1 // SPDX-License-Identifier: GPL-2.0
2 /******************************************************************************
3  *
4  * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
5  *
6  ******************************************************************************/
7 #include <drv_types.h>
8 #include <rtw_debug.h>
9 
10 static u8 P802_1H_OUI[P80211_OUI_LEN] = { 0x00, 0x00, 0xf8 };
11 static u8 RFC1042_OUI[P80211_OUI_LEN] = { 0x00, 0x00, 0x00 };
12 
13 static void _init_txservq(struct tx_servq *ptxservq)
14 {
15 	INIT_LIST_HEAD(&ptxservq->tx_pending);
16 	INIT_LIST_HEAD(&ptxservq->sta_pending.queue);
17 	spin_lock_init(&ptxservq->sta_pending.lock);
18 	ptxservq->qcnt = 0;
19 }
20 
21 void _rtw_init_sta_xmit_priv(struct sta_xmit_priv *psta_xmitpriv)
22 {
23 	memset((unsigned char *)psta_xmitpriv, 0, sizeof(struct sta_xmit_priv));
24 
25 	spin_lock_init(&psta_xmitpriv->lock);
26 
27 	_init_txservq(&psta_xmitpriv->be_q);
28 	_init_txservq(&psta_xmitpriv->bk_q);
29 	_init_txservq(&psta_xmitpriv->vi_q);
30 	_init_txservq(&psta_xmitpriv->vo_q);
31 	INIT_LIST_HEAD(&psta_xmitpriv->legacy_dz);
32 	INIT_LIST_HEAD(&psta_xmitpriv->apsd);
33 }
34 
35 s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter)
36 {
37 	int i;
38 	struct xmit_buf *pxmitbuf;
39 	struct xmit_frame *pxframe;
40 	signed int	res = _SUCCESS;
41 
42 	spin_lock_init(&pxmitpriv->lock);
43 	spin_lock_init(&pxmitpriv->lock_sctx);
44 	init_completion(&pxmitpriv->xmit_comp);
45 	init_completion(&pxmitpriv->terminate_xmitthread_comp);
46 
47 	/*
48 	 * Please insert all the queue initializaiton using _rtw_init_queue below
49 	 */
50 
51 	pxmitpriv->adapter = padapter;
52 
53 	INIT_LIST_HEAD(&pxmitpriv->be_pending.queue);
54 	spin_lock_init(&pxmitpriv->be_pending.lock);
55 	INIT_LIST_HEAD(&pxmitpriv->bk_pending.queue);
56 	spin_lock_init(&pxmitpriv->bk_pending.lock);
57 	INIT_LIST_HEAD(&pxmitpriv->vi_pending.queue);
58 	spin_lock_init(&pxmitpriv->vi_pending.lock);
59 	INIT_LIST_HEAD(&pxmitpriv->vo_pending.queue);
60 	spin_lock_init(&pxmitpriv->vo_pending.lock);
61 	INIT_LIST_HEAD(&pxmitpriv->bm_pending.queue);
62 	spin_lock_init(&pxmitpriv->bm_pending.lock);
63 
64 	INIT_LIST_HEAD(&pxmitpriv->free_xmit_queue.queue);
65 	spin_lock_init(&pxmitpriv->free_xmit_queue.lock);
66 
67 	/*
68 	 * Please allocate memory with the sz = (struct xmit_frame) * NR_XMITFRAME,
69 	 * and initialize free_xmit_frame below.
70 	 * Please also apply  free_txobj to link_up all the xmit_frames...
71 	 */
72 
73 	pxmitpriv->pallocated_frame_buf = vzalloc(NR_XMITFRAME * sizeof(struct xmit_frame) + 4);
74 
75 	if (!pxmitpriv->pallocated_frame_buf) {
76 		pxmitpriv->pxmit_frame_buf = NULL;
77 		res = _FAIL;
78 		goto exit;
79 	}
80 	pxmitpriv->pxmit_frame_buf = (u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(pxmitpriv->pallocated_frame_buf), 4);
81 
82 	pxframe = (struct xmit_frame *) pxmitpriv->pxmit_frame_buf;
83 
84 	for (i = 0; i < NR_XMITFRAME; i++) {
85 		INIT_LIST_HEAD(&pxframe->list);
86 
87 		pxframe->padapter = padapter;
88 		pxframe->frame_tag = NULL_FRAMETAG;
89 
90 		pxframe->pkt = NULL;
91 
92 		pxframe->buf_addr = NULL;
93 		pxframe->pxmitbuf = NULL;
94 
95 		list_add_tail(&pxframe->list,
96 			      &pxmitpriv->free_xmit_queue.queue);
97 
98 		pxframe++;
99 	}
100 
101 	pxmitpriv->free_xmitframe_cnt = NR_XMITFRAME;
102 
103 	pxmitpriv->frag_len = MAX_FRAG_THRESHOLD;
104 
105 	/* init xmit_buf */
106 	INIT_LIST_HEAD(&pxmitpriv->free_xmitbuf_queue.queue);
107 	spin_lock_init(&pxmitpriv->free_xmitbuf_queue.lock);
108 	INIT_LIST_HEAD(&pxmitpriv->pending_xmitbuf_queue.queue);
109 	spin_lock_init(&pxmitpriv->pending_xmitbuf_queue.lock);
110 
111 	pxmitpriv->pallocated_xmitbuf = vzalloc(NR_XMITBUFF * sizeof(struct xmit_buf) + 4);
112 
113 	if (!pxmitpriv->pallocated_xmitbuf) {
114 		res = _FAIL;
115 		goto exit;
116 	}
117 
118 	pxmitpriv->pxmitbuf = (u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(pxmitpriv->pallocated_xmitbuf), 4);
119 
120 	pxmitbuf = (struct xmit_buf *)pxmitpriv->pxmitbuf;
121 
122 	for (i = 0; i < NR_XMITBUFF; i++) {
123 		INIT_LIST_HEAD(&pxmitbuf->list);
124 
125 		pxmitbuf->priv_data = NULL;
126 		pxmitbuf->padapter = padapter;
127 		pxmitbuf->buf_tag = XMITBUF_DATA;
128 
129 		/* Tx buf allocation may fail sometimes, so sleep and retry. */
130 		res = rtw_os_xmit_resource_alloc(padapter, pxmitbuf, (MAX_XMITBUF_SZ + XMITBUF_ALIGN_SZ), true);
131 		if (res == _FAIL) {
132 			msleep(10);
133 			res = rtw_os_xmit_resource_alloc(padapter, pxmitbuf, (MAX_XMITBUF_SZ + XMITBUF_ALIGN_SZ), true);
134 			if (res == _FAIL)
135 				goto exit;
136 		}
137 
138 		pxmitbuf->phead = pxmitbuf->pbuf;
139 		pxmitbuf->pend = pxmitbuf->pbuf + MAX_XMITBUF_SZ;
140 		pxmitbuf->len = 0;
141 		pxmitbuf->pdata = pxmitbuf->ptail = pxmitbuf->phead;
142 
143 		pxmitbuf->flags = XMIT_VO_QUEUE;
144 
145 		list_add_tail(&pxmitbuf->list,
146 			      &pxmitpriv->free_xmitbuf_queue.queue);
147 		#ifdef DBG_XMIT_BUF
148 		pxmitbuf->no = i;
149 		#endif
150 
151 		pxmitbuf++;
152 	}
153 
154 	pxmitpriv->free_xmitbuf_cnt = NR_XMITBUFF;
155 
156 	/* init xframe_ext queue,  the same count as extbuf  */
157 	INIT_LIST_HEAD(&pxmitpriv->free_xframe_ext_queue.queue);
158 	spin_lock_init(&pxmitpriv->free_xframe_ext_queue.lock);
159 
160 	pxmitpriv->xframe_ext_alloc_addr = vzalloc(NR_XMIT_EXTBUFF * sizeof(struct xmit_frame) + 4);
161 
162 	if (!pxmitpriv->xframe_ext_alloc_addr) {
163 		pxmitpriv->xframe_ext = NULL;
164 		res = _FAIL;
165 		goto exit;
166 	}
167 	pxmitpriv->xframe_ext = (u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(pxmitpriv->xframe_ext_alloc_addr), 4);
168 	pxframe = (struct xmit_frame *)pxmitpriv->xframe_ext;
169 
170 	for (i = 0; i < NR_XMIT_EXTBUFF; i++) {
171 		INIT_LIST_HEAD(&pxframe->list);
172 
173 		pxframe->padapter = padapter;
174 		pxframe->frame_tag = NULL_FRAMETAG;
175 
176 		pxframe->pkt = NULL;
177 
178 		pxframe->buf_addr = NULL;
179 		pxframe->pxmitbuf = NULL;
180 
181 		pxframe->ext_tag = 1;
182 
183 		list_add_tail(&pxframe->list,
184 			      &pxmitpriv->free_xframe_ext_queue.queue);
185 
186 		pxframe++;
187 	}
188 	pxmitpriv->free_xframe_ext_cnt = NR_XMIT_EXTBUFF;
189 
190 	/*  Init xmit extension buff */
191 	INIT_LIST_HEAD(&pxmitpriv->free_xmit_extbuf_queue.queue);
192 	spin_lock_init(&pxmitpriv->free_xmit_extbuf_queue.lock);
193 
194 	pxmitpriv->pallocated_xmit_extbuf = vzalloc(NR_XMIT_EXTBUFF * sizeof(struct xmit_buf) + 4);
195 
196 	if (!pxmitpriv->pallocated_xmit_extbuf) {
197 		res = _FAIL;
198 		goto exit;
199 	}
200 
201 	pxmitpriv->pxmit_extbuf = (u8 *)N_BYTE_ALIGMENT((SIZE_PTR)(pxmitpriv->pallocated_xmit_extbuf), 4);
202 
203 	pxmitbuf = (struct xmit_buf *)pxmitpriv->pxmit_extbuf;
204 
205 	for (i = 0; i < NR_XMIT_EXTBUFF; i++) {
206 		INIT_LIST_HEAD(&pxmitbuf->list);
207 
208 		pxmitbuf->priv_data = NULL;
209 		pxmitbuf->padapter = padapter;
210 		pxmitbuf->buf_tag = XMITBUF_MGNT;
211 
212 		res = rtw_os_xmit_resource_alloc(padapter, pxmitbuf, MAX_XMIT_EXTBUF_SZ + XMITBUF_ALIGN_SZ, true);
213 		if (res == _FAIL) {
214 			res = _FAIL;
215 			goto exit;
216 		}
217 
218 		pxmitbuf->phead = pxmitbuf->pbuf;
219 		pxmitbuf->pend = pxmitbuf->pbuf + MAX_XMIT_EXTBUF_SZ;
220 		pxmitbuf->len = 0;
221 		pxmitbuf->pdata = pxmitbuf->ptail = pxmitbuf->phead;
222 
223 		list_add_tail(&pxmitbuf->list,
224 			      &pxmitpriv->free_xmit_extbuf_queue.queue);
225 		#ifdef DBG_XMIT_BUF_EXT
226 		pxmitbuf->no = i;
227 		#endif
228 		pxmitbuf++;
229 	}
230 
231 	pxmitpriv->free_xmit_extbuf_cnt = NR_XMIT_EXTBUFF;
232 
233 	for (i = 0; i < CMDBUF_MAX; i++) {
234 		pxmitbuf = &pxmitpriv->pcmd_xmitbuf[i];
235 		if (pxmitbuf) {
236 			INIT_LIST_HEAD(&pxmitbuf->list);
237 
238 			pxmitbuf->priv_data = NULL;
239 			pxmitbuf->padapter = padapter;
240 			pxmitbuf->buf_tag = XMITBUF_CMD;
241 
242 			res = rtw_os_xmit_resource_alloc(padapter, pxmitbuf, MAX_CMDBUF_SZ+XMITBUF_ALIGN_SZ, true);
243 			if (res == _FAIL) {
244 				res = _FAIL;
245 				goto exit;
246 			}
247 
248 			pxmitbuf->phead = pxmitbuf->pbuf;
249 			pxmitbuf->pend = pxmitbuf->pbuf + MAX_CMDBUF_SZ;
250 			pxmitbuf->len = 0;
251 			pxmitbuf->pdata = pxmitbuf->ptail = pxmitbuf->phead;
252 			pxmitbuf->alloc_sz = MAX_CMDBUF_SZ+XMITBUF_ALIGN_SZ;
253 		}
254 	}
255 
256 	res = rtw_alloc_hwxmits(padapter);
257 	if (res == _FAIL)
258 		goto exit;
259 	rtw_init_hwxmits(pxmitpriv->hwxmits, pxmitpriv->hwxmit_entry);
260 
261 	for (i = 0; i < 4; i++)
262 		pxmitpriv->wmm_para_seq[i] = i;
263 
264 	pxmitpriv->ack_tx = false;
265 	mutex_init(&pxmitpriv->ack_tx_mutex);
266 	rtw_sctx_init(&pxmitpriv->ack_tx_ops, 0);
267 
268 	rtw_hal_init_xmit_priv(padapter);
269 
270 exit:
271 	return res;
272 }
273 
274 void _rtw_free_xmit_priv(struct xmit_priv *pxmitpriv)
275 {
276 	int i;
277 	struct adapter *padapter = pxmitpriv->adapter;
278 	struct xmit_frame	*pxmitframe = (struct xmit_frame *) pxmitpriv->pxmit_frame_buf;
279 	struct xmit_buf *pxmitbuf = (struct xmit_buf *)pxmitpriv->pxmitbuf;
280 
281 	rtw_hal_free_xmit_priv(padapter);
282 
283 	if (!pxmitpriv->pxmit_frame_buf)
284 		return;
285 
286 	for (i = 0; i < NR_XMITFRAME; i++) {
287 		rtw_os_xmit_complete(padapter, pxmitframe);
288 
289 		pxmitframe++;
290 	}
291 
292 	for (i = 0; i < NR_XMITBUFF; i++) {
293 		rtw_os_xmit_resource_free(padapter, pxmitbuf, (MAX_XMITBUF_SZ + XMITBUF_ALIGN_SZ), true);
294 
295 		pxmitbuf++;
296 	}
297 
298 	vfree(pxmitpriv->pallocated_frame_buf);
299 	vfree(pxmitpriv->pallocated_xmitbuf);
300 
301 	/* free xframe_ext queue,  the same count as extbuf  */
302 	pxmitframe = (struct xmit_frame *)pxmitpriv->xframe_ext;
303 	if (pxmitframe) {
304 		for (i = 0; i < NR_XMIT_EXTBUFF; i++) {
305 			rtw_os_xmit_complete(padapter, pxmitframe);
306 			pxmitframe++;
307 		}
308 	}
309 
310 	vfree(pxmitpriv->xframe_ext_alloc_addr);
311 
312 	/*  free xmit extension buff */
313 	pxmitbuf = (struct xmit_buf *)pxmitpriv->pxmit_extbuf;
314 	for (i = 0; i < NR_XMIT_EXTBUFF; i++) {
315 		rtw_os_xmit_resource_free(padapter, pxmitbuf, (MAX_XMIT_EXTBUF_SZ + XMITBUF_ALIGN_SZ), true);
316 
317 		pxmitbuf++;
318 	}
319 
320 	vfree(pxmitpriv->pallocated_xmit_extbuf);
321 
322 	for (i = 0; i < CMDBUF_MAX; i++) {
323 		pxmitbuf = &pxmitpriv->pcmd_xmitbuf[i];
324 		if (pxmitbuf)
325 			rtw_os_xmit_resource_free(padapter, pxmitbuf, MAX_CMDBUF_SZ+XMITBUF_ALIGN_SZ, true);
326 	}
327 
328 	rtw_free_hwxmits(padapter);
329 
330 	mutex_destroy(&pxmitpriv->ack_tx_mutex);
331 }
332 
333 u8 query_ra_short_GI(struct sta_info *psta)
334 {
335 	u8 sgi = false, sgi_20m = false, sgi_40m = false;
336 
337 	sgi_20m = psta->htpriv.sgi_20m;
338 	sgi_40m = psta->htpriv.sgi_40m;
339 
340 	switch (psta->bw_mode) {
341 	case CHANNEL_WIDTH_40:
342 		sgi = sgi_40m;
343 		break;
344 	case CHANNEL_WIDTH_20:
345 	default:
346 		sgi = sgi_20m;
347 		break;
348 	}
349 
350 	return sgi;
351 }
352 
353 static void update_attrib_vcs_info(struct adapter *padapter, struct xmit_frame *pxmitframe)
354 {
355 	u32 sz;
356 	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
357 	/* struct sta_info *psta = pattrib->psta; */
358 	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
359 	struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
360 
361 	if (pattrib->nr_frags != 1)
362 		sz = padapter->xmitpriv.frag_len;
363 	else /* no frag */
364 		sz = pattrib->last_txcmdsz;
365 
366 	/*  (1) RTS_Threshold is compared to the MPDU, not MSDU. */
367 	/*  (2) If there are more than one frag in  this MSDU, only the first frag uses protection frame. */
368 	/* Other fragments are protected by previous fragment. */
369 	/* So we only need to check the length of first fragment. */
370 	if (pmlmeext->cur_wireless_mode < WIRELESS_11_24N  || padapter->registrypriv.wifi_spec) {
371 		if (sz > padapter->registrypriv.rts_thresh) {
372 			pattrib->vcs_mode = RTS_CTS;
373 		} else {
374 			if (pattrib->rtsen)
375 				pattrib->vcs_mode = RTS_CTS;
376 			else if (pattrib->cts2self)
377 				pattrib->vcs_mode = CTS_TO_SELF;
378 			else
379 				pattrib->vcs_mode = NONE_VCS;
380 		}
381 	} else {
382 		while (true) {
383 			/* IOT action */
384 			if ((pmlmeinfo->assoc_AP_vendor == HT_IOT_PEER_ATHEROS) && (pattrib->ampdu_en == true) &&
385 				(padapter->securitypriv.dot11PrivacyAlgrthm == _AES_)) {
386 				pattrib->vcs_mode = CTS_TO_SELF;
387 				break;
388 			}
389 
390 			/* check ERP protection */
391 			if (pattrib->rtsen || pattrib->cts2self) {
392 				if (pattrib->rtsen)
393 					pattrib->vcs_mode = RTS_CTS;
394 				else if (pattrib->cts2self)
395 					pattrib->vcs_mode = CTS_TO_SELF;
396 
397 				break;
398 			}
399 
400 			/* check HT op mode */
401 			if (pattrib->ht_en) {
402 				u8 HTOpMode = pmlmeinfo->HT_protection;
403 
404 				if ((pmlmeext->cur_bwmode && (HTOpMode == 2 || HTOpMode == 3)) ||
405 					(!pmlmeext->cur_bwmode && HTOpMode == 3)) {
406 					pattrib->vcs_mode = RTS_CTS;
407 					break;
408 				}
409 			}
410 
411 			/* check rts */
412 			if (sz > padapter->registrypriv.rts_thresh) {
413 				pattrib->vcs_mode = RTS_CTS;
414 				break;
415 			}
416 
417 			/* to do list: check MIMO power save condition. */
418 
419 			/* check AMPDU aggregation for TXOP */
420 			if (pattrib->ampdu_en == true) {
421 				pattrib->vcs_mode = RTS_CTS;
422 				break;
423 			}
424 
425 			pattrib->vcs_mode = NONE_VCS;
426 			break;
427 		}
428 	}
429 
430 	/* for debug : force driver control vrtl_carrier_sense. */
431 	if (padapter->driver_vcs_en == 1)
432 		pattrib->vcs_mode = padapter->driver_vcs_type;
433 }
434 
435 static void update_attrib_phy_info(struct adapter *padapter, struct pkt_attrib *pattrib, struct sta_info *psta)
436 {
437 	struct mlme_ext_priv *mlmeext = &padapter->mlmeextpriv;
438 
439 	pattrib->rtsen = psta->rtsen;
440 	pattrib->cts2self = psta->cts2self;
441 
442 	pattrib->mdata = 0;
443 	pattrib->eosp = 0;
444 	pattrib->triggered = 0;
445 	pattrib->ampdu_spacing = 0;
446 
447 	/* qos_en, ht_en, init rate, , bw, ch_offset, sgi */
448 	pattrib->qos_en = psta->qos_option;
449 
450 	pattrib->raid = psta->raid;
451 
452 	if (mlmeext->cur_bwmode < psta->bw_mode)
453 		pattrib->bwmode = mlmeext->cur_bwmode;
454 	else
455 		pattrib->bwmode = psta->bw_mode;
456 
457 	pattrib->sgi = query_ra_short_GI(psta);
458 
459 	pattrib->ldpc = psta->ldpc;
460 	pattrib->stbc = psta->stbc;
461 
462 	pattrib->ht_en = psta->htpriv.ht_option;
463 	pattrib->ch_offset = psta->htpriv.ch_offset;
464 	pattrib->ampdu_en = false;
465 
466 	if (padapter->driver_ampdu_spacing != 0xFF) /* driver control AMPDU Density for peer sta's rx */
467 		pattrib->ampdu_spacing = padapter->driver_ampdu_spacing;
468 	else
469 		pattrib->ampdu_spacing = psta->htpriv.rx_ampdu_min_spacing;
470 
471 	pattrib->retry_ctrl = false;
472 }
473 
474 static s32 update_attrib_sec_info(struct adapter *padapter, struct pkt_attrib *pattrib, struct sta_info *psta)
475 {
476 	signed int res = _SUCCESS;
477 	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
478 	struct security_priv *psecuritypriv = &padapter->securitypriv;
479 	signed int bmcast = IS_MCAST(pattrib->ra);
480 
481 	memset(pattrib->dot118021x_UncstKey.skey,  0, 16);
482 	memset(pattrib->dot11tkiptxmickey.skey,  0, 16);
483 	pattrib->mac_id = psta->mac_id;
484 
485 	if (psta->ieee8021x_blocked == true) {
486 		pattrib->encrypt = 0;
487 
488 		if ((pattrib->ether_type != 0x888e) && (check_fwstate(pmlmepriv, WIFI_MP_STATE) == false)) {
489 			res = _FAIL;
490 			goto exit;
491 		}
492 	} else {
493 		GET_ENCRY_ALGO(psecuritypriv, psta, pattrib->encrypt, bmcast);
494 
495 		switch (psecuritypriv->dot11AuthAlgrthm) {
496 		case dot11AuthAlgrthm_Open:
497 		case dot11AuthAlgrthm_Shared:
498 		case dot11AuthAlgrthm_Auto:
499 			pattrib->key_idx = (u8)psecuritypriv->dot11PrivacyKeyIndex;
500 			break;
501 		case dot11AuthAlgrthm_8021X:
502 			if (bmcast)
503 				pattrib->key_idx = (u8)psecuritypriv->dot118021XGrpKeyid;
504 			else
505 				pattrib->key_idx = 0;
506 			break;
507 		default:
508 			pattrib->key_idx = 0;
509 			break;
510 		}
511 
512 		/* For WPS 1.0 WEP, driver should not encrypt EAPOL Packet for WPS handshake. */
513 		if (((pattrib->encrypt == _WEP40_) || (pattrib->encrypt == _WEP104_)) && (pattrib->ether_type == 0x888e))
514 			pattrib->encrypt = _NO_PRIVACY_;
515 	}
516 
517 	switch (pattrib->encrypt) {
518 	case _WEP40_:
519 	case _WEP104_:
520 		pattrib->iv_len = 4;
521 		pattrib->icv_len = 4;
522 		WEP_IV(pattrib->iv, psta->dot11txpn, pattrib->key_idx);
523 		break;
524 
525 	case _TKIP_:
526 		pattrib->iv_len = 8;
527 		pattrib->icv_len = 4;
528 
529 		if (psecuritypriv->busetkipkey == _FAIL) {
530 			res = _FAIL;
531 			goto exit;
532 		}
533 
534 		if (bmcast)
535 			TKIP_IV(pattrib->iv, psta->dot11txpn, pattrib->key_idx);
536 		else
537 			TKIP_IV(pattrib->iv, psta->dot11txpn, 0);
538 
539 		memcpy(pattrib->dot11tkiptxmickey.skey, psta->dot11tkiptxmickey.skey, 16);
540 
541 		break;
542 
543 	case _AES_:
544 
545 		pattrib->iv_len = 8;
546 		pattrib->icv_len = 8;
547 
548 		if (bmcast)
549 			AES_IV(pattrib->iv, psta->dot11txpn, pattrib->key_idx);
550 		else
551 			AES_IV(pattrib->iv, psta->dot11txpn, 0);
552 
553 		break;
554 
555 	default:
556 		pattrib->iv_len = 0;
557 		pattrib->icv_len = 0;
558 		break;
559 	}
560 
561 	if (pattrib->encrypt > 0)
562 		memcpy(pattrib->dot118021x_UncstKey.skey, psta->dot118021x_UncstKey.skey, 16);
563 
564 	if (pattrib->encrypt &&
565 		((padapter->securitypriv.sw_encrypt) || (!psecuritypriv->hw_decrypted)))
566 		pattrib->bswenc = true;
567 	else
568 		pattrib->bswenc = false;
569 
570 exit:
571 
572 	return res;
573 }
574 
575 u8 qos_acm(u8 acm_mask, u8 priority)
576 {
577 	switch (priority) {
578 	case 0:
579 	case 3:
580 		if (acm_mask & BIT(1))
581 			priority = 1;
582 		break;
583 	case 1:
584 	case 2:
585 		break;
586 	case 4:
587 	case 5:
588 		if (acm_mask & BIT(2))
589 			priority = 0;
590 		break;
591 	case 6:
592 	case 7:
593 		if (acm_mask & BIT(3))
594 			priority = 5;
595 		break;
596 	default:
597 		break;
598 	}
599 
600 	return priority;
601 }
602 
603 static void set_qos(struct pkt_file *ppktfile, struct pkt_attrib *pattrib)
604 {
605 	struct ethhdr etherhdr;
606 	struct iphdr ip_hdr;
607 	s32 UserPriority = 0;
608 
609 	_rtw_open_pktfile(ppktfile->pkt, ppktfile);
610 	_rtw_pktfile_read(ppktfile, (unsigned char *)&etherhdr, ETH_HLEN);
611 
612 	/*  get UserPriority from IP hdr */
613 	if (pattrib->ether_type == 0x0800) {
614 		_rtw_pktfile_read(ppktfile, (u8 *)&ip_hdr, sizeof(ip_hdr));
615 		UserPriority = ip_hdr.tos >> 5;
616 	}
617 	pattrib->priority = UserPriority;
618 	pattrib->hdrlen = WLAN_HDR_A3_QOS_LEN;
619 	pattrib->subtype = WIFI_QOS_DATA_TYPE;
620 }
621 
622 static s32 update_attrib(struct adapter *padapter, struct sk_buff *pkt, struct pkt_attrib *pattrib)
623 {
624 	struct pkt_file pktfile;
625 	struct sta_info *psta = NULL;
626 	struct ethhdr etherhdr;
627 
628 	signed int bmcast;
629 	struct sta_priv *pstapriv = &padapter->stapriv;
630 	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
631 	struct qos_priv *pqospriv = &pmlmepriv->qospriv;
632 	signed int res = _SUCCESS;
633 
634 	_rtw_open_pktfile(pkt, &pktfile);
635 	_rtw_pktfile_read(&pktfile, (u8 *)&etherhdr, ETH_HLEN);
636 
637 	pattrib->ether_type = ntohs(etherhdr.h_proto);
638 
639 	memcpy(pattrib->dst, &etherhdr.h_dest, ETH_ALEN);
640 	memcpy(pattrib->src, &etherhdr.h_source, ETH_ALEN);
641 
642 	if ((check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == true) ||
643 		(check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == true)) {
644 		memcpy(pattrib->ra, pattrib->dst, ETH_ALEN);
645 		memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
646 	} else if (check_fwstate(pmlmepriv, WIFI_STATION_STATE)) {
647 		memcpy(pattrib->ra, get_bssid(pmlmepriv), ETH_ALEN);
648 		memcpy(pattrib->ta, pattrib->src, ETH_ALEN);
649 	} else if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
650 		memcpy(pattrib->ra, pattrib->dst, ETH_ALEN);
651 		memcpy(pattrib->ta, get_bssid(pmlmepriv), ETH_ALEN);
652 	}
653 
654 	pattrib->pktlen = pktfile.pkt_len;
655 
656 	if (pattrib->ether_type == ETH_P_IP) {
657 		/*  The following is for DHCP and ARP packet, we use cck1M to tx these packets and let LPS awake some time */
658 		/*  to prevent DHCP protocol fail */
659 
660 		u8 tmp[24];
661 
662 		_rtw_pktfile_read(&pktfile, &tmp[0], 24);
663 
664 		pattrib->dhcp_pkt = 0;
665 		if (pktfile.pkt_len > 282) {/* MINIMUM_DHCP_PACKET_SIZE) { */
666 			if (pattrib->ether_type == ETH_P_IP) {/*  IP header */
667 				if (((tmp[21] == 68) && (tmp[23] == 67)) ||
668 					((tmp[21] == 67) && (tmp[23] == 68))) {
669 					/*  68 : UDP BOOTP client */
670 					/*  67 : UDP BOOTP server */
671 					pattrib->dhcp_pkt = 1;
672 				}
673 			}
674 		}
675 
676 		/* for parsing ICMP pakcets */
677 		{
678 			struct iphdr *piphdr = (struct iphdr *)tmp;
679 
680 			pattrib->icmp_pkt = 0;
681 			if (piphdr->protocol == 0x1) /*  protocol type in ip header 0x1 is ICMP */
682 				pattrib->icmp_pkt = 1;
683 		}
684 	} else if (pattrib->ether_type == 0x888e) {
685 		netdev_dbg(padapter->pnetdev, "send eapol packet\n");
686 	}
687 
688 	if ((pattrib->ether_type == 0x888e) || (pattrib->dhcp_pkt == 1))
689 		rtw_set_scan_deny(padapter, 3000);
690 
691 	/*  If EAPOL , ARP , OR DHCP packet, driver must be in active mode. */
692 	if (pattrib->icmp_pkt == 1)
693 		rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_LEAVE, 1);
694 	else if (pattrib->dhcp_pkt == 1)
695 		rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_SPECIAL_PACKET, 1);
696 
697 	bmcast = IS_MCAST(pattrib->ra);
698 
699 	/*  get sta_info */
700 	if (bmcast) {
701 		psta = rtw_get_bcmc_stainfo(padapter);
702 	} else {
703 		psta = rtw_get_stainfo(pstapriv, pattrib->ra);
704 		if (!psta)	{ /*  if we cannot get psta => drop the pkt */
705 			res = _FAIL;
706 			goto exit;
707 		} else if ((check_fwstate(pmlmepriv, WIFI_AP_STATE) == true) && (!(psta->state & _FW_LINKED))) {
708 			res = _FAIL;
709 			goto exit;
710 		}
711 	}
712 
713 	if (!psta) {
714 		/*  if we cannot get psta => drop the pkt */
715 		res = _FAIL;
716 		goto exit;
717 	}
718 
719 	if (!(psta->state & _FW_LINKED))
720 		return _FAIL;
721 
722 	/* TODO:_lock */
723 	if (update_attrib_sec_info(padapter, pattrib, psta) == _FAIL) {
724 		res = _FAIL;
725 		goto exit;
726 	}
727 
728 	update_attrib_phy_info(padapter, pattrib, psta);
729 
730 	pattrib->psta = psta;
731 	/* TODO:_unlock */
732 
733 	pattrib->pctrl = 0;
734 
735 	pattrib->ack_policy = 0;
736 	/*  get ether_hdr_len */
737 	pattrib->pkt_hdrlen = ETH_HLEN;/* pattrib->ether_type == 0x8100) ? (14 + 4): 14; vlan tag */
738 
739 	pattrib->hdrlen = WLAN_HDR_A3_LEN;
740 	pattrib->subtype = WIFI_DATA_TYPE;
741 	pattrib->priority = 0;
742 
743 	if (check_fwstate(pmlmepriv, WIFI_AP_STATE|WIFI_ADHOC_STATE|WIFI_ADHOC_MASTER_STATE)) {
744 		if (pattrib->qos_en)
745 			set_qos(&pktfile, pattrib);
746 	} else {
747 		if (pqospriv->qos_option) {
748 			set_qos(&pktfile, pattrib);
749 
750 			if (pmlmepriv->acm_mask != 0)
751 				pattrib->priority = qos_acm(pmlmepriv->acm_mask, pattrib->priority);
752 		}
753 	}
754 
755 	/* pattrib->priority = 5; force to used VI queue, for testing */
756 
757 exit:
758 	return res;
759 }
760 
761 static s32 xmitframe_addmic(struct adapter *padapter, struct xmit_frame *pxmitframe)
762 {
763 	signed int			curfragnum, length;
764 	u8 *pframe, *payload, mic[8];
765 	struct mic_data micdata;
766 	struct pkt_attrib *pattrib = &pxmitframe->attrib;
767 	struct security_priv *psecuritypriv = &padapter->securitypriv;
768 	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
769 	u8 priority[4] = {0x0, 0x0, 0x0, 0x0};
770 	u8 hw_hdr_offset = 0;
771 	signed int bmcst = IS_MCAST(pattrib->ra);
772 
773 	hw_hdr_offset = TXDESC_OFFSET;
774 
775 	if (pattrib->encrypt == _TKIP_) {
776 		/* encode mic code */
777 		{
778 			u8 null_key[16] = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0};
779 
780 			pframe = pxmitframe->buf_addr + hw_hdr_offset;
781 
782 			if (bmcst) {
783 				if (!memcmp(psecuritypriv->dot118021XGrptxmickey[psecuritypriv->dot118021XGrpKeyid].skey, null_key, 16))
784 					return _FAIL;
785 				/* start to calculate the mic code */
786 				rtw_secmicsetkey(&micdata, psecuritypriv->dot118021XGrptxmickey[psecuritypriv->dot118021XGrpKeyid].skey);
787 			} else {
788 				if (!memcmp(&pattrib->dot11tkiptxmickey.skey[0], null_key, 16))
789 					return _FAIL;
790 				/* start to calculate the mic code */
791 				rtw_secmicsetkey(&micdata, &pattrib->dot11tkiptxmickey.skey[0]);
792 			}
793 
794 			if (pframe[1]&1) {   /* ToDS == 1 */
795 				rtw_secmicappend(&micdata, &pframe[16], 6);  /* DA */
796 				if (pframe[1]&2)  /* From Ds == 1 */
797 					rtw_secmicappend(&micdata, &pframe[24], 6);
798 				else
799 					rtw_secmicappend(&micdata, &pframe[10], 6);
800 			} else {	/* ToDS == 0 */
801 				rtw_secmicappend(&micdata, &pframe[4], 6);   /* DA */
802 				if (pframe[1]&2)  /* From Ds == 1 */
803 					rtw_secmicappend(&micdata, &pframe[16], 6);
804 				else
805 					rtw_secmicappend(&micdata, &pframe[10], 6);
806 			}
807 
808 			if (pattrib->qos_en)
809 				priority[0] = (u8)pxmitframe->attrib.priority;
810 
811 			rtw_secmicappend(&micdata, &priority[0], 4);
812 
813 			payload = pframe;
814 
815 			for (curfragnum = 0; curfragnum < pattrib->nr_frags; curfragnum++) {
816 				payload = (u8 *)round_up((SIZE_PTR)(payload), 4);
817 				payload = payload+pattrib->hdrlen+pattrib->iv_len;
818 
819 				if ((curfragnum+1) == pattrib->nr_frags) {
820 					length = pattrib->last_txcmdsz-pattrib->hdrlen-pattrib->iv_len-((pattrib->bswenc) ? pattrib->icv_len : 0);
821 					rtw_secmicappend(&micdata, payload, length);
822 					payload = payload+length;
823 				} else {
824 					length = pxmitpriv->frag_len-pattrib->hdrlen-pattrib->iv_len-((pattrib->bswenc) ? pattrib->icv_len : 0);
825 					rtw_secmicappend(&micdata, payload, length);
826 					payload = payload+length+pattrib->icv_len;
827 				}
828 			}
829 			rtw_secgetmic(&micdata, &mic[0]);
830 			/* add mic code  and add the mic code length in last_txcmdsz */
831 
832 			memcpy(payload, &mic[0], 8);
833 			pattrib->last_txcmdsz += 8;
834 			}
835 	}
836 	return _SUCCESS;
837 }
838 
839 static s32 xmitframe_swencrypt(struct adapter *padapter, struct xmit_frame *pxmitframe)
840 {
841 	struct	pkt_attrib	 *pattrib = &pxmitframe->attrib;
842 
843 	if (pattrib->bswenc) {
844 		switch (pattrib->encrypt) {
845 		case _WEP40_:
846 		case _WEP104_:
847 			rtw_wep_encrypt(padapter, (u8 *)pxmitframe);
848 			break;
849 		case _TKIP_:
850 			rtw_tkip_encrypt(padapter, (u8 *)pxmitframe);
851 			break;
852 		case _AES_:
853 			rtw_aes_encrypt(padapter, (u8 *)pxmitframe);
854 			break;
855 		default:
856 				break;
857 		}
858 	}
859 
860 	return _SUCCESS;
861 }
862 
863 s32 rtw_make_wlanhdr(struct adapter *padapter, u8 *hdr, struct pkt_attrib *pattrib)
864 {
865 	u16 *qc;
866 
867 	struct ieee80211_hdr *pwlanhdr = (struct ieee80211_hdr *)hdr;
868 	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
869 	struct qos_priv *pqospriv = &pmlmepriv->qospriv;
870 	u8 qos_option = false;
871 	signed int res = _SUCCESS;
872 	__le16 *fctrl = &pwlanhdr->frame_control;
873 
874 	memset(hdr, 0, WLANHDR_OFFSET);
875 
876 	SetFrameSubType(fctrl, pattrib->subtype);
877 
878 	if (pattrib->subtype & WIFI_DATA_TYPE) {
879 		if (check_fwstate(pmlmepriv,  WIFI_STATION_STATE) == true) {
880 			/* to_ds = 1, fr_ds = 0; */
881 
882 			{
883 				/*  1.Data transfer to AP */
884 				/*  2.Arp pkt will relayed by AP */
885 				SetToDs(fctrl);
886 				memcpy(pwlanhdr->addr1, get_bssid(pmlmepriv), ETH_ALEN);
887 				memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN);
888 				memcpy(pwlanhdr->addr3, pattrib->dst, ETH_ALEN);
889 			}
890 
891 			if (pqospriv->qos_option)
892 				qos_option = true;
893 		} else if (check_fwstate(pmlmepriv,  WIFI_AP_STATE) == true) {
894 			/* to_ds = 0, fr_ds = 1; */
895 			SetFrDs(fctrl);
896 			memcpy(pwlanhdr->addr1, pattrib->dst, ETH_ALEN);
897 			memcpy(pwlanhdr->addr2, get_bssid(pmlmepriv), ETH_ALEN);
898 			memcpy(pwlanhdr->addr3, pattrib->src, ETH_ALEN);
899 
900 			if (pattrib->qos_en)
901 				qos_option = true;
902 		} else if ((check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == true) ||
903 		(check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == true)) {
904 			memcpy(pwlanhdr->addr1, pattrib->dst, ETH_ALEN);
905 			memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN);
906 			memcpy(pwlanhdr->addr3, get_bssid(pmlmepriv), ETH_ALEN);
907 
908 			if (pattrib->qos_en)
909 				qos_option = true;
910 		} else {
911 			res = _FAIL;
912 			goto exit;
913 		}
914 
915 		if (pattrib->mdata)
916 			SetMData(fctrl);
917 
918 		if (pattrib->encrypt)
919 			SetPrivacy(fctrl);
920 
921 		if (qos_option) {
922 			qc = (unsigned short *)(hdr + pattrib->hdrlen - 2);
923 
924 			if (pattrib->priority)
925 				SetPriority(qc, pattrib->priority);
926 
927 			SetEOSP(qc, pattrib->eosp);
928 
929 			SetAckpolicy(qc, pattrib->ack_policy);
930 		}
931 
932 		/* TODO: fill HT Control Field */
933 
934 		/* Update Seq Num will be handled by f/w */
935 		{
936 			struct sta_info *psta;
937 
938 			psta = rtw_get_stainfo(&padapter->stapriv, pattrib->ra);
939 			if (pattrib->psta != psta)
940 				return _FAIL;
941 
942 			if (!psta)
943 				return _FAIL;
944 
945 			if (!(psta->state & _FW_LINKED))
946 				return _FAIL;
947 
948 			if (psta) {
949 				psta->sta_xmitpriv.txseq_tid[pattrib->priority]++;
950 				psta->sta_xmitpriv.txseq_tid[pattrib->priority] &= 0xFFF;
951 				pattrib->seqnum = psta->sta_xmitpriv.txseq_tid[pattrib->priority];
952 
953 				SetSeqNum(hdr, pattrib->seqnum);
954 
955 				/* check if enable ampdu */
956 				if (pattrib->ht_en && psta->htpriv.ampdu_enable)
957 					if (psta->htpriv.agg_enable_bitmap & BIT(pattrib->priority))
958 						pattrib->ampdu_en = true;
959 
960 				/* re-check if enable ampdu by BA_starting_seqctrl */
961 				if (pattrib->ampdu_en == true) {
962 					u16 tx_seq;
963 
964 					tx_seq = psta->BA_starting_seqctrl[pattrib->priority & 0x0f];
965 
966 					/* check BA_starting_seqctrl */
967 					if (SN_LESS(pattrib->seqnum, tx_seq)) {
968 						pattrib->ampdu_en = false;/* AGG BK */
969 					} else if (SN_EQUAL(pattrib->seqnum, tx_seq)) {
970 						psta->BA_starting_seqctrl[pattrib->priority & 0x0f] = (tx_seq+1)&0xfff;
971 
972 						pattrib->ampdu_en = true;/* AGG EN */
973 					} else {
974 						psta->BA_starting_seqctrl[pattrib->priority & 0x0f] = (pattrib->seqnum+1)&0xfff;
975 						pattrib->ampdu_en = true;/* AGG EN */
976 					}
977 				}
978 			}
979 		}
980 	} else {
981 	}
982 
983 exit:
984 	return res;
985 }
986 
987 s32 rtw_txframes_pending(struct adapter *padapter)
988 {
989 	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
990 
991 	return ((!list_empty(&pxmitpriv->be_pending.queue)) ||
992 			 (!list_empty(&pxmitpriv->bk_pending.queue)) ||
993 			 (!list_empty(&pxmitpriv->vi_pending.queue)) ||
994 			 (!list_empty(&pxmitpriv->vo_pending.queue)));
995 }
996 
997 /*
998  * Calculate wlan 802.11 packet MAX size from pkt_attrib
999  * This function doesn't consider fragment case
1000  */
1001 u32 rtw_calculate_wlan_pkt_size_by_attribue(struct pkt_attrib *pattrib)
1002 {
1003 	u32 len = 0;
1004 
1005 	len = pattrib->hdrlen + pattrib->iv_len; /*  WLAN Header and IV */
1006 	len += SNAP_SIZE + sizeof(u16); /*  LLC */
1007 	len += pattrib->pktlen;
1008 	if (pattrib->encrypt == _TKIP_)
1009 		len += 8; /*  MIC */
1010 	len += ((pattrib->bswenc) ? pattrib->icv_len : 0); /*  ICV */
1011 
1012 	return len;
1013 }
1014 
1015 /*
1016  * This sub-routine will perform all the following:
1017  * 1. remove 802.3 header.
1018  * 2. create wlan_header, based on the info in pxmitframe
1019  * 3. append sta's iv/ext-iv
1020  * 4. append LLC
1021  * 5. move frag chunk from pframe to pxmitframe->mem
1022  * 6. apply sw-encrypt, if necessary.
1023  */
1024 s32 rtw_xmitframe_coalesce(struct adapter *padapter, struct sk_buff *pkt, struct xmit_frame *pxmitframe)
1025 {
1026 	struct pkt_file pktfile;
1027 
1028 	s32 frg_inx, frg_len, mpdu_len, llc_sz, mem_sz;
1029 
1030 	SIZE_PTR addr;
1031 
1032 	u8 *pframe, *mem_start;
1033 	u8 hw_hdr_offset;
1034 
1035 	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
1036 
1037 	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
1038 
1039 	u8 *pbuf_start;
1040 
1041 	s32 bmcst = IS_MCAST(pattrib->ra);
1042 	s32 res = _SUCCESS;
1043 
1044 	if (!pxmitframe->buf_addr)
1045 		return _FAIL;
1046 
1047 	pbuf_start = pxmitframe->buf_addr;
1048 
1049 	hw_hdr_offset = TXDESC_OFFSET;
1050 	mem_start = pbuf_start +	hw_hdr_offset;
1051 
1052 	if (rtw_make_wlanhdr(padapter, mem_start, pattrib) == _FAIL) {
1053 		res = _FAIL;
1054 		goto exit;
1055 	}
1056 
1057 	_rtw_open_pktfile(pkt, &pktfile);
1058 	_rtw_pktfile_read(&pktfile, NULL, pattrib->pkt_hdrlen);
1059 
1060 	frg_inx = 0;
1061 	frg_len = pxmitpriv->frag_len - 4;/* 2346-4 = 2342 */
1062 
1063 	while (1) {
1064 		llc_sz = 0;
1065 
1066 		mpdu_len = frg_len;
1067 
1068 		pframe = mem_start;
1069 
1070 		SetMFrag(mem_start);
1071 
1072 		pframe += pattrib->hdrlen;
1073 		mpdu_len -= pattrib->hdrlen;
1074 
1075 		/* adding icv, if necessary... */
1076 		if (pattrib->iv_len) {
1077 			memcpy(pframe, pattrib->iv, pattrib->iv_len);
1078 
1079 			pframe += pattrib->iv_len;
1080 
1081 			mpdu_len -= pattrib->iv_len;
1082 		}
1083 
1084 		if (frg_inx == 0) {
1085 			llc_sz = rtw_put_snap(pframe, pattrib->ether_type);
1086 			pframe += llc_sz;
1087 			mpdu_len -= llc_sz;
1088 		}
1089 
1090 		if ((pattrib->icv_len > 0) && (pattrib->bswenc))
1091 			mpdu_len -= pattrib->icv_len;
1092 
1093 		if (bmcst) {
1094 			/*  don't do fragment to broadcast/multicast packets */
1095 			mem_sz = _rtw_pktfile_read(&pktfile, pframe, pattrib->pktlen);
1096 		} else {
1097 			mem_sz = _rtw_pktfile_read(&pktfile, pframe, mpdu_len);
1098 		}
1099 
1100 		pframe += mem_sz;
1101 
1102 		if ((pattrib->icv_len > 0) && (pattrib->bswenc)) {
1103 			memcpy(pframe, pattrib->icv, pattrib->icv_len);
1104 			pframe += pattrib->icv_len;
1105 		}
1106 
1107 		frg_inx++;
1108 
1109 		if (bmcst || (rtw_endofpktfile(&pktfile) == true)) {
1110 			pattrib->nr_frags = frg_inx;
1111 
1112 			pattrib->last_txcmdsz = pattrib->hdrlen + pattrib->iv_len + ((pattrib->nr_frags == 1) ? llc_sz:0) +
1113 					((pattrib->bswenc) ? pattrib->icv_len : 0) + mem_sz;
1114 
1115 			ClearMFrag(mem_start);
1116 
1117 			break;
1118 		}
1119 
1120 		addr = (SIZE_PTR)(pframe);
1121 
1122 		mem_start = (unsigned char *)round_up(addr, 4) + hw_hdr_offset;
1123 		memcpy(mem_start, pbuf_start + hw_hdr_offset, pattrib->hdrlen);
1124 	}
1125 
1126 	if (xmitframe_addmic(padapter, pxmitframe) == _FAIL) {
1127 		res = _FAIL;
1128 		goto exit;
1129 	}
1130 
1131 	xmitframe_swencrypt(padapter, pxmitframe);
1132 
1133 	if (bmcst == false)
1134 		update_attrib_vcs_info(padapter, pxmitframe);
1135 	else
1136 		pattrib->vcs_mode = NONE_VCS;
1137 
1138 exit:
1139 	return res;
1140 }
1141 
1142 /* broadcast or multicast management pkt use BIP, unicast management pkt use CCMP encryption */
1143 s32 rtw_mgmt_xmitframe_coalesce(struct adapter *padapter, struct sk_buff *pkt, struct xmit_frame *pxmitframe)
1144 {
1145 	u8 *pframe, *mem_start = NULL, *tmp_buf = NULL;
1146 	u8 subtype;
1147 	struct sta_info *psta = NULL;
1148 	struct pkt_attrib *pattrib = &pxmitframe->attrib;
1149 	s32 bmcst = IS_MCAST(pattrib->ra);
1150 	u8 *BIP_AAD = NULL;
1151 	u8 *MGMT_body = NULL;
1152 
1153 	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
1154 	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
1155 	struct ieee80211_hdr	*pwlanhdr;
1156 	u8 MME[_MME_IE_LENGTH_];
1157 	u32 ori_len;
1158 
1159 	mem_start = pframe = (u8 *)(pxmitframe->buf_addr) + TXDESC_OFFSET;
1160 	pwlanhdr = (struct ieee80211_hdr *)pframe;
1161 
1162 	ori_len = BIP_AAD_SIZE+pattrib->pktlen;
1163 	tmp_buf = BIP_AAD = rtw_zmalloc(ori_len);
1164 	subtype = GetFrameSubType(pframe); /* bit(7)~bit(2) */
1165 
1166 	if (!BIP_AAD)
1167 		return _FAIL;
1168 
1169 	spin_lock_bh(&padapter->security_key_mutex);
1170 
1171 	/* only support station mode */
1172 	if (!check_fwstate(pmlmepriv, WIFI_STATION_STATE) || !check_fwstate(pmlmepriv, _FW_LINKED))
1173 		goto xmitframe_coalesce_success;
1174 
1175 	/* IGTK key is not install, it may not support 802.11w */
1176 	if (!padapter->securitypriv.binstallBIPkey)
1177 		goto xmitframe_coalesce_success;
1178 
1179 	/* station mode doesn't need TX BIP, just ready the code */
1180 	if (bmcst) {
1181 		int frame_body_len;
1182 		u8 mic[16];
1183 
1184 		memset(MME, 0, 18);
1185 
1186 		/* other types doesn't need the BIP */
1187 		if (GetFrameSubType(pframe) != WIFI_DEAUTH && GetFrameSubType(pframe) != WIFI_DISASSOC)
1188 			goto xmitframe_coalesce_fail;
1189 
1190 		MGMT_body = pframe + sizeof(struct ieee80211_hdr_3addr);
1191 		pframe += pattrib->pktlen;
1192 
1193 		/* octent 0 and 1 is key index , BIP keyid is 4 or 5, LSB only need octent 0 */
1194 		MME[0] = padapter->securitypriv.dot11wBIPKeyid;
1195 		/* copy packet number */
1196 		memcpy(&MME[2], &pmlmeext->mgnt_80211w_IPN, 6);
1197 		/* increase the packet number */
1198 		pmlmeext->mgnt_80211w_IPN++;
1199 
1200 		/* add MME IE with MIC all zero, MME string doesn't include element id and length */
1201 		pframe = rtw_set_ie(pframe, WLAN_EID_MMIE, 16,
1202 				    MME, &pattrib->pktlen);
1203 		pattrib->last_txcmdsz = pattrib->pktlen;
1204 		/*  total frame length - header length */
1205 		frame_body_len = pattrib->pktlen - sizeof(struct ieee80211_hdr_3addr);
1206 
1207 		/* conscruct AAD, copy frame control field */
1208 		memcpy(BIP_AAD, &pwlanhdr->frame_control, 2);
1209 		ClearRetry(BIP_AAD);
1210 		ClearPwrMgt(BIP_AAD);
1211 		ClearMData(BIP_AAD);
1212 		/* conscruct AAD, copy address 1 to address 3 */
1213 		memcpy(BIP_AAD+2, pwlanhdr->addr1, 18);
1214 		/* copy management fram body */
1215 		memcpy(BIP_AAD+BIP_AAD_SIZE, MGMT_body, frame_body_len);
1216 		/* calculate mic */
1217 		if (omac1_aes_128(padapter->securitypriv.dot11wBIPKey[padapter->securitypriv.dot11wBIPKeyid].skey
1218 			, BIP_AAD, BIP_AAD_SIZE+frame_body_len, mic))
1219 			goto xmitframe_coalesce_fail;
1220 
1221 		/* copy right BIP mic value, total is 128bits, we use the 0~63 bits */
1222 		memcpy(pframe-8, mic, 8);
1223 	} else { /* unicast mgmt frame TX */
1224 		/* start to encrypt mgmt frame */
1225 		if (subtype == WIFI_DEAUTH || subtype == WIFI_DISASSOC ||
1226 			subtype == WIFI_REASSOCREQ || subtype == WIFI_ACTION) {
1227 			if (pattrib->psta)
1228 				psta = pattrib->psta;
1229 			else
1230 				psta = rtw_get_stainfo(&padapter->stapriv, pattrib->ra);
1231 
1232 			if (!psta)
1233 				goto xmitframe_coalesce_fail;
1234 
1235 			if (!(psta->state & _FW_LINKED) || !pxmitframe->buf_addr)
1236 				goto xmitframe_coalesce_fail;
1237 
1238 			/* according 802.11-2012 standard, these five types are not robust types */
1239 			if (subtype == WIFI_ACTION &&
1240 			(pframe[WLAN_HDR_A3_LEN] == RTW_WLAN_CATEGORY_PUBLIC ||
1241 			pframe[WLAN_HDR_A3_LEN] == RTW_WLAN_CATEGORY_HT ||
1242 			pframe[WLAN_HDR_A3_LEN] == RTW_WLAN_CATEGORY_UNPROTECTED_WNM ||
1243 			pframe[WLAN_HDR_A3_LEN] == RTW_WLAN_CATEGORY_SELF_PROTECTED  ||
1244 			pframe[WLAN_HDR_A3_LEN] == RTW_WLAN_CATEGORY_P2P))
1245 				goto xmitframe_coalesce_fail;
1246 			/* before encrypt dump the management packet content */
1247 			if (pattrib->encrypt > 0)
1248 				memcpy(pattrib->dot118021x_UncstKey.skey, psta->dot118021x_UncstKey.skey, 16);
1249 			/* bakeup original management packet */
1250 			memcpy(tmp_buf, pframe, pattrib->pktlen);
1251 			/* move to data portion */
1252 			pframe += pattrib->hdrlen;
1253 
1254 			/* 802.11w unicast management packet must be _AES_ */
1255 			pattrib->iv_len = 8;
1256 			/* it's MIC of AES */
1257 			pattrib->icv_len = 8;
1258 
1259 			switch (pattrib->encrypt) {
1260 			case _AES_:
1261 					/* set AES IV header */
1262 					AES_IV(pattrib->iv, psta->dot11wtxpn, 0);
1263 				break;
1264 			default:
1265 				goto xmitframe_coalesce_fail;
1266 			}
1267 			/* insert iv header into management frame */
1268 			memcpy(pframe, pattrib->iv, pattrib->iv_len);
1269 			pframe += pattrib->iv_len;
1270 			/* copy mgmt data portion after CCMP header */
1271 			memcpy(pframe, tmp_buf+pattrib->hdrlen, pattrib->pktlen-pattrib->hdrlen);
1272 			/* move pframe to end of mgmt pkt */
1273 			pframe += pattrib->pktlen-pattrib->hdrlen;
1274 			/* add 8 bytes CCMP IV header to length */
1275 			pattrib->pktlen += pattrib->iv_len;
1276 			if ((pattrib->icv_len > 0) && (pattrib->bswenc)) {
1277 				memcpy(pframe, pattrib->icv, pattrib->icv_len);
1278 				pframe += pattrib->icv_len;
1279 			}
1280 			/* add 8 bytes MIC */
1281 			pattrib->pktlen += pattrib->icv_len;
1282 			/* set final tx command size */
1283 			pattrib->last_txcmdsz = pattrib->pktlen;
1284 
1285 			/* set protected bit must be beofre SW encrypt */
1286 			SetPrivacy(mem_start);
1287 			/* software encrypt */
1288 			xmitframe_swencrypt(padapter, pxmitframe);
1289 		}
1290 	}
1291 
1292 xmitframe_coalesce_success:
1293 	spin_unlock_bh(&padapter->security_key_mutex);
1294 	kfree(BIP_AAD);
1295 	return _SUCCESS;
1296 
1297 xmitframe_coalesce_fail:
1298 	spin_unlock_bh(&padapter->security_key_mutex);
1299 	kfree(BIP_AAD);
1300 	return _FAIL;
1301 }
1302 
1303 /* Logical Link Control(LLC) SubNetwork Attachment Point(SNAP) header
1304  * IEEE LLC/SNAP header contains 8 octets
1305  * First 3 octets comprise the LLC portion
1306  * SNAP portion, 5 octets, is divided into two fields:
1307  *Organizationally Unique Identifier(OUI), 3 octets,
1308  *type, defined by that organization, 2 octets.
1309  */
1310 s32 rtw_put_snap(u8 *data, u16 h_proto)
1311 {
1312 	struct ieee80211_snap_hdr *snap;
1313 	u8 *oui;
1314 
1315 	snap = (struct ieee80211_snap_hdr *)data;
1316 	snap->dsap = 0xaa;
1317 	snap->ssap = 0xaa;
1318 	snap->ctrl = 0x03;
1319 
1320 	if (h_proto == 0x8137 || h_proto == 0x80f3)
1321 		oui = P802_1H_OUI;
1322 	else
1323 		oui = RFC1042_OUI;
1324 
1325 	snap->oui[0] = oui[0];
1326 	snap->oui[1] = oui[1];
1327 	snap->oui[2] = oui[2];
1328 
1329 	*(__be16 *)(data + SNAP_SIZE) = htons(h_proto);
1330 
1331 	return SNAP_SIZE + sizeof(u16);
1332 }
1333 
1334 void rtw_update_protection(struct adapter *padapter, u8 *ie, uint ie_len)
1335 {
1336 	uint	protection;
1337 	u8 *perp;
1338 	signed int	 erp_len;
1339 	struct	xmit_priv *pxmitpriv = &padapter->xmitpriv;
1340 	struct	registry_priv *pregistrypriv = &padapter->registrypriv;
1341 
1342 	switch (pxmitpriv->vcs_setting) {
1343 	case DISABLE_VCS:
1344 		pxmitpriv->vcs = NONE_VCS;
1345 		break;
1346 
1347 	case ENABLE_VCS:
1348 		break;
1349 
1350 	case AUTO_VCS:
1351 	default:
1352 		perp = rtw_get_ie(ie, WLAN_EID_ERP_INFO, &erp_len, ie_len);
1353 		if (!perp) {
1354 			pxmitpriv->vcs = NONE_VCS;
1355 		} else {
1356 			protection = (*(perp + 2)) & BIT(1);
1357 			if (protection) {
1358 				if (pregistrypriv->vcs_type == RTS_CTS)
1359 					pxmitpriv->vcs = RTS_CTS;
1360 				else
1361 					pxmitpriv->vcs = CTS_TO_SELF;
1362 			} else {
1363 				pxmitpriv->vcs = NONE_VCS;
1364 			}
1365 		}
1366 
1367 		break;
1368 	}
1369 }
1370 
1371 void rtw_count_tx_stats(struct adapter *padapter, struct xmit_frame *pxmitframe, int sz)
1372 {
1373 	struct sta_info *psta = NULL;
1374 	struct stainfo_stats *pstats = NULL;
1375 	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
1376 	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
1377 	u8 pkt_num = 1;
1378 
1379 	if ((pxmitframe->frame_tag&0x0f) == DATA_FRAMETAG) {
1380 		pkt_num = pxmitframe->agg_num;
1381 
1382 		pmlmepriv->LinkDetectInfo.NumTxOkInPeriod += pkt_num;
1383 
1384 		pxmitpriv->tx_pkts += pkt_num;
1385 
1386 		pxmitpriv->tx_bytes += sz;
1387 
1388 		psta = pxmitframe->attrib.psta;
1389 		if (psta) {
1390 			pstats = &psta->sta_stats;
1391 
1392 			pstats->tx_pkts += pkt_num;
1393 
1394 			pstats->tx_bytes += sz;
1395 		}
1396 	}
1397 }
1398 
1399 static struct xmit_buf *__rtw_alloc_cmd_xmitbuf(struct xmit_priv *pxmitpriv,
1400 		enum cmdbuf_type buf_type)
1401 {
1402 	struct xmit_buf *pxmitbuf =  NULL;
1403 
1404 	pxmitbuf = &pxmitpriv->pcmd_xmitbuf[buf_type];
1405 	if (pxmitbuf) {
1406 		pxmitbuf->priv_data = NULL;
1407 
1408 		pxmitbuf->len = 0;
1409 		pxmitbuf->pdata = pxmitbuf->ptail = pxmitbuf->phead;
1410 		pxmitbuf->agg_num = 0;
1411 		pxmitbuf->pg_num = 0;
1412 
1413 		if (pxmitbuf->sctx)
1414 			rtw_sctx_done_err(&pxmitbuf->sctx, RTW_SCTX_DONE_BUF_ALLOC);
1415 	}
1416 
1417 	return pxmitbuf;
1418 }
1419 
1420 struct xmit_frame *__rtw_alloc_cmdxmitframe(struct xmit_priv *pxmitpriv,
1421 		enum cmdbuf_type buf_type)
1422 {
1423 	struct xmit_frame		*pcmdframe;
1424 	struct xmit_buf		*pxmitbuf;
1425 
1426 	pcmdframe = rtw_alloc_xmitframe(pxmitpriv);
1427 	if (!pcmdframe)
1428 		return NULL;
1429 
1430 	pxmitbuf = __rtw_alloc_cmd_xmitbuf(pxmitpriv, buf_type);
1431 	if (!pxmitbuf) {
1432 		rtw_free_xmitframe(pxmitpriv, pcmdframe);
1433 		return NULL;
1434 	}
1435 
1436 	pcmdframe->frame_tag = MGNT_FRAMETAG;
1437 
1438 	pcmdframe->pxmitbuf = pxmitbuf;
1439 
1440 	pcmdframe->buf_addr = pxmitbuf->pbuf;
1441 
1442 	pxmitbuf->priv_data = pcmdframe;
1443 
1444 	return pcmdframe;
1445 }
1446 
1447 struct xmit_buf *rtw_alloc_xmitbuf_ext(struct xmit_priv *pxmitpriv)
1448 {
1449 	unsigned long irqL;
1450 	struct xmit_buf *pxmitbuf =  NULL;
1451 	struct list_head *plist, *phead;
1452 	struct __queue *pfree_queue = &pxmitpriv->free_xmit_extbuf_queue;
1453 
1454 	spin_lock_irqsave(&pfree_queue->lock, irqL);
1455 
1456 	if (list_empty(&pfree_queue->queue)) {
1457 		pxmitbuf = NULL;
1458 	} else {
1459 		phead = get_list_head(pfree_queue);
1460 
1461 		plist = get_next(phead);
1462 
1463 		pxmitbuf = container_of(plist, struct xmit_buf, list);
1464 
1465 		list_del_init(&pxmitbuf->list);
1466 	}
1467 
1468 	if (pxmitbuf) {
1469 		pxmitpriv->free_xmit_extbuf_cnt--;
1470 
1471 		pxmitbuf->priv_data = NULL;
1472 
1473 		pxmitbuf->len = 0;
1474 		pxmitbuf->pdata = pxmitbuf->ptail = pxmitbuf->phead;
1475 		pxmitbuf->agg_num = 1;
1476 
1477 		if (pxmitbuf->sctx)
1478 			rtw_sctx_done_err(&pxmitbuf->sctx, RTW_SCTX_DONE_BUF_ALLOC);
1479 	}
1480 
1481 	spin_unlock_irqrestore(&pfree_queue->lock, irqL);
1482 
1483 	return pxmitbuf;
1484 }
1485 
1486 s32 rtw_free_xmitbuf_ext(struct xmit_priv *pxmitpriv, struct xmit_buf *pxmitbuf)
1487 {
1488 	unsigned long irqL;
1489 	struct __queue *pfree_queue = &pxmitpriv->free_xmit_extbuf_queue;
1490 
1491 	if (!pxmitbuf)
1492 		return _FAIL;
1493 
1494 	spin_lock_irqsave(&pfree_queue->lock, irqL);
1495 
1496 	list_del_init(&pxmitbuf->list);
1497 
1498 	list_add_tail(&pxmitbuf->list, get_list_head(pfree_queue));
1499 	pxmitpriv->free_xmit_extbuf_cnt++;
1500 
1501 	spin_unlock_irqrestore(&pfree_queue->lock, irqL);
1502 
1503 	return _SUCCESS;
1504 }
1505 
1506 struct xmit_buf *rtw_alloc_xmitbuf(struct xmit_priv *pxmitpriv)
1507 {
1508 	unsigned long irqL;
1509 	struct xmit_buf *pxmitbuf =  NULL;
1510 	struct list_head *plist, *phead;
1511 	struct __queue *pfree_xmitbuf_queue = &pxmitpriv->free_xmitbuf_queue;
1512 
1513 	spin_lock_irqsave(&pfree_xmitbuf_queue->lock, irqL);
1514 
1515 	if (list_empty(&pfree_xmitbuf_queue->queue)) {
1516 		pxmitbuf = NULL;
1517 	} else {
1518 		phead = get_list_head(pfree_xmitbuf_queue);
1519 
1520 		plist = get_next(phead);
1521 
1522 		pxmitbuf = container_of(plist, struct xmit_buf, list);
1523 
1524 		list_del_init(&pxmitbuf->list);
1525 	}
1526 
1527 	if (pxmitbuf) {
1528 		pxmitpriv->free_xmitbuf_cnt--;
1529 
1530 		pxmitbuf->priv_data = NULL;
1531 
1532 		pxmitbuf->len = 0;
1533 		pxmitbuf->pdata = pxmitbuf->ptail = pxmitbuf->phead;
1534 		pxmitbuf->agg_num = 0;
1535 		pxmitbuf->pg_num = 0;
1536 
1537 		if (pxmitbuf->sctx)
1538 			rtw_sctx_done_err(&pxmitbuf->sctx, RTW_SCTX_DONE_BUF_ALLOC);
1539 	}
1540 
1541 	spin_unlock_irqrestore(&pfree_xmitbuf_queue->lock, irqL);
1542 
1543 	return pxmitbuf;
1544 }
1545 
1546 s32 rtw_free_xmitbuf(struct xmit_priv *pxmitpriv, struct xmit_buf *pxmitbuf)
1547 {
1548 	unsigned long irqL;
1549 	struct __queue *pfree_xmitbuf_queue = &pxmitpriv->free_xmitbuf_queue;
1550 
1551 	if (!pxmitbuf)
1552 		return _FAIL;
1553 
1554 	if (pxmitbuf->sctx)
1555 		rtw_sctx_done_err(&pxmitbuf->sctx, RTW_SCTX_DONE_BUF_FREE);
1556 
1557 	if (pxmitbuf->buf_tag == XMITBUF_CMD) {
1558 	} else if (pxmitbuf->buf_tag == XMITBUF_MGNT) {
1559 		rtw_free_xmitbuf_ext(pxmitpriv, pxmitbuf);
1560 	} else {
1561 		spin_lock_irqsave(&pfree_xmitbuf_queue->lock, irqL);
1562 
1563 		list_del_init(&pxmitbuf->list);
1564 
1565 		list_add_tail(&pxmitbuf->list,
1566 			      get_list_head(pfree_xmitbuf_queue));
1567 
1568 		pxmitpriv->free_xmitbuf_cnt++;
1569 		spin_unlock_irqrestore(&pfree_xmitbuf_queue->lock, irqL);
1570 	}
1571 	return _SUCCESS;
1572 }
1573 
1574 static void rtw_init_xmitframe(struct xmit_frame *pxframe)
1575 {
1576 	if (pxframe) { /* default value setting */
1577 		pxframe->buf_addr = NULL;
1578 		pxframe->pxmitbuf = NULL;
1579 
1580 		memset(&pxframe->attrib, 0, sizeof(struct pkt_attrib));
1581 
1582 		pxframe->frame_tag = DATA_FRAMETAG;
1583 
1584 		pxframe->pg_num = 1;
1585 		pxframe->agg_num = 1;
1586 		pxframe->ack_report = 0;
1587 	}
1588 }
1589 
1590 /*
1591  * Calling context:
1592  * 1. OS_TXENTRY
1593  * 2. RXENTRY (rx_thread or RX_ISR/RX_CallBack)
1594  *
1595  * If we turn on USE_RXTHREAD, then, no need for critical section.
1596  * Otherwise, we must use _enter/_exit critical to protect free_xmit_queue...
1597  *
1598  * Must be very, very cautious...
1599  */
1600 struct xmit_frame *rtw_alloc_xmitframe(struct xmit_priv *pxmitpriv)/* _queue *pfree_xmit_queue) */
1601 {
1602 	/*
1603 	 *	Please remember to use all the osdep_service api,
1604 	 *	and lock/unlock or _enter/_exit critical to protect
1605 	 *	pfree_xmit_queue
1606 	 */
1607 
1608 	struct xmit_frame *pxframe = NULL;
1609 	struct list_head *plist, *phead;
1610 	struct __queue *pfree_xmit_queue = &pxmitpriv->free_xmit_queue;
1611 
1612 	spin_lock_bh(&pfree_xmit_queue->lock);
1613 
1614 	if (list_empty(&pfree_xmit_queue->queue)) {
1615 		pxframe =  NULL;
1616 	} else {
1617 		phead = get_list_head(pfree_xmit_queue);
1618 
1619 		plist = get_next(phead);
1620 
1621 		pxframe = container_of(plist, struct xmit_frame, list);
1622 
1623 		list_del_init(&pxframe->list);
1624 		pxmitpriv->free_xmitframe_cnt--;
1625 	}
1626 
1627 	spin_unlock_bh(&pfree_xmit_queue->lock);
1628 
1629 	rtw_init_xmitframe(pxframe);
1630 	return pxframe;
1631 }
1632 
1633 struct xmit_frame *rtw_alloc_xmitframe_ext(struct xmit_priv *pxmitpriv)
1634 {
1635 	struct xmit_frame *pxframe = NULL;
1636 	struct list_head *plist, *phead;
1637 	struct __queue *queue = &pxmitpriv->free_xframe_ext_queue;
1638 
1639 	spin_lock_bh(&queue->lock);
1640 
1641 	if (list_empty(&queue->queue)) {
1642 		pxframe =  NULL;
1643 	} else {
1644 		phead = get_list_head(queue);
1645 		plist = get_next(phead);
1646 		pxframe = container_of(plist, struct xmit_frame, list);
1647 
1648 		list_del_init(&pxframe->list);
1649 		pxmitpriv->free_xframe_ext_cnt--;
1650 	}
1651 
1652 	spin_unlock_bh(&queue->lock);
1653 
1654 	rtw_init_xmitframe(pxframe);
1655 
1656 	return pxframe;
1657 }
1658 
1659 struct xmit_frame *rtw_alloc_xmitframe_once(struct xmit_priv *pxmitpriv)
1660 {
1661 	struct xmit_frame *pxframe = NULL;
1662 	u8 *alloc_addr;
1663 
1664 	alloc_addr = rtw_zmalloc(sizeof(struct xmit_frame) + 4);
1665 
1666 	if (!alloc_addr)
1667 		goto exit;
1668 
1669 	pxframe = (struct xmit_frame *)N_BYTE_ALIGMENT((SIZE_PTR)(alloc_addr), 4);
1670 	pxframe->alloc_addr = alloc_addr;
1671 
1672 	pxframe->padapter = pxmitpriv->adapter;
1673 	pxframe->frame_tag = NULL_FRAMETAG;
1674 
1675 	pxframe->pkt = NULL;
1676 
1677 	pxframe->buf_addr = NULL;
1678 	pxframe->pxmitbuf = NULL;
1679 
1680 	rtw_init_xmitframe(pxframe);
1681 
1682 exit:
1683 	return pxframe;
1684 }
1685 
1686 s32 rtw_free_xmitframe(struct xmit_priv *pxmitpriv, struct xmit_frame *pxmitframe)
1687 {
1688 	struct __queue *queue = NULL;
1689 	struct adapter *padapter = pxmitpriv->adapter;
1690 	struct sk_buff *pndis_pkt = NULL;
1691 
1692 	if (!pxmitframe)
1693 		goto exit;
1694 
1695 	if (pxmitframe->pkt) {
1696 		pndis_pkt = pxmitframe->pkt;
1697 		pxmitframe->pkt = NULL;
1698 	}
1699 
1700 	if (pxmitframe->alloc_addr) {
1701 		kfree(pxmitframe->alloc_addr);
1702 		goto check_pkt_complete;
1703 	}
1704 
1705 	if (pxmitframe->ext_tag == 0)
1706 		queue = &pxmitpriv->free_xmit_queue;
1707 	else if (pxmitframe->ext_tag == 1)
1708 		queue = &pxmitpriv->free_xframe_ext_queue;
1709 	else {
1710 	}
1711 
1712 	spin_lock_bh(&queue->lock);
1713 
1714 	list_del_init(&pxmitframe->list);
1715 	list_add_tail(&pxmitframe->list, get_list_head(queue));
1716 	if (pxmitframe->ext_tag == 0)
1717 		pxmitpriv->free_xmitframe_cnt++;
1718 	else if (pxmitframe->ext_tag == 1)
1719 		pxmitpriv->free_xframe_ext_cnt++;
1720 
1721 	spin_unlock_bh(&queue->lock);
1722 
1723 check_pkt_complete:
1724 
1725 	if (pndis_pkt)
1726 		rtw_os_pkt_complete(padapter, pndis_pkt);
1727 
1728 exit:
1729 	return _SUCCESS;
1730 }
1731 
1732 void rtw_free_xmitframe_queue(struct xmit_priv *pxmitpriv, struct __queue *pframequeue)
1733 {
1734 	struct list_head *plist, *phead, *tmp;
1735 	struct	xmit_frame	*pxmitframe;
1736 
1737 	phead = get_list_head(pframequeue);
1738 	list_for_each_safe(plist, tmp, phead) {
1739 		pxmitframe = list_entry(plist, struct xmit_frame, list);
1740 
1741 		rtw_free_xmitframe(pxmitpriv, pxmitframe);
1742 	}
1743 }
1744 
1745 s32 rtw_xmitframe_enqueue(struct adapter *padapter, struct xmit_frame *pxmitframe)
1746 {
1747 	if (rtw_xmit_classifier(padapter, pxmitframe) == _FAIL)
1748 		return _FAIL;
1749 
1750 	return _SUCCESS;
1751 }
1752 
1753 struct tx_servq *rtw_get_sta_pending(struct adapter *padapter, struct sta_info *psta, signed int up, u8 *ac)
1754 {
1755 	struct tx_servq *ptxservq = NULL;
1756 
1757 	switch (up) {
1758 	case 1:
1759 	case 2:
1760 		ptxservq = &psta->sta_xmitpriv.bk_q;
1761 		*(ac) = 3;
1762 		break;
1763 
1764 	case 4:
1765 	case 5:
1766 		ptxservq = &psta->sta_xmitpriv.vi_q;
1767 		*(ac) = 1;
1768 		break;
1769 
1770 	case 6:
1771 	case 7:
1772 		ptxservq = &psta->sta_xmitpriv.vo_q;
1773 		*(ac) = 0;
1774 		break;
1775 
1776 	case 0:
1777 	case 3:
1778 	default:
1779 		ptxservq = &psta->sta_xmitpriv.be_q;
1780 		*(ac) = 2;
1781 	break;
1782 	}
1783 
1784 	return ptxservq;
1785 }
1786 
1787 /*
1788  * Will enqueue pxmitframe to the proper queue,
1789  * and indicate it to xx_pending list.....
1790  */
1791 s32 rtw_xmit_classifier(struct adapter *padapter, struct xmit_frame *pxmitframe)
1792 {
1793 	u8 ac_index;
1794 	struct sta_info *psta;
1795 	struct tx_servq	*ptxservq;
1796 	struct pkt_attrib	*pattrib = &pxmitframe->attrib;
1797 	struct xmit_priv *xmit_priv = &padapter->xmitpriv;
1798 	struct hw_xmit	*phwxmits =  padapter->xmitpriv.hwxmits;
1799 	signed int res = _SUCCESS;
1800 
1801 	psta = rtw_get_stainfo(&padapter->stapriv, pattrib->ra);
1802 	if (pattrib->psta != psta)
1803 		return _FAIL;
1804 
1805 	if (!psta) {
1806 		res = _FAIL;
1807 		goto exit;
1808 	}
1809 
1810 	if (!(psta->state & _FW_LINKED))
1811 		return _FAIL;
1812 
1813 	ptxservq = rtw_get_sta_pending(padapter, psta, pattrib->priority, (u8 *)(&ac_index));
1814 
1815 	spin_lock_bh(&xmit_priv->lock);
1816 	if (list_empty(&ptxservq->tx_pending))
1817 		list_add_tail(&ptxservq->tx_pending, get_list_head(phwxmits[ac_index].sta_queue));
1818 
1819 	list_add_tail(&pxmitframe->list, get_list_head(&ptxservq->sta_pending));
1820 	ptxservq->qcnt++;
1821 	phwxmits[ac_index].accnt++;
1822 	spin_unlock_bh(&xmit_priv->lock);
1823 
1824 exit:
1825 
1826 	return res;
1827 }
1828 
1829 s32 rtw_alloc_hwxmits(struct adapter *padapter)
1830 {
1831 	struct hw_xmit *hwxmits;
1832 	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
1833 
1834 	pxmitpriv->hwxmit_entry = HWXMIT_ENTRY;
1835 
1836 	pxmitpriv->hwxmits = NULL;
1837 
1838 	pxmitpriv->hwxmits = rtw_zmalloc(sizeof(struct hw_xmit) * pxmitpriv->hwxmit_entry);
1839 
1840 	if (!pxmitpriv->hwxmits)
1841 		return _FAIL;
1842 
1843 	hwxmits = pxmitpriv->hwxmits;
1844 
1845 	if (pxmitpriv->hwxmit_entry == 5) {
1846 		hwxmits[0] .sta_queue = &pxmitpriv->bm_pending;
1847 
1848 		hwxmits[1] .sta_queue = &pxmitpriv->vo_pending;
1849 
1850 		hwxmits[2] .sta_queue = &pxmitpriv->vi_pending;
1851 
1852 		hwxmits[3] .sta_queue = &pxmitpriv->bk_pending;
1853 
1854 		hwxmits[4] .sta_queue = &pxmitpriv->be_pending;
1855 	} else if (pxmitpriv->hwxmit_entry == 4) {
1856 		hwxmits[0] .sta_queue = &pxmitpriv->vo_pending;
1857 
1858 		hwxmits[1] .sta_queue = &pxmitpriv->vi_pending;
1859 
1860 		hwxmits[2] .sta_queue = &pxmitpriv->be_pending;
1861 
1862 		hwxmits[3] .sta_queue = &pxmitpriv->bk_pending;
1863 	} else {
1864 	}
1865 
1866 	return _SUCCESS;
1867 }
1868 
1869 void rtw_free_hwxmits(struct adapter *padapter)
1870 {
1871 	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
1872 
1873 	kfree(pxmitpriv->hwxmits);
1874 }
1875 
1876 void rtw_init_hwxmits(struct hw_xmit *phwxmit, signed int entry)
1877 {
1878 	signed int i;
1879 
1880 	for (i = 0; i < entry; i++, phwxmit++)
1881 		phwxmit->accnt = 0;
1882 }
1883 
1884 u32 rtw_get_ff_hwaddr(struct xmit_frame *pxmitframe)
1885 {
1886 	u32 addr;
1887 	struct pkt_attrib *pattrib = &pxmitframe->attrib;
1888 
1889 	switch (pattrib->qsel) {
1890 	case 0:
1891 	case 3:
1892 		addr = BE_QUEUE_INX;
1893 		break;
1894 	case 1:
1895 	case 2:
1896 		addr = BK_QUEUE_INX;
1897 		break;
1898 	case 4:
1899 	case 5:
1900 		addr = VI_QUEUE_INX;
1901 		break;
1902 	case 6:
1903 	case 7:
1904 		addr = VO_QUEUE_INX;
1905 		break;
1906 	case 0x10:
1907 		addr = BCN_QUEUE_INX;
1908 		break;
1909 	case 0x11:/* BC/MC in PS (HIQ) */
1910 		addr = HIGH_QUEUE_INX;
1911 		break;
1912 	case 0x12:
1913 	default:
1914 		addr = MGT_QUEUE_INX;
1915 		break;
1916 	}
1917 
1918 	return addr;
1919 }
1920 
1921 static void do_queue_select(struct adapter	*padapter, struct pkt_attrib *pattrib)
1922 {
1923 	u8 qsel;
1924 
1925 	qsel = pattrib->priority;
1926 
1927 	pattrib->qsel = qsel;
1928 }
1929 
1930 /*
1931  * The main transmit(tx) entry
1932  *
1933  * Return
1934  *1	enqueue
1935  *0	success, hardware will handle this xmit frame(packet)
1936  *<0	fail
1937  */
1938 s32 rtw_xmit(struct adapter *padapter, struct sk_buff **ppkt)
1939 {
1940 	static unsigned long start;
1941 	static u32 drop_cnt;
1942 
1943 	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
1944 	struct xmit_frame *pxmitframe = NULL;
1945 
1946 	s32 res;
1947 
1948 	if (start == 0)
1949 		start = jiffies;
1950 
1951 	pxmitframe = rtw_alloc_xmitframe(pxmitpriv);
1952 
1953 	if (jiffies_to_msecs(jiffies - start) > 2000) {
1954 		start = jiffies;
1955 		drop_cnt = 0;
1956 	}
1957 
1958 	if (!pxmitframe) {
1959 		drop_cnt++;
1960 		return -1;
1961 	}
1962 
1963 	res = update_attrib(padapter, *ppkt, &pxmitframe->attrib);
1964 
1965 	if (res == _FAIL) {
1966 		rtw_free_xmitframe(pxmitpriv, pxmitframe);
1967 		return -1;
1968 	}
1969 	pxmitframe->pkt = *ppkt;
1970 
1971 	do_queue_select(padapter, &pxmitframe->attrib);
1972 
1973 	spin_lock_bh(&pxmitpriv->lock);
1974 	if (xmitframe_enqueue_for_sleeping_sta(padapter, pxmitframe) == true) {
1975 		spin_unlock_bh(&pxmitpriv->lock);
1976 		return 1;
1977 	}
1978 	spin_unlock_bh(&pxmitpriv->lock);
1979 
1980 	/* pre_xmitframe */
1981 	if (rtw_hal_xmit(padapter, pxmitframe) == false)
1982 		return 1;
1983 
1984 	return 0;
1985 }
1986 
1987 #define RTW_HIQ_FILTER_ALLOW_ALL 0
1988 #define RTW_HIQ_FILTER_ALLOW_SPECIAL 1
1989 #define RTW_HIQ_FILTER_DENY_ALL 2
1990 
1991 inline bool xmitframe_hiq_filter(struct xmit_frame *xmitframe)
1992 {
1993 	bool allow = false;
1994 	struct adapter *adapter = xmitframe->padapter;
1995 	struct registry_priv *registry = &adapter->registrypriv;
1996 
1997 	if (registry->hiq_filter == RTW_HIQ_FILTER_ALLOW_SPECIAL) {
1998 		struct pkt_attrib *attrib = &xmitframe->attrib;
1999 
2000 		if (attrib->ether_type == 0x0806 ||
2001 		    attrib->ether_type == 0x888e ||
2002 		    attrib->dhcp_pkt
2003 		)
2004 			allow = true;
2005 
2006 	} else if (registry->hiq_filter == RTW_HIQ_FILTER_ALLOW_ALL)
2007 		allow = true;
2008 	else if (registry->hiq_filter == RTW_HIQ_FILTER_DENY_ALL) {
2009 	} else
2010 		rtw_warn_on(1);
2011 
2012 	return allow;
2013 }
2014 
2015 signed int xmitframe_enqueue_for_sleeping_sta(struct adapter *padapter, struct xmit_frame *pxmitframe)
2016 {
2017 	signed int ret = false;
2018 	struct sta_info *psta = NULL;
2019 	struct sta_priv *pstapriv = &padapter->stapriv;
2020 	struct pkt_attrib *pattrib = &pxmitframe->attrib;
2021 	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2022 	signed int bmcst = IS_MCAST(pattrib->ra);
2023 	bool update_tim = false;
2024 
2025 	if (check_fwstate(pmlmepriv, WIFI_AP_STATE) == false)
2026 		return ret;
2027 	psta = rtw_get_stainfo(&padapter->stapriv, pattrib->ra);
2028 	if (pattrib->psta != psta)
2029 		return false;
2030 
2031 	if (!psta)
2032 		return false;
2033 
2034 	if (!(psta->state & _FW_LINKED))
2035 		return false;
2036 
2037 	if (pattrib->triggered == 1) {
2038 		if (bmcst && xmitframe_hiq_filter(pxmitframe))
2039 			pattrib->qsel = 0x11;/* HIQ */
2040 
2041 		return ret;
2042 	}
2043 
2044 	if (bmcst) {
2045 		spin_lock_bh(&psta->sleep_q.lock);
2046 
2047 		if (pstapriv->sta_dz_bitmap) { /* if anyone sta is in ps mode */
2048 			/* pattrib->qsel = 0x11;HIQ */
2049 
2050 			list_del_init(&pxmitframe->list);
2051 
2052 			list_add_tail(&pxmitframe->list, get_list_head(&psta->sleep_q));
2053 
2054 			psta->sleepq_len++;
2055 
2056 			if (!(pstapriv->tim_bitmap & BIT(0)))
2057 				update_tim = true;
2058 
2059 			pstapriv->tim_bitmap |= BIT(0);
2060 			pstapriv->sta_dz_bitmap |= BIT(0);
2061 
2062 			if (update_tim)
2063 				update_beacon(padapter, WLAN_EID_TIM, NULL, true);
2064 			else
2065 				chk_bmc_sleepq_cmd(padapter);
2066 
2067 			ret = true;
2068 		}
2069 
2070 		spin_unlock_bh(&psta->sleep_q.lock);
2071 
2072 		return ret;
2073 	}
2074 
2075 	spin_lock_bh(&psta->sleep_q.lock);
2076 
2077 	if (psta->state&WIFI_SLEEP_STATE) {
2078 		u8 wmmps_ac = 0;
2079 
2080 		if (pstapriv->sta_dz_bitmap & BIT(psta->aid)) {
2081 			list_del_init(&pxmitframe->list);
2082 
2083 			list_add_tail(&pxmitframe->list, get_list_head(&psta->sleep_q));
2084 
2085 			psta->sleepq_len++;
2086 
2087 			switch (pattrib->priority) {
2088 			case 1:
2089 			case 2:
2090 				wmmps_ac = psta->uapsd_bk&BIT(0);
2091 				break;
2092 			case 4:
2093 			case 5:
2094 				wmmps_ac = psta->uapsd_vi&BIT(0);
2095 				break;
2096 			case 6:
2097 			case 7:
2098 				wmmps_ac = psta->uapsd_vo&BIT(0);
2099 				break;
2100 			case 0:
2101 			case 3:
2102 			default:
2103 				wmmps_ac = psta->uapsd_be&BIT(0);
2104 				break;
2105 			}
2106 
2107 			if (wmmps_ac)
2108 				psta->sleepq_ac_len++;
2109 
2110 			if (((psta->has_legacy_ac) && (!wmmps_ac)) || ((!psta->has_legacy_ac) && (wmmps_ac))) {
2111 				if (!(pstapriv->tim_bitmap & BIT(psta->aid)))
2112 					update_tim = true;
2113 
2114 				pstapriv->tim_bitmap |= BIT(psta->aid);
2115 
2116 				if (update_tim)
2117 					/* update BCN for TIM IE */
2118 					update_beacon(padapter, WLAN_EID_TIM, NULL, true);
2119 			}
2120 
2121 			ret = true;
2122 		}
2123 	}
2124 
2125 	spin_unlock_bh(&psta->sleep_q.lock);
2126 
2127 	return ret;
2128 }
2129 
2130 static void dequeue_xmitframes_to_sleeping_queue(struct adapter *padapter, struct sta_info *psta, struct __queue *pframequeue)
2131 {
2132 	signed int ret;
2133 	struct list_head *plist, *phead, *tmp;
2134 	u8 ac_index;
2135 	struct tx_servq	*ptxservq;
2136 	struct pkt_attrib	*pattrib;
2137 	struct xmit_frame	*pxmitframe;
2138 	struct hw_xmit *phwxmits =  padapter->xmitpriv.hwxmits;
2139 
2140 	phead = get_list_head(pframequeue);
2141 	list_for_each_safe(plist, tmp, phead) {
2142 		pxmitframe = list_entry(plist, struct xmit_frame, list);
2143 
2144 		pattrib = &pxmitframe->attrib;
2145 
2146 		pattrib->triggered = 0;
2147 
2148 		ret = xmitframe_enqueue_for_sleeping_sta(padapter, pxmitframe);
2149 
2150 		if (true == ret) {
2151 			ptxservq = rtw_get_sta_pending(padapter, psta, pattrib->priority, (u8 *)(&ac_index));
2152 
2153 			ptxservq->qcnt--;
2154 			phwxmits[ac_index].accnt--;
2155 		} else {
2156 		}
2157 	}
2158 }
2159 
2160 void stop_sta_xmit(struct adapter *padapter, struct sta_info *psta)
2161 {
2162 	struct sta_info *psta_bmc;
2163 	struct sta_xmit_priv *pstaxmitpriv;
2164 	struct sta_priv *pstapriv = &padapter->stapriv;
2165 	struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
2166 
2167 	pstaxmitpriv = &psta->sta_xmitpriv;
2168 
2169 	/* for BC/MC Frames */
2170 	psta_bmc = rtw_get_bcmc_stainfo(padapter);
2171 
2172 	spin_lock_bh(&pxmitpriv->lock);
2173 
2174 	psta->state |= WIFI_SLEEP_STATE;
2175 
2176 	pstapriv->sta_dz_bitmap |= BIT(psta->aid);
2177 
2178 	dequeue_xmitframes_to_sleeping_queue(padapter, psta, &pstaxmitpriv->vo_q.sta_pending);
2179 	list_del_init(&pstaxmitpriv->vo_q.tx_pending);
2180 
2181 	dequeue_xmitframes_to_sleeping_queue(padapter, psta, &pstaxmitpriv->vi_q.sta_pending);
2182 	list_del_init(&pstaxmitpriv->vi_q.tx_pending);
2183 
2184 	dequeue_xmitframes_to_sleeping_queue(padapter, psta, &pstaxmitpriv->be_q.sta_pending);
2185 	list_del_init(&pstaxmitpriv->be_q.tx_pending);
2186 
2187 	dequeue_xmitframes_to_sleeping_queue(padapter, psta, &pstaxmitpriv->bk_q.sta_pending);
2188 	list_del_init(&pstaxmitpriv->bk_q.tx_pending);
2189 
2190 	/* for BC/MC Frames */
2191 	pstaxmitpriv = &psta_bmc->sta_xmitpriv;
2192 	dequeue_xmitframes_to_sleeping_queue(padapter, psta_bmc, &pstaxmitpriv->be_q.sta_pending);
2193 	list_del_init(&pstaxmitpriv->be_q.tx_pending);
2194 
2195 	spin_unlock_bh(&pxmitpriv->lock);
2196 }
2197 
2198 void wakeup_sta_to_xmit(struct adapter *padapter, struct sta_info *psta)
2199 {
2200 	u8 update_mask = 0, wmmps_ac = 0;
2201 	struct sta_info *psta_bmc;
2202 	struct list_head *xmitframe_plist, *xmitframe_phead, *tmp;
2203 	struct xmit_frame *pxmitframe = NULL;
2204 	struct sta_priv *pstapriv = &padapter->stapriv;
2205 
2206 	psta_bmc = rtw_get_bcmc_stainfo(padapter);
2207 
2208 	spin_lock_bh(&psta->sleep_q.lock);
2209 
2210 	xmitframe_phead = get_list_head(&psta->sleep_q);
2211 	list_for_each_safe(xmitframe_plist, tmp, xmitframe_phead) {
2212 		pxmitframe = list_entry(xmitframe_plist, struct xmit_frame,
2213 					list);
2214 
2215 		list_del_init(&pxmitframe->list);
2216 
2217 		switch (pxmitframe->attrib.priority) {
2218 		case 1:
2219 		case 2:
2220 			wmmps_ac = psta->uapsd_bk&BIT(1);
2221 			break;
2222 		case 4:
2223 		case 5:
2224 			wmmps_ac = psta->uapsd_vi&BIT(1);
2225 			break;
2226 		case 6:
2227 		case 7:
2228 			wmmps_ac = psta->uapsd_vo&BIT(1);
2229 			break;
2230 		case 0:
2231 		case 3:
2232 		default:
2233 			wmmps_ac = psta->uapsd_be&BIT(1);
2234 			break;
2235 		}
2236 
2237 		psta->sleepq_len--;
2238 		if (psta->sleepq_len > 0)
2239 			pxmitframe->attrib.mdata = 1;
2240 		else
2241 			pxmitframe->attrib.mdata = 0;
2242 
2243 		if (wmmps_ac) {
2244 			psta->sleepq_ac_len--;
2245 			if (psta->sleepq_ac_len > 0) {
2246 				pxmitframe->attrib.mdata = 1;
2247 				pxmitframe->attrib.eosp = 0;
2248 			} else {
2249 				pxmitframe->attrib.mdata = 0;
2250 				pxmitframe->attrib.eosp = 1;
2251 			}
2252 		}
2253 
2254 		pxmitframe->attrib.triggered = 1;
2255 
2256 		rtw_hal_xmitframe_enqueue(padapter, pxmitframe);
2257 	}
2258 
2259 	if (psta->sleepq_len == 0) {
2260 		if (pstapriv->tim_bitmap & BIT(psta->aid))
2261 			update_mask = BIT(0);
2262 
2263 		pstapriv->tim_bitmap &= ~BIT(psta->aid);
2264 
2265 		if (psta->state&WIFI_SLEEP_STATE)
2266 			psta->state ^= WIFI_SLEEP_STATE;
2267 
2268 		if (psta->state & WIFI_STA_ALIVE_CHK_STATE) {
2269 			psta->expire_to = pstapriv->expire_to;
2270 			psta->state ^= WIFI_STA_ALIVE_CHK_STATE;
2271 		}
2272 
2273 		pstapriv->sta_dz_bitmap &= ~BIT(psta->aid);
2274 	}
2275 
2276 	/* for BC/MC Frames */
2277 	if (!psta_bmc)
2278 		goto _exit;
2279 
2280 	if ((pstapriv->sta_dz_bitmap&0xfffe) == 0x0) { /* no any sta in ps mode */
2281 		xmitframe_phead = get_list_head(&psta_bmc->sleep_q);
2282 		list_for_each_safe(xmitframe_plist, tmp, xmitframe_phead) {
2283 			pxmitframe = list_entry(xmitframe_plist,
2284 						struct xmit_frame, list);
2285 
2286 			list_del_init(&pxmitframe->list);
2287 
2288 			psta_bmc->sleepq_len--;
2289 			if (psta_bmc->sleepq_len > 0)
2290 				pxmitframe->attrib.mdata = 1;
2291 			else
2292 				pxmitframe->attrib.mdata = 0;
2293 
2294 			pxmitframe->attrib.triggered = 1;
2295 			rtw_hal_xmitframe_enqueue(padapter, pxmitframe);
2296 		}
2297 
2298 		if (psta_bmc->sleepq_len == 0) {
2299 			if (pstapriv->tim_bitmap & BIT(0))
2300 				update_mask |= BIT(1);
2301 
2302 			pstapriv->tim_bitmap &= ~BIT(0);
2303 			pstapriv->sta_dz_bitmap &= ~BIT(0);
2304 		}
2305 	}
2306 
2307 _exit:
2308 
2309 	spin_unlock_bh(&psta->sleep_q.lock);
2310 
2311 	if (update_mask)
2312 		update_beacon(padapter, WLAN_EID_TIM, NULL, true);
2313 }
2314 
2315 void xmit_delivery_enabled_frames(struct adapter *padapter, struct sta_info *psta)
2316 {
2317 	u8 wmmps_ac = 0;
2318 	struct list_head *xmitframe_plist, *xmitframe_phead, *tmp;
2319 	struct xmit_frame *pxmitframe = NULL;
2320 	struct sta_priv *pstapriv = &padapter->stapriv;
2321 
2322 	spin_lock_bh(&psta->sleep_q.lock);
2323 
2324 	xmitframe_phead = get_list_head(&psta->sleep_q);
2325 	list_for_each_safe(xmitframe_plist, tmp, xmitframe_phead) {
2326 		pxmitframe = list_entry(xmitframe_plist, struct xmit_frame,
2327 					list);
2328 
2329 		switch (pxmitframe->attrib.priority) {
2330 		case 1:
2331 		case 2:
2332 			wmmps_ac = psta->uapsd_bk&BIT(1);
2333 			break;
2334 		case 4:
2335 		case 5:
2336 			wmmps_ac = psta->uapsd_vi&BIT(1);
2337 			break;
2338 		case 6:
2339 		case 7:
2340 			wmmps_ac = psta->uapsd_vo&BIT(1);
2341 			break;
2342 		case 0:
2343 		case 3:
2344 		default:
2345 			wmmps_ac = psta->uapsd_be&BIT(1);
2346 			break;
2347 		}
2348 
2349 		if (!wmmps_ac)
2350 			continue;
2351 
2352 		list_del_init(&pxmitframe->list);
2353 
2354 		psta->sleepq_len--;
2355 		psta->sleepq_ac_len--;
2356 
2357 		if (psta->sleepq_ac_len > 0) {
2358 			pxmitframe->attrib.mdata = 1;
2359 			pxmitframe->attrib.eosp = 0;
2360 		} else {
2361 			pxmitframe->attrib.mdata = 0;
2362 			pxmitframe->attrib.eosp = 1;
2363 		}
2364 
2365 		pxmitframe->attrib.triggered = 1;
2366 		rtw_hal_xmitframe_enqueue(padapter, pxmitframe);
2367 
2368 		if ((psta->sleepq_ac_len == 0) && (!psta->has_legacy_ac) && (wmmps_ac)) {
2369 			pstapriv->tim_bitmap &= ~BIT(psta->aid);
2370 
2371 			update_beacon(padapter, WLAN_EID_TIM, NULL, true);
2372 		}
2373 	}
2374 
2375 	spin_unlock_bh(&psta->sleep_q.lock);
2376 }
2377 
2378 void enqueue_pending_xmitbuf(struct xmit_priv *pxmitpriv, struct xmit_buf *pxmitbuf)
2379 {
2380 	struct __queue *pqueue;
2381 	struct adapter *pri_adapter = pxmitpriv->adapter;
2382 
2383 	pqueue = &pxmitpriv->pending_xmitbuf_queue;
2384 
2385 	spin_lock_bh(&pqueue->lock);
2386 	list_del_init(&pxmitbuf->list);
2387 	list_add_tail(&pxmitbuf->list, get_list_head(pqueue));
2388 	spin_unlock_bh(&pqueue->lock);
2389 
2390 	complete(&pri_adapter->xmitpriv.xmit_comp);
2391 }
2392 
2393 void enqueue_pending_xmitbuf_to_head(struct xmit_priv *pxmitpriv, struct xmit_buf *pxmitbuf)
2394 {
2395 	struct __queue *pqueue;
2396 
2397 	pqueue = &pxmitpriv->pending_xmitbuf_queue;
2398 
2399 	spin_lock_bh(&pqueue->lock);
2400 	list_del_init(&pxmitbuf->list);
2401 	list_add(&pxmitbuf->list, get_list_head(pqueue));
2402 	spin_unlock_bh(&pqueue->lock);
2403 }
2404 
2405 struct xmit_buf *dequeue_pending_xmitbuf(struct xmit_priv *pxmitpriv)
2406 {
2407 	struct xmit_buf *pxmitbuf;
2408 	struct __queue *pqueue;
2409 
2410 	pxmitbuf = NULL;
2411 	pqueue = &pxmitpriv->pending_xmitbuf_queue;
2412 
2413 	spin_lock_bh(&pqueue->lock);
2414 
2415 	if (!list_empty(&pqueue->queue)) {
2416 		struct list_head *plist, *phead;
2417 
2418 		phead = get_list_head(pqueue);
2419 		plist = get_next(phead);
2420 		pxmitbuf = container_of(plist, struct xmit_buf, list);
2421 		list_del_init(&pxmitbuf->list);
2422 	}
2423 
2424 	spin_unlock_bh(&pqueue->lock);
2425 
2426 	return pxmitbuf;
2427 }
2428 
2429 struct xmit_buf *dequeue_pending_xmitbuf_under_survey(struct xmit_priv *pxmitpriv)
2430 {
2431 	struct xmit_buf *pxmitbuf;
2432 	struct __queue *pqueue;
2433 
2434 	pxmitbuf = NULL;
2435 	pqueue = &pxmitpriv->pending_xmitbuf_queue;
2436 
2437 	spin_lock_bh(&pqueue->lock);
2438 
2439 	if (!list_empty(&pqueue->queue)) {
2440 		struct list_head *plist, *phead;
2441 		u8 type;
2442 
2443 		phead = get_list_head(pqueue);
2444 		plist = phead;
2445 		do {
2446 			plist = get_next(plist);
2447 			if (plist == phead)
2448 				break;
2449 
2450 			pxmitbuf = container_of(plist, struct xmit_buf, list);
2451 
2452 			type = GetFrameSubType(pxmitbuf->pbuf + TXDESC_OFFSET);
2453 
2454 			if ((type == WIFI_PROBEREQ) ||
2455 				(type == WIFI_DATA_NULL) ||
2456 				(type == WIFI_QOS_DATA_NULL)) {
2457 				list_del_init(&pxmitbuf->list);
2458 				break;
2459 			}
2460 			pxmitbuf = NULL;
2461 		} while (1);
2462 	}
2463 
2464 	spin_unlock_bh(&pqueue->lock);
2465 
2466 	return pxmitbuf;
2467 }
2468 
2469 signed int check_pending_xmitbuf(struct xmit_priv *pxmitpriv)
2470 {
2471 	struct __queue *pqueue;
2472 	signed int	ret = false;
2473 
2474 	pqueue = &pxmitpriv->pending_xmitbuf_queue;
2475 
2476 	spin_lock_bh(&pqueue->lock);
2477 
2478 	if (!list_empty(&pqueue->queue))
2479 		ret = true;
2480 
2481 	spin_unlock_bh(&pqueue->lock);
2482 
2483 	return ret;
2484 }
2485 
2486 int rtw_xmit_thread(void *context)
2487 {
2488 	s32 err;
2489 	struct adapter *padapter;
2490 
2491 	err = _SUCCESS;
2492 	padapter = context;
2493 
2494 	thread_enter("RTW_XMIT_THREAD");
2495 
2496 	do {
2497 		err = rtw_hal_xmit_thread_handler(padapter);
2498 		flush_signals_thread();
2499 	} while (err == _SUCCESS);
2500 
2501 	complete(&padapter->xmitpriv.terminate_xmitthread_comp);
2502 
2503 	return 0;
2504 }
2505 
2506 void rtw_sctx_init(struct submit_ctx *sctx, int timeout_ms)
2507 {
2508 	sctx->timeout_ms = timeout_ms;
2509 	sctx->submit_time = jiffies;
2510 	init_completion(&sctx->done);
2511 	sctx->status = RTW_SCTX_SUBMITTED;
2512 }
2513 
2514 int rtw_sctx_wait(struct submit_ctx *sctx)
2515 {
2516 	int ret = _FAIL;
2517 	unsigned long expire;
2518 	int status = 0;
2519 
2520 	expire = sctx->timeout_ms ? msecs_to_jiffies(sctx->timeout_ms) : MAX_SCHEDULE_TIMEOUT;
2521 	if (!wait_for_completion_timeout(&sctx->done, expire))
2522 		/* timeout, do something?? */
2523 		status = RTW_SCTX_DONE_TIMEOUT;
2524 	else
2525 		status = sctx->status;
2526 
2527 	if (status == RTW_SCTX_DONE_SUCCESS)
2528 		ret = _SUCCESS;
2529 
2530 	return ret;
2531 }
2532 
2533 void rtw_sctx_done_err(struct submit_ctx **sctx, int status)
2534 {
2535 	if (*sctx) {
2536 		(*sctx)->status = status;
2537 		complete(&((*sctx)->done));
2538 		*sctx = NULL;
2539 	}
2540 }
2541 
2542 void rtw_sctx_done(struct submit_ctx **sctx)
2543 {
2544 	rtw_sctx_done_err(sctx, RTW_SCTX_DONE_SUCCESS);
2545 }
2546 
2547 int rtw_ack_tx_wait(struct xmit_priv *pxmitpriv, u32 timeout_ms)
2548 {
2549 	struct submit_ctx *pack_tx_ops = &pxmitpriv->ack_tx_ops;
2550 
2551 	pack_tx_ops->submit_time = jiffies;
2552 	pack_tx_ops->timeout_ms = timeout_ms;
2553 	pack_tx_ops->status = RTW_SCTX_SUBMITTED;
2554 
2555 	return rtw_sctx_wait(pack_tx_ops);
2556 }
2557 
2558 void rtw_ack_tx_done(struct xmit_priv *pxmitpriv, int status)
2559 {
2560 	struct submit_ctx *pack_tx_ops = &pxmitpriv->ack_tx_ops;
2561 
2562 	if (pxmitpriv->ack_tx)
2563 		rtw_sctx_done_err(&pack_tx_ops, status);
2564 }
2565