
1034 	if (pattrib->subtype & WIFI_DATA_TYPE) {
1035 		if ((check_fwstate(pmlmepriv,  WIFI_STATION_STATE) == true)) {
1036 			/* to_ds = 1, fr_ds = 0; */
1037 
1038 			{
1039 				/*  1.Data transfer to AP */
1040 				/*  2.Arp pkt will relayed by AP */
1041 				SetToDs(fctrl);
1042 				memcpy(pwlanhdr->addr1, get_bssid(pmlmepriv), ETH_ALEN);
1043 				memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN);
1044 				memcpy(pwlanhdr->addr3, pattrib->dst, ETH_ALEN);
1045 			}
1046 
1047 			if (pqospriv->qos_option)
1048 				qos_option = true;
1049 
1050 		} else if ((check_fwstate(pmlmepriv,  WIFI_AP_STATE) == true)) {
1051 			/* to_ds = 0, fr_ds = 1; */
1052 			SetFrDs(fctrl);
1053 			memcpy(pwlanhdr->addr1, pattrib->dst, ETH_ALEN);
1054 			memcpy(pwlanhdr->addr2, get_bssid(pmlmepriv), ETH_ALEN);
1055 			memcpy(pwlanhdr->addr3, pattrib->src, ETH_ALEN);
1056 
1057 			if (pattrib->qos_en)
1058 				qos_option = true;
1059 		} else if ((check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == true) ||
1060 		(check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == true)) {
1061 			memcpy(pwlanhdr->addr1, pattrib->dst, ETH_ALEN);
1062 			memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN);
1063 			memcpy(pwlanhdr->addr3, get_bssid(pmlmepriv), ETH_ALEN);
1064 
1065 			if (pattrib->qos_en)
1066 				qos_option = true;
1067 		} else {
1068 			RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("fw_state:%x is not allowed to xmit frame\n", get_fwstate(pmlmepriv)));
1069 			res = _FAIL;
1070 			goto exit;
1071 		}
1072 
1073 		if (pattrib->mdata)
1074 			SetMData(fctrl);
1075 
1076 		if (pattrib->encrypt)
1077 			SetPrivacy(fctrl);
1078 
1079 		if (qos_option) {
1080 			qc = (unsigned short *)(hdr + pattrib->hdrlen - 2);
1081 
1082 			if (pattrib->priority)
1083 				SetPriority(qc, pattrib->priority);
1084 
1085 			SetEOSP(qc, pattrib->eosp);
1086 
1087 			SetAckpolicy(qc, pattrib->ack_policy);
1088 		}
1089 
1090 		/* TODO: fill HT Control Field */
1091 
1092 		/* Update Seq Num will be handled by f/w */
1093 		{
1094 			struct sta_info *psta;
1095 			psta = rtw_get_stainfo(&padapter->stapriv, pattrib->ra);
1096 			if (pattrib->psta != psta) {
1097 				DBG_871X("%s, pattrib->psta(%p) != psta(%p)\n", __func__, pattrib->psta, psta);
1098 				return _FAIL;
1099 			}
1100 
1101 			if (psta == NULL) {
1102 				DBG_871X("%s, psta ==NUL\n", __func__);
1103 				return _FAIL;
1104 			}
1105 
1106 			if (!(psta->state & _FW_LINKED)) {
1107 				DBG_871X("%s, psta->state(0x%x) != _FW_LINKED\n", __func__, psta->state);
1108 				return _FAIL;
1109 			}
1110 
1111 
1112 			if (psta) {
1113 				psta->sta_xmitpriv.txseq_tid[pattrib->priority]++;
1114 				psta->sta_xmitpriv.txseq_tid[pattrib->priority] &= 0xFFF;
1115 				pattrib->seqnum = psta->sta_xmitpriv.txseq_tid[pattrib->priority];
1116 
1117 				SetSeqNum(hdr, pattrib->seqnum);
1118 
1119 				/* check if enable ampdu */
1120 				if (pattrib->ht_en && psta->htpriv.ampdu_enable)
1121 					if (psta->htpriv.agg_enable_bitmap & BIT(pattrib->priority))
1122 						pattrib->ampdu_en = true;
1123 
1124 
1125 				/* re-check if enable ampdu by BA_starting_seqctrl */
1126 				if (pattrib->ampdu_en == true) {
1127 					u16 tx_seq;
1128 
1129 					tx_seq = psta->BA_starting_seqctrl[pattrib->priority & 0x0f];
1130 
1131 					/* check BA_starting_seqctrl */
1132 					if (SN_LESS(pattrib->seqnum, tx_seq)) {
1133 						/* DBG_871X("tx ampdu seqnum(%d) < tx_seq(%d)\n", pattrib->seqnum, tx_seq); */
1134 						pattrib->ampdu_en = false;/* AGG BK */
1135 					} else if (SN_EQUAL(pattrib->seqnum, tx_seq)) {
1136 						psta->BA_starting_seqctrl[pattrib->priority & 0x0f] = (tx_seq+1)&0xfff;
1137 
1138 						pattrib->ampdu_en = true;/* AGG EN */
1139 					} else{
1140 						/* DBG_871X("tx ampdu over run\n"); */
1141 						psta->BA_starting_seqctrl[pattrib->priority & 0x0f] = (pattrib->seqnum+1)&0xfff;
1142 						pattrib->ampdu_en = true;/* AGG EN */
1143 					}
1144 
1145 				}
1146 			}
1147 		}
1148 
1149 	} else{
1150 
1151 	}
1152 
1153 exit:
1154 	return res;
1155 }
1156 
1157 s32 rtw_txframes_pending(struct adapter *padapter)
1158 {
1159 	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
1160 
1161 	return ((!list_empty(&pxmitpriv->be_pending.queue)) ||
1162 			 (!list_empty(&pxmitpriv->bk_pending.queue)) ||
1163 			 (!list_empty(&pxmitpriv->vi_pending.queue)) ||
1164 			 (!list_empty(&pxmitpriv->vo_pending.queue)));
1165 }
1166 
1167 /*
1168  * Calculate wlan 802.11 packet MAX size from pkt_attrib
1169  * This function doesn't consider fragment case
1170  */
1171 u32 rtw_calculate_wlan_pkt_size_by_attribue(struct pkt_attrib *pattrib)
1172 {
1173 	u32 len = 0;
1174 
1175 	len = pattrib->hdrlen + pattrib->iv_len; /*  WLAN Header and IV */
1176 	len += SNAP_SIZE + sizeof(u16); /*  LLC */
1177 	len += pattrib->pktlen;
1178 	if (pattrib->encrypt == _TKIP_)
1179 		len += 8; /*  MIC */
1180 	len += ((pattrib->bswenc) ? pattrib->icv_len : 0); /*  ICV */
1181 
1182 	return len;
1183 }
1184 
1185 /*
1186 
1187 This sub-routine will perform all the following:
1188 
1189 1. remove 802.3 header.
1190 2. create wlan_header, based on the info in pxmitframe
1191 3. append sta's iv/ext-iv
1192 4. append LLC
1193 5. move frag chunk from pframe to pxmitframe->mem
1194 6. apply sw-encrypt, if necessary.
1195 
1196 */
1197 s32 rtw_xmitframe_coalesce(struct adapter *padapter, _pkt *pkt, struct xmit_frame *pxmitframe)
1198 {
1199 	struct pkt_file pktfile;
1200 
1201 	s32 frg_inx, frg_len, mpdu_len, llc_sz, mem_sz;
1202 
1203 	SIZE_PTR addr;
1204 
1205 	u8 *pframe, *mem_start;
1206 	u8 hw_hdr_offset;
1207 
1208 	/* struct sta_info 	*psta; */
1209 	/* struct sta_priv 	*pstapriv = &padapter->stapriv; */
1210 	/* struct mlme_priv *pmlmepriv = &padapter->mlmepriv; */
1211 	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
1212 
1213 	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
1214 
1215 	u8 *pbuf_start;
1216 
1217 	s32 bmcst = IS_MCAST(pattrib->ra);
1218 	s32 res = _SUCCESS;
1219 
1220 /*
1221 	if (pattrib->psta)
1222 	{
1223 		psta = pattrib->psta;
1224 	} else
1225 	{
1226 		DBG_871X("%s, call rtw_get_stainfo()\n", __func__);
1227 		psta = rtw_get_stainfo(&padapter->stapriv, pattrib->ra);
1228 	}
1229 
1230 	if (psta == NULL)
1231   {
1232 
1233 		DBG_871X("%s, psta ==NUL\n", __func__);
1234 		return _FAIL;
1235 	}
1236 
1237 
1238 	if (!(psta->state &_FW_LINKED))
1239 	{
1240 		DBG_871X("%s, psta->state(0x%x) != _FW_LINKED\n", __func__, psta->state);
1241 		return _FAIL;
1242 	}
1243 */
1244 	if (pxmitframe->buf_addr == NULL) {
1245 		DBG_8192C("==> %s buf_addr == NULL\n", __func__);
1246 		return _FAIL;
1247 	}
1248 
1249 	pbuf_start = pxmitframe->buf_addr;
1250 
1251 	hw_hdr_offset = TXDESC_OFFSET;
1252 	mem_start = pbuf_start +	hw_hdr_offset;
1253 
1254 	if (rtw_make_wlanhdr(padapter, mem_start, pattrib) == _FAIL) {
1255 		RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("rtw_xmitframe_coalesce: rtw_make_wlanhdr fail; drop pkt\n"));
1256 		DBG_8192C("rtw_xmitframe_coalesce: rtw_make_wlanhdr fail; drop pkt\n");
1257 		res = _FAIL;
1258 		goto exit;
1259 	}
1260 
1261 	_rtw_open_pktfile(pkt, &pktfile);
1262 	_rtw_pktfile_read(&pktfile, NULL, pattrib->pkt_hdrlen);
1263 
1264 	frg_inx = 0;
1265 	frg_len = pxmitpriv->frag_len - 4;/* 2346-4 = 2342 */
1266 
1267 	while (1) {
1268 		llc_sz = 0;
1269 
1270 		mpdu_len = frg_len;
1271 
1272 		pframe = mem_start;
1273 
1274 		SetMFrag(mem_start);
1275 
1276 		pframe += pattrib->hdrlen;
1277 		mpdu_len -= pattrib->hdrlen;
1278 
1279 		/* adding icv, if necessary... */
1280 		if (pattrib->iv_len) {
1281 			memcpy(pframe, pattrib->iv, pattrib->iv_len);
1282 
1283 			RT_TRACE(_module_rtl871x_xmit_c_, _drv_notice_,
1284 				 ("rtw_xmitframe_coalesce: keyid =%d pattrib->iv[3]=%.2x pframe =%.2x %.2x %.2x %.2x\n",
1285 				  padapter->securitypriv.dot11PrivacyKeyIndex, pattrib->iv[3], *pframe, *(pframe+1), *(pframe+2), *(pframe+3)));
1286 
1287 			pframe += pattrib->iv_len;
1288 
1289 			mpdu_len -= pattrib->iv_len;
1290 		}
1291 
1292 		if (frg_inx == 0) {
1293 			llc_sz = rtw_put_snap(pframe, pattrib->ether_type);
1294 			pframe += llc_sz;
1295 			mpdu_len -= llc_sz;
1296 		}
1297 
1298 		if ((pattrib->icv_len > 0) && (pattrib->bswenc)) {
1299 			mpdu_len -= pattrib->icv_len;
1300 		}
1301 
1302 
1303 		if (bmcst) {
1304 			/*  don't do fragment to broadcat/multicast packets */
1305 			mem_sz = _rtw_pktfile_read(&pktfile, pframe, pattrib->pktlen);
1306 		} else {
1307 			mem_sz = _rtw_pktfile_read(&pktfile, pframe, mpdu_len);
1308 		}
1309 
1310 		pframe += mem_sz;
1311 
1312 		if ((pattrib->icv_len > 0) && (pattrib->bswenc)) {
1313 			memcpy(pframe, pattrib->icv, pattrib->icv_len);
1314 			pframe += pattrib->icv_len;
1315 		}
1316 
1317 		frg_inx++;
1318 
1319 		if (bmcst || (rtw_endofpktfile(&pktfile) == true)) {
1320 			pattrib->nr_frags = frg_inx;
1321 
1322 			pattrib->last_txcmdsz = pattrib->hdrlen + pattrib->iv_len + ((pattrib->nr_frags == 1) ? llc_sz:0) +
1323 					((pattrib->bswenc) ? pattrib->icv_len : 0) + mem_sz;
1324 
1325 			ClearMFrag(mem_start);
1326 
1327 			break;
1328 		} else
1329 			RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("%s: There're still something in packet!\n", __func__));
1330 
1331 		addr = (SIZE_PTR)(pframe);
1332 
1333 		mem_start = (unsigned char *)RND4(addr) + hw_hdr_offset;
1334 		memcpy(mem_start, pbuf_start + hw_hdr_offset, pattrib->hdrlen);
1335 
1336 	}
1337 
1338 	if (xmitframe_addmic(padapter, pxmitframe) == _FAIL) {
1339 		RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("xmitframe_addmic(padapter, pxmitframe) == _FAIL\n"));
1340 		DBG_8192C("xmitframe_addmic(padapter, pxmitframe) == _FAIL\n");
1341 		res = _FAIL;
1342 		goto exit;
1343 	}
1344 
1345 	xmitframe_swencrypt(padapter, pxmitframe);
1346 
1347 	if (bmcst == false)
1348 		update_attrib_vcs_info(padapter, pxmitframe);
1349 	else
1350 		pattrib->vcs_mode = NONE_VCS;
1351 
1352 exit:
1353 	return res;
1354 }
1355 
1356 /* broadcast or multicast management pkt use BIP, unicast management pkt use CCMP encryption */
1357 s32 rtw_mgmt_xmitframe_coalesce(struct adapter *padapter, _pkt *pkt, struct xmit_frame *pxmitframe)
1358 {
1359 	u8 *pframe, *mem_start = NULL, *tmp_buf = NULL;
1360 	u8 subtype;
1361 	struct sta_info 	*psta = NULL;
1362 	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
1363 	s32 bmcst = IS_MCAST(pattrib->ra);
1364 	u8 *BIP_AAD = NULL;
1365 	u8 *MGMT_body = NULL;
1366 
1367 	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
1368 	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
1369 	struct ieee80211_hdr	*pwlanhdr;
1370 	u8 MME[_MME_IE_LENGTH_];
1371 	u32 ori_len;
1372 	mem_start = pframe = (u8 *)(pxmitframe->buf_addr) + TXDESC_OFFSET;
1373 	pwlanhdr = (struct ieee80211_hdr *)pframe;
1374 
1375 	ori_len = BIP_AAD_SIZE+pattrib->pktlen;
1376 	tmp_buf = BIP_AAD = rtw_zmalloc(ori_len);
1377 	subtype = GetFrameSubType(pframe); /* bit(7)~bit(2) */
1378 
1379 	if (BIP_AAD == NULL)
1380 		return _FAIL;
1381 
1382 	spin_lock_bh(&padapter->security_key_mutex);
1383 
1384 	/* only support station mode */
1385 	if (!check_fwstate(pmlmepriv, WIFI_STATION_STATE) || !check_fwstate(pmlmepriv, _FW_LINKED))
1386 		goto xmitframe_coalesce_success;
1387 
1388 	/* IGTK key is not install, it may not support 802.11w */
1389 	if (padapter->securitypriv.binstallBIPkey != true) {
1390 		DBG_871X("no instll BIP key\n");
1391 		goto xmitframe_coalesce_success;
1392 	}
1393 	/* station mode doesn't need TX BIP, just ready the code */
1394 	if (bmcst) {
1395 		int frame_body_len;
1396 		u8 mic[16];
1397 
1398 		memset(MME, 0, 18);
1399 
1400 		/* other types doesn't need the BIP */
1401 		if (GetFrameSubType(pframe) != WIFI_DEAUTH && GetFrameSubType(pframe) != WIFI_DISASSOC)
1402 			goto xmitframe_coalesce_fail;
1403 
1404 		MGMT_body = pframe + sizeof(struct ieee80211_hdr_3addr);
1405 		pframe += pattrib->pktlen;
1406 
1407 		/* octent 0 and 1 is key index , BIP keyid is 4 or 5, LSB only need octent 0 */
1408 		MME[0] = padapter->securitypriv.dot11wBIPKeyid;
1409 		/* copy packet number */
1410 		memcpy(&MME[2], &pmlmeext->mgnt_80211w_IPN, 6);
1411 		/* increase the packet number */
1412 		pmlmeext->mgnt_80211w_IPN++;
1413 
1414 		/* add MME IE with MIC all zero, MME string doesn't include element id and length */
1415 		pframe = rtw_set_ie(pframe, _MME_IE_, 16, MME, &(pattrib->pktlen));
1416 		pattrib->last_txcmdsz = pattrib->pktlen;
1417 		/*  total frame length - header length */
1418 		frame_body_len = pattrib->pktlen - sizeof(struct ieee80211_hdr_3addr);
1419 
1420 		/* conscruct AAD, copy frame control field */
1421 		memcpy(BIP_AAD, &pwlanhdr->frame_control, 2);
1422 		ClearRetry(BIP_AAD);
1423 		ClearPwrMgt(BIP_AAD);
1424 		ClearMData(BIP_AAD);
1425 		/* conscruct AAD, copy address 1 to address 3 */
1426 		memcpy(BIP_AAD+2, pwlanhdr->addr1, 18);
1427 		/* copy management fram body */
1428 		memcpy(BIP_AAD+BIP_AAD_SIZE, MGMT_body, frame_body_len);
1429 		/* calculate mic */
1430 		if (omac1_aes_128(padapter->securitypriv.dot11wBIPKey[padapter->securitypriv.dot11wBIPKeyid].skey
1431 			, BIP_AAD, BIP_AAD_SIZE+frame_body_len, mic))
1432 			goto xmitframe_coalesce_fail;
1433 
1434 		/* copy right BIP mic value, total is 128bits, we use the 0~63 bits */
1435 		memcpy(pframe-8, mic, 8);
1436 	} else { /* unicast mgmt frame TX */
1437 		/* start to encrypt mgmt frame */
1438 		if (subtype == WIFI_DEAUTH || subtype == WIFI_DISASSOC ||
1439 			subtype == WIFI_REASSOCREQ || subtype == WIFI_ACTION) {
1440 			if (pattrib->psta)
1441 				psta = pattrib->psta;
1442 			else
1443 				psta = rtw_get_stainfo(&padapter->stapriv, pattrib->ra);
1444 
1445 			if (psta == NULL) {
1446 
1447 				DBG_871X("%s, psta ==NUL\n", __func__);
1448 				goto xmitframe_coalesce_fail;
1449 			}
1450 
1451 			if (!(psta->state & _FW_LINKED) || pxmitframe->buf_addr == NULL) {
1452 				DBG_871X("%s, not _FW_LINKED or addr null\n", __func__);
1453 				goto xmitframe_coalesce_fail;
1454 			}
1455 
1456 			/* DBG_871X("%s, action frame category =%d\n", __func__, pframe[WLAN_HDR_A3_LEN]); */
1457 			/* according 802.11-2012 standard, these five types are not robust types */
1458 			if (subtype == WIFI_ACTION &&
1459 			(pframe[WLAN_HDR_A3_LEN] == RTW_WLAN_CATEGORY_PUBLIC ||
1460 			pframe[WLAN_HDR_A3_LEN] == RTW_WLAN_CATEGORY_HT ||
1461 			pframe[WLAN_HDR_A3_LEN] == RTW_WLAN_CATEGORY_UNPROTECTED_WNM ||
1462 			pframe[WLAN_HDR_A3_LEN] == RTW_WLAN_CATEGORY_SELF_PROTECTED  ||
1463 			pframe[WLAN_HDR_A3_LEN] == RTW_WLAN_CATEGORY_P2P))
1464 				goto xmitframe_coalesce_fail;
1465 			/* before encrypt dump the management packet content */
1466 			if (pattrib->encrypt > 0)
1467 				memcpy(pattrib->dot118021x_UncstKey.skey, psta->dot118021x_UncstKey.skey, 16);
1468 			/* bakeup original management packet */
1469 			memcpy(tmp_buf, pframe, pattrib->pktlen);
1470 			/* move to data portion */
1471 			pframe += pattrib->hdrlen;
1472 
1473 			/* 802.11w unicast management packet must be _AES_ */
1474 			pattrib->iv_len = 8;
1475 			/* it's MIC of AES */
1476 			pattrib->icv_len = 8;
1477 
1478 			switch (pattrib->encrypt) {
1479 			case _AES_:
1480 					/* set AES IV header */
1481 					AES_IV(pattrib->iv, psta->dot11wtxpn, 0);
1482 				break;
1483 			default:
1484 				goto xmitframe_coalesce_fail;
1485 			}
1486 			/* insert iv header into management frame */
1487 			memcpy(pframe, pattrib->iv, pattrib->iv_len);
1488 			pframe += pattrib->iv_len;
1489 			/* copy mgmt data portion after CCMP header */
1490 			memcpy(pframe, tmp_buf+pattrib->hdrlen, pattrib->pktlen-pattrib->hdrlen);
1491 			/* move pframe to end of mgmt pkt */
1492 			pframe += pattrib->pktlen-pattrib->hdrlen;
1493 			/* add 8 bytes CCMP IV header to length */
1494 			pattrib->pktlen += pattrib->iv_len;
1495 			if ((pattrib->icv_len > 0) && (pattrib->bswenc)) {
1496 				memcpy(pframe, pattrib->icv, pattrib->icv_len);
1497 				pframe += pattrib->icv_len;
1498 			}
1499 			/* add 8 bytes MIC */
1500 			pattrib->pktlen += pattrib->icv_len;
1501 			/* set final tx command size */
1502 			pattrib->last_txcmdsz = pattrib->pktlen;
1503 
1504 			/* set protected bit must be beofre SW encrypt */
1505 			SetPrivacy(mem_start);
1506 			/* software encrypt */
1507 			xmitframe_swencrypt(padapter, pxmitframe);
1508 		}
1509 	}
1510 
1511 xmitframe_coalesce_success:
1512 	spin_unlock_bh(&padapter->security_key_mutex);
1513 	kfree(BIP_AAD);
1514 	return _SUCCESS;
1515 
1516 xmitframe_coalesce_fail:
1517 	spin_unlock_bh(&padapter->security_key_mutex);
1518 	kfree(BIP_AAD);
1519 	return _FAIL;
1520 }
1521 
1522 /* Logical Link Control(LLC) SubNetwork Attachment Point(SNAP) header
1523  * IEEE LLC/SNAP header contains 8 octets
1524  * First 3 octets comprise the LLC portion
1525  * SNAP portion, 5 octets, is divided into two fields:
1526  *Organizationally Unique Identifier(OUI), 3 octets,
1527  *type, defined by that organization, 2 octets.
1528  */
1529 s32 rtw_put_snap(u8 *data, u16 h_proto)
1530 {
1531 	struct ieee80211_snap_hdr *snap;
1532 	u8 *oui;
1533 
1534 	snap = (struct ieee80211_snap_hdr *)data;
1535 	snap->dsap = 0xaa;
1536 	snap->ssap = 0xaa;
1537 	snap->ctrl = 0x03;
1538 
1539 	if (h_proto == 0x8137 || h_proto == 0x80f3)
1540 		oui = P802_1H_OUI;
1541 	else
1542 		oui = RFC1042_OUI;
1543 
1544 	snap->oui[0] = oui[0];
1545 	snap->oui[1] = oui[1];
1546 	snap->oui[2] = oui[2];
1547 
1548 	*(__be16 *)(data + SNAP_SIZE) = htons(h_proto);
1549 
1550 	return SNAP_SIZE + sizeof(u16);
1551 }
1552 
1553 void rtw_update_protection(struct adapter *padapter, u8 *ie, uint ie_len)
1554 {
1555 
1556 	uint	protection;
1557 	u8 *perp;
1558 	sint	 erp_len;
1559 	struct	xmit_priv *pxmitpriv = &padapter->xmitpriv;
1560 	struct	registry_priv *pregistrypriv = &padapter->registrypriv;
1561 
1562 	switch (pxmitpriv->vcs_setting) {
1563 	case DISABLE_VCS:
1564 		pxmitpriv->vcs = NONE_VCS;
1565 		break;
1566 
1567 	case ENABLE_VCS:
1568 		break;
1569 
1570 	case AUTO_VCS:
1571 	default:
1572 		perp = rtw_get_ie(ie, _ERPINFO_IE_, &erp_len, ie_len);
1573 		if (perp == NULL)
1574 			pxmitpriv->vcs = NONE_VCS;
1575 		else{
1576 			protection = (*(perp + 2)) & BIT(1);
1577 			if (protection) {
1578 				if (pregistrypriv->vcs_type == RTS_CTS)
1579 					pxmitpriv->vcs = RTS_CTS;
1580 				else
1581 					pxmitpriv->vcs = CTS_TO_SELF;
1582 			} else
1583 				pxmitpriv->vcs = NONE_VCS;
1584 		}
1585 
1586 		break;
1587 
1588 	}
1589 }
1590 
1591 void rtw_count_tx_stats(struct adapter *padapter, struct xmit_frame *pxmitframe, int sz)
1592 {
1593 	struct sta_info *psta = NULL;
1594 	struct stainfo_stats *pstats = NULL;
1595 	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
1596 	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
1597 	u8 pkt_num = 1;
1598 
1599 	if ((pxmitframe->frame_tag&0x0f) == DATA_FRAMETAG) {
1600 		pkt_num = pxmitframe->agg_num;
1601 
1602 		pmlmepriv->LinkDetectInfo.NumTxOkInPeriod += pkt_num;
1603 
1604 		pxmitpriv->tx_pkts += pkt_num;
1605 
1606 		pxmitpriv->tx_bytes += sz;
1607 
1608 		psta = pxmitframe->attrib.psta;
1609 		if (psta) {
1610 			pstats = &psta->sta_stats;
1611 
1612 			pstats->tx_pkts += pkt_num;
1613 
1614 			pstats->tx_bytes += sz;
1615 		}
1616 	}
1617 }
1618 
1619 static struct xmit_buf *__rtw_alloc_cmd_xmitbuf(struct xmit_priv *pxmitpriv,
1620 		enum cmdbuf_type buf_type)
1621 {
1622 	struct xmit_buf *pxmitbuf =  NULL;
1623 
1624 	pxmitbuf = &pxmitpriv->pcmd_xmitbuf[buf_type];
1625 	if (pxmitbuf !=  NULL) {
1626 		pxmitbuf->priv_data = NULL;
1627 
1628 		pxmitbuf->len = 0;
1629 		pxmitbuf->pdata = pxmitbuf->ptail = pxmitbuf->phead;
1630 		pxmitbuf->agg_num = 0;
1631 		pxmitbuf->pg_num = 0;
1632 
1633 		if (pxmitbuf->sctx) {
1634 			DBG_871X("%s pxmitbuf->sctx is not NULL\n", __func__);
1635 			rtw_sctx_done_err(&pxmitbuf->sctx, RTW_SCTX_DONE_BUF_ALLOC);
1636 		}
1637 	} else
1638 		DBG_871X("%s fail, no xmitbuf available !!!\n", __func__);
1639 
1640 	return pxmitbuf;
1641 }
1642 
1643 struct xmit_frame *__rtw_alloc_cmdxmitframe(struct xmit_priv *pxmitpriv,
1644 		enum cmdbuf_type buf_type)
1645 {
1646 	struct xmit_frame		*pcmdframe;
1647 	struct xmit_buf		*pxmitbuf;
1648 
1649 	pcmdframe = rtw_alloc_xmitframe(pxmitpriv);
1650 	if (pcmdframe == NULL) {
1651 		DBG_871X("%s, alloc xmitframe fail\n", __func__);
1652 		return NULL;
1653 	}
1654 
1655 	pxmitbuf = __rtw_alloc_cmd_xmitbuf(pxmitpriv, buf_type);
1656 	if (pxmitbuf == NULL) {
1657 		DBG_871X("%s, alloc xmitbuf fail\n", __func__);
1658 		rtw_free_xmitframe(pxmitpriv, pcmdframe);
1659 		return NULL;
1660 	}
1661 
1662 	pcmdframe->frame_tag = MGNT_FRAMETAG;
1663 
1664 	pcmdframe->pxmitbuf = pxmitbuf;
1665 
1666 	pcmdframe->buf_addr = pxmitbuf->pbuf;
1667 
1668 	pxmitbuf->priv_data = pcmdframe;
1669 
1670 	return pcmdframe;
1671 
1672 }
1673 
1674 struct xmit_buf *rtw_alloc_xmitbuf_ext(struct xmit_priv *pxmitpriv)
1675 {
1676 	_irqL irqL;
1677 	struct xmit_buf *pxmitbuf =  NULL;
1678 	struct list_head *plist, *phead;
1679 	struct __queue *pfree_queue = &pxmitpriv->free_xmit_extbuf_queue;
1680 
1681 	spin_lock_irqsave(&pfree_queue->lock, irqL);
1682 
1683 	if (list_empty(&pfree_queue->queue)) {
1684 		pxmitbuf = NULL;
1685 	} else {
1686 
1687 		phead = get_list_head(pfree_queue);
1688 
1689 		plist = get_next(phead);
1690 
1691 		pxmitbuf = LIST_CONTAINOR(plist, struct xmit_buf, list);
1692 
1693 		list_del_init(&(pxmitbuf->list));
1694 	}
1695 
1696 	if (pxmitbuf !=  NULL) {
1697 		pxmitpriv->free_xmit_extbuf_cnt--;
1698 		#ifdef DBG_XMIT_BUF_EXT
1699 		DBG_871X("DBG_XMIT_BUF_EXT ALLOC no =%d,  free_xmit_extbuf_cnt =%d\n", pxmitbuf->no, pxmitpriv->free_xmit_extbuf_cnt);
1700 		#endif
1701 
1702 
1703 		pxmitbuf->priv_data = NULL;
1704 
1705 		pxmitbuf->len = 0;
1706 		pxmitbuf->pdata = pxmitbuf->ptail = pxmitbuf->phead;
1707 		pxmitbuf->agg_num = 1;
1708 
1709 		if (pxmitbuf->sctx) {
1710 			DBG_871X("%s pxmitbuf->sctx is not NULL\n", __func__);
1711 			rtw_sctx_done_err(&pxmitbuf->sctx, RTW_SCTX_DONE_BUF_ALLOC);
1712 		}
1713 
1714 	}
1715 
1716 	spin_unlock_irqrestore(&pfree_queue->lock, irqL);
1717 
1718 	return pxmitbuf;
1719 }
1720 
1721 s32 rtw_free_xmitbuf_ext(struct xmit_priv *pxmitpriv, struct xmit_buf *pxmitbuf)
1722 {
1723 	_irqL irqL;
1724 	struct __queue *pfree_queue = &pxmitpriv->free_xmit_extbuf_queue;
1725 
1726 	if (pxmitbuf == NULL)
1727 		return _FAIL;
1728 
1729 	spin_lock_irqsave(&pfree_queue->lock, irqL);
1730 
1731 	list_del_init(&pxmitbuf->list);
1732 
1733 	list_add_tail(&(pxmitbuf->list), get_list_head(pfree_queue));
1734 	pxmitpriv->free_xmit_extbuf_cnt++;
1735 	#ifdef DBG_XMIT_BUF_EXT
1736 	DBG_871X("DBG_XMIT_BUF_EXT FREE no =%d, free_xmit_extbuf_cnt =%d\n", pxmitbuf->no, pxmitpriv->free_xmit_extbuf_cnt);
1737 	#endif
1738 
1739 	spin_unlock_irqrestore(&pfree_queue->lock, irqL);
1740 
1741 	return _SUCCESS;
1742 }
1743 
1744 struct xmit_buf *rtw_alloc_xmitbuf(struct xmit_priv *pxmitpriv)
1745 {
1746 	_irqL irqL;
1747 	struct xmit_buf *pxmitbuf =  NULL;
1748 	struct list_head *plist, *phead;
1749 	struct __queue *pfree_xmitbuf_queue = &pxmitpriv->free_xmitbuf_queue;
1750 
1751 	/* DBG_871X("+rtw_alloc_xmitbuf\n"); */
1752 
1753 	spin_lock_irqsave(&pfree_xmitbuf_queue->lock, irqL);
1754 
1755 	if (list_empty(&pfree_xmitbuf_queue->queue)) {
1756 		pxmitbuf = NULL;
1757 	} else {
1758 
1759 		phead = get_list_head(pfree_xmitbuf_queue);
1760 
1761 		plist = get_next(phead);
1762 
1763 		pxmitbuf = LIST_CONTAINOR(plist, struct xmit_buf, list);
1764 
1765 		list_del_init(&(pxmitbuf->list));
1766 	}
1767 
1768 	if (pxmitbuf !=  NULL) {
1769 		pxmitpriv->free_xmitbuf_cnt--;
1770 		#ifdef DBG_XMIT_BUF
1771 		DBG_871X("DBG_XMIT_BUF ALLOC no =%d,  free_xmitbuf_cnt =%d\n", pxmitbuf->no, pxmitpriv->free_xmitbuf_cnt);
1772 		#endif
1773 		/* DBG_871X("alloc, free_xmitbuf_cnt =%d\n", pxmitpriv->free_xmitbuf_cnt); */
1774 
1775 		pxmitbuf->priv_data = NULL;
1776 
1777 		pxmitbuf->len = 0;
1778 		pxmitbuf->pdata = pxmitbuf->ptail = pxmitbuf->phead;
1779 		pxmitbuf->agg_num = 0;
1780 		pxmitbuf->pg_num = 0;
1781 
1782 		if (pxmitbuf->sctx) {
1783 			DBG_871X("%s pxmitbuf->sctx is not NULL\n", __func__);
1784 			rtw_sctx_done_err(&pxmitbuf->sctx, RTW_SCTX_DONE_BUF_ALLOC);
1785 		}
1786 	}
1787 	#ifdef DBG_XMIT_BUF
1788 	else
1789 		DBG_871X("DBG_XMIT_BUF rtw_alloc_xmitbuf return NULL\n");
1790 	#endif
1791 
1792 	spin_unlock_irqrestore(&pfree_xmitbuf_queue->lock, irqL);
1793 
1794 	return pxmitbuf;
1795 }
1796 
1797 s32 rtw_free_xmitbuf(struct xmit_priv *pxmitpriv, struct xmit_buf *pxmitbuf)
1798 {
1799 	_irqL irqL;
1800 	struct __queue *pfree_xmitbuf_queue = &pxmitpriv->free_xmitbuf_queue;
1801 
1802 	/* DBG_871X("+rtw_free_xmitbuf\n"); */
1803 
1804 	if (pxmitbuf == NULL)
1805 		return _FAIL;
1806 
1807 	if (pxmitbuf->sctx) {
1808 		DBG_871X("%s pxmitbuf->sctx is not NULL\n", __func__);
1809 		rtw_sctx_done_err(&pxmitbuf->sctx, RTW_SCTX_DONE_BUF_FREE);
1810 	}
1811 
1812 	if (pxmitbuf->buf_tag == XMITBUF_CMD) {
1813 	} else if (pxmitbuf->buf_tag == XMITBUF_MGNT) {
1814 		rtw_free_xmitbuf_ext(pxmitpriv, pxmitbuf);
1815 	} else{
1816 		spin_lock_irqsave(&pfree_xmitbuf_queue->lock, irqL);
1817 
1818 		list_del_init(&pxmitbuf->list);
1819 
1820 		list_add_tail(&(pxmitbuf->list), get_list_head(pfree_xmitbuf_queue));
1821 
1822 		pxmitpriv->free_xmitbuf_cnt++;
1823 		/* DBG_871X("FREE, free_xmitbuf_cnt =%d\n", pxmitpriv->free_xmitbuf_cnt); */
1824 		#ifdef DBG_XMIT_BUF
1825 		DBG_871X("DBG_XMIT_BUF FREE no =%d, free_xmitbuf_cnt =%d\n", pxmitbuf->no, pxmitpriv->free_xmitbuf_cnt);
1826 		#endif
1827 		spin_unlock_irqrestore(&pfree_xmitbuf_queue->lock, irqL);
1828 	}
1829 	return _SUCCESS;
1830 }
1831 
1832 static void rtw_init_xmitframe(struct xmit_frame *pxframe)
1833 {
1834 	if (pxframe !=  NULL) { /* default value setting */
1835 		pxframe->buf_addr = NULL;
1836 		pxframe->pxmitbuf = NULL;
1837 
1838 		memset(&pxframe->attrib, 0, sizeof(struct pkt_attrib));
1839 		/* pxframe->attrib.psta = NULL; */
1840 
1841 		pxframe->frame_tag = DATA_FRAMETAG;
1842 
1843 		pxframe->pg_num = 1;
1844 		pxframe->agg_num = 1;
1845 		pxframe->ack_report = 0;
1846 	}
1847 }
1848 
1849 /*
1850 Calling context:
1851 1. OS_TXENTRY
1852 2. RXENTRY (rx_thread or RX_ISR/RX_CallBack)
1853 
1854 If we turn on USE_RXTHREAD, then, no need for critical section.
1855 Otherwise, we must use _enter/_exit critical to protect free_xmit_queue...
1856 
1857 Must be very very cautious...
1858 
1859 */
1860 struct xmit_frame *rtw_alloc_xmitframe(struct xmit_priv *pxmitpriv)/* _queue *pfree_xmit_queue) */
1861 {
1862 	/*
1863 		Please remember to use all the osdep_service api,
1864 		and lock/unlock or _enter/_exit critical to protect
1865 		pfree_xmit_queue
1866 	*/
1867 
1868 	struct xmit_frame *pxframe = NULL;
1869 	struct list_head *plist, *phead;
1870 	struct __queue *pfree_xmit_queue = &pxmitpriv->free_xmit_queue;
1871 
1872 	spin_lock_bh(&pfree_xmit_queue->lock);
1873 
1874 	if (list_empty(&pfree_xmit_queue->queue)) {
1875 		RT_TRACE(_module_rtl871x_xmit_c_, _drv_info_, ("rtw_alloc_xmitframe:%d\n", pxmitpriv->free_xmitframe_cnt));
1876 		pxframe =  NULL;
1877 	} else {
1878 		phead = get_list_head(pfree_xmit_queue);
1879 
1880 		plist = get_next(phead);
1881 
1882 		pxframe = LIST_CONTAINOR(plist, struct xmit_frame, list);
1883 
1884 		list_del_init(&(pxframe->list));
1885 		pxmitpriv->free_xmitframe_cnt--;
1886 		RT_TRACE(_module_rtl871x_xmit_c_, _drv_info_, ("rtw_alloc_xmitframe():free_xmitframe_cnt =%d\n", pxmitpriv->free_xmitframe_cnt));
1887 	}
1888 
1889 	spin_unlock_bh(&pfree_xmit_queue->lock);
1890 
1891 	rtw_init_xmitframe(pxframe);
1892 	return pxframe;
1893 }
1894 
1895 struct xmit_frame *rtw_alloc_xmitframe_ext(struct xmit_priv *pxmitpriv)
1896 {
1897 	struct xmit_frame *pxframe = NULL;
1898 	struct list_head *plist, *phead;
1899 	struct __queue *queue = &pxmitpriv->free_xframe_ext_queue;
1900 
1901 	spin_lock_bh(&queue->lock);
1902 
1903 	if (list_empty(&queue->queue)) {
1904 		RT_TRACE(_module_rtl871x_xmit_c_, _drv_info_, ("rtw_alloc_xmitframe_ext:%d\n", pxmitpriv->free_xframe_ext_cnt));
1905 		pxframe =  NULL;
1906 	} else {
1907 		phead = get_list_head(queue);
1908 		plist = get_next(phead);
1909 		pxframe = LIST_CONTAINOR(plist, struct xmit_frame, list);
1910 
1911 		list_del_init(&(pxframe->list));
1912 		pxmitpriv->free_xframe_ext_cnt--;
1913 		RT_TRACE(_module_rtl871x_xmit_c_, _drv_info_, ("rtw_alloc_xmitframe_ext():free_xmitframe_cnt =%d\n", pxmitpriv->free_xframe_ext_cnt));
1914 	}
1915 
1916 	spin_unlock_bh(&queue->lock);
1917 
1918 	rtw_init_xmitframe(pxframe);
1919 
1920 	return pxframe;
1921 }
1922 
1923 struct xmit_frame *rtw_alloc_xmitframe_once(struct xmit_priv *pxmitpriv)
1924 {
1925 	struct xmit_frame *pxframe = NULL;
1926 	u8 *alloc_addr;
1927 
1928 	alloc_addr = rtw_zmalloc(sizeof(struct xmit_frame) + 4);
1929 
1930 	if (alloc_addr == NULL)
1931 		goto exit;
1932 
1933 	pxframe = (struct xmit_frame *)N_BYTE_ALIGMENT((SIZE_PTR)(alloc_addr), 4);
1934 	pxframe->alloc_addr = alloc_addr;
1935 
1936 	pxframe->padapter = pxmitpriv->adapter;
1937 	pxframe->frame_tag = NULL_FRAMETAG;
1938 
1939 	pxframe->pkt = NULL;
1940 
1941 	pxframe->buf_addr = NULL;
1942 	pxframe->pxmitbuf = NULL;
1943 
1944 	rtw_init_xmitframe(pxframe);
1945 
1946 	DBG_871X("################## %s ##################\n", __func__);
1947 
1948 exit:
1949 	return pxframe;
1950 }
1951 
1952 s32 rtw_free_xmitframe(struct xmit_priv *pxmitpriv, struct xmit_frame *pxmitframe)
1953 {
1954 	struct __queue *queue = NULL;
1955 	struct adapter *padapter = pxmitpriv->adapter;
1956 	_pkt *pndis_pkt = NULL;
1957 
1958 	if (pxmitframe == NULL) {
1959 		RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("======rtw_free_xmitframe():pxmitframe == NULL!!!!!!!!!!\n"));
1960 		goto exit;
1961 	}
1962 
1963 	if (pxmitframe->pkt) {
1964 		pndis_pkt = pxmitframe->pkt;
1965 		pxmitframe->pkt = NULL;
1966 	}
1967 
1968 	if (pxmitframe->alloc_addr) {
1969 		DBG_871X("################## %s with alloc_addr ##################\n", __func__);
1970 		kfree(pxmitframe->alloc_addr);
1971 		goto check_pkt_complete;
1972 	}
1973 
1974 	if (pxmitframe->ext_tag == 0)
1975 		queue = &pxmitpriv->free_xmit_queue;
1976 	else if (pxmitframe->ext_tag == 1)
1977 		queue = &pxmitpriv->free_xframe_ext_queue;
1978 	else {
1979 
1980 	}
1981 
1982 	spin_lock_bh(&queue->lock);
1983 
1984 	list_del_init(&pxmitframe->list);
1985 	list_add_tail(&pxmitframe->list, get_list_head(queue));
1986 	if (pxmitframe->ext_tag == 0) {
1987 		pxmitpriv->free_xmitframe_cnt++;
1988 		RT_TRACE(_module_rtl871x_xmit_c_, _drv_debug_, ("rtw_free_xmitframe():free_xmitframe_cnt =%d\n", pxmitpriv->free_xmitframe_cnt));
1989 	} else if (pxmitframe->ext_tag == 1) {
1990 		pxmitpriv->free_xframe_ext_cnt++;
1991 		RT_TRACE(_module_rtl871x_xmit_c_, _drv_debug_, ("rtw_free_xmitframe():free_xframe_ext_cnt =%d\n", pxmitpriv->free_xframe_ext_cnt));
1992 	} else {
1993 	}
1994 
1995 	spin_unlock_bh(&queue->lock);
1996 
1997 check_pkt_complete:
1998 
1999 	if (pndis_pkt)
2000 		rtw_os_pkt_complete(padapter, pndis_pkt);
2001 
2002 exit:
2003 	return _SUCCESS;
2004 }
2005 
2006 void rtw_free_xmitframe_queue(struct xmit_priv *pxmitpriv, struct __queue *pframequeue)
2007 {
2008 	struct list_head	*plist, *phead;
2009 	struct	xmit_frame	*pxmitframe;
2010 
2011 	spin_lock_bh(&(pframequeue->lock));
2012 
2013 	phead = get_list_head(pframequeue);
2014 	plist = get_next(phead);
2015 
2016 	while (phead != plist) {
2017 
2018 		pxmitframe = LIST_CONTAINOR(plist, struct xmit_frame, list);
2019 
2020 		plist = get_next(plist);
2021 
2022 		rtw_free_xmitframe(pxmitpriv, pxmitframe);
2023 
2024 	}
2025 	spin_unlock_bh(&(pframequeue->lock));
2026 }
2027 
2028 s32 rtw_xmitframe_enqueue(struct adapter *padapter, struct xmit_frame *pxmitframe)
2029 {
2030 	DBG_COUNTER(padapter->tx_logs.core_tx_enqueue);
2031 	if (rtw_xmit_classifier(padapter, pxmitframe) == _FAIL) {
2032 		RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_,
2033 			 ("rtw_xmitframe_enqueue: drop xmit pkt for classifier fail\n"));
2034 /* 		pxmitframe->pkt = NULL; */
2035 		return _FAIL;
2036 	}
2037 
2038 	return _SUCCESS;
2039 }
2040 
2041 struct tx_servq *rtw_get_sta_pending(struct adapter *padapter, struct sta_info *psta, sint up, u8 *ac)
2042 {
2043 	struct tx_servq *ptxservq = NULL;
2044 
2045 	switch (up) {
2046 	case 1:
2047 	case 2:
2048 		ptxservq = &(psta->sta_xmitpriv.bk_q);
2049 		*(ac) = 3;
2050 		RT_TRACE(_module_rtl871x_xmit_c_, _drv_info_, ("rtw_get_sta_pending : BK\n"));
2051 		break;
2052 
2053 	case 4:
2054 	case 5:
2055 		ptxservq = &(psta->sta_xmitpriv.vi_q);
2056 		*(ac) = 1;
2057 		RT_TRACE(_module_rtl871x_xmit_c_, _drv_info_, ("rtw_get_sta_pending : VI\n"));
2058 		break;
2059 
2060 	case 6:
2061 	case 7:
2062 		ptxservq = &(psta->sta_xmitpriv.vo_q);
2063 		*(ac) = 0;
2064 		RT_TRACE(_module_rtl871x_xmit_c_, _drv_info_, ("rtw_get_sta_pending : VO\n"));
2065 		break;
2066 
2067 	case 0:
2068 	case 3:
2069 	default:
2070 		ptxservq = &(psta->sta_xmitpriv.be_q);
2071 		*(ac) = 2;
2072 		RT_TRACE(_module_rtl871x_xmit_c_, _drv_info_, ("rtw_get_sta_pending : BE\n"));
2073 	break;
2074 
2075 	}
2076 
2077 	return ptxservq;
2078 }
2079 
2080 /*
2081  * Will enqueue pxmitframe to the proper queue,
2082  * and indicate it to xx_pending list.....
2083  */
2084 s32 rtw_xmit_classifier(struct adapter *padapter, struct xmit_frame *pxmitframe)
2085 {
2086 	/* _irqL irqL0; */
2087 	u8 ac_index;
2088 	struct sta_info *psta;
2089 	struct tx_servq	*ptxservq;
2090 	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
2091 	struct hw_xmit	*phwxmits =  padapter->xmitpriv.hwxmits;
2092 	sint res = _SUCCESS;
2093 
2094 	DBG_COUNTER(padapter->tx_logs.core_tx_enqueue_class);
2095 
2096 /*
2097 	if (pattrib->psta) {
2098 		psta = pattrib->psta;
2099 	} else {
2100 		DBG_871X("%s, call rtw_get_stainfo()\n", __func__);
2101 		psta = rtw_get_stainfo(pstapriv, pattrib->ra);
2102 	}
2103 */
2104 
2105 	psta = rtw_get_stainfo(&padapter->stapriv, pattrib->ra);
2106 	if (pattrib->psta != psta) {
2107 		DBG_COUNTER(padapter->tx_logs.core_tx_enqueue_class_err_sta);
2108 		DBG_871X("%s, pattrib->psta(%p) != psta(%p)\n", __func__, pattrib->psta, psta);
2109 		return _FAIL;
2110 	}
2111 
2112 	if (psta == NULL) {
2113 		DBG_COUNTER(padapter->tx_logs.core_tx_enqueue_class_err_nosta);
2114 		res = _FAIL;
2115 		DBG_8192C("rtw_xmit_classifier: psta == NULL\n");
2116 		RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("rtw_xmit_classifier: psta == NULL\n"));
2117 		goto exit;
2118 	}
2119 
2120 	if (!(psta->state & _FW_LINKED)) {
2121 		DBG_COUNTER(padapter->tx_logs.core_tx_enqueue_class_err_fwlink);
2122 		DBG_871X("%s, psta->state(0x%x) != _FW_LINKED\n", __func__, psta->state);
2123 		return _FAIL;
2124 	}
2125 
2126 	ptxservq = rtw_get_sta_pending(padapter, psta, pattrib->priority, (u8 *)(&ac_index));
2127 
2128 	/* spin_lock_irqsave(&pstapending->lock, irqL0); */
2129 
2130 	if (list_empty(&ptxservq->tx_pending)) {
2131 		list_add_tail(&ptxservq->tx_pending, get_list_head(phwxmits[ac_index].sta_queue));
2132 	}
2133 
2134 	/* spin_lock_irqsave(&ptxservq->sta_pending.lock, irqL1); */
2135 
2136 	list_add_tail(&pxmitframe->list, get_list_head(&ptxservq->sta_pending));
2137 	ptxservq->qcnt++;
2138 	phwxmits[ac_index].accnt++;
2139 
2140 	/* spin_unlock_irqrestore(&ptxservq->sta_pending.lock, irqL1); */
2141 
2142 	/* spin_unlock_irqrestore(&pstapending->lock, irqL0); */
2143 
2144 exit:
2145 
2146 	return res;
2147 }
2148 
2149 void rtw_alloc_hwxmits(struct adapter *padapter)
2150 {
2151 	struct hw_xmit *hwxmits;
2152 	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
2153 
2154 	pxmitpriv->hwxmit_entry = HWXMIT_ENTRY;
2155 
2156 	pxmitpriv->hwxmits = NULL;
2157 
2158 	pxmitpriv->hwxmits = rtw_zmalloc(sizeof(struct hw_xmit) * pxmitpriv->hwxmit_entry);
2159 
2160 	if (pxmitpriv->hwxmits == NULL) {
2161 		DBG_871X("alloc hwxmits fail!...\n");
2162 		return;
2163 	}
2164 
2165 	hwxmits = pxmitpriv->hwxmits;
2166 
2167 	if (pxmitpriv->hwxmit_entry == 5) {
2168 		/* pxmitpriv->bmc_txqueue.head = 0; */
2169 		/* hwxmits[0] .phwtxqueue = &pxmitpriv->bmc_txqueue; */
2170 		hwxmits[0] .sta_queue = &pxmitpriv->bm_pending;
2171 
2172 		/* pxmitpriv->vo_txqueue.head = 0; */
2173 		/* hwxmits[1] .phwtxqueue = &pxmitpriv->vo_txqueue; */
2174 		hwxmits[1] .sta_queue = &pxmitpriv->vo_pending;
2175 
2176 		/* pxmitpriv->vi_txqueue.head = 0; */
2177 		/* hwxmits[2] .phwtxqueue = &pxmitpriv->vi_txqueue; */
2178 		hwxmits[2] .sta_queue = &pxmitpriv->vi_pending;
2179 
2180 		/* pxmitpriv->bk_txqueue.head = 0; */
2181 		/* hwxmits[3] .phwtxqueue = &pxmitpriv->bk_txqueue; */
2182 		hwxmits[3] .sta_queue = &pxmitpriv->bk_pending;
2183 
2184 		/* pxmitpriv->be_txqueue.head = 0; */
2185 		/* hwxmits[4] .phwtxqueue = &pxmitpriv->be_txqueue; */
2186 		hwxmits[4] .sta_queue = &pxmitpriv->be_pending;
2187 
2188 	} else if (pxmitpriv->hwxmit_entry == 4) {
2189 
2190 		/* pxmitpriv->vo_txqueue.head = 0; */
2191 		/* hwxmits[0] .phwtxqueue = &pxmitpriv->vo_txqueue; */
2192 		hwxmits[0] .sta_queue = &pxmitpriv->vo_pending;
2193 
2194 		/* pxmitpriv->vi_txqueue.head = 0; */
2195 		/* hwxmits[1] .phwtxqueue = &pxmitpriv->vi_txqueue; */
2196 		hwxmits[1] .sta_queue = &pxmitpriv->vi_pending;
2197 
2198 		/* pxmitpriv->be_txqueue.head = 0; */
2199 		/* hwxmits[2] .phwtxqueue = &pxmitpriv->be_txqueue; */
2200 		hwxmits[2] .sta_queue = &pxmitpriv->be_pending;
2201 
2202 		/* pxmitpriv->bk_txqueue.head = 0; */
2203 		/* hwxmits[3] .phwtxqueue = &pxmitpriv->bk_txqueue; */
2204 		hwxmits[3] .sta_queue = &pxmitpriv->bk_pending;
2205 	} else {
2206 
2207 	}
2208 
2209 
2210 }
2211 
2212 void rtw_free_hwxmits(struct adapter *padapter)
2213 {
2214 	struct hw_xmit *hwxmits;
2215 	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
2216 
2217 	hwxmits = pxmitpriv->hwxmits;
2218 	if (hwxmits)
2219 		kfree((u8 *)hwxmits);
2220 }
2221 
2222 void rtw_init_hwxmits(struct hw_xmit *phwxmit, sint entry)
2223 {
2224 	sint i;
2225 
2226 	for (i = 0; i < entry; i++, phwxmit++) {
2227 		/* spin_lock_init(&phwxmit->xmit_lock); */
2228 		/* INIT_LIST_HEAD(&phwxmit->pending); */
2229 		/* phwxmit->txcmdcnt = 0; */
2230 		phwxmit->accnt = 0;
2231 	}
2232 }
2233 
2234 u32 rtw_get_ff_hwaddr(struct xmit_frame *pxmitframe)
2235 {
2236 	u32 addr;
2237 	struct pkt_attrib *pattrib = &pxmitframe->attrib;
2238 
2239 	switch (pattrib->qsel) {
2240 	case 0:
2241 	case 3:
2242 		addr = BE_QUEUE_INX;
2243 		break;
2244 	case 1:
2245 	case 2:
2246 		addr = BK_QUEUE_INX;
2247 		break;
2248 	case 4:
2249 	case 5:
2250 		addr = VI_QUEUE_INX;
2251 		break;
2252 	case 6:
2253 	case 7:
2254 		addr = VO_QUEUE_INX;
2255 		break;
2256 	case 0x10:
2257 		addr = BCN_QUEUE_INX;
2258 		break;
2259 	case 0x11:/* BC/MC in PS (HIQ) */
2260 		addr = HIGH_QUEUE_INX;
2261 		break;
2262 	case 0x12:
2263 	default:
2264 		addr = MGT_QUEUE_INX;
2265 		break;
2266 
2267 	}
2268 
2269 	return addr;
2270 
2271 }
2272 
2273 static void do_queue_select(struct adapter	*padapter, struct pkt_attrib *pattrib)
2274 {
2275 	u8 qsel;
2276 
2277 	qsel = pattrib->priority;
2278 	RT_TRACE(_module_rtl871x_xmit_c_, _drv_info_, ("### do_queue_select priority =%d , qsel = %d\n", pattrib->priority, qsel));
2279 
2280 	pattrib->qsel = qsel;
2281 }
2282 
2283 /*
2284  * The main transmit(tx) entry
2285  *
2286  * Return
2287  *1	enqueue
2288  *0	success, hardware will handle this xmit frame(packet)
2289  *<0	fail
2290  */
2291 s32 rtw_xmit(struct adapter *padapter, _pkt **ppkt)
2292 {
2293 	static unsigned long start;
2294 	static u32 drop_cnt;
2295 
2296 	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
2297 	struct xmit_frame *pxmitframe = NULL;
2298 
2299 	s32 res;
2300 
2301 	DBG_COUNTER(padapter->tx_logs.core_tx);
2302 
2303 	if (start == 0)
2304 		start = jiffies;
2305 
2306 	pxmitframe = rtw_alloc_xmitframe(pxmitpriv);
2307 
2308 	if (jiffies_to_msecs(jiffies - start) > 2000) {
2309 		if (drop_cnt)
2310 			DBG_871X("DBG_TX_DROP_FRAME %s no more pxmitframe, drop_cnt:%u\n", __func__, drop_cnt);
2311 		start = jiffies;
2312 		drop_cnt = 0;
2313 	}
2314 
2315 	if (pxmitframe == NULL) {
2316 		drop_cnt++;
2317 		RT_TRACE(_module_xmit_osdep_c_, _drv_err_, ("rtw_xmit: no more pxmitframe\n"));
2318 		DBG_COUNTER(padapter->tx_logs.core_tx_err_pxmitframe);
2319 		return -1;
2320 	}
2321 
2322 	res = update_attrib(padapter, *ppkt, &pxmitframe->attrib);
2323 
2324 	if (res == _FAIL) {
2325 		RT_TRACE(_module_xmit_osdep_c_, _drv_err_, ("rtw_xmit: update attrib fail\n"));
2326 		#ifdef DBG_TX_DROP_FRAME
2327 		DBG_871X("DBG_TX_DROP_FRAME %s update attrib fail\n", __func__);
2328 		#endif
2329 		rtw_free_xmitframe(pxmitpriv, pxmitframe);
2330 		return -1;
2331 	}
2332 	pxmitframe->pkt = *ppkt;
2333 
2334 	do_queue_select(padapter, &pxmitframe->attrib);
2335 
2336 	spin_lock_bh(&pxmitpriv->lock);
2337 	if (xmitframe_enqueue_for_sleeping_sta(padapter, pxmitframe) == true) {
2338 		spin_unlock_bh(&pxmitpriv->lock);
2339 		DBG_COUNTER(padapter->tx_logs.core_tx_ap_enqueue);
2340 		return 1;
2341 	}
2342 	spin_unlock_bh(&pxmitpriv->lock);
2343 
2344 	/* pre_xmitframe */
2345 	if (rtw_hal_xmit(padapter, pxmitframe) == false)
2346 		return 1;
2347 
2348 	return 0;
2349 }
2350 
2351 #define RTW_HIQ_FILTER_ALLOW_ALL 0
2352 #define RTW_HIQ_FILTER_ALLOW_SPECIAL 1
2353 #define RTW_HIQ_FILTER_DENY_ALL 2
2354 
2355 inline bool xmitframe_hiq_filter(struct xmit_frame *xmitframe)
2356 {
2357 	bool allow = false;
2358 	struct adapter *adapter = xmitframe->padapter;
2359 	struct registry_priv *registry = &adapter->registrypriv;
2360 
2361 	if (registry->hiq_filter == RTW_HIQ_FILTER_ALLOW_SPECIAL) {
2362 
2363 		struct pkt_attrib *attrib = &xmitframe->attrib;
2364 
2365 		if (attrib->ether_type == 0x0806
2366 			|| attrib->ether_type == 0x888e
2367 			|| attrib->dhcp_pkt
2368 		) {
2369 			DBG_871X(FUNC_ADPT_FMT" ether_type:0x%04x%s\n", FUNC_ADPT_ARG(xmitframe->padapter)
2370 				, attrib->ether_type, attrib->dhcp_pkt?" DHCP":"");
2371 			allow = true;
2372 		}
2373 	} else if (registry->hiq_filter == RTW_HIQ_FILTER_ALLOW_ALL)
2374 		allow = true;
2375 	else if (registry->hiq_filter == RTW_HIQ_FILTER_DENY_ALL) {
2376 	} else
2377 		rtw_warn_on(1);
2378 
2379 	return allow;
2380 }
2381 
2382 sint xmitframe_enqueue_for_sleeping_sta(struct adapter *padapter, struct xmit_frame *pxmitframe)
2383 {
2384 	sint ret = false;
2385 	struct sta_info *psta = NULL;
2386 	struct sta_priv *pstapriv = &padapter->stapriv;
2387 	struct pkt_attrib *pattrib = &pxmitframe->attrib;
2388 	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2389 	sint bmcst = IS_MCAST(pattrib->ra);
2390 	bool update_tim = false;
2391 
2392 	if (check_fwstate(pmlmepriv, WIFI_AP_STATE) == false) {
2393 		DBG_COUNTER(padapter->tx_logs.core_tx_ap_enqueue_warn_fwstate);
2394 	    return ret;
2395 	}
2396 /*
2397 	if (pattrib->psta)
2398 	{
2399 		psta = pattrib->psta;
2400 	}
2401 	else
2402 	{
2403 		DBG_871X("%s, call rtw_get_stainfo()\n", __func__);
2404 		psta =rtw_get_stainfo(pstapriv, pattrib->ra);
2405 	}
2406 */
2407 	psta = rtw_get_stainfo(&padapter->stapriv, pattrib->ra);
2408 	if (pattrib->psta != psta) {
2409 		DBG_COUNTER(padapter->tx_logs.core_tx_ap_enqueue_warn_sta);
2410 		DBG_871X("%s, pattrib->psta(%p) != psta(%p)\n", __func__, pattrib->psta, psta);
2411 		return false;
2412 	}
2413 
2414 	if (psta == NULL) {
2415 		DBG_COUNTER(padapter->tx_logs.core_tx_ap_enqueue_warn_nosta);
2416 		DBG_871X("%s, psta ==NUL\n", __func__);
2417 		return false;
2418 	}
2419 
2420 	if (!(psta->state & _FW_LINKED)) {
2421 		DBG_COUNTER(padapter->tx_logs.core_tx_ap_enqueue_warn_link);
2422 		DBG_871X("%s, psta->state(0x%x) != _FW_LINKED\n", __func__, psta->state);
2423 		return false;
2424 	}
2425 
2426 	if (pattrib->triggered == 1) {
2427 		DBG_COUNTER(padapter->tx_logs.core_tx_ap_enqueue_warn_trigger);
2428 		/* DBG_871X("directly xmit pspoll_triggered packet\n"); */
2429 
2430 		/* pattrib->triggered = 0; */
2431 		if (bmcst && xmitframe_hiq_filter(pxmitframe) == true)
2432 			pattrib->qsel = 0x11;/* HIQ */
2433 
2434 		return ret;
2435 	}
2436 
2437 
2438 	if (bmcst) {
2439 		spin_lock_bh(&psta->sleep_q.lock);
2440 
2441 		if (pstapriv->sta_dz_bitmap) { /* if anyone sta is in ps mode */
2442 			/* pattrib->qsel = 0x11;HIQ */
2443 
2444 			list_del_init(&pxmitframe->list);
2445 
2446 			/* spin_lock_bh(&psta->sleep_q.lock); */
2447 
2448 			list_add_tail(&pxmitframe->list, get_list_head(&psta->sleep_q));
2449 
2450 			psta->sleepq_len++;
2451 
2452 			if (!(pstapriv->tim_bitmap & BIT(0)))
2453 				update_tim = true;
2454 
2455 			pstapriv->tim_bitmap |= BIT(0);/*  */
2456 			pstapriv->sta_dz_bitmap |= BIT(0);
2457 
2458 			/* DBG_871X("enqueue, sq_len =%d, tim =%x\n", psta->sleepq_len, pstapriv->tim_bitmap); */
2459 
2460 			if (update_tim == true) {
2461 				update_beacon(padapter, _TIM_IE_, NULL, true);
2462 			} else {
2463 				chk_bmc_sleepq_cmd(padapter);
2464 			}
2465 
2466 			/* spin_unlock_bh(&psta->sleep_q.lock); */
2467 
2468 			ret = true;
2469 
2470 			DBG_COUNTER(padapter->tx_logs.core_tx_ap_enqueue_mcast);
2471 
2472 		}
2473 
2474 		spin_unlock_bh(&psta->sleep_q.lock);
2475 
2476 		return ret;
2477 
2478 	}
2479 
2480 
2481 	spin_lock_bh(&psta->sleep_q.lock);
2482 
2483 	if (psta->state&WIFI_SLEEP_STATE) {
2484 		u8 wmmps_ac = 0;
2485 
2486 		if (pstapriv->sta_dz_bitmap & BIT(psta->aid)) {
2487 			list_del_init(&pxmitframe->list);
2488 
2489 			/* spin_lock_bh(&psta->sleep_q.lock); */
2490 
2491 			list_add_tail(&pxmitframe->list, get_list_head(&psta->sleep_q));
2492 
2493 			psta->sleepq_len++;
2494 
2495 			switch (pattrib->priority) {
2496 			case 1:
2497 			case 2:
2498 				wmmps_ac = psta->uapsd_bk&BIT(0);
2499 				break;
2500 			case 4:
2501 			case 5:
2502 				wmmps_ac = psta->uapsd_vi&BIT(0);
2503 				break;
2504 			case 6:
2505 			case 7:
2506 				wmmps_ac = psta->uapsd_vo&BIT(0);
2507 				break;
2508 			case 0:
2509 			case 3:
2510 			default:
2511 				wmmps_ac = psta->uapsd_be&BIT(0);
2512 				break;
2513 			}
2514 
2515 			if (wmmps_ac)
2516 				psta->sleepq_ac_len++;
2517 
2518 			if (((psta->has_legacy_ac) && (!wmmps_ac)) || ((!psta->has_legacy_ac) && (wmmps_ac))) {
2519 				if (!(pstapriv->tim_bitmap & BIT(psta->aid)))
2520 					update_tim = true;
2521 
2522 				pstapriv->tim_bitmap |= BIT(psta->aid);
2523 
2524 				/* DBG_871X("enqueue, sq_len =%d, tim =%x\n", psta->sleepq_len, pstapriv->tim_bitmap); */
2525 
2526 				if (update_tim == true)
2527 					/* DBG_871X("sleepq_len == 1, update BCNTIM\n"); */
2528 					/* upate BCN for TIM IE */
2529 					update_beacon(padapter, _TIM_IE_, NULL, true);
2530 			}
2531 
2532 			/* spin_unlock_bh(&psta->sleep_q.lock); */
2533 
2534 			/* if (psta->sleepq_len > (NR_XMITFRAME>>3)) */
2535 			/*  */
2536 			/* 	wakeup_sta_to_xmit(padapter, psta); */
2537 			/*  */
2538 
2539 			ret = true;
2540 
2541 			DBG_COUNTER(padapter->tx_logs.core_tx_ap_enqueue_ucast);
2542 		}
2543 
2544 	}
2545 
2546 	spin_unlock_bh(&psta->sleep_q.lock);
2547 
2548 	return ret;
2549 
2550 }
2551 
2552 static void dequeue_xmitframes_to_sleeping_queue(struct adapter *padapter, struct sta_info *psta, struct __queue *pframequeue)
2553 {
2554 	sint ret;
2555 	struct list_head	*plist, *phead;
2556 	u8 ac_index;
2557 	struct tx_servq	*ptxservq;
2558 	struct pkt_attrib	*pattrib;
2559 	struct xmit_frame	*pxmitframe;
2560 	struct hw_xmit *phwxmits =  padapter->xmitpriv.hwxmits;
2561 
2562 	phead = get_list_head(pframequeue);
2563 	plist = get_next(phead);
2564 
2565 	while (phead != plist) {
2566 		pxmitframe = LIST_CONTAINOR(plist, struct xmit_frame, list);
2567 
2568 		plist = get_next(plist);
2569 
2570 		pattrib = &pxmitframe->attrib;
2571 
2572 		pattrib->triggered = 0;
2573 
2574 		ret = xmitframe_enqueue_for_sleeping_sta(padapter, pxmitframe);
2575 
2576 		if (true == ret) {
2577 			ptxservq = rtw_get_sta_pending(padapter, psta, pattrib->priority, (u8 *)(&ac_index));
2578 
2579 			ptxservq->qcnt--;
2580 			phwxmits[ac_index].accnt--;
2581 		} else {
2582 			/* DBG_871X("xmitframe_enqueue_for_sleeping_sta return false\n"); */
2583 		}
2584 
2585 	}
2586 
2587 }
2588 
2589 void stop_sta_xmit(struct adapter *padapter, struct sta_info *psta)
2590 {
2591 	struct sta_info *psta_bmc;
2592 	struct sta_xmit_priv *pstaxmitpriv;
2593 	struct sta_priv *pstapriv = &padapter->stapriv;
2594 	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
2595 
2596 	pstaxmitpriv = &psta->sta_xmitpriv;
2597 
2598 	/* for BC/MC Frames */
2599 	psta_bmc = rtw_get_bcmc_stainfo(padapter);
2600 
2601 
2602 	spin_lock_bh(&pxmitpriv->lock);
2603 
2604 	psta->state |= WIFI_SLEEP_STATE;
2605 
2606 	pstapriv->sta_dz_bitmap |= BIT(psta->aid);
2607 
2608 
2609 
2610 	dequeue_xmitframes_to_sleeping_queue(padapter, psta, &pstaxmitpriv->vo_q.sta_pending);
2611 	list_del_init(&(pstaxmitpriv->vo_q.tx_pending));
2612 
2613 
2614 	dequeue_xmitframes_to_sleeping_queue(padapter, psta, &pstaxmitpriv->vi_q.sta_pending);
2615 	list_del_init(&(pstaxmitpriv->vi_q.tx_pending));
2616 
2617 
2618 	dequeue_xmitframes_to_sleeping_queue(padapter, psta, &pstaxmitpriv->be_q.sta_pending);
2619 	list_del_init(&(pstaxmitpriv->be_q.tx_pending));
2620 
2621 
2622 	dequeue_xmitframes_to_sleeping_queue(padapter, psta, &pstaxmitpriv->bk_q.sta_pending);
2623 	list_del_init(&(pstaxmitpriv->bk_q.tx_pending));
2624 
2625 	/* for BC/MC Frames */
2626 	pstaxmitpriv = &psta_bmc->sta_xmitpriv;
2627 	dequeue_xmitframes_to_sleeping_queue(padapter, psta_bmc, &pstaxmitpriv->be_q.sta_pending);
2628 	list_del_init(&(pstaxmitpriv->be_q.tx_pending));
2629 
2630 	spin_unlock_bh(&pxmitpriv->lock);
2631 }
2632 
2633 void wakeup_sta_to_xmit(struct adapter *padapter, struct sta_info *psta)
2634 {
2635 	u8 update_mask = 0, wmmps_ac = 0;
2636 	struct sta_info *psta_bmc;
2637 	struct list_head	*xmitframe_plist, *xmitframe_phead;
2638 	struct xmit_frame *pxmitframe = NULL;
2639 	struct sta_priv *pstapriv = &padapter->stapriv;
2640 	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
2641 
2642 	psta_bmc = rtw_get_bcmc_stainfo(padapter);
2643 
2644 
2645 	/* spin_lock_bh(&psta->sleep_q.lock); */
2646 	spin_lock_bh(&pxmitpriv->lock);
2647 
2648 	xmitframe_phead = get_list_head(&psta->sleep_q);
2649 	xmitframe_plist = get_next(xmitframe_phead);
2650 
2651 	while (xmitframe_phead != xmitframe_plist) {
2652 		pxmitframe = LIST_CONTAINOR(xmitframe_plist, struct xmit_frame, list);
2653 
2654 		xmitframe_plist = get_next(xmitframe_plist);
2655 
2656 		list_del_init(&pxmitframe->list);
2657 
2658 		switch (pxmitframe->attrib.priority) {
2659 		case 1:
2660 		case 2:
2661 			wmmps_ac = psta->uapsd_bk&BIT(1);
2662 			break;
2663 		case 4:
2664 		case 5:
2665 			wmmps_ac = psta->uapsd_vi&BIT(1);
2666 			break;
2667 		case 6:
2668 		case 7:
2669 			wmmps_ac = psta->uapsd_vo&BIT(1);
2670 			break;
2671 		case 0:
2672 		case 3:
2673 		default:
2674 			wmmps_ac = psta->uapsd_be&BIT(1);
2675 			break;
2676 		}
2677 
2678 		psta->sleepq_len--;
2679 		if (psta->sleepq_len > 0)
2680 			pxmitframe->attrib.mdata = 1;
2681 		else
2682 			pxmitframe->attrib.mdata = 0;
2683 
2684 		if (wmmps_ac) {
2685 			psta->sleepq_ac_len--;
2686 			if (psta->sleepq_ac_len > 0) {
2687 				pxmitframe->attrib.mdata = 1;
2688 				pxmitframe->attrib.eosp = 0;
2689 			} else{
2690 				pxmitframe->attrib.mdata = 0;
2691 				pxmitframe->attrib.eosp = 1;
2692 			}
2693 		}
2694 
2695 		pxmitframe->attrib.triggered = 1;
2696 
2697 /*
2698 		spin_unlock_bh(&psta->sleep_q.lock);
2699 		if (rtw_hal_xmit(padapter, pxmitframe) == true)
2700 		{
2701 			rtw_os_xmit_complete(padapter, pxmitframe);
2702 		}
2703 		spin_lock_bh(&psta->sleep_q.lock);
2704 */
2705 		rtw_hal_xmitframe_enqueue(padapter, pxmitframe);
2706 
2707 
2708 	}
2709 
2710 	if (psta->sleepq_len == 0) {
2711 		if (pstapriv->tim_bitmap & BIT(psta->aid)) {
2712 			/* DBG_871X("wakeup to xmit, qlen == 0, update_BCNTIM, tim =%x\n", pstapriv->tim_bitmap); */
2713 			/* upate BCN for TIM IE */
2714 			/* update_BCNTIM(padapter); */
2715 			update_mask = BIT(0);
2716 		}
2717 
2718 		pstapriv->tim_bitmap &= ~BIT(psta->aid);
2719 
2720 		if (psta->state&WIFI_SLEEP_STATE)
2721 			psta->state ^= WIFI_SLEEP_STATE;
2722 
2723 		if (psta->state & WIFI_STA_ALIVE_CHK_STATE) {
2724 			DBG_871X("%s alive check\n", __func__);
2725 			psta->expire_to = pstapriv->expire_to;
2726 			psta->state ^= WIFI_STA_ALIVE_CHK_STATE;
2727 		}
2728 
2729 		pstapriv->sta_dz_bitmap &= ~BIT(psta->aid);
2730 	}
2731 
2732 	/* for BC/MC Frames */
2733 	if (!psta_bmc)
2734 		goto _exit;
2735 
2736 	if ((pstapriv->sta_dz_bitmap&0xfffe) == 0x0) { /* no any sta in ps mode */
2737 		xmitframe_phead = get_list_head(&psta_bmc->sleep_q);
2738 		xmitframe_plist = get_next(xmitframe_phead);
2739 
2740 		while (xmitframe_phead != xmitframe_plist) {
2741 			pxmitframe = LIST_CONTAINOR(xmitframe_plist, struct xmit_frame, list);
2742 
2743 			xmitframe_plist = get_next(xmitframe_plist);
2744 
2745 			list_del_init(&pxmitframe->list);
2746 
2747 			psta_bmc->sleepq_len--;
2748 			if (psta_bmc->sleepq_len > 0)
2749 				pxmitframe->attrib.mdata = 1;
2750 			else
2751 				pxmitframe->attrib.mdata = 0;
2752 
2753 
2754 			pxmitframe->attrib.triggered = 1;
2755 /*
2756 			spin_unlock_bh(&psta_bmc->sleep_q.lock);
2757 			if (rtw_hal_xmit(padapter, pxmitframe) == true)
2758 			{
2759 				rtw_os_xmit_complete(padapter, pxmitframe);
2760 			}
2761 			spin_lock_bh(&psta_bmc->sleep_q.lock);
2762 
2763 */
2764 			rtw_hal_xmitframe_enqueue(padapter, pxmitframe);
2765 
2766 		}
2767 
2768 		if (psta_bmc->sleepq_len == 0) {
2769 			if (pstapriv->tim_bitmap & BIT(0)) {
2770 				/* DBG_871X("wakeup to xmit, qlen == 0, update_BCNTIM, tim =%x\n", pstapriv->tim_bitmap); */
2771 				/* upate BCN for TIM IE */
2772 				/* update_BCNTIM(padapter); */
2773 				update_mask |= BIT(1);
2774 			}
2775 			pstapriv->tim_bitmap &= ~BIT(0);
2776 			pstapriv->sta_dz_bitmap &= ~BIT(0);
2777 		}
2778 
2779 	}
2780 
2781 _exit:
2782 
2783 	/* spin_unlock_bh(&psta_bmc->sleep_q.lock); */
2784 	spin_unlock_bh(&pxmitpriv->lock);
2785 
2786 	if (update_mask)
2787 		/* update_BCNTIM(padapter); */
2788 		/* printk("%s => call update_beacon\n", __func__); */
2789 		update_beacon(padapter, _TIM_IE_, NULL, true);
2790 
2791 }
2792 
2793 void xmit_delivery_enabled_frames(struct adapter *padapter, struct sta_info *psta)
2794 {
2795 	u8 wmmps_ac = 0;
2796 	struct list_head	*xmitframe_plist, *xmitframe_phead;
2797 	struct xmit_frame *pxmitframe = NULL;
2798 	struct sta_priv *pstapriv = &padapter->stapriv;
2799 	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
2800 
2801 
2802 	/* spin_lock_bh(&psta->sleep_q.lock); */
2803 	spin_lock_bh(&pxmitpriv->lock);
2804 
2805 	xmitframe_phead = get_list_head(&psta->sleep_q);
2806 	xmitframe_plist = get_next(xmitframe_phead);
2807 
2808 	while (xmitframe_phead != xmitframe_plist) {
2809 		pxmitframe = LIST_CONTAINOR(xmitframe_plist, struct xmit_frame, list);
2810 
2811 		xmitframe_plist = get_next(xmitframe_plist);
2812 
2813 		switch (pxmitframe->attrib.priority) {
2814 		case 1:
2815 		case 2:
2816 			wmmps_ac = psta->uapsd_bk&BIT(1);
2817 			break;
2818 		case 4:
2819 		case 5:
2820 			wmmps_ac = psta->uapsd_vi&BIT(1);
2821 			break;
2822 		case 6:
2823 		case 7:
2824 			wmmps_ac = psta->uapsd_vo&BIT(1);
2825 			break;
2826 		case 0:
2827 		case 3:
2828 		default:
2829 			wmmps_ac = psta->uapsd_be&BIT(1);
2830 			break;
2831 		}
2832 
2833 		if (!wmmps_ac)
2834 			continue;
2835 
2836 		list_del_init(&pxmitframe->list);
2837 
2838 		psta->sleepq_len--;
2839 		psta->sleepq_ac_len--;
2840 
2841 		if (psta->sleepq_ac_len > 0) {
2842 			pxmitframe->attrib.mdata = 1;
2843 			pxmitframe->attrib.eosp = 0;
2844 		} else{
2845 			pxmitframe->attrib.mdata = 0;
2846 			pxmitframe->attrib.eosp = 1;
2847 		}
2848 
2849 		pxmitframe->attrib.triggered = 1;
2850 		rtw_hal_xmitframe_enqueue(padapter, pxmitframe);
2851 
2852 		if ((psta->sleepq_ac_len == 0) && (!psta->has_legacy_ac) && (wmmps_ac)) {
2853 			pstapriv->tim_bitmap &= ~BIT(psta->aid);
2854 
2855 			/* DBG_871X("wakeup to xmit, qlen == 0, update_BCNTIM, tim =%x\n", pstapriv->tim_bitmap); */
2856 			/* upate BCN for TIM IE */
2857 			/* update_BCNTIM(padapter); */
2858 			update_beacon(padapter, _TIM_IE_, NULL, true);
2859 			/* update_mask = BIT(0); */
2860 		}
2861 
2862 	}
2863 
2864 	/* spin_unlock_bh(&psta->sleep_q.lock); */
2865 	spin_unlock_bh(&pxmitpriv->lock);
2866 
2867 	return;
2868 }
2869 
2870 void enqueue_pending_xmitbuf(
2871 	struct xmit_priv *pxmitpriv,
2872 	struct xmit_buf *pxmitbuf)
2873 {
2874 	struct __queue *pqueue;
2875 	struct adapter *pri_adapter = pxmitpriv->adapter;
2876 
2877 	pqueue = &pxmitpriv->pending_xmitbuf_queue;
2878 
2879 	spin_lock_bh(&pqueue->lock);
2880 	list_del_init(&pxmitbuf->list);
2881 	list_add_tail(&pxmitbuf->list, get_list_head(pqueue));
2882 	spin_unlock_bh(&pqueue->lock);
2883 
2884 	up(&(pri_adapter->xmitpriv.xmit_sema));
2885 }
2886 
2887 void enqueue_pending_xmitbuf_to_head(
2888 	struct xmit_priv *pxmitpriv,
2889 	struct xmit_buf *pxmitbuf)
2890 {
2891 	struct __queue *pqueue;
2892 
2893 	pqueue = &pxmitpriv->pending_xmitbuf_queue;
2894 
2895 	spin_lock_bh(&pqueue->lock);
2896 	list_del_init(&pxmitbuf->list);
2897 	list_add(&pxmitbuf->list, get_list_head(pqueue));
2898 	spin_unlock_bh(&pqueue->lock);
2899 }
2900 
2901 struct xmit_buf *dequeue_pending_xmitbuf(
2902 	struct xmit_priv *pxmitpriv)
2903 {
2904 	struct xmit_buf *pxmitbuf;
2905 	struct __queue *pqueue;
2906 
2907 
2908 	pxmitbuf = NULL;
2909 	pqueue = &pxmitpriv->pending_xmitbuf_queue;
2910 
2911 	spin_lock_bh(&pqueue->lock);
2912 
2913 	if (!list_empty(&pqueue->queue)) {
2914 		struct list_head *plist, *phead;
2915 
2916 		phead = get_list_head(pqueue);
2917 		plist = get_next(phead);
2918 		pxmitbuf = LIST_CONTAINOR(plist, struct xmit_buf, list);
2919 		list_del_init(&pxmitbuf->list);
2920 	}
2921 
2922 	spin_unlock_bh(&pqueue->lock);
2923 
2924 	return pxmitbuf;
2925 }
2926 
2927 struct xmit_buf *dequeue_pending_xmitbuf_under_survey(
2928 	struct xmit_priv *pxmitpriv)
2929 {
2930 	struct xmit_buf *pxmitbuf;
2931 	struct __queue *pqueue;
2932 
2933 
2934 	pxmitbuf = NULL;
2935 	pqueue = &pxmitpriv->pending_xmitbuf_queue;
2936 
2937 	spin_lock_bh(&pqueue->lock);
2938 
2939 	if (!list_empty(&pqueue->queue)) {
2940 		struct list_head *plist, *phead;
2941 		u8 type;
2942 
2943 		phead = get_list_head(pqueue);
2944 		plist = phead;
2945 		do {
2946 			plist = get_next(plist);
2947 			if (plist == phead)
2948 				break;
2949 
2950 			pxmitbuf = LIST_CONTAINOR(plist, struct xmit_buf, list);
2951 
2952 			type = GetFrameSubType(pxmitbuf->pbuf + TXDESC_OFFSET);
2953 
2954 			if ((type == WIFI_PROBEREQ) ||
2955 				(type == WIFI_DATA_NULL) ||
2956 				(type == WIFI_QOS_DATA_NULL)) {
2957 				list_del_init(&pxmitbuf->list);
2958 				break;
2959 			}
2960 			pxmitbuf = NULL;
2961 		} while (1);
2962 	}
2963 
2964 	spin_unlock_bh(&pqueue->lock);
2965 
2966 	return pxmitbuf;
2967 }
2968 
2969 sint check_pending_xmitbuf(
2970 	struct xmit_priv *pxmitpriv)
2971 {
2972 	struct __queue *pqueue;
2973 	sint	ret = false;
2974 
2975 	pqueue = &pxmitpriv->pending_xmitbuf_queue;
2976 
2977 	spin_lock_bh(&pqueue->lock);
2978 
2979 	if (!list_empty(&pqueue->queue))
2980 		ret = true;
2981 
2982 	spin_unlock_bh(&pqueue->lock);
2983 
2984 	return ret;
2985 }
2986 
2987 int rtw_xmit_thread(void *context)
2988 {
2989 	s32 err;
2990 	struct adapter *padapter;
2991 
2992 
2993 	err = _SUCCESS;
2994 	padapter = context;
2995 
2996 	thread_enter("RTW_XMIT_THREAD");
2997 
2998 	do {
2999 		err = rtw_hal_xmit_thread_handler(padapter);
3000 		flush_signals_thread();
3001 	} while (_SUCCESS == err);
3002 
3003 	up(&padapter->xmitpriv.terminate_xmitthread_sema);
3004 
3005 	thread_exit();
3006 }
3007 
3008 void rtw_sctx_init(struct submit_ctx *sctx, int timeout_ms)
3009 {
3010 	sctx->timeout_ms = timeout_ms;
3011 	sctx->submit_time = jiffies;
3012 	init_completion(&sctx->done);
3013 	sctx->status = RTW_SCTX_SUBMITTED;
3014 }
3015 
3016 int rtw_sctx_wait(struct submit_ctx *sctx, const char *msg)
3017 {
3018 	int ret = _FAIL;
3019 	unsigned long expire;
3020 	int status = 0;
3021 
3022 	expire = sctx->timeout_ms ? msecs_to_jiffies(sctx->timeout_ms) : MAX_SCHEDULE_TIMEOUT;
3023 	if (!wait_for_completion_timeout(&sctx->done, expire)) {
3024 		/* timeout, do something?? */
3025 		status = RTW_SCTX_DONE_TIMEOUT;
3026 		DBG_871X("%s timeout: %s\n", __func__, msg);
3027 	} else {
3028 		status = sctx->status;
3029 	}
3030 
3031 	if (status == RTW_SCTX_DONE_SUCCESS) {
3032 		ret = _SUCCESS;
3033 	}
3034 
3035 	return ret;
3036 }
3037 
3038 static bool rtw_sctx_chk_waring_status(int status)
3039 {
3040 	switch (status) {
3041 	case RTW_SCTX_DONE_UNKNOWN:
3042 	case RTW_SCTX_DONE_BUF_ALLOC:
3043 	case RTW_SCTX_DONE_BUF_FREE:
3044 
3045 	case RTW_SCTX_DONE_DRV_STOP:
3046 	case RTW_SCTX_DONE_DEV_REMOVE:
3047 		return true;
3048 	default:
3049 		return false;
3050 	}
3051 }
3052 
3053 void rtw_sctx_done_err(struct submit_ctx **sctx, int status)
3054 {
3055 	if (*sctx) {
3056 		if (rtw_sctx_chk_waring_status(status))
3057 			DBG_871X("%s status:%d\n", __func__, status);
3058 		(*sctx)->status = status;
3059 		complete(&((*sctx)->done));
3060 		*sctx = NULL;
3061 	}
3062 }
3063 
3064 void rtw_sctx_done(struct submit_ctx **sctx)
3065 {
3066 	rtw_sctx_done_err(sctx, RTW_SCTX_DONE_SUCCESS);
3067 }
3068 
3069 int rtw_ack_tx_wait(struct xmit_priv *pxmitpriv, u32 timeout_ms)
3070 {
3071 	struct submit_ctx *pack_tx_ops = &pxmitpriv->ack_tx_ops;
3072 
3073 	pack_tx_ops->submit_time = jiffies;
3074 	pack_tx_ops->timeout_ms = timeout_ms;
3075 	pack_tx_ops->status = RTW_SCTX_SUBMITTED;
3076 
3077 	return rtw_sctx_wait(pack_tx_ops, __func__);
3078 }
3079 
3080 void rtw_ack_tx_done(struct xmit_priv *pxmitpriv, int status)
3081 {
3082 	struct submit_ctx *pack_tx_ops = &pxmitpriv->ack_tx_ops;
3083 
3084 	if (pxmitpriv->ack_tx) {
3085 		rtw_sctx_done_err(&pack_tx_ops, status);
3086 	} else {
3087 		DBG_871X("%s ack_tx not set\n", __func__);
3088 	}
3089 }
3090