1/******************************************************************************
2
3  Copyright(c) 2003 - 2004 Intel Corporation. All rights reserved.
4
5  This program is free software; you can redistribute it and/or modify it
6  under the terms of version 2 of the GNU General Public License as
7  published by the Free Software Foundation.
8
9  This program is distributed in the hope that it will be useful, but WITHOUT
10  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
12  more details.
13
14  You should have received a copy of the GNU General Public License along with
15  this program; if not, write to the Free Software Foundation, Inc., 59
16  Temple Place - Suite 330, Boston, MA  02111-1307, USA.
17
18  The full GNU General Public License is included in this distribution in the
19  file called LICENSE.
20
21  Contact Information:
22  James P. Ketrenos <ipw2100-admin@linux.intel.com>
23  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
24
25******************************************************************************
26
27  Few modifications for Realtek's Wi-Fi drivers by
28  Andrea Merello <andrea.merello@gmail.com>
29
30  A special thanks goes to Realtek for their support !
31
32******************************************************************************/
33
34#include <linux/compiler.h>
35#include <linux/errno.h>
36#include <linux/if_arp.h>
37#include <linux/in6.h>
38#include <linux/in.h>
39#include <linux/ip.h>
40#include <linux/kernel.h>
41#include <linux/module.h>
42#include <linux/netdevice.h>
43#include <linux/pci.h>
44#include <linux/proc_fs.h>
45#include <linux/skbuff.h>
46#include <linux/slab.h>
47#include <linux/tcp.h>
48#include <linux/types.h>
49#include <linux/wireless.h>
50#include <linux/etherdevice.h>
51#include <linux/uaccess.h>
52#include <linux/if_vlan.h>
53
54#include "rtllib.h"
55
56/* 802.11 Data Frame
57 *
58 *
59 * 802.11 frame_control for data frames - 2 bytes
60 *      ,-----------------------------------------------------------------------------------------.
61 * bits | 0  |  1  |  2  |  3  |  4  |  5  |  6  |  7  |  8  |  9  |  a  |  b  |  c  |  d  |  e   |
62 *      |----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|------|
63 * val  | 0  |  0  |  0  |  1  |  x  |  0  |  0  |  0  |  1  |  0  |  x  |  x  |  x  |  x  |  x   |
64 *      |----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|------|
65 * desc | ^-ver-^  |  ^type-^  |  ^-----subtype-----^  | to  |from |more |retry| pwr |more |wep   |
66 *      |          |           | x=0 data,x=1 data+ack | DS  | DS  |frag |     | mgm |data |      |
67 *      '-----------------------------------------------------------------------------------------'
68 *                                                   /\
69 *                                                   |
70 * 802.11 Data Frame                                 |
71 *          ,--------- 'ctrl' expands to >-----------'
72 *          |
73 *       ,--'---,-------------------------------------------------------------.
74 * Bytes |  2   |  2   |    6    |    6    |    6    |  2   | 0..2312 |   4  |
75 *       |------|------|---------|---------|---------|------|---------|------|
76 * Desc. | ctrl | dura |  DA/RA  |   TA    |    SA   | Sequ |  Frame  |  fcs |
77 *       |      | tion | (BSSID) |         |         | ence |  data   |      |
78 *       `--------------------------------------------------|         |------'
79 * Total: 28 non-data bytes                                 `----.----'
80 *                                                               |
81 *        .- 'Frame data' expands to <---------------------------'
82 *        |
83 *        V
84 *       ,---------------------------------------------------.
85 * Bytes |  1   |  1   |    1    |    3     |  2   |  0-2304 |
86 *       |------|------|---------|----------|------|---------|
87 * Desc. | SNAP | SNAP | Control |Eth Tunnel| Type | IP      |
88 *       | DSAP | SSAP |         |          |      | Packet  |
89 *       | 0xAA | 0xAA |0x03 (UI)|0x00-00-F8|      |         |
90 *       `-----------------------------------------|         |
91 * Total: 8 non-data bytes                         `----.----'
92 *                                                      |
93 *        .- 'IP Packet' expands, if WEP enabled, to <--'
94 *        |
95 *        V
96 *       ,-----------------------.
97 * Bytes |  4  |   0-2296  |  4  |
98 *       |-----|-----------|-----|
99 * Desc. | IV  | Encrypted | ICV |
100 *       |     | IP Packet |     |
101 *       `-----------------------'
102 * Total: 8 non-data bytes
103 *
104 *
105 * 802.3 Ethernet Data Frame
106 *
107 *       ,-----------------------------------------.
108 * Bytes |   6   |   6   |  2   |  Variable |   4  |
109 *       |-------|-------|------|-----------|------|
110 * Desc. | Dest. | Source| Type | IP Packet |  fcs |
111 *       |  MAC  |  MAC  |      |	   |      |
112 *       `-----------------------------------------'
113 * Total: 18 non-data bytes
114 *
115 * In the event that fragmentation is required, the incoming payload is split into
116 * N parts of size ieee->fts.  The first fragment contains the SNAP header and the
117 * remaining packets are just data.
118 *
119 * If encryption is enabled, each fragment payload size is reduced by enough space
120 * to add the prefix and postfix (IV and ICV totalling 8 bytes in the case of WEP)
121 * So if you have 1500 bytes of payload with ieee->fts set to 500 without
122 * encryption it will take 3 frames.  With WEP it will take 4 frames as the
123 * payload of each frame is reduced to 492 bytes.
124 *
125 * SKB visualization
126 *
127 * ,- skb->data
128 * |
129 * |    ETHERNET HEADER        ,-<-- PAYLOAD
130 * |                           |     14 bytes from skb->data
131 * |  2 bytes for Type --> ,T. |     (sizeof ethhdr)
132 * |                       | | |
133 * |,-Dest.--. ,--Src.---. | | |
134 * |  6 bytes| | 6 bytes | | | |
135 * v         | |         | | | |
136 * 0         | v       1 | v | v           2
137 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
138 *     ^     | ^         | ^ |
139 *     |     | |         | | |
140 *     |     | |         | `T' <---- 2 bytes for Type
141 *     |     | |         |
142 *     |     | '---SNAP--' <-------- 6 bytes for SNAP
143 *     |     |
144 *     `-IV--' <-------------------- 4 bytes for IV (WEP)
145 *
146 *      SNAP HEADER
147 *
148 */
149
150static u8 P802_1H_OUI[P80211_OUI_LEN] = { 0x00, 0x00, 0xf8 };
151static u8 RFC1042_OUI[P80211_OUI_LEN] = { 0x00, 0x00, 0x00 };
152
153inline int rtllib_put_snap(u8 *data, u16 h_proto)
154{
155	struct rtllib_snap_hdr *snap;
156	u8 *oui;
157
158	snap = (struct rtllib_snap_hdr *)data;
159	snap->dsap = 0xaa;
160	snap->ssap = 0xaa;
161	snap->ctrl = 0x03;
162
163	if (h_proto == 0x8137 || h_proto == 0x80f3)
164		oui = P802_1H_OUI;
165	else
166		oui = RFC1042_OUI;
167	snap->oui[0] = oui[0];
168	snap->oui[1] = oui[1];
169	snap->oui[2] = oui[2];
170
171	*(__be16 *)(data + SNAP_SIZE) = htons(h_proto);
172
173	return SNAP_SIZE + sizeof(u16);
174}
175
176int rtllib_encrypt_fragment(struct rtllib_device *ieee, struct sk_buff *frag,
177			    int hdr_len)
178{
179	struct lib80211_crypt_data *crypt = NULL;
180	int res;
181
182	crypt = ieee->crypt_info.crypt[ieee->crypt_info.tx_keyidx];
183
184	if (!(crypt && crypt->ops)) {
185		netdev_info(ieee->dev, "=========>%s(), crypt is null\n",
186			    __func__);
187		return -1;
188	}
189	/* To encrypt, frame format is:
190	 * IV (4 bytes), clear payload (including SNAP), ICV (4 bytes)
191	 */
192
193	/* Host-based IEEE 802.11 fragmentation for TX is not yet supported, so
194	 * call both MSDU and MPDU encryption functions from here.
195	 */
196	atomic_inc(&crypt->refcnt);
197	res = 0;
198	if (crypt->ops->encrypt_msdu)
199		res = crypt->ops->encrypt_msdu(frag, hdr_len, crypt->priv);
200	if (res == 0 && crypt->ops->encrypt_mpdu)
201		res = crypt->ops->encrypt_mpdu(frag, hdr_len, crypt->priv);
202
203	atomic_dec(&crypt->refcnt);
204	if (res < 0) {
205		netdev_info(ieee->dev, "%s: Encryption failed: len=%d.\n",
206			    ieee->dev->name, frag->len);
207		ieee->ieee_stats.tx_discards++;
208		return -1;
209	}
210
211	return 0;
212}
213
214
215void rtllib_txb_free(struct rtllib_txb *txb)
216{
217	if (unlikely(!txb))
218		return;
219	kfree(txb);
220}
221
222static struct rtllib_txb *rtllib_alloc_txb(int nr_frags, int txb_size,
223					   gfp_t gfp_mask)
224{
225	struct rtllib_txb *txb;
226	int i;
227
228	txb = kmalloc(sizeof(struct rtllib_txb) + (sizeof(u8 *) * nr_frags),
229		      gfp_mask);
230	if (!txb)
231		return NULL;
232
233	memset(txb, 0, sizeof(struct rtllib_txb));
234	txb->nr_frags = nr_frags;
235	txb->frag_size = cpu_to_le16(txb_size);
236
237	for (i = 0; i < nr_frags; i++) {
238		txb->fragments[i] = dev_alloc_skb(txb_size);
239		if (unlikely(!txb->fragments[i])) {
240			i--;
241			break;
242		}
243		memset(txb->fragments[i]->cb, 0, sizeof(txb->fragments[i]->cb));
244	}
245	if (unlikely(i != nr_frags)) {
246		while (i >= 0)
247			dev_kfree_skb_any(txb->fragments[i--]);
248		kfree(txb);
249		return NULL;
250	}
251	return txb;
252}
253
254static int rtllib_classify(struct sk_buff *skb, u8 bIsAmsdu)
255{
256	struct ethhdr *eth;
257	struct iphdr *ip;
258
259	eth = (struct ethhdr *)skb->data;
260	if (eth->h_proto != htons(ETH_P_IP))
261		return 0;
262
263	RTLLIB_DEBUG_DATA(RTLLIB_DL_DATA, skb->data, skb->len);
264	ip = ip_hdr(skb);
265	switch (ip->tos & 0xfc) {
266	case 0x20:
267		return 2;
268	case 0x40:
269		return 1;
270	case 0x60:
271		return 3;
272	case 0x80:
273		return 4;
274	case 0xa0:
275		return 5;
276	case 0xc0:
277		return 6;
278	case 0xe0:
279		return 7;
280	default:
281		return 0;
282	}
283}
284
285static void rtllib_tx_query_agg_cap(struct rtllib_device *ieee,
286				    struct sk_buff *skb,
287				    struct cb_desc *tcb_desc)
288{
289	struct rt_hi_throughput *pHTInfo = ieee->pHTInfo;
290	struct tx_ts_record *pTxTs = NULL;
291	struct rtllib_hdr_1addr *hdr = (struct rtllib_hdr_1addr *)skb->data;
292
293	if (rtllib_act_scanning(ieee, false))
294		return;
295
296	if (!pHTInfo->bCurrentHTSupport || !pHTInfo->bEnableHT)
297		return;
298	if (!IsQoSDataFrame(skb->data))
299		return;
300	if (is_multicast_ether_addr(hdr->addr1))
301		return;
302
303	if (tcb_desc->bdhcp || ieee->CntAfterLink < 2)
304		return;
305
306	if (pHTInfo->IOTAction & HT_IOT_ACT_TX_NO_AGGREGATION)
307		return;
308
309	if (!ieee->GetNmodeSupportBySecCfg(ieee->dev))
310		return;
311	if (pHTInfo->bCurrentAMPDUEnable) {
312		if (!GetTs(ieee, (struct ts_common_info **)(&pTxTs), hdr->addr1,
313		    skb->priority, TX_DIR, true)) {
314			netdev_info(ieee->dev, "%s: can't get TS\n", __func__);
315			return;
316		}
317		if (pTxTs->TxAdmittedBARecord.bValid == false) {
318			if (ieee->wpa_ie_len && (ieee->pairwise_key_type ==
319			    KEY_TYPE_NA)) {
320				;
321			} else if (tcb_desc->bdhcp == 1) {
322				;
323			} else if (!pTxTs->bDisable_AddBa) {
324				TsStartAddBaProcess(ieee, pTxTs);
325			}
326			goto FORCED_AGG_SETTING;
327		} else if (pTxTs->bUsingBa == false) {
328			if (SN_LESS(pTxTs->TxAdmittedBARecord.BaStartSeqCtrl.field.SeqNum,
329			   (pTxTs->TxCurSeq+1)%4096))
330				pTxTs->bUsingBa = true;
331			else
332				goto FORCED_AGG_SETTING;
333		}
334		if (ieee->iw_mode == IW_MODE_INFRA) {
335			tcb_desc->bAMPDUEnable = true;
336			tcb_desc->ampdu_factor = pHTInfo->CurrentAMPDUFactor;
337			tcb_desc->ampdu_density = pHTInfo->CurrentMPDUDensity;
338		}
339	}
340FORCED_AGG_SETTING:
341	switch (pHTInfo->ForcedAMPDUMode) {
342	case HT_AGG_AUTO:
343		break;
344
345	case HT_AGG_FORCE_ENABLE:
346		tcb_desc->bAMPDUEnable = true;
347		tcb_desc->ampdu_density = pHTInfo->ForcedMPDUDensity;
348		tcb_desc->ampdu_factor = pHTInfo->ForcedAMPDUFactor;
349		break;
350
351	case HT_AGG_FORCE_DISABLE:
352		tcb_desc->bAMPDUEnable = false;
353		tcb_desc->ampdu_density = 0;
354		tcb_desc->ampdu_factor = 0;
355		break;
356	}
357}
358
359static void rtllib_qurey_ShortPreambleMode(struct rtllib_device *ieee,
360					   struct cb_desc *tcb_desc)
361{
362	tcb_desc->bUseShortPreamble = false;
363	if (tcb_desc->data_rate == 2)
364		return;
365	else if (ieee->current_network.capability &
366		 WLAN_CAPABILITY_SHORT_PREAMBLE)
367		tcb_desc->bUseShortPreamble = true;
368}
369
370static void rtllib_query_HTCapShortGI(struct rtllib_device *ieee,
371				      struct cb_desc *tcb_desc)
372{
373	struct rt_hi_throughput *pHTInfo = ieee->pHTInfo;
374
375	tcb_desc->bUseShortGI		= false;
376
377	if (!pHTInfo->bCurrentHTSupport || !pHTInfo->bEnableHT)
378		return;
379
380	if (pHTInfo->bForcedShortGI) {
381		tcb_desc->bUseShortGI = true;
382		return;
383	}
384
385	if ((pHTInfo->bCurBW40MHz == true) && pHTInfo->bCurShortGI40MHz)
386		tcb_desc->bUseShortGI = true;
387	else if ((pHTInfo->bCurBW40MHz == false) && pHTInfo->bCurShortGI20MHz)
388		tcb_desc->bUseShortGI = true;
389}
390
391static void rtllib_query_BandwidthMode(struct rtllib_device *ieee,
392				       struct cb_desc *tcb_desc)
393{
394	struct rt_hi_throughput *pHTInfo = ieee->pHTInfo;
395
396	tcb_desc->bPacketBW = false;
397
398	if (!pHTInfo->bCurrentHTSupport || !pHTInfo->bEnableHT)
399		return;
400
401	if (tcb_desc->bMulticast || tcb_desc->bBroadcast)
402		return;
403
404	if ((tcb_desc->data_rate & 0x80) == 0)
405		return;
406	if (pHTInfo->bCurBW40MHz && pHTInfo->bCurTxBW40MHz &&
407	    !ieee->bandwidth_auto_switch.bforced_tx20Mhz)
408		tcb_desc->bPacketBW = true;
409}
410
411static void rtllib_query_protectionmode(struct rtllib_device *ieee,
412					struct cb_desc *tcb_desc,
413					struct sk_buff *skb)
414{
415	struct rt_hi_throughput *pHTInfo;
416
417	tcb_desc->bRTSSTBC			= false;
418	tcb_desc->bRTSUseShortGI		= false;
419	tcb_desc->bCTSEnable			= false;
420	tcb_desc->RTSSC				= 0;
421	tcb_desc->bRTSBW			= false;
422
423	if (tcb_desc->bBroadcast || tcb_desc->bMulticast)
424		return;
425
426	if (is_broadcast_ether_addr(skb->data+16))
427		return;
428
429	if (ieee->mode < IEEE_N_24G) {
430		if (skb->len > ieee->rts) {
431			tcb_desc->bRTSEnable = true;
432			tcb_desc->rts_rate = MGN_24M;
433		} else if (ieee->current_network.buseprotection) {
434			tcb_desc->bRTSEnable = true;
435			tcb_desc->bCTSEnable = true;
436			tcb_desc->rts_rate = MGN_24M;
437		}
438		return;
439	}
440
441	pHTInfo = ieee->pHTInfo;
442
443	while (true) {
444		if (pHTInfo->IOTAction & HT_IOT_ACT_FORCED_CTS2SELF) {
445			tcb_desc->bCTSEnable	= true;
446			tcb_desc->rts_rate  =	MGN_24M;
447			tcb_desc->bRTSEnable = true;
448			break;
449		} else if (pHTInfo->IOTAction & (HT_IOT_ACT_FORCED_RTS |
450			   HT_IOT_ACT_PURE_N_MODE)) {
451			tcb_desc->bRTSEnable = true;
452			tcb_desc->rts_rate  =	MGN_24M;
453			break;
454		}
455		if (ieee->current_network.buseprotection) {
456			tcb_desc->bRTSEnable = true;
457			tcb_desc->bCTSEnable = true;
458			tcb_desc->rts_rate = MGN_24M;
459			break;
460		}
461		if (pHTInfo->bCurrentHTSupport  && pHTInfo->bEnableHT) {
462			u8 HTOpMode = pHTInfo->CurrentOpMode;
463
464			if ((pHTInfo->bCurBW40MHz && (HTOpMode == 2 ||
465			     HTOpMode == 3)) ||
466			     (!pHTInfo->bCurBW40MHz && HTOpMode == 3)) {
467				tcb_desc->rts_rate = MGN_24M;
468				tcb_desc->bRTSEnable = true;
469				break;
470			}
471		}
472		if (skb->len > ieee->rts) {
473			tcb_desc->rts_rate = MGN_24M;
474			tcb_desc->bRTSEnable = true;
475			break;
476		}
477		if (tcb_desc->bAMPDUEnable) {
478			tcb_desc->rts_rate = MGN_24M;
479			tcb_desc->bRTSEnable = false;
480			break;
481		}
482		goto NO_PROTECTION;
483	}
484	if (ieee->current_network.capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
485		tcb_desc->bUseShortPreamble = true;
486	if (ieee->iw_mode == IW_MODE_MASTER)
487			goto NO_PROTECTION;
488	return;
489NO_PROTECTION:
490	tcb_desc->bRTSEnable	= false;
491	tcb_desc->bCTSEnable	= false;
492	tcb_desc->rts_rate	= 0;
493	tcb_desc->RTSSC		= 0;
494	tcb_desc->bRTSBW	= false;
495}
496
497
498static void rtllib_txrate_selectmode(struct rtllib_device *ieee,
499				     struct cb_desc *tcb_desc)
500{
501	if (ieee->bTxDisableRateFallBack)
502		tcb_desc->bTxDisableRateFallBack = true;
503
504	if (ieee->bTxUseDriverAssingedRate)
505		tcb_desc->bTxUseDriverAssingedRate = true;
506	if (!tcb_desc->bTxDisableRateFallBack ||
507	    !tcb_desc->bTxUseDriverAssingedRate) {
508		if (ieee->iw_mode == IW_MODE_INFRA ||
509		    ieee->iw_mode == IW_MODE_ADHOC)
510			tcb_desc->RATRIndex = 0;
511	}
512}
513
514u16 rtllib_query_seqnum(struct rtllib_device *ieee, struct sk_buff *skb,
515			u8 *dst)
516{
517	u16 seqnum = 0;
518
519	if (is_multicast_ether_addr(dst))
520		return 0;
521	if (IsQoSDataFrame(skb->data)) {
522		struct tx_ts_record *pTS = NULL;
523
524		if (!GetTs(ieee, (struct ts_common_info **)(&pTS), dst,
525		    skb->priority, TX_DIR, true))
526			return 0;
527		seqnum = pTS->TxCurSeq;
528		pTS->TxCurSeq = (pTS->TxCurSeq+1)%4096;
529		return seqnum;
530	}
531	return 0;
532}
533
534static int wme_downgrade_ac(struct sk_buff *skb)
535{
536	switch (skb->priority) {
537	case 6:
538	case 7:
539		skb->priority = 5; /* VO -> VI */
540		return 0;
541	case 4:
542	case 5:
543		skb->priority = 3; /* VI -> BE */
544		return 0;
545	case 0:
546	case 3:
547		skb->priority = 1; /* BE -> BK */
548		return 0;
549	default:
550		return -1;
551	}
552}
553
554static u8 rtllib_current_rate(struct rtllib_device *ieee)
555{
556	if (ieee->mode & IEEE_MODE_MASK)
557		return ieee->rate;
558
559	if (ieee->HTCurrentOperaRate)
560		return ieee->HTCurrentOperaRate;
561	else
562		return ieee->rate & 0x7F;
563}
564
565int rtllib_xmit_inter(struct sk_buff *skb, struct net_device *dev)
566{
567	struct rtllib_device *ieee = (struct rtllib_device *)
568				     netdev_priv_rsl(dev);
569	struct rtllib_txb *txb = NULL;
570	struct rtllib_hdr_3addrqos *frag_hdr;
571	int i, bytes_per_frag, nr_frags, bytes_last_frag, frag_size;
572	unsigned long flags;
573	struct net_device_stats *stats = &ieee->stats;
574	int ether_type = 0, encrypt;
575	int bytes, fc, qos_ctl = 0, hdr_len;
576	struct sk_buff *skb_frag;
577	struct rtllib_hdr_3addrqos header = { /* Ensure zero initialized */
578		.duration_id = 0,
579		.seq_ctl = 0,
580		.qos_ctl = 0
581	};
582	u8 dest[ETH_ALEN], src[ETH_ALEN];
583	int qos_actived = ieee->current_network.qos_data.active;
584	struct lib80211_crypt_data *crypt = NULL;
585	struct cb_desc *tcb_desc;
586	u8 bIsMulticast = false;
587	u8 IsAmsdu = false;
588	bool	bdhcp = false;
589
590	spin_lock_irqsave(&ieee->lock, flags);
591
592	/* If there is no driver handler to take the TXB, don't bother
593	 * creating it...
594	 */
595	if ((!ieee->hard_start_xmit && !(ieee->softmac_features &
596	   IEEE_SOFTMAC_TX_QUEUE)) ||
597	   ((!ieee->softmac_data_hard_start_xmit &&
598	   (ieee->softmac_features & IEEE_SOFTMAC_TX_QUEUE)))) {
599		netdev_warn(ieee->dev, "No xmit handler.\n");
600		goto success;
601	}
602
603
604	if (likely(ieee->raw_tx == 0)) {
605		if (unlikely(skb->len < SNAP_SIZE + sizeof(u16))) {
606			netdev_warn(ieee->dev, "skb too small (%d).\n",
607				    skb->len);
608			goto success;
609		}
610		/* Save source and destination addresses */
611		memcpy(dest, skb->data, ETH_ALEN);
612		memcpy(src, skb->data+ETH_ALEN, ETH_ALEN);
613
614		memset(skb->cb, 0, sizeof(skb->cb));
615		ether_type = ntohs(((struct ethhdr *)skb->data)->h_proto);
616
617		if (ieee->iw_mode == IW_MODE_MONITOR) {
618			txb = rtllib_alloc_txb(1, skb->len, GFP_ATOMIC);
619			if (unlikely(!txb)) {
620				netdev_warn(ieee->dev,
621					    "Could not allocate TXB\n");
622				goto failed;
623			}
624
625			txb->encrypted = 0;
626			txb->payload_size = cpu_to_le16(skb->len);
627			memcpy(skb_put(txb->fragments[0], skb->len), skb->data,
628			       skb->len);
629
630			goto success;
631		}
632
633		if (skb->len > 282) {
634			if (ETH_P_IP == ether_type) {
635				const struct iphdr *ip = (struct iphdr *)
636					((u8 *)skb->data+14);
637				if (IPPROTO_UDP == ip->protocol) {
638					struct udphdr *udp;
639
640					udp = (struct udphdr *)((u8 *)ip +
641					      (ip->ihl << 2));
642					if (((((u8 *)udp)[1] == 68) &&
643					   (((u8 *)udp)[3] == 67)) ||
644					   ((((u8 *)udp)[1] == 67) &&
645					   (((u8 *)udp)[3] == 68))) {
646						bdhcp = true;
647						ieee->LPSDelayCnt = 200;
648					}
649				}
650			} else if (ETH_P_ARP == ether_type) {
651				netdev_info(ieee->dev,
652					    "=================>DHCP Protocol start tx ARP pkt!!\n");
653				bdhcp = true;
654				ieee->LPSDelayCnt =
655					 ieee->current_network.tim.tim_count;
656			}
657		}
658
659		skb->priority = rtllib_classify(skb, IsAmsdu);
660		crypt = ieee->crypt_info.crypt[ieee->crypt_info.tx_keyidx];
661		encrypt = !(ether_type == ETH_P_PAE && ieee->ieee802_1x) &&
662			ieee->host_encrypt && crypt && crypt->ops;
663		if (!encrypt && ieee->ieee802_1x &&
664		    ieee->drop_unencrypted && ether_type != ETH_P_PAE) {
665			stats->tx_dropped++;
666			goto success;
667		}
668		if (crypt && !encrypt && ether_type == ETH_P_PAE) {
669			struct eapol *eap = (struct eapol *)(skb->data +
670				sizeof(struct ethhdr) - SNAP_SIZE -
671				sizeof(u16));
672			RTLLIB_DEBUG_EAP("TX: IEEE 802.11 EAPOL frame: %s\n",
673				eap_get_type(eap->type));
674		}
675
676		/* Advance the SKB to the start of the payload */
677		skb_pull(skb, sizeof(struct ethhdr));
678
679		/* Determine total amount of storage required for TXB packets */
680		bytes = skb->len + SNAP_SIZE + sizeof(u16);
681
682		if (encrypt)
683			fc = RTLLIB_FTYPE_DATA | RTLLIB_FCTL_WEP;
684		else
685			fc = RTLLIB_FTYPE_DATA;
686
687		if (qos_actived)
688			fc |= RTLLIB_STYPE_QOS_DATA;
689		else
690			fc |= RTLLIB_STYPE_DATA;
691
692		if (ieee->iw_mode == IW_MODE_INFRA) {
693			fc |= RTLLIB_FCTL_TODS;
694			/* To DS: Addr1 = BSSID, Addr2 = SA,
695			 * Addr3 = DA
696			 */
697			memcpy(&header.addr1, ieee->current_network.bssid,
698			       ETH_ALEN);
699			memcpy(&header.addr2, &src, ETH_ALEN);
700			if (IsAmsdu)
701				memcpy(&header.addr3,
702				       ieee->current_network.bssid, ETH_ALEN);
703			else
704				memcpy(&header.addr3, &dest, ETH_ALEN);
705		} else if (ieee->iw_mode == IW_MODE_ADHOC) {
706			/* not From/To DS: Addr1 = DA, Addr2 = SA,
707			 * Addr3 = BSSID
708			 */
709			memcpy(&header.addr1, dest, ETH_ALEN);
710			memcpy(&header.addr2, src, ETH_ALEN);
711			memcpy(&header.addr3, ieee->current_network.bssid,
712			       ETH_ALEN);
713		}
714
715		bIsMulticast = is_multicast_ether_addr(header.addr1);
716
717		header.frame_ctl = cpu_to_le16(fc);
718
719		/* Determine fragmentation size based on destination (multicast
720		 * and broadcast are not fragmented)
721		 */
722		if (bIsMulticast) {
723			frag_size = MAX_FRAG_THRESHOLD;
724			qos_ctl |= QOS_CTL_NOTCONTAIN_ACK;
725		} else {
726			frag_size = ieee->fts;
727			qos_ctl = 0;
728		}
729
730		if (qos_actived) {
731			hdr_len = RTLLIB_3ADDR_LEN + 2;
732
733		/* in case we are a client verify acm is not set for this ac */
734		while (unlikely(ieee->wmm_acm & (0x01 << skb->priority))) {
735			netdev_info(ieee->dev, "skb->priority = %x\n",
736				    skb->priority);
737			if (wme_downgrade_ac(skb))
738				break;
739			netdev_info(ieee->dev, "converted skb->priority = %x\n",
740			       skb->priority);
741		 }
742			qos_ctl |= skb->priority;
743			header.qos_ctl = cpu_to_le16(qos_ctl & RTLLIB_QOS_TID);
744		} else {
745			hdr_len = RTLLIB_3ADDR_LEN;
746		}
747		/* Determine amount of payload per fragment.  Regardless of if
748		 * this stack is providing the full 802.11 header, one will
749		 * eventually be affixed to this fragment -- so we must account
750		 * for it when determining the amount of payload space.
751		 */
752		bytes_per_frag = frag_size - hdr_len;
753		if (ieee->config &
754		   (CFG_RTLLIB_COMPUTE_FCS | CFG_RTLLIB_RESERVE_FCS))
755			bytes_per_frag -= RTLLIB_FCS_LEN;
756
757		/* Each fragment may need to have room for encrypting
758		 * pre/postfix
759		 */
760		if (encrypt) {
761			bytes_per_frag -= crypt->ops->extra_mpdu_prefix_len +
762				crypt->ops->extra_mpdu_postfix_len +
763				crypt->ops->extra_msdu_prefix_len +
764				crypt->ops->extra_msdu_postfix_len;
765		}
766		/* Number of fragments is the total bytes_per_frag /
767		 * payload_per_fragment
768		 */
769		nr_frags = bytes / bytes_per_frag;
770		bytes_last_frag = bytes % bytes_per_frag;
771		if (bytes_last_frag)
772			nr_frags++;
773		else
774			bytes_last_frag = bytes_per_frag;
775
776		/* When we allocate the TXB we allocate enough space for the
777		 * reserve and full fragment bytes (bytes_per_frag doesn't
778		 * include prefix, postfix, header, FCS, etc.)
779		 */
780		txb = rtllib_alloc_txb(nr_frags, frag_size +
781				       ieee->tx_headroom, GFP_ATOMIC);
782		if (unlikely(!txb)) {
783			netdev_warn(ieee->dev, "Could not allocate TXB\n");
784			goto failed;
785		}
786		txb->encrypted = encrypt;
787		txb->payload_size = cpu_to_le16(bytes);
788
789		if (qos_actived)
790			txb->queue_index = UP2AC(skb->priority);
791		else
792			txb->queue_index = WME_AC_BE;
793
794		for (i = 0; i < nr_frags; i++) {
795			skb_frag = txb->fragments[i];
796			tcb_desc = (struct cb_desc *)(skb_frag->cb +
797				    MAX_DEV_ADDR_SIZE);
798			if (qos_actived) {
799				skb_frag->priority = skb->priority;
800				tcb_desc->queue_index =  UP2AC(skb->priority);
801			} else {
802				skb_frag->priority = WME_AC_BE;
803				tcb_desc->queue_index = WME_AC_BE;
804			}
805			skb_reserve(skb_frag, ieee->tx_headroom);
806
807			if (encrypt) {
808				if (ieee->hwsec_active)
809					tcb_desc->bHwSec = 1;
810				else
811					tcb_desc->bHwSec = 0;
812				skb_reserve(skb_frag,
813					    crypt->ops->extra_mpdu_prefix_len +
814					    crypt->ops->extra_msdu_prefix_len);
815			} else {
816				tcb_desc->bHwSec = 0;
817			}
818			frag_hdr = (struct rtllib_hdr_3addrqos *)
819				   skb_put(skb_frag, hdr_len);
820			memcpy(frag_hdr, &header, hdr_len);
821
822			/* If this is not the last fragment, then add the
823			 * MOREFRAGS bit to the frame control
824			 */
825			if (i != nr_frags - 1) {
826				frag_hdr->frame_ctl = cpu_to_le16(
827					fc | RTLLIB_FCTL_MOREFRAGS);
828				bytes = bytes_per_frag;
829
830			} else {
831				/* The last fragment has the remaining length */
832				bytes = bytes_last_frag;
833			}
834			if ((qos_actived) && (!bIsMulticast)) {
835				frag_hdr->seq_ctl =
836					 cpu_to_le16(rtllib_query_seqnum(ieee, skb_frag,
837							     header.addr1));
838				frag_hdr->seq_ctl =
839					 cpu_to_le16(le16_to_cpu(frag_hdr->seq_ctl)<<4 | i);
840			} else {
841				frag_hdr->seq_ctl =
842					 cpu_to_le16(ieee->seq_ctrl[0]<<4 | i);
843			}
844			/* Put a SNAP header on the first fragment */
845			if (i == 0) {
846				rtllib_put_snap(
847					skb_put(skb_frag, SNAP_SIZE +
848					sizeof(u16)), ether_type);
849				bytes -= SNAP_SIZE + sizeof(u16);
850			}
851
852			memcpy(skb_put(skb_frag, bytes), skb->data, bytes);
853
854			/* Advance the SKB... */
855			skb_pull(skb, bytes);
856
857			/* Encryption routine will move the header forward in
858			 * order to insert the IV between the header and the
859			 * payload
860			 */
861			if (encrypt)
862				rtllib_encrypt_fragment(ieee, skb_frag,
863							hdr_len);
864			if (ieee->config &
865			   (CFG_RTLLIB_COMPUTE_FCS | CFG_RTLLIB_RESERVE_FCS))
866				skb_put(skb_frag, 4);
867		}
868
869		if ((qos_actived) && (!bIsMulticast)) {
870			if (ieee->seq_ctrl[UP2AC(skb->priority) + 1] == 0xFFF)
871				ieee->seq_ctrl[UP2AC(skb->priority) + 1] = 0;
872			else
873				ieee->seq_ctrl[UP2AC(skb->priority) + 1]++;
874		} else {
875			if (ieee->seq_ctrl[0] == 0xFFF)
876				ieee->seq_ctrl[0] = 0;
877			else
878					ieee->seq_ctrl[0]++;
879		}
880	} else {
881		if (unlikely(skb->len < sizeof(struct rtllib_hdr_3addr))) {
882			netdev_warn(ieee->dev, "skb too small (%d).\n",
883				    skb->len);
884			goto success;
885		}
886
887		txb = rtllib_alloc_txb(1, skb->len, GFP_ATOMIC);
888		if (!txb) {
889			netdev_warn(ieee->dev, "Could not allocate TXB\n");
890			goto failed;
891		}
892
893		txb->encrypted = 0;
894		txb->payload_size = cpu_to_le16(skb->len);
895		memcpy(skb_put(txb->fragments[0], skb->len), skb->data,
896		       skb->len);
897	}
898
899 success:
900	if (txb) {
901		struct cb_desc *tcb_desc = (struct cb_desc *)
902				(txb->fragments[0]->cb + MAX_DEV_ADDR_SIZE);
903		tcb_desc->bTxEnableFwCalcDur = 1;
904		tcb_desc->priority = skb->priority;
905
906		if (ether_type == ETH_P_PAE) {
907			if (ieee->pHTInfo->IOTAction &
908			    HT_IOT_ACT_WA_IOT_Broadcom) {
909				tcb_desc->data_rate =
910					 MgntQuery_TxRateExcludeCCKRates(ieee);
911				tcb_desc->bTxDisableRateFallBack = false;
912			} else {
913				tcb_desc->data_rate = ieee->basic_rate;
914				tcb_desc->bTxDisableRateFallBack = 1;
915			}
916
917
918			tcb_desc->RATRIndex = 7;
919			tcb_desc->bTxUseDriverAssingedRate = 1;
920		} else {
921			if (is_multicast_ether_addr(header.addr1))
922				tcb_desc->bMulticast = 1;
923			if (is_broadcast_ether_addr(header.addr1))
924				tcb_desc->bBroadcast = 1;
925			rtllib_txrate_selectmode(ieee, tcb_desc);
926			if (tcb_desc->bMulticast ||  tcb_desc->bBroadcast)
927				tcb_desc->data_rate = ieee->basic_rate;
928			else
929				tcb_desc->data_rate = rtllib_current_rate(ieee);
930
931			if (bdhcp) {
932				if (ieee->pHTInfo->IOTAction &
933				    HT_IOT_ACT_WA_IOT_Broadcom) {
934					tcb_desc->data_rate =
935					   MgntQuery_TxRateExcludeCCKRates(ieee);
936					tcb_desc->bTxDisableRateFallBack = false;
937				} else {
938					tcb_desc->data_rate = MGN_1M;
939					tcb_desc->bTxDisableRateFallBack = 1;
940				}
941
942
943				tcb_desc->RATRIndex = 7;
944				tcb_desc->bTxUseDriverAssingedRate = 1;
945				tcb_desc->bdhcp = 1;
946			}
947
948			rtllib_qurey_ShortPreambleMode(ieee, tcb_desc);
949			rtllib_tx_query_agg_cap(ieee, txb->fragments[0],
950						tcb_desc);
951			rtllib_query_HTCapShortGI(ieee, tcb_desc);
952			rtllib_query_BandwidthMode(ieee, tcb_desc);
953			rtllib_query_protectionmode(ieee, tcb_desc,
954						    txb->fragments[0]);
955		}
956	}
957	spin_unlock_irqrestore(&ieee->lock, flags);
958	dev_kfree_skb_any(skb);
959	if (txb) {
960		if (ieee->softmac_features & IEEE_SOFTMAC_TX_QUEUE) {
961			dev->stats.tx_packets++;
962			dev->stats.tx_bytes += le16_to_cpu(txb->payload_size);
963			rtllib_softmac_xmit(txb, ieee);
964		} else {
965			if ((*ieee->hard_start_xmit)(txb, dev) == 0) {
966				stats->tx_packets++;
967				stats->tx_bytes += le16_to_cpu(txb->payload_size);
968				return 0;
969			}
970			rtllib_txb_free(txb);
971		}
972	}
973
974	return 0;
975
976 failed:
977	spin_unlock_irqrestore(&ieee->lock, flags);
978	netif_stop_queue(dev);
979	stats->tx_errors++;
980	return 1;
981
982}
983int rtllib_xmit(struct sk_buff *skb, struct net_device *dev)
984{
985	memset(skb->cb, 0, sizeof(skb->cb));
986	return rtllib_xmit_inter(skb, dev);
987}
988EXPORT_SYMBOL(rtllib_xmit);
989