drivers/staging/vt6655/rxtx.c

   1 /*
   2  * Copyright (c) 1996, 2003 VIA Networking Technologies, Inc.
   3  * All rights reserved.
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License along
  16  * with this program; if not, write to the Free Software Foundation, Inc.,
  17  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  18  *
  19  * File: rxtx.c
  20  *
  21  * Purpose: handle WMAC/802.3/802.11 rx & tx functions
  22  *
  23  * Author: Lyndon Chen
  24  *
  25  * Date: May 20, 2003
  26  *
  27  * Functions:
  28  *      s_vGenerateTxParameter - Generate tx dma required parameter.
  29  *      vGenerateMACHeader - Translate 802.3 to 802.11 header
  30  *      cbGetFragCount - Calculate fragment number count
  31  *      csBeacon_xmit - beacon tx function
  32  *      csMgmt_xmit - management tx function
  33  *      s_cbFillTxBufHead - fulfill tx dma buffer header
  34  *      s_uGetDataDuration - get tx data required duration
  35  *      s_uFillDataHead- fulfill tx data duration header
  36  *      s_uGetRTSCTSDuration- get rtx/cts required duration
  37  *      s_uGetRTSCTSRsvTime- get rts/cts reserved time
  38  *      s_uGetTxRsvTime- get frame reserved time
  39  *      s_vFillCTSHead- fulfill CTS ctl header
  40  *      s_vFillFragParameter- Set fragment ctl parameter.
  41  *      s_vFillRTSHead- fulfill RTS ctl header
  42  *      s_vFillTxKey- fulfill tx encrypt key
  43  *      s_vSWencryption- Software encrypt header
  44  *      vDMA0_tx_80211- tx 802.11 frame via dma0
  45  *      vGenerateFIFOHeader- Generate tx FIFO ctl header
  46  *
  47  * Revision History:
  48  *
  49  */
  50
  51 #include "device.h"
  52 #include "rxtx.h"
  53 #include "tether.h"
  54 #include "card.h"
  55 #include "bssdb.h"
  56 #include "mac.h"
  57 #include "baseband.h"
  58 #include "michael.h"
  59 #include "tkip.h"
  60 #include "tcrc.h"
  61 #include "wctl.h"
  62 #include "wroute.h"
  63 #include "hostap.h"
  64 #include "rf.h"
  65
  66 /*---------------------  Static Definitions -------------------------*/
  67
  68 /*---------------------  Static Classes  ----------------------------*/
  69
  70 /*---------------------  Static Variables  --------------------------*/
  71
  72 /*---------------------  Static Functions  --------------------------*/
  73
  74 /*---------------------  Static Definitions -------------------------*/
  75 #define CRITICAL_PACKET_LEN      256    // if packet size < 256 -> in-direct send
  76                                         //    packet size >= 256 -> direct send
  77
  78 static const unsigned short wTimeStampOff[2][MAX_RATE] = {
  79         {384, 288, 226, 209, 54, 43, 37, 31, 28, 25, 24, 23}, // Long Preamble
  80         {384, 192, 130, 113, 54, 43, 37, 31, 28, 25, 24, 23}, // Short Preamble
  81 };
  82
  83 static const unsigned short wFB_Opt0[2][5] = {
  84         {RATE_12M, RATE_18M, RATE_24M, RATE_36M, RATE_48M}, // fallback_rate0
  85         {RATE_12M, RATE_12M, RATE_18M, RATE_24M, RATE_36M}, // fallback_rate1
  86 };
  87 static const unsigned short wFB_Opt1[2][5] = {
  88         {RATE_12M, RATE_18M, RATE_24M, RATE_24M, RATE_36M}, // fallback_rate0
  89         {RATE_6M , RATE_6M,  RATE_12M, RATE_12M, RATE_18M}, // fallback_rate1
  90 };
  91
  92 #define RTSDUR_BB       0
  93 #define RTSDUR_BA       1
  94 #define RTSDUR_AA       2
  95 #define CTSDUR_BA       3
  96 #define RTSDUR_BA_F0    4
  97 #define RTSDUR_AA_F0    5
  98 #define RTSDUR_BA_F1    6
  99 #define RTSDUR_AA_F1    7
 100 #define CTSDUR_BA_F0    8
 101 #define CTSDUR_BA_F1    9
 102 #define DATADUR_B       10
 103 #define DATADUR_A       11
 104 #define DATADUR_A_F0    12
 105 #define DATADUR_A_F1    13
 106
 107 /*---------------------  Static Functions  --------------------------*/
 108
 109 static
 110 void
 111 s_vFillTxKey(
 112         struct vnt_private *pDevice,
 113         unsigned char *pbyBuf,
 114         unsigned char *pbyIVHead,
 115         PSKeyItem  pTransmitKey,
 116         unsigned char *pbyHdrBuf,
 117         unsigned short wPayloadLen,
 118         unsigned char *pMICHDR
 119 );
 120
 121 static
 122 void
 123 s_vFillRTSHead(
 124         struct vnt_private *pDevice,
 125         unsigned char byPktType,
 126         void *pvRTS,
 127         unsigned int    cbFrameLength,
 128         bool bNeedAck,
 129         bool bDisCRC,
 130         PSEthernetHeader psEthHeader,
 131         unsigned short wCurrentRate,
 132         unsigned char byFBOption
 133 );
 134
 135 static
 136 void
 137 s_vGenerateTxParameter(
 138         struct vnt_private *pDevice,
 139         unsigned char byPktType,
 140         void *pTxBufHead,
 141         void *pvRrvTime,
 142         void *pvRTS,
 143         void *pvCTS,
 144         unsigned int    cbFrameSize,
 145         bool bNeedACK,
 146         unsigned int    uDMAIdx,
 147         PSEthernetHeader psEthHeader,
 148         unsigned short wCurrentRate
 149 );
 150
 151 static void s_vFillFragParameter(
 152         struct vnt_private *pDevice,
 153         unsigned char *pbyBuffer,
 154         unsigned int    uTxType,
 155         void *pvtdCurr,
 156         unsigned short wFragType,
 157         unsigned int    cbReqCount
 158 );
 159
 160 static unsigned int
 161 s_cbFillTxBufHead(struct vnt_private *pDevice, unsigned char byPktType,
 162                   unsigned char *pbyTxBufferAddr, unsigned int cbFrameBodySize,
 163                   unsigned int uDMAIdx, PSTxDesc pHeadTD,
 164                   PSEthernetHeader psEthHeader, unsigned char *pPacket,
 165                   bool bNeedEncrypt, PSKeyItem pTransmitKey,
 166                   unsigned int uNodeIndex, unsigned int *puMACfragNum);
 167
 168 static
 169 __le16
 170 s_uFillDataHead(
 171         struct vnt_private *pDevice,
 172         unsigned char byPktType,
 173         void *pTxDataHead,
 174         unsigned int cbFrameLength,
 175         unsigned int uDMAIdx,
 176         bool bNeedAck,
 177         unsigned int uFragIdx,
 178         unsigned int cbLastFragmentSize,
 179         unsigned int uMACfragNum,
 180         unsigned char byFBOption,
 181         unsigned short wCurrentRate
 182 );
 183
 184 /*---------------------  Export Variables  --------------------------*/
 185
 186 static
 187 void
 188 s_vFillTxKey(
 189         struct vnt_private *pDevice,
 190         unsigned char *pbyBuf,
 191         unsigned char *pbyIVHead,
 192         PSKeyItem  pTransmitKey,
 193         unsigned char *pbyHdrBuf,
 194         unsigned short wPayloadLen,
 195         unsigned char *pMICHDR
 196 )
 197 {
 198         struct vnt_mic_hdr *mic_hdr = (struct vnt_mic_hdr *)pMICHDR;
 199         unsigned long *pdwIV = (unsigned long *)pbyIVHead;
 200         unsigned long *pdwExtIV = (unsigned long *)((unsigned char *)pbyIVHead+4);
 201         PS802_11Header  pMACHeader = (PS802_11Header)pbyHdrBuf;
 202         unsigned long dwRevIVCounter;
 203         unsigned char byKeyIndex = 0;
 204
 205         //Fill TXKEY
 206         if (pTransmitKey == NULL)
 207                 return;
 208
 209         dwRevIVCounter = cpu_to_le32(pDevice->dwIVCounter);
 210         *pdwIV = pDevice->dwIVCounter;
 211         byKeyIndex = pTransmitKey->dwKeyIndex & 0xf;
 212
 213         if (pTransmitKey->byCipherSuite == KEY_CTL_WEP) {
 214                 if (pTransmitKey->uKeyLength == WLAN_WEP232_KEYLEN) {
 215                         memcpy(pDevice->abyPRNG, (unsigned char *)&(dwRevIVCounter), 3);
 216                         memcpy(pDevice->abyPRNG+3, pTransmitKey->abyKey, pTransmitKey->uKeyLength);
 217                 } else {
 218                         memcpy(pbyBuf, (unsigned char *)&(dwRevIVCounter), 3);
 219                         memcpy(pbyBuf+3, pTransmitKey->abyKey, pTransmitKey->uKeyLength);
 220                         if (pTransmitKey->uKeyLength == WLAN_WEP40_KEYLEN) {
 221                                 memcpy(pbyBuf+8, (unsigned char *)&(dwRevIVCounter), 3);
 222                                 memcpy(pbyBuf+11, pTransmitKey->abyKey, pTransmitKey->uKeyLength);
 223                         }
 224                         memcpy(pDevice->abyPRNG, pbyBuf, 16);
 225                 }
 226                 // Append IV after Mac Header
 227                 *pdwIV &= WEP_IV_MASK;//00000000 11111111 11111111 11111111
 228                 *pdwIV |= (unsigned long)byKeyIndex << 30;
 229                 *pdwIV = cpu_to_le32(*pdwIV);
 230                 pDevice->dwIVCounter++;
 231                 if (pDevice->dwIVCounter > WEP_IV_MASK)
 232                         pDevice->dwIVCounter = 0;
 233
 234         } else if (pTransmitKey->byCipherSuite == KEY_CTL_TKIP) {
 235                 pTransmitKey->wTSC15_0++;
 236                 if (pTransmitKey->wTSC15_0 == 0)
 237                         pTransmitKey->dwTSC47_16++;
 238
 239                 TKIPvMixKey(pTransmitKey->abyKey, pDevice->abyCurrentNetAddr,
 240                             pTransmitKey->wTSC15_0, pTransmitKey->dwTSC47_16, pDevice->abyPRNG);
 241                 memcpy(pbyBuf, pDevice->abyPRNG, 16);
 242                 // Make IV
 243                 memcpy(pdwIV, pDevice->abyPRNG, 3);
 244
 245                 *(pbyIVHead+3) = (unsigned char)(((byKeyIndex << 6) & 0xc0) | 0x20); // 0x20 is ExtIV
 246                 // Append IV&ExtIV after Mac Header
 247                 *pdwExtIV = cpu_to_le32(pTransmitKey->dwTSC47_16);
 248                 pr_debug("vFillTxKey()---- pdwExtIV: %lx\n", *pdwExtIV);
 249
 250         } else if (pTransmitKey->byCipherSuite == KEY_CTL_CCMP) {
 251                 pTransmitKey->wTSC15_0++;
 252                 if (pTransmitKey->wTSC15_0 == 0)
 253                         pTransmitKey->dwTSC47_16++;
 254
 255                 memcpy(pbyBuf, pTransmitKey->abyKey, 16);
 256
 257                 // Make IV
 258                 *pdwIV = 0;
 259                 *(pbyIVHead+3) = (unsigned char)(((byKeyIndex << 6) & 0xc0) | 0x20); // 0x20 is ExtIV
 260                 *pdwIV |= cpu_to_le16((unsigned short)(pTransmitKey->wTSC15_0));
 261                 //Append IV&ExtIV after Mac Header
 262                 *pdwExtIV = cpu_to_le32(pTransmitKey->dwTSC47_16);
 263
 264                 /* MICHDR0 */
 265                 mic_hdr->id = 0x59;
 266                 mic_hdr->tx_priority = 0;
 267                 memcpy(mic_hdr->mic_addr2, pMACHeader->abyAddr2, ETH_ALEN);
 268
 269                 /* ccmp pn big endian order */
 270                 mic_hdr->ccmp_pn[0] = (u8)(pTransmitKey->dwTSC47_16 >> 24);
 271                 mic_hdr->ccmp_pn[1] = (u8)(pTransmitKey->dwTSC47_16 >> 16);
 272                 mic_hdr->ccmp_pn[2] = (u8)(pTransmitKey->dwTSC47_16 >> 8);
 273                 mic_hdr->ccmp_pn[3] = (u8)pTransmitKey->dwTSC47_16;
 274                 mic_hdr->ccmp_pn[4] = (u8)(pTransmitKey->wTSC15_0 >> 8);
 275                 mic_hdr->ccmp_pn[5] = (u8)pTransmitKey->wTSC15_0;
 276
 277                 /* MICHDR1 */
 278                 mic_hdr->payload_len = cpu_to_be16(wPayloadLen);
 279
 280                 if (pDevice->bLongHeader)
 281                         mic_hdr->hlen = cpu_to_be16(28);
 282                 else
 283                         mic_hdr->hlen = cpu_to_be16(22);
 284
 285                 memcpy(mic_hdr->addr1, pMACHeader->abyAddr1, ETH_ALEN);
 286                 memcpy(mic_hdr->addr2, pMACHeader->abyAddr2, ETH_ALEN);
 287
 288                 /* MICHDR2 */
 289                 memcpy(mic_hdr->addr3, pMACHeader->abyAddr3, ETH_ALEN);
 290                 mic_hdr->frame_control =
 291                                 cpu_to_le16(pMACHeader->wFrameCtl & 0xc78f);
 292                 mic_hdr->seq_ctrl = cpu_to_le16(pMACHeader->wSeqCtl & 0xf);
 293
 294                 if (pDevice->bLongHeader)
 295                         memcpy(mic_hdr->addr4, pMACHeader->abyAddr4, ETH_ALEN);
 296         }
 297 }
 298
 299 static
 300 void
 301 s_vSWencryption(
 302         struct vnt_private *pDevice,
 303         PSKeyItem           pTransmitKey,
 304         unsigned char *pbyPayloadHead,
 305         unsigned short wPayloadSize
 306 )
 307 {
 308         unsigned int cbICVlen = 4;
 309         unsigned long dwICV = 0xFFFFFFFFL;
 310         unsigned long *pdwICV;
 311
 312         if (pTransmitKey == NULL)
 313                 return;
 314
 315         if (pTransmitKey->byCipherSuite == KEY_CTL_WEP) {
 316                 //=======================================================================
 317                 // Append ICV after payload
 318                 dwICV = CRCdwGetCrc32Ex(pbyPayloadHead, wPayloadSize, dwICV);//ICV(Payload)
 319                 pdwICV = (unsigned long *)(pbyPayloadHead + wPayloadSize);
 320                 // finally, we must invert dwCRC to get the correct answer
 321                 *pdwICV = cpu_to_le32(~dwICV);
 322                 // RC4 encryption
 323                 rc4_init(&pDevice->SBox, pDevice->abyPRNG, pTransmitKey->uKeyLength + 3);
 324                 rc4_encrypt(&pDevice->SBox, pbyPayloadHead, pbyPayloadHead, wPayloadSize+cbICVlen);
 325                 //=======================================================================
 326         } else if (pTransmitKey->byCipherSuite == KEY_CTL_TKIP) {
 327                 //=======================================================================
 328                 //Append ICV after payload
 329                 dwICV = CRCdwGetCrc32Ex(pbyPayloadHead, wPayloadSize, dwICV);//ICV(Payload)
 330                 pdwICV = (unsigned long *)(pbyPayloadHead + wPayloadSize);
 331                 // finally, we must invert dwCRC to get the correct answer
 332                 *pdwICV = cpu_to_le32(~dwICV);
 333                 // RC4 encryption
 334                 rc4_init(&pDevice->SBox, pDevice->abyPRNG, TKIP_KEY_LEN);
 335                 rc4_encrypt(&pDevice->SBox, pbyPayloadHead, pbyPayloadHead, wPayloadSize+cbICVlen);
 336                 //=======================================================================
 337         }
 338 }
 339
 340 static __le16 vnt_time_stamp_off(struct vnt_private *priv, u16 rate)
 341 {
 342         return cpu_to_le16(wTimeStampOff[priv->byPreambleType % 2]
 343                                                         [rate % MAX_RATE]);
 344 }
 345
 346 /*byPktType : PK_TYPE_11A     0
 347   PK_TYPE_11B     1
 348   PK_TYPE_11GB    2
 349   PK_TYPE_11GA    3
 350 */
 351 static
 352 unsigned int
 353 s_uGetTxRsvTime(
 354         struct vnt_private *pDevice,
 355         unsigned char byPktType,
 356         unsigned int cbFrameLength,
 357         unsigned short wRate,
 358         bool bNeedAck
 359 )
 360 {
 361         unsigned int uDataTime, uAckTime;
 362
 363         uDataTime = BBuGetFrameTime(pDevice->byPreambleType, byPktType, cbFrameLength, wRate);
 364         if (byPktType == PK_TYPE_11B) //llb,CCK mode
 365                 uAckTime = BBuGetFrameTime(pDevice->byPreambleType, byPktType, 14, (unsigned short)pDevice->byTopCCKBasicRate);
 366         else //11g 2.4G OFDM mode & 11a 5G OFDM mode
 367                 uAckTime = BBuGetFrameTime(pDevice->byPreambleType, byPktType, 14, (unsigned short)pDevice->byTopOFDMBasicRate);
 368
 369         if (bNeedAck)
 370                 return uDataTime + pDevice->uSIFS + uAckTime;
 371         else
 372                 return uDataTime;
 373 }
 374
 375 static __le16 vnt_rxtx_rsvtime_le16(struct vnt_private *priv, u8 pkt_type,
 376                                     u32 frame_length, u16 rate, bool need_ack)
 377 {
 378         return cpu_to_le16((u16)s_uGetTxRsvTime(priv, pkt_type,
 379                                                 frame_length, rate, need_ack));
 380 }
 381
 382 //byFreqType: 0=>5GHZ 1=>2.4GHZ
 383 static
 384 __le16
 385 s_uGetRTSCTSRsvTime(
 386         struct vnt_private *pDevice,
 387         unsigned char byRTSRsvType,
 388         unsigned char byPktType,
 389         unsigned int cbFrameLength,
 390         unsigned short wCurrentRate
 391 )
 392 {
 393         unsigned int uRrvTime  , uRTSTime, uCTSTime, uAckTime, uDataTime;
 394
 395         uRrvTime = uRTSTime = uCTSTime = uAckTime = uDataTime = 0;
 396
 397         uDataTime = BBuGetFrameTime(pDevice->byPreambleType, byPktType, cbFrameLength, wCurrentRate);
 398         if (byRTSRsvType == 0) { //RTSTxRrvTime_bb
 399                 uRTSTime = BBuGetFrameTime(pDevice->byPreambleType, byPktType, 20, pDevice->byTopCCKBasicRate);
 400                 uCTSTime = uAckTime = BBuGetFrameTime(pDevice->byPreambleType, byPktType, 14, pDevice->byTopCCKBasicRate);
 401         } else if (byRTSRsvType == 1) { //RTSTxRrvTime_ba, only in 2.4GHZ
 402                 uRTSTime = BBuGetFrameTime(pDevice->byPreambleType, byPktType, 20, pDevice->byTopCCKBasicRate);
 403                 uCTSTime = BBuGetFrameTime(pDevice->byPreambleType, byPktType, 14, pDevice->byTopCCKBasicRate);
 404                 uAckTime = BBuGetFrameTime(pDevice->byPreambleType, byPktType, 14, pDevice->byTopOFDMBasicRate);
 405         } else if (byRTSRsvType == 2) { //RTSTxRrvTime_aa
 406                 uRTSTime = BBuGetFrameTime(pDevice->byPreambleType, byPktType, 20, pDevice->byTopOFDMBasicRate);
 407                 uCTSTime = uAckTime = BBuGetFrameTime(pDevice->byPreambleType, byPktType, 14, pDevice->byTopOFDMBasicRate);
 408         } else if (byRTSRsvType == 3) { //CTSTxRrvTime_ba, only in 2.4GHZ
 409                 uCTSTime = BBuGetFrameTime(pDevice->byPreambleType, byPktType, 14, pDevice->byTopCCKBasicRate);
 410                 uAckTime = BBuGetFrameTime(pDevice->byPreambleType, byPktType, 14, pDevice->byTopOFDMBasicRate);
 411                 uRrvTime = uCTSTime + uAckTime + uDataTime + 2*pDevice->uSIFS;
 412                 return cpu_to_le16((u16)uRrvTime);
 413         }
 414
 415         //RTSRrvTime
 416         uRrvTime = uRTSTime + uCTSTime + uAckTime + uDataTime + 3*pDevice->uSIFS;
 417         return cpu_to_le16((u16)uRrvTime);
 418 }
 419
 420 //byFreqType 0: 5GHz, 1:2.4Ghz
 421 static
 422 unsigned int
 423 s_uGetDataDuration(
 424         struct vnt_private *pDevice,
 425         unsigned char byDurType,
 426         unsigned int cbFrameLength,
 427         unsigned char byPktType,
 428         unsigned short wRate,
 429         bool bNeedAck,
 430         unsigned int uFragIdx,
 431         unsigned int cbLastFragmentSize,
 432         unsigned int uMACfragNum,
 433         unsigned char byFBOption
 434 )
 435 {
 436         bool bLastFrag = 0;
 437         unsigned int uAckTime = 0, uNextPktTime = 0;
 438
 439         if (uFragIdx == (uMACfragNum-1))
 440                 bLastFrag = 1;
 441
 442         switch (byDurType) {
 443         case DATADUR_B:    //DATADUR_B
 444                 if (((uMACfragNum == 1)) || bLastFrag) {//Non Frag or Last Frag
 445                         if (bNeedAck) {
 446                                 uAckTime = BBuGetFrameTime(pDevice->byPreambleType, byPktType, 14, pDevice->byTopCCKBasicRate);
 447                                 return pDevice->uSIFS + uAckTime;
 448                         } else {
 449                                 return 0;
 450                         }
 451                 } else {//First Frag or Mid Frag
 452                         if (uFragIdx == (uMACfragNum-2))
 453                                 uNextPktTime = s_uGetTxRsvTime(pDevice, byPktType, cbLastFragmentSize, wRate, bNeedAck);
 454                         else
 455                                 uNextPktTime = s_uGetTxRsvTime(pDevice, byPktType, cbFrameLength, wRate, bNeedAck);
 456
 457                         if (bNeedAck) {
 458                                 uAckTime = BBuGetFrameTime(pDevice->byPreambleType, byPktType, 14, pDevice->byTopCCKBasicRate);
 459                                 return pDevice->uSIFS + uAckTime + uNextPktTime;
 460                         } else {
 461                                 return pDevice->uSIFS + uNextPktTime;
 462                         }
 463                 }
 464                 break;
 465
 466         case DATADUR_A:    //DATADUR_A
 467                 if (((uMACfragNum == 1)) || bLastFrag) {//Non Frag or Last Frag
 468                         if (bNeedAck) {
 469                                 uAckTime = BBuGetFrameTime(pDevice->byPreambleType, byPktType, 14, pDevice->byTopOFDMBasicRate);
 470                                 return pDevice->uSIFS + uAckTime;
 471                         } else {
 472                                 return 0;
 473                         }
 474                 } else {//First Frag or Mid Frag
 475                         if (uFragIdx == (uMACfragNum-2))
 476                                 uNextPktTime = s_uGetTxRsvTime(pDevice, byPktType, cbLastFragmentSize, wRate, bNeedAck);
 477                         else
 478                                 uNextPktTime = s_uGetTxRsvTime(pDevice, byPktType, cbFrameLength, wRate, bNeedAck);
 479
 480                         if (bNeedAck) {
 481                                 uAckTime = BBuGetFrameTime(pDevice->byPreambleType, byPktType, 14, pDevice->byTopOFDMBasicRate);
 482                                 return pDevice->uSIFS + uAckTime + uNextPktTime;
 483                         } else {
 484                                 return pDevice->uSIFS + uNextPktTime;
 485                         }
 486                 }
 487                 break;
 488
 489         case DATADUR_A_F0:    //DATADUR_A_F0
 490                 if (((uMACfragNum == 1)) || bLastFrag) {//Non Frag or Last Frag
 491                         if (bNeedAck) {
 492                                 uAckTime = BBuGetFrameTime(pDevice->byPreambleType, byPktType, 14, pDevice->byTopOFDMBasicRate);
 493                                 return pDevice->uSIFS + uAckTime;
 494                         } else {
 495                                 return 0;
 496                         }
 497                 } else { //First Frag or Mid Frag
 498                         if (byFBOption == AUTO_FB_0) {
 499                                 if (wRate < RATE_18M)
 500                                         wRate = RATE_18M;
 501                                 else if (wRate > RATE_54M)
 502                                         wRate = RATE_54M;
 503
 504                                 if (uFragIdx == (uMACfragNum-2))
 505                                         uNextPktTime = s_uGetTxRsvTime(pDevice, byPktType, cbLastFragmentSize, wFB_Opt0[FB_RATE0][wRate-RATE_18M], bNeedAck);
 506                                 else
 507                                         uNextPktTime = s_uGetTxRsvTime(pDevice, byPktType, cbFrameLength, wFB_Opt0[FB_RATE0][wRate-RATE_18M], bNeedAck);
 508
 509                         } else { // (byFBOption == AUTO_FB_1)
 510                                 if (wRate < RATE_18M)
 511                                         wRate = RATE_18M;
 512                                 else if (wRate > RATE_54M)
 513                                         wRate = RATE_54M;
 514
 515                                 if (uFragIdx == (uMACfragNum-2))
 516                                         uNextPktTime = s_uGetTxRsvTime(pDevice, byPktType, cbLastFragmentSize, wFB_Opt1[FB_RATE0][wRate-RATE_18M], bNeedAck);
 517                                 else
 518                                         uNextPktTime = s_uGetTxRsvTime(pDevice, byPktType, cbFrameLength, wFB_Opt1[FB_RATE0][wRate-RATE_18M], bNeedAck);
 519
 520                         }
 521
 522                         if (bNeedAck) {
 523                                 uAckTime = BBuGetFrameTime(pDevice->byPreambleType, byPktType, 14, pDevice->byTopOFDMBasicRate);
 524                                 return pDevice->uSIFS + uAckTime + uNextPktTime;
 525                         } else {
 526                                 return pDevice->uSIFS + uNextPktTime;
 527                         }
 528                 }
 529                 break;
 530
 531         case DATADUR_A_F1:    //DATADUR_A_F1
 532                 if (((uMACfragNum == 1)) || bLastFrag) {//Non Frag or Last Frag
 533                         if (bNeedAck) {
 534                                 uAckTime = BBuGetFrameTime(pDevice->byPreambleType, byPktType, 14, pDevice->byTopOFDMBasicRate);
 535                                 return pDevice->uSIFS + uAckTime;
 536                         } else {
 537                                 return 0;
 538                         }
 539                 } else { //First Frag or Mid Frag
 540                         if (byFBOption == AUTO_FB_0) {
 541                                 if (wRate < RATE_18M)
 542                                         wRate = RATE_18M;
 543                                 else if (wRate > RATE_54M)
 544                                         wRate = RATE_54M;
 545
 546                                 if (uFragIdx == (uMACfragNum-2))
 547                                         uNextPktTime = s_uGetTxRsvTime(pDevice, byPktType, cbLastFragmentSize, wFB_Opt0[FB_RATE1][wRate-RATE_18M], bNeedAck);
 548                                 else
 549                                         uNextPktTime = s_uGetTxRsvTime(pDevice, byPktType, cbFrameLength, wFB_Opt0[FB_RATE1][wRate-RATE_18M], bNeedAck);
 550
 551                         } else { // (byFBOption == AUTO_FB_1)
 552                                 if (wRate < RATE_18M)
 553                                         wRate = RATE_18M;
 554                                 else if (wRate > RATE_54M)
 555                                         wRate = RATE_54M;
 556
 557                                 if (uFragIdx == (uMACfragNum-2))
 558                                         uNextPktTime = s_uGetTxRsvTime(pDevice, byPktType, cbLastFragmentSize, wFB_Opt1[FB_RATE1][wRate-RATE_18M], bNeedAck);
 559                                 else
 560                                         uNextPktTime = s_uGetTxRsvTime(pDevice, byPktType, cbFrameLength, wFB_Opt1[FB_RATE1][wRate-RATE_18M], bNeedAck);
 561                         }
 562                         if (bNeedAck) {
 563                                 uAckTime = BBuGetFrameTime(pDevice->byPreambleType, byPktType, 14, pDevice->byTopOFDMBasicRate);
 564                                 return pDevice->uSIFS + uAckTime + uNextPktTime;
 565                         } else {
 566                                 return pDevice->uSIFS + uNextPktTime;
 567                         }
 568                 }
 569                 break;
 570
 571         default:
 572                 break;
 573         }
 574
 575         ASSERT(false);
 576         return 0;
 577 }
 578
 579 //byFreqType: 0=>5GHZ 1=>2.4GHZ
 580 static
 581 __le16
 582 s_uGetRTSCTSDuration(
 583         struct vnt_private *pDevice,
 584         unsigned char byDurType,
 585         unsigned int cbFrameLength,
 586         unsigned char byPktType,
 587         unsigned short wRate,
 588         bool bNeedAck,
 589         unsigned char byFBOption
 590 )
 591 {
 592         unsigned int uCTSTime = 0, uDurTime = 0;
 593
 594         switch (byDurType) {
 595         case RTSDUR_BB:    //RTSDuration_bb
 596                 uCTSTime = BBuGetFrameTime(pDevice->byPreambleType, byPktType, 14, pDevice->byTopCCKBasicRate);
 597                 uDurTime = uCTSTime + 2*pDevice->uSIFS + s_uGetTxRsvTime(pDevice, byPktType, cbFrameLength, wRate, bNeedAck);
 598                 break;
 599
 600         case RTSDUR_BA:    //RTSDuration_ba
 601                 uCTSTime = BBuGetFrameTime(pDevice->byPreambleType, byPktType, 14, pDevice->byTopCCKBasicRate);
 602                 uDurTime = uCTSTime + 2*pDevice->uSIFS + s_uGetTxRsvTime(pDevice, byPktType, cbFrameLength, wRate, bNeedAck);
 603                 break;
 604
 605         case RTSDUR_AA:    //RTSDuration_aa
 606                 uCTSTime = BBuGetFrameTime(pDevice->byPreambleType, byPktType, 14, pDevice->byTopOFDMBasicRate);
 607                 uDurTime = uCTSTime + 2*pDevice->uSIFS + s_uGetTxRsvTime(pDevice, byPktType, cbFrameLength, wRate, bNeedAck);
 608                 break;
 609
 610         case CTSDUR_BA:    //CTSDuration_ba
 611                 uDurTime = pDevice->uSIFS + s_uGetTxRsvTime(pDevice, byPktType, cbFrameLength, wRate, bNeedAck);
 612                 break;
 613
 614         case RTSDUR_BA_F0: //RTSDuration_ba_f0
 615                 uCTSTime = BBuGetFrameTime(pDevice->byPreambleType, byPktType, 14, pDevice->byTopCCKBasicRate);
 616                 if ((byFBOption == AUTO_FB_0) && (wRate >= RATE_18M) && (wRate <= RATE_54M))
 617                         uDurTime = uCTSTime + 2 * pDevice->uSIFS + s_uGetTxRsvTime(pDevice, byPktType, cbFrameLength, wFB_Opt0[FB_RATE0][wRate-RATE_18M], bNeedAck);
 618                 else if ((byFBOption == AUTO_FB_1) && (wRate >= RATE_18M) && (wRate <= RATE_54M))
 619                         uDurTime = uCTSTime + 2 * pDevice->uSIFS + s_uGetTxRsvTime(pDevice, byPktType, cbFrameLength, wFB_Opt1[FB_RATE0][wRate-RATE_18M], bNeedAck);
 620
 621                 break;
 622
 623         case RTSDUR_AA_F0: //RTSDuration_aa_f0
 624                 uCTSTime = BBuGetFrameTime(pDevice->byPreambleType, byPktType, 14, pDevice->byTopOFDMBasicRate);
 625                 if ((byFBOption == AUTO_FB_0) && (wRate >= RATE_18M) && (wRate <= RATE_54M))
 626                         uDurTime = uCTSTime + 2*pDevice->uSIFS + s_uGetTxRsvTime(pDevice, byPktType, cbFrameLength, wFB_Opt0[FB_RATE0][wRate-RATE_18M], bNeedAck);
 627                 else if ((byFBOption == AUTO_FB_1) && (wRate >= RATE_18M) && (wRate <= RATE_54M))
 628                         uDurTime = uCTSTime + 2*pDevice->uSIFS + s_uGetTxRsvTime(pDevice, byPktType, cbFrameLength, wFB_Opt1[FB_RATE0][wRate-RATE_18M], bNeedAck);
 629
 630                 break;
 631
 632         case RTSDUR_BA_F1: //RTSDuration_ba_f1
 633                 uCTSTime = BBuGetFrameTime(pDevice->byPreambleType, byPktType, 14, pDevice->byTopCCKBasicRate);
 634                 if ((byFBOption == AUTO_FB_0) && (wRate >= RATE_18M) && (wRate <= RATE_54M))
 635                         uDurTime = uCTSTime + 2*pDevice->uSIFS + s_uGetTxRsvTime(pDevice, byPktType, cbFrameLength, wFB_Opt0[FB_RATE1][wRate-RATE_18M], bNeedAck);
 636                 else if ((byFBOption == AUTO_FB_1) && (wRate >= RATE_18M) && (wRate <= RATE_54M))
 637                         uDurTime = uCTSTime + 2*pDevice->uSIFS + s_uGetTxRsvTime(pDevice, byPktType, cbFrameLength, wFB_Opt1[FB_RATE1][wRate-RATE_18M], bNeedAck);
 638
 639                 break;
 640
 641         case RTSDUR_AA_F1: //RTSDuration_aa_f1
 642                 uCTSTime = BBuGetFrameTime(pDevice->byPreambleType, byPktType, 14, pDevice->byTopOFDMBasicRate);
 643                 if ((byFBOption == AUTO_FB_0) && (wRate >= RATE_18M) && (wRate <= RATE_54M))
 644                         uDurTime = uCTSTime + 2*pDevice->uSIFS + s_uGetTxRsvTime(pDevice, byPktType, cbFrameLength, wFB_Opt0[FB_RATE1][wRate-RATE_18M], bNeedAck);
 645                 else if ((byFBOption == AUTO_FB_1) && (wRate >= RATE_18M) && (wRate <= RATE_54M))
 646                         uDurTime = uCTSTime + 2*pDevice->uSIFS + s_uGetTxRsvTime(pDevice, byPktType, cbFrameLength, wFB_Opt1[FB_RATE1][wRate-RATE_18M], bNeedAck);
 647
 648                 break;
 649
 650         case CTSDUR_BA_F0: //CTSDuration_ba_f0
 651                 if ((byFBOption == AUTO_FB_0) && (wRate >= RATE_18M) && (wRate <= RATE_54M))
 652                         uDurTime = pDevice->uSIFS + s_uGetTxRsvTime(pDevice, byPktType, cbFrameLength, wFB_Opt0[FB_RATE0][wRate-RATE_18M], bNeedAck);
 653                 else if ((byFBOption == AUTO_FB_1) && (wRate >= RATE_18M) && (wRate <= RATE_54M))
 654                         uDurTime = pDevice->uSIFS + s_uGetTxRsvTime(pDevice, byPktType, cbFrameLength, wFB_Opt1[FB_RATE0][wRate-RATE_18M], bNeedAck);
 655
 656                 break;
 657
 658         case CTSDUR_BA_F1: //CTSDuration_ba_f1
 659                 if ((byFBOption == AUTO_FB_0) && (wRate >= RATE_18M) && (wRate <= RATE_54M))
 660                         uDurTime = pDevice->uSIFS + s_uGetTxRsvTime(pDevice, byPktType, cbFrameLength, wFB_Opt0[FB_RATE1][wRate-RATE_18M], bNeedAck);
 661                 else if ((byFBOption == AUTO_FB_1) && (wRate >= RATE_18M) && (wRate <= RATE_54M))
 662                         uDurTime = pDevice->uSIFS + s_uGetTxRsvTime(pDevice, byPktType, cbFrameLength, wFB_Opt1[FB_RATE1][wRate-RATE_18M], bNeedAck);
 663
 664                 break;
 665
 666         default:
 667                 break;
 668         }
 669
 670         return cpu_to_le16((u16)uDurTime);
 671 }
 672
 673 static
 674 __le16
 675 s_uFillDataHead(
 676         struct vnt_private *pDevice,
 677         unsigned char byPktType,
 678         void *pTxDataHead,
 679         unsigned int cbFrameLength,
 680         unsigned int uDMAIdx,
 681         bool bNeedAck,
 682         unsigned int uFragIdx,
 683         unsigned int cbLastFragmentSize,
 684         unsigned int uMACfragNum,
 685         unsigned char byFBOption,
 686         unsigned short wCurrentRate
 687 )
 688 {
 689
 690         if (pTxDataHead == NULL)
 691                 return 0;
 692
 693
 694         if (byPktType == PK_TYPE_11GB || byPktType == PK_TYPE_11GA) {
 695                 if (byFBOption == AUTO_FB_NONE) {
 696                         struct vnt_tx_datahead_g *buf = pTxDataHead;
 697                         /* Get SignalField, ServiceField & Length */
 698                         vnt_get_phy_field(pDevice, cbFrameLength, wCurrentRate,
 699                                           byPktType, &buf->a);
 700
 701                         vnt_get_phy_field(pDevice, cbFrameLength,
 702                                           pDevice->byTopCCKBasicRate,
 703                                           PK_TYPE_11B, &buf->b);
 704
 705                         /* Get Duration and TimeStamp */
 706                         buf->duration_a = cpu_to_le16((u16)s_uGetDataDuration(pDevice, DATADUR_A, cbFrameLength,
 707                                                                               byPktType, wCurrentRate, bNeedAck, uFragIdx,
 708                                                                               cbLastFragmentSize, uMACfragNum,
 709                                                                               byFBOption));
 710                         buf->duration_b = cpu_to_le16((u16)s_uGetDataDuration(pDevice, DATADUR_B, cbFrameLength,
 711                                                                               PK_TYPE_11B, pDevice->byTopCCKBasicRate,
 712                                                                               bNeedAck, uFragIdx, cbLastFragmentSize,
 713                                                                               uMACfragNum, byFBOption));
 714
 715                         buf->time_stamp_off_a = vnt_time_stamp_off(pDevice, wCurrentRate);
 716                         buf->time_stamp_off_b = vnt_time_stamp_off(pDevice, pDevice->byTopCCKBasicRate);
 717
 718                         return buf->duration_a;
 719                 } else {
 720                         /* Auto Fallback */
 721                         struct vnt_tx_datahead_g_fb *buf = pTxDataHead;
 722                         /* Get SignalField, ServiceField & Length */
 723                         vnt_get_phy_field(pDevice, cbFrameLength, wCurrentRate,
 724                                           byPktType, &buf->a);
 725
 726                         vnt_get_phy_field(pDevice, cbFrameLength,
 727                                           pDevice->byTopCCKBasicRate,
 728                                           PK_TYPE_11B, &buf->b);
 729                         /* Get Duration and TimeStamp */
 730                         buf->duration_a = cpu_to_le16((u16)s_uGetDataDuration(pDevice, DATADUR_A, cbFrameLength, byPktType,
 731                                                                               wCurrentRate, bNeedAck, uFragIdx, cbLastFragmentSize, uMACfragNum, byFBOption));
 732                         buf->duration_b = cpu_to_le16((u16)s_uGetDataDuration(pDevice, DATADUR_B, cbFrameLength, PK_TYPE_11B,
 733                                                                                pDevice->byTopCCKBasicRate, bNeedAck, uFragIdx, cbLastFragmentSize, uMACfragNum, byFBOption));
 734                         buf->duration_a_f0 = cpu_to_le16((u16)s_uGetDataDuration(pDevice, DATADUR_A_F0, cbFrameLength, byPktType,
 735                                                                                   wCurrentRate, bNeedAck, uFragIdx, cbLastFragmentSize, uMACfragNum, byFBOption));
 736                         buf->duration_a_f1 = cpu_to_le16((u16)s_uGetDataDuration(pDevice, DATADUR_A_F1, cbFrameLength, byPktType,
 737                                                                                  wCurrentRate, bNeedAck, uFragIdx, cbLastFragmentSize, uMACfragNum, byFBOption));
 738
 739                         buf->time_stamp_off_a = vnt_time_stamp_off(pDevice, wCurrentRate);
 740                         buf->time_stamp_off_b = vnt_time_stamp_off(pDevice, pDevice->byTopCCKBasicRate);
 741
 742                         return buf->duration_a;
 743                 } //if (byFBOption == AUTO_FB_NONE)
 744         } else if (byPktType == PK_TYPE_11A) {
 745                 if ((byFBOption != AUTO_FB_NONE)) {
 746                         /* Auto Fallback */
 747                         struct vnt_tx_datahead_a_fb *buf = pTxDataHead;
 748                         /* Get SignalField, ServiceField & Length */
 749                         vnt_get_phy_field(pDevice, cbFrameLength, wCurrentRate,
 750                                           byPktType, &buf->a);
 751
 752                         /* Get Duration and TimeStampOff */
 753                         buf->duration = cpu_to_le16((u16)s_uGetDataDuration(pDevice, DATADUR_A, cbFrameLength, byPktType,
 754                                                                             wCurrentRate, bNeedAck, uFragIdx, cbLastFragmentSize, uMACfragNum, byFBOption));
 755                         buf->duration_f0 = cpu_to_le16((u16)s_uGetDataDuration(pDevice, DATADUR_A_F0, cbFrameLength, byPktType,
 756                                                                                wCurrentRate, bNeedAck, uFragIdx, cbLastFragmentSize, uMACfragNum, byFBOption));
 757                         buf->duration_f1 = cpu_to_le16((u16)s_uGetDataDuration(pDevice, DATADUR_A_F1, cbFrameLength, byPktType,
 758                                                                                 wCurrentRate, bNeedAck, uFragIdx, cbLastFragmentSize, uMACfragNum, byFBOption));
 759                         buf->time_stamp_off = vnt_time_stamp_off(pDevice, wCurrentRate);
 760                         return buf->duration;
 761                 } else {
 762                         struct vnt_tx_datahead_ab *buf = pTxDataHead;
 763                         /* Get SignalField, ServiceField & Length */
 764                         vnt_get_phy_field(pDevice, cbFrameLength, wCurrentRate,
 765                                           byPktType, &buf->ab);
 766
 767                         /* Get Duration and TimeStampOff */
 768                         buf->duration = cpu_to_le16((u16)s_uGetDataDuration(pDevice, DATADUR_A, cbFrameLength, byPktType,
 769                                                                             wCurrentRate, bNeedAck, uFragIdx,
 770                                                                             cbLastFragmentSize, uMACfragNum,
 771                                                                             byFBOption));
 772
 773                         buf->time_stamp_off = vnt_time_stamp_off(pDevice, wCurrentRate);
 774                         return buf->duration;
 775                 }
 776         } else {
 777                 struct vnt_tx_datahead_ab *buf = pTxDataHead;
 778                 /* Get SignalField, ServiceField & Length */
 779                 vnt_get_phy_field(pDevice, cbFrameLength, wCurrentRate,
 780                                   byPktType, &buf->ab);
 781                 /* Get Duration and TimeStampOff */
 782                 buf->duration = cpu_to_le16((u16)s_uGetDataDuration(pDevice, DATADUR_B, cbFrameLength, byPktType,
 783                                                                     wCurrentRate, bNeedAck, uFragIdx,
 784                                                                     cbLastFragmentSize, uMACfragNum,
 785                                                                     byFBOption));
 786                 buf->time_stamp_off = vnt_time_stamp_off(pDevice, wCurrentRate);
 787                 return buf->duration;
 788         }
 789         return 0;
 790 }
 791
 792 static
 793 void
 794 s_vFillRTSHead(
 795         struct vnt_private *pDevice,
 796         unsigned char byPktType,
 797         void *pvRTS,
 798         unsigned int cbFrameLength,
 799         bool bNeedAck,
 800         bool bDisCRC,
 801         PSEthernetHeader psEthHeader,
 802         unsigned short wCurrentRate,
 803         unsigned char byFBOption
 804 )
 805 {
 806         unsigned int uRTSFrameLen = 20;
 807
 808         if (pvRTS == NULL)
 809                 return;
 810
 811         if (bDisCRC) {
 812                 // When CRCDIS bit is on, H/W forgot to generate FCS for RTS frame,
 813                 // in this case we need to decrease its length by 4.
 814                 uRTSFrameLen -= 4;
 815         }
 816
 817         // Note: So far RTSHead dosen't appear in ATIM & Beacom DMA, so we don't need to take them into account.
 818         //       Otherwise, we need to modify codes for them.
 819         if (byPktType == PK_TYPE_11GB || byPktType == PK_TYPE_11GA) {
 820                 if (byFBOption == AUTO_FB_NONE) {
 821                         struct vnt_rts_g *buf = pvRTS;
 822                         /* Get SignalField, ServiceField & Length */
 823                         vnt_get_phy_field(pDevice, uRTSFrameLen,
 824                                           pDevice->byTopCCKBasicRate,
 825                                           PK_TYPE_11B, &buf->b);
 826
 827                         vnt_get_phy_field(pDevice, uRTSFrameLen,
 828                                           pDevice->byTopOFDMBasicRate,
 829                                           byPktType, &buf->a);
 830                         /* Get Duration */
 831                         buf->duration_bb =
 832                                 s_uGetRTSCTSDuration(pDevice, RTSDUR_BB,
 833                                                      cbFrameLength, PK_TYPE_11B,
 834                                                      pDevice->byTopCCKBasicRate,
 835                                                      bNeedAck, byFBOption);
 836                         buf->duration_aa =
 837                                 s_uGetRTSCTSDuration(pDevice, RTSDUR_AA,
 838                                                      cbFrameLength, byPktType,
 839                                                      wCurrentRate, bNeedAck,
 840                                                      byFBOption);
 841                         buf->duration_ba =
 842                                 s_uGetRTSCTSDuration(pDevice, RTSDUR_BA,
 843                                                      cbFrameLength, byPktType,
 844                                                      wCurrentRate, bNeedAck,
 845                                                      byFBOption);
 846
 847                         buf->data.duration = buf->duration_aa;
 848                         /* Get RTS Frame body */
 849                         buf->data.frame_control =
 850                                         cpu_to_le16(IEEE80211_FTYPE_CTL |
 851                                                     IEEE80211_STYPE_RTS);
 852
 853
 854                         if ((pDevice->op_mode == NL80211_IFTYPE_ADHOC) ||
 855                             (pDevice->op_mode == NL80211_IFTYPE_AP)) {
 856                                 memcpy(&buf->data.ra, psEthHeader->abyDstAddr, ETH_ALEN);
 857                         } else {
 858                                 memcpy(&buf->data.ra, pDevice->abyBSSID, ETH_ALEN);
 859                         }
 860                         if (pDevice->op_mode == NL80211_IFTYPE_AP)
 861                                 memcpy(&buf->data.ta, pDevice->abyBSSID, ETH_ALEN);
 862                         else
 863                                 memcpy(&buf->data.ta, psEthHeader->abySrcAddr, ETH_ALEN);
 864
 865                 } else {
 866                         struct vnt_rts_g_fb *buf = pvRTS;
 867                         /* Get SignalField, ServiceField & Length */
 868                         vnt_get_phy_field(pDevice, uRTSFrameLen,
 869                                           pDevice->byTopCCKBasicRate,
 870                                           PK_TYPE_11B, &buf->b);
 871
 872                         vnt_get_phy_field(pDevice, uRTSFrameLen,
 873                                           pDevice->byTopOFDMBasicRate,
 874                                           byPktType, &buf->a);
 875                         /* Get Duration */
 876                         buf->duration_bb =
 877                                 s_uGetRTSCTSDuration(pDevice, RTSDUR_BB,
 878                                                      cbFrameLength, PK_TYPE_11B,
 879                                                      pDevice->byTopCCKBasicRate,
 880                                                      bNeedAck, byFBOption);
 881                         buf->duration_aa =
 882                                 s_uGetRTSCTSDuration(pDevice, RTSDUR_AA,
 883                                                      cbFrameLength, byPktType,
 884                                                      wCurrentRate, bNeedAck,
 885                                                      byFBOption);
 886                         buf->duration_ba =
 887                                 s_uGetRTSCTSDuration(pDevice, RTSDUR_BA,
 888                                                      cbFrameLength, byPktType,
 889                                                      wCurrentRate, bNeedAck,
 890                                                      byFBOption);
 891                         buf->rts_duration_ba_f0 =
 892                                 s_uGetRTSCTSDuration(pDevice, RTSDUR_BA_F0,
 893                                                      cbFrameLength, byPktType,
 894                                                      wCurrentRate, bNeedAck,
 895                                                      byFBOption);
 896                         buf->rts_duration_aa_f0 =
 897                                 s_uGetRTSCTSDuration(pDevice, RTSDUR_AA_F0,
 898                                                      cbFrameLength, byPktType,
 899                                                      wCurrentRate, bNeedAck,
 900                                                      byFBOption);
 901                         buf->rts_duration_ba_f1 =
 902                                 s_uGetRTSCTSDuration(pDevice, RTSDUR_BA_F1,
 903                                                      cbFrameLength, byPktType,
 904                                                      wCurrentRate, bNeedAck,
 905                                                      byFBOption);
 906                         buf->rts_duration_aa_f1 =
 907                                 s_uGetRTSCTSDuration(pDevice, RTSDUR_AA_F1,
 908                                                      cbFrameLength, byPktType,
 909                                                      wCurrentRate, bNeedAck,
 910                                                      byFBOption);
 911                         buf->data.duration = buf->duration_aa;
 912                         /* Get RTS Frame body */
 913                         buf->data.frame_control =
 914                                         cpu_to_le16(IEEE80211_FTYPE_CTL |
 915                                                     IEEE80211_STYPE_RTS);
 916
 917
 918                         if ((pDevice->op_mode == NL80211_IFTYPE_ADHOC) ||
 919                             (pDevice->op_mode == NL80211_IFTYPE_AP)) {
 920                                 memcpy(&buf->data.ra, psEthHeader->abyDstAddr, ETH_ALEN);
 921                         } else {
 922                                 memcpy(&buf->data.ra, pDevice->abyBSSID, ETH_ALEN);
 923                         }
 924
 925                         if (pDevice->op_mode == NL80211_IFTYPE_AP)
 926                                 memcpy(&buf->data.ta, pDevice->abyBSSID, ETH_ALEN);
 927                         else
 928                                 memcpy(&buf->data.ta, psEthHeader->abySrcAddr, ETH_ALEN);
 929
 930                 } // if (byFBOption == AUTO_FB_NONE)
 931         } else if (byPktType == PK_TYPE_11A) {
 932                 if (byFBOption == AUTO_FB_NONE) {
 933                         struct vnt_rts_ab *buf = pvRTS;
 934                         /* Get SignalField, ServiceField & Length */
 935                         vnt_get_phy_field(pDevice, uRTSFrameLen,
 936                                           pDevice->byTopOFDMBasicRate,
 937                                           byPktType, &buf->ab);
 938                         /* Get Duration */
 939                         buf->duration =
 940                                 s_uGetRTSCTSDuration(pDevice, RTSDUR_AA,
 941                                                      cbFrameLength, byPktType,
 942                                                      wCurrentRate, bNeedAck,
 943                                                      byFBOption);
 944                         buf->data.duration = buf->duration;
 945                         /* Get RTS Frame body */
 946                         buf->data.frame_control =
 947                                         cpu_to_le16(IEEE80211_FTYPE_CTL |
 948                                                     IEEE80211_STYPE_RTS);
 949
 950
 951                         if ((pDevice->op_mode == NL80211_IFTYPE_ADHOC) ||
 952                             (pDevice->op_mode == NL80211_IFTYPE_AP)) {
 953                                 memcpy(&buf->data.ra, psEthHeader->abyDstAddr, ETH_ALEN);
 954                         } else {
 955                                 memcpy(&buf->data.ra, pDevice->abyBSSID, ETH_ALEN);
 956                         }
 957
 958                         if (pDevice->op_mode == NL80211_IFTYPE_AP)
 959                                 memcpy(&buf->data.ta, pDevice->abyBSSID, ETH_ALEN);
 960                         else
 961                                 memcpy(&buf->data.ta, psEthHeader->abySrcAddr, ETH_ALEN);
 962
 963                 } else {
 964                         struct vnt_rts_a_fb *buf = pvRTS;
 965                         /* Get SignalField, ServiceField & Length */
 966                         vnt_get_phy_field(pDevice, uRTSFrameLen,
 967                                           pDevice->byTopOFDMBasicRate,
 968                                           byPktType, &buf->a);
 969                         /* Get Duration */
 970                         buf->duration =
 971                                 s_uGetRTSCTSDuration(pDevice, RTSDUR_AA,
 972                                                      cbFrameLength, byPktType,
 973                                                      wCurrentRate, bNeedAck,
 974                                                      byFBOption);
 975                         buf->rts_duration_f0 =
 976                                 s_uGetRTSCTSDuration(pDevice, RTSDUR_AA_F0,
 977                                                      cbFrameLength, byPktType,
 978                                                      wCurrentRate, bNeedAck,
 979                                                      byFBOption);
 980                         buf->rts_duration_f1 =
 981                                 s_uGetRTSCTSDuration(pDevice, RTSDUR_AA_F1,
 982                                                      cbFrameLength, byPktType,
 983                                                      wCurrentRate, bNeedAck,
 984                                                      byFBOption);
 985                         buf->data.duration = buf->duration;
 986                         /* Get RTS Frame body */
 987                         buf->data.frame_control =
 988                                         cpu_to_le16(IEEE80211_FTYPE_CTL |
 989                                                     IEEE80211_STYPE_RTS);
 990
 991                         if ((pDevice->op_mode == NL80211_IFTYPE_ADHOC) ||
 992                             (pDevice->op_mode == NL80211_IFTYPE_AP)) {
 993                                 memcpy(&buf->data.ra, psEthHeader->abyDstAddr, ETH_ALEN);
 994                         } else {
 995                                 memcpy(&buf->data.ra, pDevice->abyBSSID, ETH_ALEN);
 996                         }
 997                         if (pDevice->op_mode == NL80211_IFTYPE_AP)
 998                                 memcpy(&buf->data.ta, pDevice->abyBSSID, ETH_ALEN);
 999                         else
1000                                 memcpy(&buf->data.ta, psEthHeader->abySrcAddr, ETH_ALEN);
1001                 }
1002         } else if (byPktType == PK_TYPE_11B) {
1003                 struct vnt_rts_ab *buf = pvRTS;
1004                 /* Get SignalField, ServiceField & Length */
1005                 vnt_get_phy_field(pDevice, uRTSFrameLen,
1006                                   pDevice->byTopCCKBasicRate,
1007                                   PK_TYPE_11B, &buf->ab);
1008                 /* Get Duration */
1009                 buf->duration =
1010                         s_uGetRTSCTSDuration(pDevice, RTSDUR_BB, cbFrameLength,
1011                                              byPktType, wCurrentRate, bNeedAck,
1012                                              byFBOption);
1013
1014                 buf->data.duration = buf->duration;
1015                 /* Get RTS Frame body */
1016                 buf->data.frame_control =
1017                         cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_RTS);
1018
1019                 if ((pDevice->op_mode == NL80211_IFTYPE_ADHOC) ||
1020                     (pDevice->op_mode == NL80211_IFTYPE_AP)) {
1021                         memcpy(&buf->data.ra, psEthHeader->abyDstAddr, ETH_ALEN);
1022                 } else {
1023                         memcpy(&buf->data.ra, pDevice->abyBSSID, ETH_ALEN);
1024                 }
1025
1026                 if (pDevice->op_mode == NL80211_IFTYPE_AP)
1027                         memcpy(&buf->data.ta, pDevice->abyBSSID, ETH_ALEN);
1028                 else
1029                         memcpy(&buf->data.ta, psEthHeader->abySrcAddr, ETH_ALEN);
1030         }
1031 }
1032
1033 static
1034 void
1035 s_vFillCTSHead(
1036         struct vnt_private *pDevice,
1037         unsigned int uDMAIdx,
1038         unsigned char byPktType,
1039         void *pvCTS,
1040         unsigned int cbFrameLength,
1041         bool bNeedAck,
1042         bool bDisCRC,
1043         unsigned short wCurrentRate,
1044         unsigned char byFBOption
1045 )
1046 {
1047         unsigned int uCTSFrameLen = 14;
1048
1049         if (pvCTS == NULL)
1050                 return;
1051
1052         if (bDisCRC) {
1053                 // When CRCDIS bit is on, H/W forgot to generate FCS for CTS frame,
1054                 // in this case we need to decrease its length by 4.
1055                 uCTSFrameLen -= 4;
1056         }
1057
1058         if (byPktType == PK_TYPE_11GB || byPktType == PK_TYPE_11GA) {
1059                 if (byFBOption != AUTO_FB_NONE && uDMAIdx != TYPE_ATIMDMA && uDMAIdx != TYPE_BEACONDMA) {
1060                         // Auto Fall back
1061                         struct vnt_cts_fb *buf = pvCTS;
1062                         /* Get SignalField, ServiceField & Length */
1063                         vnt_get_phy_field(pDevice, uCTSFrameLen,
1064                                           pDevice->byTopCCKBasicRate,
1065                                           PK_TYPE_11B, &buf->b);
1066
1067                         buf->duration_ba =
1068                                 s_uGetRTSCTSDuration(pDevice, CTSDUR_BA,
1069                                                      cbFrameLength, byPktType,
1070                                                      wCurrentRate, bNeedAck,
1071                                                      byFBOption);
1072
1073                         /* Get CTSDuration_ba_f0 */
1074                         buf->cts_duration_ba_f0 =
1075                                 s_uGetRTSCTSDuration(pDevice, CTSDUR_BA_F0,
1076                                                      cbFrameLength, byPktType,
1077                                                      wCurrentRate, bNeedAck,
1078                                                      byFBOption);
1079
1080                         /* Get CTSDuration_ba_f1 */
1081                         buf->cts_duration_ba_f1 =
1082                                 s_uGetRTSCTSDuration(pDevice, CTSDUR_BA_F1,
1083                                                      cbFrameLength, byPktType,
1084                                                      wCurrentRate, bNeedAck,
1085                                                      byFBOption);
1086
1087                         /* Get CTS Frame body */
1088                         buf->data.duration = buf->duration_ba;
1089
1090                         buf->data.frame_control =
1091                                 cpu_to_le16(IEEE80211_FTYPE_CTL |
1092                                             IEEE80211_STYPE_CTS);
1093
1094                         buf->reserved2 = 0x0;
1095
1096                         memcpy(&buf->data.ra, pDevice->abyCurrentNetAddr, ETH_ALEN);
1097                 } else { //if (byFBOption != AUTO_FB_NONE && uDMAIdx != TYPE_ATIMDMA && uDMAIdx != TYPE_BEACONDMA)
1098                         struct vnt_cts *buf = pvCTS;
1099                         /* Get SignalField, ServiceField & Length */
1100                         vnt_get_phy_field(pDevice, uCTSFrameLen,
1101                                           pDevice->byTopCCKBasicRate,
1102                                           PK_TYPE_11B, &buf->b);
1103
1104                         /* Get CTSDuration_ba */
1105                         buf->duration_ba =
1106                                 s_uGetRTSCTSDuration(pDevice, CTSDUR_BA,
1107                                                      cbFrameLength, byPktType,
1108                                                      wCurrentRate, bNeedAck,
1109                                                      byFBOption);
1110
1111                         /* Get CTS Frame body */
1112                         buf->data.duration = buf->duration_ba;
1113
1114                         buf->data.frame_control =
1115                                 cpu_to_le16(IEEE80211_FTYPE_CTL |
1116                                             IEEE80211_STYPE_CTS);
1117
1118                         buf->reserved2 = 0x0;
1119                         memcpy(&buf->data.ra, pDevice->abyCurrentNetAddr, ETH_ALEN);
1120                 }
1121         }
1122 }
1123
1124 /*+
1125  *
1126  * Description:
1127  *      Generate FIFO control for MAC & Baseband controller
1128  *
1129  * Parameters:
1130  *  In:
1131  *      pDevice         - Pointer to adapter
1132  *      pTxDataHead     - Transmit Data Buffer
1133  *      pTxBufHead      - pTxBufHead
1134  *      pvRrvTime        - pvRrvTime
1135  *      pvRTS            - RTS Buffer
1136  *      pCTS            - CTS Buffer
1137  *      cbFrameSize     - Transmit Data Length (Hdr+Payload+FCS)
1138  *      bNeedACK        - If need ACK
1139  *      uDescIdx        - Desc Index
1140  *  Out:
1141  *      none
1142  *
1143  * Return Value: none
1144  *
1145  -*/
1146 // unsigned int cbFrameSize,//Hdr+Payload+FCS
1147 static
1148 void
1149 s_vGenerateTxParameter(
1150         struct vnt_private *pDevice,
1151         unsigned char byPktType,
1152         void *pTxBufHead,
1153         void *pvRrvTime,
1154         void *pvRTS,
1155         void *pvCTS,
1156         unsigned int cbFrameSize,
1157         bool bNeedACK,
1158         unsigned int uDMAIdx,
1159         PSEthernetHeader psEthHeader,
1160         unsigned short wCurrentRate
1161 )
1162 {
1163         unsigned int cbMACHdLen = WLAN_HDR_ADDR3_LEN; //24
1164         unsigned short wFifoCtl;
1165         bool bDisCRC = false;
1166         unsigned char byFBOption = AUTO_FB_NONE;
1167
1168         PSTxBufHead pFifoHead = (PSTxBufHead)pTxBufHead;
1169
1170         pFifoHead->wReserved = wCurrentRate;
1171         wFifoCtl = pFifoHead->wFIFOCtl;
1172
1173         if (wFifoCtl & FIFOCTL_CRCDIS)
1174                 bDisCRC = true;
1175
1176         if (wFifoCtl & FIFOCTL_AUTO_FB_0)
1177                 byFBOption = AUTO_FB_0;
1178         else if (wFifoCtl & FIFOCTL_AUTO_FB_1)
1179                 byFBOption = AUTO_FB_1;
1180
1181         if (pDevice->bLongHeader)
1182                 cbMACHdLen = WLAN_HDR_ADDR3_LEN + 6;
1183
1184         if (!pvRrvTime)
1185                 return;
1186
1187         if (byPktType == PK_TYPE_11GB || byPktType == PK_TYPE_11GA) {
1188                 if (pvRTS != NULL) { //RTS_need
1189                         /* Fill RsvTime */
1190                         struct vnt_rrv_time_rts *buf = pvRrvTime;
1191
1192                         buf->rts_rrv_time_aa = s_uGetRTSCTSRsvTime(pDevice, 2, byPktType, cbFrameSize, wCurrentRate);
1193                         buf->rts_rrv_time_ba = s_uGetRTSCTSRsvTime(pDevice, 1, byPktType, cbFrameSize, wCurrentRate);
1194                         buf->rts_rrv_time_bb = s_uGetRTSCTSRsvTime(pDevice, 0, byPktType, cbFrameSize, wCurrentRate);
1195                         buf->rrv_time_a = vnt_rxtx_rsvtime_le16(pDevice, byPktType, cbFrameSize, wCurrentRate, bNeedACK);
1196                         buf->rrv_time_b = vnt_rxtx_rsvtime_le16(pDevice, PK_TYPE_11B, cbFrameSize, pDevice->byTopCCKBasicRate, bNeedACK);
1197
1198                         s_vFillRTSHead(pDevice, byPktType, pvRTS, cbFrameSize, bNeedACK, bDisCRC, psEthHeader, wCurrentRate, byFBOption);
1199                 } else {//RTS_needless, PCF mode
1200                         struct vnt_rrv_time_cts *buf = pvRrvTime;
1201
1202                         buf->rrv_time_a = vnt_rxtx_rsvtime_le16(pDevice, byPktType, cbFrameSize, wCurrentRate, bNeedACK);
1203                         buf->rrv_time_b = vnt_rxtx_rsvtime_le16(pDevice, PK_TYPE_11B, cbFrameSize, pDevice->byTopCCKBasicRate, bNeedACK);
1204                         buf->cts_rrv_time_ba = s_uGetRTSCTSRsvTime(pDevice, 3, byPktType, cbFrameSize, wCurrentRate);
1205
1206                         //Fill CTS
1207                         s_vFillCTSHead(pDevice, uDMAIdx, byPktType, pvCTS, cbFrameSize, bNeedACK, bDisCRC, wCurrentRate, byFBOption);
1208                 }
1209         } else if (byPktType == PK_TYPE_11A) {
1210                 if (pvRTS != NULL) {//RTS_need, non PCF mode
1211                         struct vnt_rrv_time_ab *buf = pvRrvTime;
1212
1213                         buf->rts_rrv_time = s_uGetRTSCTSRsvTime(pDevice, 2, byPktType, cbFrameSize, wCurrentRate);
1214                         buf->rrv_time = vnt_rxtx_rsvtime_le16(pDevice, byPktType, cbFrameSize, wCurrentRate, bNeedACK);
1215
1216                         //Fill RTS
1217                         s_vFillRTSHead(pDevice, byPktType, pvRTS, cbFrameSize, bNeedACK, bDisCRC, psEthHeader, wCurrentRate, byFBOption);
1218                 } else if (pvRTS == NULL) {//RTS_needless, non PCF mode
1219                         struct vnt_rrv_time_ab *buf = pvRrvTime;
1220
1221                         buf->rrv_time = vnt_rxtx_rsvtime_le16(pDevice, PK_TYPE_11A, cbFrameSize, wCurrentRate, bNeedACK);
1222                 }
1223         } else if (byPktType == PK_TYPE_11B) {
1224                 if ((pvRTS != NULL)) {//RTS_need, non PCF mode
1225                         struct vnt_rrv_time_ab *buf = pvRrvTime;
1226
1227                         buf->rts_rrv_time = s_uGetRTSCTSRsvTime(pDevice, 0, byPktType, cbFrameSize, wCurrentRate);
1228                         buf->rrv_time = vnt_rxtx_rsvtime_le16(pDevice, PK_TYPE_11B, cbFrameSize, wCurrentRate, bNeedACK);
1229
1230                         //Fill RTS
1231                         s_vFillRTSHead(pDevice, byPktType, pvRTS, cbFrameSize, bNeedACK, bDisCRC, psEthHeader, wCurrentRate, byFBOption);
1232                 } else { //RTS_needless, non PCF mode
1233                         struct vnt_rrv_time_ab *buf = pvRrvTime;
1234
1235                         buf->rrv_time = vnt_rxtx_rsvtime_le16(pDevice, PK_TYPE_11B, cbFrameSize, wCurrentRate, bNeedACK);
1236                 }
1237         }
1238 }
1239
1240 static
1241 void
1242 s_vFillFragParameter(
1243         struct vnt_private *pDevice,
1244         unsigned char *pbyBuffer,
1245         unsigned int uTxType,
1246         void *pvtdCurr,
1247         unsigned short wFragType,
1248         unsigned int cbReqCount
1249 )
1250 {
1251         PSTxBufHead pTxBufHead = (PSTxBufHead) pbyBuffer;
1252
1253         if (uTxType == TYPE_SYNCDMA) {
1254                 PSTxSyncDesc ptdCurr = (PSTxSyncDesc)pvtdCurr;
1255
1256                 //Set FIFOCtl & TimeStamp in TxSyncDesc
1257                 ptdCurr->m_wFIFOCtl = pTxBufHead->wFIFOCtl;
1258                 ptdCurr->m_wTimeStamp = pTxBufHead->wTimeStamp;
1259                 //Set TSR1 & ReqCount in TxDescHead
1260                 ptdCurr->m_td1TD1.wReqCount = cpu_to_le16((unsigned short)(cbReqCount));
1261                 if (wFragType == FRAGCTL_ENDFRAG) //Last Fragmentation
1262                         ptdCurr->m_td1TD1.byTCR |= (TCR_STP | TCR_EDP | EDMSDU);
1263                 else
1264                         ptdCurr->m_td1TD1.byTCR |= (TCR_STP | TCR_EDP);
1265         } else {
1266                 PSTxDesc ptdCurr = (PSTxDesc)pvtdCurr;
1267                 //Set TSR1 & ReqCount in TxDescHead
1268                 ptdCurr->m_td1TD1.wReqCount = cpu_to_le16((unsigned short)(cbReqCount));
1269                 if (wFragType == FRAGCTL_ENDFRAG) //Last Fragmentation
1270                         ptdCurr->m_td1TD1.byTCR |= (TCR_STP | TCR_EDP | EDMSDU);
1271                 else
1272                         ptdCurr->m_td1TD1.byTCR |= (TCR_STP | TCR_EDP);
1273         }
1274
1275         pTxBufHead->wFragCtl |= (unsigned short)wFragType;//0x0001; //0000 0000 0000 0001
1276 }
1277
1278 static unsigned int
1279 s_cbFillTxBufHead(struct vnt_private *pDevice, unsigned char byPktType,
1280                   unsigned char *pbyTxBufferAddr, unsigned int cbFrameBodySize,
1281                   unsigned int uDMAIdx, PSTxDesc pHeadTD,
1282                   PSEthernetHeader psEthHeader, unsigned char *pPacket,
1283                   bool bNeedEncrypt, PSKeyItem pTransmitKey,
1284                   unsigned int uNodeIndex, unsigned int *puMACfragNum)
1285 {
1286         unsigned int cbMACHdLen;
1287         unsigned int cbFrameSize;
1288         unsigned int cbFragmentSize; //Hdr+(IV)+payoad+(MIC)+(ICV)+FCS
1289         unsigned int cbFragPayloadSize;
1290         unsigned int cbLastFragmentSize; //Hdr+(IV)+payoad+(MIC)+(ICV)+FCS
1291         unsigned int cbLastFragPayloadSize;
1292         unsigned int uFragIdx;
1293         unsigned char *pbyPayloadHead;
1294         unsigned char *pbyIVHead;
1295         unsigned char *pbyMacHdr;
1296         unsigned short wFragType; //00:Non-Frag, 01:Start, 10:Mid, 11:Last
1297         __le16 uDuration;
1298         unsigned char *pbyBuffer;
1299         unsigned int cbIVlen = 0;
1300         unsigned int cbICVlen = 0;
1301         unsigned int cbMIClen = 0;
1302         unsigned int cbFCSlen = 4;
1303         unsigned int cb802_1_H_len = 0;
1304         unsigned int uLength = 0;
1305         unsigned int uTmpLen = 0;
1306         unsigned int cbMICHDR = 0;
1307         u32 dwMICKey0, dwMICKey1;
1308         u32 dwMIC_Priority;
1309         u32 *pdwMIC_L;
1310         u32 *pdwMIC_R;
1311         u32 dwSafeMIC_L, dwSafeMIC_R; /* Fix "Last Frag Size" < "MIC length". */
1312         bool bMIC2Frag = false;
1313         unsigned int uMICFragLen = 0;
1314         unsigned int uMACfragNum = 1;
1315         unsigned int uPadding = 0;
1316         unsigned int cbReqCount = 0;
1317
1318         bool bNeedACK;
1319         bool bRTS;
1320         bool bIsAdhoc;
1321         unsigned char *pbyType;
1322         PSTxDesc       ptdCurr;
1323         PSTxBufHead    psTxBufHd = (PSTxBufHead) pbyTxBufferAddr;
1324         unsigned int cbHeaderLength = 0;
1325         void *pvRrvTime;
1326         struct vnt_mic_hdr *pMICHDR;
1327         void *pvRTS;
1328         void *pvCTS;
1329         void *pvTxDataHd;
1330         unsigned short wTxBufSize;   // FFinfo size
1331         unsigned int uTotalCopyLength = 0;
1332         unsigned char byFBOption = AUTO_FB_NONE;
1333         bool bIsWEP256 = false;
1334         PSMgmtObject    pMgmt = pDevice->pMgmt;
1335
1336         pvRrvTime = pMICHDR = pvRTS = pvCTS = pvTxDataHd = NULL;
1337
1338         if ((pDevice->op_mode == NL80211_IFTYPE_ADHOC) ||
1339             (pDevice->op_mode == NL80211_IFTYPE_AP)) {
1340                 if (is_multicast_ether_addr(&(psEthHeader->abyDstAddr[0])))
1341                         bNeedACK = false;
1342                 else
1343                         bNeedACK = true;
1344                 bIsAdhoc = true;
1345         } else {
1346                 // MSDUs in Infra mode always need ACK
1347                 bNeedACK = true;
1348                 bIsAdhoc = false;
1349         }
1350
1351         if (pDevice->bLongHeader)
1352                 cbMACHdLen = WLAN_HDR_ADDR3_LEN + 6;
1353         else
1354                 cbMACHdLen = WLAN_HDR_ADDR3_LEN;
1355
1356         if ((bNeedEncrypt == true) && (pTransmitKey != NULL)) {
1357                 if (pTransmitKey->byCipherSuite == KEY_CTL_WEP) {
1358                         cbIVlen = 4;
1359                         cbICVlen = 4;
1360                         if (pTransmitKey->uKeyLength == WLAN_WEP232_KEYLEN)
1361                                 bIsWEP256 = true;
1362                 }
1363                 if (pTransmitKey->byCipherSuite == KEY_CTL_TKIP) {
1364                         cbIVlen = 8;//IV+ExtIV
1365                         cbMIClen = 8;
1366                         cbICVlen = 4;
1367                 }
1368                 if (pTransmitKey->byCipherSuite == KEY_CTL_CCMP) {
1369                         cbIVlen = 8;//RSN Header
1370                         cbICVlen = 8;//MIC
1371                         cbMICHDR = sizeof(struct vnt_mic_hdr);
1372                 }
1373                 if (pDevice->byLocalID > REV_ID_VT3253_A1) {
1374                         //MAC Header should be padding 0 to DW alignment.
1375                         uPadding = 4 - (cbMACHdLen%4);
1376                         uPadding %= 4;
1377                 }
1378         }
1379
1380         cbFrameSize = cbMACHdLen + cbIVlen + (cbFrameBodySize + cbMIClen) + cbICVlen + cbFCSlen;
1381
1382         if ((bNeedACK == false) ||
1383             (cbFrameSize < pDevice->wRTSThreshold) ||
1384             ((cbFrameSize >= pDevice->wFragmentationThreshold) && (pDevice->wFragmentationThreshold <= pDevice->wRTSThreshold))
1385 ) {
1386                 bRTS = false;
1387         } else {
1388                 bRTS = true;
1389                 psTxBufHd->wFIFOCtl |= (FIFOCTL_RTS | FIFOCTL_LRETRY);
1390         }
1391         //
1392         // Use for AUTO FALL BACK
1393         //
1394         if (psTxBufHd->wFIFOCtl & FIFOCTL_AUTO_FB_0)
1395                 byFBOption = AUTO_FB_0;
1396         else if (psTxBufHd->wFIFOCtl & FIFOCTL_AUTO_FB_1)
1397                 byFBOption = AUTO_FB_1;
1398
1399         //////////////////////////////////////////////////////
1400         //Set RrvTime/RTS/CTS Buffer
1401         wTxBufSize = sizeof(STxBufHead);
1402         if (byPktType == PK_TYPE_11GB || byPktType == PK_TYPE_11GA) {//802.11g packet
1403
1404                 if (byFBOption == AUTO_FB_NONE) {
1405                         if (bRTS == true) {//RTS_need
1406                                 pvRrvTime = (void *)(pbyTxBufferAddr + wTxBufSize);
1407                                 pMICHDR = (struct vnt_mic_hdr *)(pbyTxBufferAddr + wTxBufSize + sizeof(struct vnt_rrv_time_rts));
1408                                 pvRTS = (void *)(pbyTxBufferAddr + wTxBufSize + sizeof(struct vnt_rrv_time_rts) + cbMICHDR);
1409                                 pvCTS = NULL;
1410                                 pvTxDataHd = (void *)(pbyTxBufferAddr + wTxBufSize + sizeof(struct vnt_rrv_time_rts) +
1411                                                         cbMICHDR + sizeof(struct vnt_rts_g));
1412                                 cbHeaderLength = wTxBufSize + sizeof(struct vnt_rrv_time_rts) +
1413                                                         cbMICHDR + sizeof(struct vnt_rts_g) +
1414                                                         sizeof(struct vnt_tx_datahead_g);
1415                         } else { //RTS_needless
1416                                 pvRrvTime = (void *)(pbyTxBufferAddr + wTxBufSize);
1417                                 pMICHDR = (struct vnt_mic_hdr *) (pbyTxBufferAddr + wTxBufSize + sizeof(struct vnt_rrv_time_cts));
1418                                 pvRTS = NULL;
1419                                 pvCTS = (void *) (pbyTxBufferAddr + wTxBufSize + sizeof(struct vnt_rrv_time_cts) + cbMICHDR);
1420                                 pvTxDataHd = (void *)(pbyTxBufferAddr + wTxBufSize +
1421                                                 sizeof(struct vnt_rrv_time_cts) + cbMICHDR + sizeof(struct vnt_cts));
1422                                 cbHeaderLength = wTxBufSize + sizeof(struct vnt_rrv_time_cts) +
1423                                                         cbMICHDR + sizeof(struct vnt_cts) + sizeof(struct vnt_tx_datahead_g);
1424                         }
1425                 } else {
1426                         // Auto Fall Back
1427                         if (bRTS == true) {//RTS_need
1428                                 pvRrvTime = (void *)(pbyTxBufferAddr + wTxBufSize);
1429                                 pMICHDR = (struct vnt_mic_hdr *) (pbyTxBufferAddr + wTxBufSize + sizeof(struct vnt_rrv_time_rts));
1430                                 pvRTS = (void *) (pbyTxBufferAddr + wTxBufSize + sizeof(struct vnt_rrv_time_rts) + cbMICHDR);
1431                                 pvCTS = NULL;
1432                                 pvTxDataHd = (void *)(pbyTxBufferAddr + wTxBufSize + sizeof(struct vnt_rrv_time_rts) +
1433                                         cbMICHDR + sizeof(struct vnt_rts_g_fb));
1434                                 cbHeaderLength = wTxBufSize + sizeof(struct vnt_rrv_time_rts) +
1435                                         cbMICHDR + sizeof(struct vnt_rts_g_fb) + sizeof(struct vnt_tx_datahead_g_fb);
1436                         } else { //RTS_needless
1437                                 pvRrvTime = (void *)(pbyTxBufferAddr + wTxBufSize);
1438                                 pMICHDR = (struct vnt_mic_hdr *) (pbyTxBufferAddr + wTxBufSize + sizeof(struct vnt_rrv_time_cts));
1439                                 pvRTS = NULL;
1440                                 pvCTS = (void *)(pbyTxBufferAddr + wTxBufSize + sizeof(struct vnt_rrv_time_cts) + cbMICHDR);
1441                                 pvTxDataHd = (void  *)(pbyTxBufferAddr + wTxBufSize + sizeof(struct vnt_rrv_time_cts) +
1442                                         cbMICHDR + sizeof(struct vnt_cts_fb));
1443                                 cbHeaderLength = wTxBufSize + sizeof(struct vnt_rrv_time_cts) +
1444                                         cbMICHDR + sizeof(struct vnt_cts_fb) + sizeof(struct vnt_tx_datahead_g_fb);
1445                         }
1446                 } // Auto Fall Back
1447         } else {//802.11a/b packet
1448
1449                 if (byFBOption == AUTO_FB_NONE) {
1450                         if (bRTS == true) {
1451                                 pvRrvTime = (void *)(pbyTxBufferAddr + wTxBufSize);
1452                                 pMICHDR = (struct vnt_mic_hdr *) (pbyTxBufferAddr + wTxBufSize + sizeof(struct vnt_rrv_time_ab));
1453                                 pvRTS = (void *)(pbyTxBufferAddr + wTxBufSize + sizeof(struct vnt_rrv_time_ab) + cbMICHDR);
1454                                 pvCTS = NULL;
1455                                 pvTxDataHd = (void *)(pbyTxBufferAddr + wTxBufSize +
1456                                         sizeof(struct vnt_rrv_time_ab) + cbMICHDR + sizeof(struct vnt_rts_ab));
1457                                 cbHeaderLength = wTxBufSize + sizeof(struct vnt_rrv_time_ab) +
1458                                         cbMICHDR + sizeof(struct vnt_rts_ab) + sizeof(struct vnt_tx_datahead_ab);
1459                         } else { //RTS_needless, need MICHDR
1460                                 pvRrvTime = (void *)(pbyTxBufferAddr + wTxBufSize);
1461                                 pMICHDR = (struct vnt_mic_hdr *) (pbyTxBufferAddr + wTxBufSize + sizeof(struct vnt_rrv_time_ab));
1462                                 pvRTS = NULL;
1463                                 pvCTS = NULL;
1464                                 pvTxDataHd = (void *)(pbyTxBufferAddr + wTxBufSize + sizeof(struct vnt_rrv_time_ab) + cbMICHDR);
1465                                 cbHeaderLength = wTxBufSize + sizeof(struct vnt_rrv_time_ab) +
1466                                         cbMICHDR + sizeof(struct vnt_tx_datahead_ab);
1467                         }
1468                 } else {
1469                         // Auto Fall Back
1470                         if (bRTS == true) {//RTS_need
1471                                 pvRrvTime = (void *)(pbyTxBufferAddr + wTxBufSize);
1472                                 pMICHDR = (struct vnt_mic_hdr *) (pbyTxBufferAddr + wTxBufSize + sizeof(struct vnt_rrv_time_ab));
1473                                 pvRTS = (void *)(pbyTxBufferAddr + wTxBufSize + sizeof(struct vnt_rrv_time_ab) + cbMICHDR);
1474                                 pvCTS = NULL;
1475                                 pvTxDataHd = (void *)(pbyTxBufferAddr + wTxBufSize +
1476                                         sizeof(struct vnt_rrv_time_ab) + cbMICHDR + sizeof(struct vnt_rts_a_fb));
1477                                 cbHeaderLength = wTxBufSize + sizeof(struct vnt_rrv_time_ab) +
1478                                         cbMICHDR + sizeof(struct vnt_rts_a_fb) + sizeof(struct vnt_tx_datahead_a_fb);
1479                         } else { //RTS_needless
1480                                 pvRrvTime = (void *)(pbyTxBufferAddr + wTxBufSize);
1481                                 pMICHDR = (struct vnt_mic_hdr *)(pbyTxBufferAddr + wTxBufSize + sizeof(struct vnt_rrv_time_ab));
1482                                 pvRTS = NULL;
1483                                 pvCTS = NULL;
1484                                 pvTxDataHd = (void *)(pbyTxBufferAddr + wTxBufSize + sizeof(struct vnt_rrv_time_ab) + cbMICHDR);
1485                                 cbHeaderLength = wTxBufSize + sizeof(struct vnt_rrv_time_ab) +
1486                                         cbMICHDR + sizeof(struct vnt_tx_datahead_a_fb);
1487                         }
1488                 } // Auto Fall Back
1489         }
1490         memset((void *)(pbyTxBufferAddr + wTxBufSize), 0, (cbHeaderLength - wTxBufSize));
1491
1492 //////////////////////////////////////////////////////////////////
1493         if ((bNeedEncrypt == true) && (pTransmitKey != NULL) && (pTransmitKey->byCipherSuite == KEY_CTL_TKIP)) {
1494                 if (pDevice->pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) {
1495                         dwMICKey0 = *(u32 *)(&pTransmitKey->abyKey[16]);
1496                         dwMICKey1 = *(u32 *)(&pTransmitKey->abyKey[20]);
1497                 } else if ((pTransmitKey->dwKeyIndex & AUTHENTICATOR_KEY) != 0) {
1498                         dwMICKey0 = *(u32 *)(&pTransmitKey->abyKey[16]);
1499                         dwMICKey1 = *(u32 *)(&pTransmitKey->abyKey[20]);
1500                 } else {
1501                         dwMICKey0 = *(u32 *)(&pTransmitKey->abyKey[24]);
1502                         dwMICKey1 = *(u32 *)(&pTransmitKey->abyKey[28]);
1503                 }
1504                 // DO Software Michael
1505                 MIC_vInit(dwMICKey0, dwMICKey1);
1506                 MIC_vAppend((unsigned char *)&(psEthHeader->abyDstAddr[0]), 12);
1507                 dwMIC_Priority = 0;
1508                 MIC_vAppend((unsigned char *)&dwMIC_Priority, 4);
1509                 pr_debug("MIC KEY: %X, %X\n", dwMICKey0, dwMICKey1);
1510         }
1511
1512 ///////////////////////////////////////////////////////////////////
1513
1514         pbyMacHdr = (unsigned char *)(pbyTxBufferAddr + cbHeaderLength);
1515         pbyPayloadHead = (unsigned char *)(pbyMacHdr + cbMACHdLen + uPadding + cbIVlen);
1516         pbyIVHead = (unsigned char *)(pbyMacHdr + cbMACHdLen + uPadding);
1517
1518         if ((cbFrameSize > pDevice->wFragmentationThreshold) && (bNeedACK == true) && (bIsWEP256 == false)) {
1519                 // Fragmentation
1520                 // FragThreshold = Fragment size(Hdr+(IV)+fragment payload+(MIC)+(ICV)+FCS)
1521                 cbFragmentSize = pDevice->wFragmentationThreshold;
1522                 cbFragPayloadSize = cbFragmentSize - cbMACHdLen - cbIVlen - cbICVlen - cbFCSlen;
1523                 //FragNum = (FrameSize-(Hdr+FCS))/(Fragment Size -(Hrd+FCS)))
1524                 uMACfragNum = (unsigned short) ((cbFrameBodySize + cbMIClen) / cbFragPayloadSize);
1525                 cbLastFragPayloadSize = (cbFrameBodySize + cbMIClen) % cbFragPayloadSize;
1526                 if (cbLastFragPayloadSize == 0)
1527                         cbLastFragPayloadSize = cbFragPayloadSize;
1528                 else
1529                         uMACfragNum++;
1530
1531                 //[Hdr+(IV)+last fragment payload+(MIC)+(ICV)+FCS]
1532                 cbLastFragmentSize = cbMACHdLen + cbLastFragPayloadSize + cbIVlen + cbICVlen + cbFCSlen;
1533
1534                 for (uFragIdx = 0; uFragIdx < uMACfragNum; uFragIdx++) {
1535                         if (uFragIdx == 0) {
1536                                 //=========================
1537                                 //    Start Fragmentation
1538                                 //=========================
1539                                 pr_debug("Start Fragmentation...\n");
1540                                 wFragType = FRAGCTL_STAFRAG;
1541
1542                                 //Fill FIFO,RrvTime,RTS,and CTS
1543                                 s_vGenerateTxParameter(pDevice, byPktType, (void *)psTxBufHd, pvRrvTime, pvRTS, pvCTS,
1544                                                        cbFragmentSize, bNeedACK, uDMAIdx, psEthHeader, pDevice->wCurrentRate);
1545                                 //Fill DataHead
1546                                 uDuration = s_uFillDataHead(pDevice, byPktType, pvTxDataHd, cbFragmentSize, uDMAIdx, bNeedACK,
1547                                                             uFragIdx, cbLastFragmentSize, uMACfragNum, byFBOption, pDevice->wCurrentRate);
1548                                 // Generate TX MAC Header
1549                                 vGenerateMACHeader(pDevice, pbyMacHdr, uDuration, psEthHeader, bNeedEncrypt,
1550                                                    wFragType, uDMAIdx, uFragIdx);
1551
1552                                 if (bNeedEncrypt == true) {
1553                                         //Fill TXKEY
1554                                         s_vFillTxKey(pDevice, (unsigned char *)(psTxBufHd->adwTxKey), pbyIVHead, pTransmitKey,
1555                                                      pbyMacHdr, (unsigned short)cbFragPayloadSize, (unsigned char *)pMICHDR);
1556                                         //Fill IV(ExtIV,RSNHDR)
1557                                         if (pDevice->bEnableHostWEP) {
1558                                                 pMgmt->sNodeDBTable[uNodeIndex].dwTSC47_16 = pTransmitKey->dwTSC47_16;
1559                                                 pMgmt->sNodeDBTable[uNodeIndex].wTSC15_0 = pTransmitKey->wTSC15_0;
1560                                         }
1561                                 }
1562
1563                                 // 802.1H
1564                                 if (ntohs(psEthHeader->wType) > ETH_DATA_LEN) {
1565                                         if ((psEthHeader->wType == TYPE_PKT_IPX) ||
1566                                             (psEthHeader->wType == cpu_to_le16(0xF380))) {
1567                                                 memcpy((unsigned char *)(pbyPayloadHead), &pDevice->abySNAP_Bridgetunnel[0], 6);
1568                                         } else {
1569                                                 memcpy((unsigned char *)(pbyPayloadHead), &pDevice->abySNAP_RFC1042[0], 6);
1570                                         }
1571                                         pbyType = (unsigned char *)(pbyPayloadHead + 6);
1572                                         memcpy(pbyType, &(psEthHeader->wType), sizeof(unsigned short));
1573                                         cb802_1_H_len = 8;
1574                                 }
1575
1576                                 cbReqCount = cbHeaderLength + cbMACHdLen + uPadding + cbIVlen + cbFragPayloadSize;
1577                                 //---------------------------
1578                                 // S/W or H/W Encryption
1579                                 //---------------------------
1580                                 pbyBuffer = (unsigned char *)pHeadTD->pTDInfo->buf;
1581
1582                                 uLength = cbHeaderLength + cbMACHdLen + uPadding + cbIVlen + cb802_1_H_len;
1583                                 //copy TxBufferHeader + MacHeader to desc
1584                                 memcpy(pbyBuffer, (void *)psTxBufHd, uLength);
1585
1586                                 // Copy the Packet into a tx Buffer
1587                                 memcpy((pbyBuffer + uLength), (pPacket + 14), (cbFragPayloadSize - cb802_1_H_len));
1588
1589                                 uTotalCopyLength += cbFragPayloadSize - cb802_1_H_len;
1590
1591                                 if ((bNeedEncrypt == true) && (pTransmitKey != NULL) && (pTransmitKey->byCipherSuite == KEY_CTL_TKIP)) {
1592                                         pr_debug("Start MIC: %d\n",
1593                                                  cbFragPayloadSize);
1594                                         MIC_vAppend((pbyBuffer + uLength - cb802_1_H_len), cbFragPayloadSize);
1595
1596                                 }
1597
1598                                 //---------------------------
1599                                 // S/W Encryption
1600                                 //---------------------------
1601                                 if ((pDevice->byLocalID <= REV_ID_VT3253_A1)) {
1602                                         if (bNeedEncrypt) {
1603                                                 s_vSWencryption(pDevice, pTransmitKey, (pbyBuffer + uLength - cb802_1_H_len), (unsigned short)cbFragPayloadSize);
1604                                                 cbReqCount += cbICVlen;
1605                                         }
1606                                 }
1607
1608                                 ptdCurr = (PSTxDesc)pHeadTD;
1609                                 //--------------------
1610                                 //1.Set TSR1 & ReqCount in TxDescHead
1611                                 //2.Set FragCtl in TxBufferHead
1612                                 //3.Set Frame Control
1613                                 //4.Set Sequence Control
1614                                 //5.Get S/W generate FCS
1615                                 //--------------------
1616                                 s_vFillFragParameter(pDevice, pbyBuffer, uDMAIdx, (void *)ptdCurr, wFragType, cbReqCount);
1617
1618                                 ptdCurr->pTDInfo->dwReqCount = cbReqCount - uPadding;
1619                                 ptdCurr->pTDInfo->dwHeaderLength = cbHeaderLength;
1620                                 ptdCurr->pTDInfo->skb_dma = ptdCurr->pTDInfo->buf_dma;
1621                                 ptdCurr->buff_addr = cpu_to_le32(ptdCurr->pTDInfo->skb_dma);
1622                                 pDevice->iTDUsed[uDMAIdx]++;
1623                                 pHeadTD = ptdCurr->next;
1624                         } else if (uFragIdx == (uMACfragNum-1)) {
1625                                 //=========================
1626                                 //    Last Fragmentation
1627                                 //=========================
1628                                 pr_debug("Last Fragmentation...\n");
1629
1630                                 wFragType = FRAGCTL_ENDFRAG;
1631
1632                                 //Fill FIFO,RrvTime,RTS,and CTS
1633                                 s_vGenerateTxParameter(pDevice, byPktType, (void *)psTxBufHd, pvRrvTime, pvRTS, pvCTS,
1634                                                        cbLastFragmentSize, bNeedACK, uDMAIdx, psEthHeader, pDevice->wCurrentRate);
1635                                 //Fill DataHead
1636                                 uDuration = s_uFillDataHead(pDevice, byPktType, pvTxDataHd, cbLastFragmentSize, uDMAIdx, bNeedACK,
1637                                                             uFragIdx, cbLastFragmentSize, uMACfragNum, byFBOption, pDevice->wCurrentRate);
1638
1639                                 // Generate TX MAC Header
1640                                 vGenerateMACHeader(pDevice, pbyMacHdr, uDuration, psEthHeader, bNeedEncrypt,
1641                                                    wFragType, uDMAIdx, uFragIdx);
1642
1643                                 if (bNeedEncrypt == true) {
1644                                         //Fill TXKEY
1645                                         s_vFillTxKey(pDevice, (unsigned char *)(psTxBufHd->adwTxKey), pbyIVHead, pTransmitKey,
1646                                                      pbyMacHdr, (unsigned short)cbLastFragPayloadSize, (unsigned char *)pMICHDR);
1647
1648                                         if (pDevice->bEnableHostWEP) {
1649                                                 pMgmt->sNodeDBTable[uNodeIndex].dwTSC47_16 = pTransmitKey->dwTSC47_16;
1650                                                 pMgmt->sNodeDBTable[uNodeIndex].wTSC15_0 = pTransmitKey->wTSC15_0;
1651                                         }
1652
1653                                 }
1654
1655                                 cbReqCount = cbHeaderLength + cbMACHdLen + uPadding + cbIVlen + cbLastFragPayloadSize;
1656                                 //---------------------------
1657                                 // S/W or H/W Encryption
1658                                 //---------------------------
1659
1660                                 pbyBuffer = (unsigned char *)pHeadTD->pTDInfo->buf;
1661
1662                                 uLength = cbHeaderLength + cbMACHdLen + uPadding + cbIVlen;
1663
1664                                 //copy TxBufferHeader + MacHeader to desc
1665                                 memcpy(pbyBuffer, (void *)psTxBufHd, uLength);
1666
1667                                 // Copy the Packet into a tx Buffer
1668                                 if (bMIC2Frag == false) {
1669                                         memcpy((pbyBuffer + uLength),
1670                                                (pPacket + 14 + uTotalCopyLength),
1671                                                (cbLastFragPayloadSize - cbMIClen)
1672 );
1673                                         //TODO check uTmpLen !
1674                                         uTmpLen = cbLastFragPayloadSize - cbMIClen;
1675
1676                                 }
1677                                 if ((bNeedEncrypt == true) && (pTransmitKey != NULL) && (pTransmitKey->byCipherSuite == KEY_CTL_TKIP)) {
1678                                         pr_debug("LAST: uMICFragLen:%d, cbLastFragPayloadSize:%d, uTmpLen:%d\n",
1679                                                  uMICFragLen,
1680                                                  cbLastFragPayloadSize,
1681                                                  uTmpLen);
1682
1683                                         if (bMIC2Frag == false) {
1684                                                 if (uTmpLen != 0)
1685                                                         MIC_vAppend((pbyBuffer + uLength), uTmpLen);
1686                                                 pdwMIC_L = (u32 *)(pbyBuffer + uLength + uTmpLen);
1687                                                 pdwMIC_R = (u32 *)(pbyBuffer + uLength + uTmpLen + 4);
1688                                                 MIC_vGetMIC(pdwMIC_L, pdwMIC_R);
1689                                                 pr_debug("Last MIC:%X, %X\n",
1690                                                          *pdwMIC_L, *pdwMIC_R);
1691                                         } else {
1692                                                 if (uMICFragLen >= 4) {
1693                                                         memcpy((pbyBuffer + uLength), ((unsigned char *)&dwSafeMIC_R + (uMICFragLen - 4)),
1694                                                                (cbMIClen - uMICFragLen));
1695                                                         pr_debug("LAST: uMICFragLen >= 4: %X, %d\n",
1696                                                                  *(unsigned char *)((unsigned char *)&dwSafeMIC_R + (uMICFragLen - 4)),
1697                                                                  (cbMIClen - uMICFragLen));
1698
1699                                                 } else {
1700                                                         memcpy((pbyBuffer + uLength), ((unsigned char *)&dwSafeMIC_L + uMICFragLen),
1701                                                                (4 - uMICFragLen));
1702                                                         memcpy((pbyBuffer + uLength + (4 - uMICFragLen)), &dwSafeMIC_R, 4);
1703                                                         pr_debug("LAST: uMICFragLen < 4: %X, %d\n",
1704                                                                  *(unsigned char *)((unsigned char *)&dwSafeMIC_R + uMICFragLen - 4),
1705                                                                  (cbMIClen - uMICFragLen));
1706                                                 }
1707                                         }
1708                                         MIC_vUnInit();
1709                                 } else {
1710                                         ASSERT(uTmpLen == (cbLastFragPayloadSize - cbMIClen));
1711                                 }
1712
1713                                 //---------------------------
1714                                 // S/W Encryption
1715                                 //---------------------------
1716                                 if ((pDevice->byLocalID <= REV_ID_VT3253_A1)) {
1717                                         if (bNeedEncrypt) {
1718                                                 s_vSWencryption(pDevice, pTransmitKey, (pbyBuffer + uLength), (unsigned short)cbLastFragPayloadSize);
1719                                                 cbReqCount += cbICVlen;
1720                                         }
1721                                 }
1722
1723                                 ptdCurr = (PSTxDesc)pHeadTD;
1724
1725                                 //--------------------
1726                                 //1.Set TSR1 & ReqCount in TxDescHead
1727                                 //2.Set FragCtl in TxBufferHead
1728                                 //3.Set Frame Control
1729                                 //4.Set Sequence Control
1730                                 //5.Get S/W generate FCS
1731                                 //--------------------
1732
1733                                 s_vFillFragParameter(pDevice, pbyBuffer, uDMAIdx, (void *)ptdCurr, wFragType, cbReqCount);
1734
1735                                 ptdCurr->pTDInfo->dwReqCount = cbReqCount - uPadding;
1736                                 ptdCurr->pTDInfo->dwHeaderLength = cbHeaderLength;
1737                                 ptdCurr->pTDInfo->skb_dma = ptdCurr->pTDInfo->buf_dma;
1738                                 ptdCurr->buff_addr = cpu_to_le32(ptdCurr->pTDInfo->skb_dma);
1739                                 pDevice->iTDUsed[uDMAIdx]++;
1740                                 pHeadTD = ptdCurr->next;
1741
1742                         } else {
1743                                 //=========================
1744                                 //    Middle Fragmentation
1745                                 //=========================
1746                                 pr_debug("Middle Fragmentation...\n");
1747
1748                                 wFragType = FRAGCTL_MIDFRAG;
1749
1750                                 //Fill FIFO,RrvTime,RTS,and CTS
1751                                 s_vGenerateTxParameter(pDevice, byPktType, (void *)psTxBufHd, pvRrvTime, pvRTS, pvCTS,
1752                                                        cbFragmentSize, bNeedACK, uDMAIdx, psEthHeader, pDevice->wCurrentRate);
1753                                 //Fill DataHead
1754                                 uDuration = s_uFillDataHead(pDevice, byPktType, pvTxDataHd, cbFragmentSize, uDMAIdx, bNeedACK,
1755                                                             uFragIdx, cbLastFragmentSize, uMACfragNum, byFBOption, pDevice->wCurrentRate);
1756
1757                                 // Generate TX MAC Header
1758                                 vGenerateMACHeader(pDevice, pbyMacHdr, uDuration, psEthHeader, bNeedEncrypt,
1759                                                    wFragType, uDMAIdx, uFragIdx);
1760
1761                                 if (bNeedEncrypt == true) {
1762                                         //Fill TXKEY
1763                                         s_vFillTxKey(pDevice, (unsigned char *)(psTxBufHd->adwTxKey), pbyIVHead, pTransmitKey,
1764                                                      pbyMacHdr, (unsigned short)cbFragPayloadSize, (unsigned char *)pMICHDR);
1765
1766                                         if (pDevice->bEnableHostWEP) {
1767                                                 pMgmt->sNodeDBTable[uNodeIndex].dwTSC47_16 = pTransmitKey->dwTSC47_16;
1768                                                 pMgmt->sNodeDBTable[uNodeIndex].wTSC15_0 = pTransmitKey->wTSC15_0;
1769                                         }
1770                                 }
1771
1772                                 cbReqCount = cbHeaderLength + cbMACHdLen + uPadding + cbIVlen + cbFragPayloadSize;
1773                                 //---------------------------
1774                                 // S/W or H/W Encryption
1775                                 //---------------------------
1776
1777                                 pbyBuffer = (unsigned char *)pHeadTD->pTDInfo->buf;
1778                                 uLength = cbHeaderLength + cbMACHdLen + uPadding + cbIVlen;
1779
1780                                 //copy TxBufferHeader + MacHeader to desc
1781                                 memcpy(pbyBuffer, (void *)psTxBufHd, uLength);
1782
1783                                 // Copy the Packet into a tx Buffer
1784                                 memcpy((pbyBuffer + uLength),
1785                                        (pPacket + 14 + uTotalCopyLength),
1786                                        cbFragPayloadSize
1787 );
1788                                 uTmpLen = cbFragPayloadSize;
1789
1790                                 uTotalCopyLength += uTmpLen;
1791
1792                                 if ((bNeedEncrypt == true) && (pTransmitKey != NULL) && (pTransmitKey->byCipherSuite == KEY_CTL_TKIP)) {
1793                                         MIC_vAppend((pbyBuffer + uLength), uTmpLen);
1794
1795                                         if (uTmpLen < cbFragPayloadSize) {
1796                                                 bMIC2Frag = true;
1797                                                 uMICFragLen = cbFragPayloadSize - uTmpLen;
1798                                                 ASSERT(uMICFragLen < cbMIClen);
1799
1800                                                 pdwMIC_L = (u32 *)(pbyBuffer + uLength + uTmpLen);
1801                                                 pdwMIC_R = (u32 *)(pbyBuffer + uLength + uTmpLen + 4);
1802                                                 MIC_vGetMIC(pdwMIC_L, pdwMIC_R);
1803                                                 dwSafeMIC_L = *pdwMIC_L;
1804                                                 dwSafeMIC_R = *pdwMIC_R;
1805
1806                                                 pr_debug("MIDDLE: uMICFragLen:%d, cbFragPayloadSize:%d, uTmpLen:%d\n",
1807                                                          uMICFragLen,
1808                                                          cbFragPayloadSize,
1809                                                          uTmpLen);
1810                                                 pr_debug("Fill MIC in Middle frag [%d]\n",
1811                                                          uMICFragLen);
1812                                                 pr_debug("Get MIC:%X, %X\n",
1813                                                          *pdwMIC_L, *pdwMIC_R);
1814                                         }
1815                                         pr_debug("Middle frag len: %d\n",
1816                                                  uTmpLen);
1817
1818                                 } else {
1819                                         ASSERT(uTmpLen == (cbFragPayloadSize));
1820                                 }
1821
1822                                 if ((pDevice->byLocalID <= REV_ID_VT3253_A1)) {
1823                                         if (bNeedEncrypt) {
1824                                                 s_vSWencryption(pDevice, pTransmitKey, (pbyBuffer + uLength), (unsigned short)cbFragPayloadSize);
1825                                                 cbReqCount += cbICVlen;
1826                                         }
1827                                 }
1828
1829                                 ptdCurr = (PSTxDesc)pHeadTD;
1830
1831                                 //--------------------
1832                                 //1.Set TSR1 & ReqCount in TxDescHead
1833                                 //2.Set FragCtl in TxBufferHead
1834                                 //3.Set Frame Control
1835                                 //4.Set Sequence Control
1836                                 //5.Get S/W generate FCS
1837                                 //--------------------
1838
1839                                 s_vFillFragParameter(pDevice, pbyBuffer, uDMAIdx, (void *)ptdCurr, wFragType, cbReqCount);
1840
1841                                 ptdCurr->pTDInfo->dwReqCount = cbReqCount - uPadding;
1842                                 ptdCurr->pTDInfo->dwHeaderLength = cbHeaderLength;
1843                                 ptdCurr->pTDInfo->skb_dma = ptdCurr->pTDInfo->buf_dma;
1844                                 ptdCurr->buff_addr = cpu_to_le32(ptdCurr->pTDInfo->skb_dma);
1845                                 pDevice->iTDUsed[uDMAIdx]++;
1846                                 pHeadTD = ptdCurr->next;
1847                         }
1848                 }  // for (uMACfragNum)
1849         } else {
1850                 //=========================
1851                 //    No Fragmentation
1852                 //=========================
1853                 wFragType = FRAGCTL_NONFRAG;
1854
1855                 //Set FragCtl in TxBufferHead
1856                 psTxBufHd->wFragCtl |= (unsigned short)wFragType;
1857
1858                 //Fill FIFO,RrvTime,RTS,and CTS
1859                 s_vGenerateTxParameter(pDevice, byPktType, (void *)psTxBufHd, pvRrvTime, pvRTS, pvCTS,
1860                                        cbFrameSize, bNeedACK, uDMAIdx, psEthHeader, pDevice->wCurrentRate);
1861                 //Fill DataHead
1862                 uDuration = s_uFillDataHead(pDevice, byPktType, pvTxDataHd, cbFrameSize, uDMAIdx, bNeedACK,
1863                                             0, 0, uMACfragNum, byFBOption, pDevice->wCurrentRate);
1864
1865                 // Generate TX MAC Header
1866                 vGenerateMACHeader(pDevice, pbyMacHdr, uDuration, psEthHeader, bNeedEncrypt,
1867                                    wFragType, uDMAIdx, 0);
1868
1869                 if (bNeedEncrypt == true) {
1870                         //Fill TXKEY
1871                         s_vFillTxKey(pDevice, (unsigned char *)(psTxBufHd->adwTxKey), pbyIVHead, pTransmitKey,
1872                                      pbyMacHdr, (unsigned short)cbFrameBodySize, (unsigned char *)pMICHDR);
1873
1874                         if (pDevice->bEnableHostWEP) {
1875                                 pMgmt->sNodeDBTable[uNodeIndex].dwTSC47_16 = pTransmitKey->dwTSC47_16;
1876                                 pMgmt->sNodeDBTable[uNodeIndex].wTSC15_0 = pTransmitKey->wTSC15_0;
1877                         }
1878                 }
1879
1880                 // 802.1H
1881                 if (ntohs(psEthHeader->wType) > ETH_DATA_LEN) {
1882                         if ((psEthHeader->wType == TYPE_PKT_IPX) ||
1883                             (psEthHeader->wType == cpu_to_le16(0xF380))) {
1884                                 memcpy((unsigned char *)(pbyPayloadHead), &pDevice->abySNAP_Bridgetunnel[0], 6);
1885                         } else {
1886                                 memcpy((unsigned char *)(pbyPayloadHead), &pDevice->abySNAP_RFC1042[0], 6);
1887                         }
1888                         pbyType = (unsigned char *)(pbyPayloadHead + 6);
1889                         memcpy(pbyType, &(psEthHeader->wType), sizeof(unsigned short));
1890                         cb802_1_H_len = 8;
1891                 }
1892
1893                 cbReqCount = cbHeaderLength + cbMACHdLen + uPadding + cbIVlen + (cbFrameBodySize + cbMIClen);
1894                 //---------------------------
1895                 // S/W or H/W Encryption
1896                 //---------------------------
1897                 pbyBuffer = (unsigned char *)pHeadTD->pTDInfo->buf;
1898                 uLength = cbHeaderLength + cbMACHdLen + uPadding + cbIVlen + cb802_1_H_len;
1899
1900                 //copy TxBufferHeader + MacHeader to desc
1901                 memcpy(pbyBuffer, (void *)psTxBufHd, uLength);
1902
1903                 // Copy the Packet into a tx Buffer
1904                 memcpy((pbyBuffer + uLength),
1905                        (pPacket + 14),
1906                        cbFrameBodySize - cb802_1_H_len
1907 );
1908
1909                 if ((bNeedEncrypt == true) && (pTransmitKey != NULL) && (pTransmitKey->byCipherSuite == KEY_CTL_TKIP)) {
1910                         pr_debug("Length:%d, %d\n",
1911                                  cbFrameBodySize - cb802_1_H_len, uLength);
1912
1913                         MIC_vAppend((pbyBuffer + uLength - cb802_1_H_len), cbFrameBodySize);
1914
1915                         pdwMIC_L = (u32 *)(pbyBuffer + uLength - cb802_1_H_len + cbFrameBodySize);
1916                         pdwMIC_R = (u32 *)(pbyBuffer + uLength - cb802_1_H_len + cbFrameBodySize + 4);
1917
1918                         MIC_vGetMIC(pdwMIC_L, pdwMIC_R);
1919                         MIC_vUnInit();
1920
1921                         if (pDevice->bTxMICFail == true) {
1922                                 *pdwMIC_L = 0;
1923                                 *pdwMIC_R = 0;
1924                                 pDevice->bTxMICFail = false;
1925                         }
1926
1927                         pr_debug("uLength: %d, %d\n", uLength, cbFrameBodySize);
1928                         pr_debug("cbReqCount:%d, %d, %d, %d\n",
1929                                  cbReqCount, cbHeaderLength, uPadding, cbIVlen);
1930                         pr_debug("MIC:%x, %x\n", *pdwMIC_L, *pdwMIC_R);
1931
1932                 }
1933
1934                 if ((pDevice->byLocalID <= REV_ID_VT3253_A1)) {
1935                         if (bNeedEncrypt) {
1936                                 s_vSWencryption(pDevice, pTransmitKey, (pbyBuffer + uLength - cb802_1_H_len),
1937                                                 (unsigned short)(cbFrameBodySize + cbMIClen));
1938                                 cbReqCount += cbICVlen;
1939                         }
1940                 }
1941
1942                 ptdCurr = (PSTxDesc)pHeadTD;
1943
1944                 ptdCurr->pTDInfo->dwReqCount = cbReqCount - uPadding;
1945                 ptdCurr->pTDInfo->dwHeaderLength = cbHeaderLength;
1946                 ptdCurr->pTDInfo->skb_dma = ptdCurr->pTDInfo->buf_dma;
1947                 ptdCurr->buff_addr = cpu_to_le32(ptdCurr->pTDInfo->skb_dma);
1948                 //Set TSR1 & ReqCount in TxDescHead
1949                 ptdCurr->m_td1TD1.byTCR |= (TCR_STP | TCR_EDP | EDMSDU);
1950                 ptdCurr->m_td1TD1.wReqCount = cpu_to_le16((unsigned short)(cbReqCount));
1951
1952                 pDevice->iTDUsed[uDMAIdx]++;
1953
1954         }
1955         *puMACfragNum = uMACfragNum;
1956
1957         return cbHeaderLength;
1958 }
1959
1960 void
1961 vGenerateFIFOHeader(struct vnt_private *pDevice, unsigned char byPktType,
1962                     unsigned char *pbyTxBufferAddr, bool bNeedEncrypt,
1963                     unsigned int cbPayloadSize, unsigned int uDMAIdx,
1964                     PSTxDesc pHeadTD, PSEthernetHeader psEthHeader, unsigned char *pPacket,
1965                     PSKeyItem pTransmitKey, unsigned int uNodeIndex, unsigned int *puMACfragNum,
1966                     unsigned int *pcbHeaderSize)
1967 {
1968         unsigned int wTxBufSize;       // FFinfo size
1969         bool bNeedACK;
1970         bool bIsAdhoc;
1971         unsigned short cbMacHdLen;
1972         PSTxBufHead     pTxBufHead = (PSTxBufHead) pbyTxBufferAddr;
1973
1974         wTxBufSize = sizeof(STxBufHead);
1975
1976         memset(pTxBufHead, 0, wTxBufSize);
1977         //Set FIFOCTL_NEEDACK
1978
1979         if ((pDevice->op_mode == NL80211_IFTYPE_ADHOC) ||
1980             (pDevice->op_mode == NL80211_IFTYPE_AP)) {
1981                 if (is_multicast_ether_addr(&(psEthHeader->abyDstAddr[0]))) {
1982                         bNeedACK = false;
1983                         pTxBufHead->wFIFOCtl = pTxBufHead->wFIFOCtl & (~FIFOCTL_NEEDACK);
1984                 } else {
1985                         bNeedACK = true;
1986                         pTxBufHead->wFIFOCtl |= FIFOCTL_NEEDACK;
1987                 }
1988                 bIsAdhoc = true;
1989         } else {
1990                 // MSDUs in Infra mode always need ACK
1991                 bNeedACK = true;
1992                 pTxBufHead->wFIFOCtl |= FIFOCTL_NEEDACK;
1993                 bIsAdhoc = false;
1994         }
1995
1996         pTxBufHead->wFIFOCtl |= FIFOCTL_TMOEN;
1997         pTxBufHead->wTimeStamp = cpu_to_le16(DEFAULT_MSDU_LIFETIME_RES_64us);
1998
1999         //Set FIFOCTL_LHEAD
2000         if (pDevice->bLongHeader)
2001                 pTxBufHead->wFIFOCtl |= FIFOCTL_LHEAD;
2002
2003         //Set FIFOCTL_GENINT
2004
2005         pTxBufHead->wFIFOCtl |= FIFOCTL_GENINT;
2006
2007         //Set FIFOCTL_ISDMA0
2008         if (TYPE_TXDMA0 == uDMAIdx)
2009                 pTxBufHead->wFIFOCtl |= FIFOCTL_ISDMA0;
2010
2011         //Set FRAGCTL_MACHDCNT
2012         if (pDevice->bLongHeader)
2013                 cbMacHdLen = WLAN_HDR_ADDR3_LEN + 6;
2014         else
2015                 cbMacHdLen = WLAN_HDR_ADDR3_LEN;
2016
2017         pTxBufHead->wFragCtl |= cpu_to_le16((unsigned short)(cbMacHdLen << 10));
2018
2019         //Set packet type
2020         if (byPktType == PK_TYPE_11A) //0000 0000 0000 0000
2021                 ;
2022         else if (byPktType == PK_TYPE_11B) //0000 0001 0000 0000
2023                 pTxBufHead->wFIFOCtl |= FIFOCTL_11B;
2024         else if (byPktType == PK_TYPE_11GB) //0000 0010 0000 0000
2025                 pTxBufHead->wFIFOCtl |= FIFOCTL_11GB;
2026         else if (byPktType == PK_TYPE_11GA) //0000 0011 0000 0000
2027                 pTxBufHead->wFIFOCtl |= FIFOCTL_11GA;
2028
2029         //Set FIFOCTL_GrpAckPolicy
2030         if (pDevice->bGrpAckPolicy == true) //0000 0100 0000 0000
2031                 pTxBufHead->wFIFOCtl |= FIFOCTL_GRPACK;
2032
2033         //Set Auto Fallback Ctl
2034         if (pDevice->wCurrentRate >= RATE_18M) {
2035                 if (pDevice->byAutoFBCtrl == AUTO_FB_0)
2036                         pTxBufHead->wFIFOCtl |= FIFOCTL_AUTO_FB_0;
2037                 else if (pDevice->byAutoFBCtrl == AUTO_FB_1)
2038                         pTxBufHead->wFIFOCtl |= FIFOCTL_AUTO_FB_1;
2039         }
2040
2041         //Set FRAGCTL_WEPTYP
2042         pDevice->bAES = false;
2043
2044         //Set FRAGCTL_WEPTYP
2045         if (pDevice->byLocalID > REV_ID_VT3253_A1) {
2046                 if ((bNeedEncrypt) && (pTransmitKey != NULL))  { //WEP enabled
2047                         if (pTransmitKey->byCipherSuite == KEY_CTL_TKIP) {
2048                                 pTxBufHead->wFragCtl |= FRAGCTL_TKIP;
2049                         } else if (pTransmitKey->byCipherSuite == KEY_CTL_WEP) { //WEP40 or WEP104
2050                                 if (pTransmitKey->uKeyLength != WLAN_WEP232_KEYLEN)
2051                                         pTxBufHead->wFragCtl |= FRAGCTL_LEGACY;
2052                         } else if (pTransmitKey->byCipherSuite == KEY_CTL_CCMP) { //CCMP
2053                                 pTxBufHead->wFragCtl |= FRAGCTL_AES;
2054                         }
2055                 }
2056         }
2057
2058         RFbSetPower(pDevice, pDevice->wCurrentRate, pDevice->byCurrentCh);
2059
2060         pTxBufHead->byTxPower = pDevice->byCurPwr;
2061
2062         *pcbHeaderSize = s_cbFillTxBufHead(pDevice, byPktType, pbyTxBufferAddr, cbPayloadSize,
2063                                            uDMAIdx, pHeadTD, psEthHeader, pPacket, bNeedEncrypt,
2064                                            pTransmitKey, uNodeIndex, puMACfragNum);
2065 }
2066
2067 /*+
2068  *
2069  * Description:
2070  *      Translate 802.3 to 802.11 header
2071  *
2072  * Parameters:
2073  *  In:
2074  *      pDevice         - Pointer to adapter
2075  *      dwTxBufferAddr  - Transmit Buffer
2076  *      pPacket         - Packet from upper layer
2077  *      cbPacketSize    - Transmit Data Length
2078  *  Out:
2079  *      pcbHeadSize         - Header size of MAC&Baseband control and 802.11 Header
2080  *      pcbAppendPayload    - size of append payload for 802.1H translation
2081  *
2082  * Return Value: none
2083  *
2084  -*/
2085
2086 void
2087 vGenerateMACHeader(
2088         struct vnt_private *pDevice,
2089         unsigned char *pbyBufferAddr,
2090         __le16 wDuration,
2091         PSEthernetHeader psEthHeader,
2092         bool bNeedEncrypt,
2093         unsigned short wFragType,
2094         unsigned int uDMAIdx,
2095         unsigned int uFragIdx
2096 )
2097 {
2098         PS802_11Header  pMACHeader = (PS802_11Header)pbyBufferAddr;
2099
2100         memset(pMACHeader, 0, (sizeof(S802_11Header)));
2101
2102         if (uDMAIdx == TYPE_ATIMDMA)
2103                 pMACHeader->wFrameCtl = TYPE_802_11_ATIM;
2104         else
2105                 pMACHeader->wFrameCtl = TYPE_802_11_DATA;
2106
2107         if (pDevice->op_mode == NL80211_IFTYPE_AP) {
2108                 memcpy(&(pMACHeader->abyAddr1[0]), &(psEthHeader->abyDstAddr[0]), ETH_ALEN);
2109                 memcpy(&(pMACHeader->abyAddr2[0]), &(pDevice->abyBSSID[0]), ETH_ALEN);
2110                 memcpy(&(pMACHeader->abyAddr3[0]), &(psEthHeader->abySrcAddr[0]), ETH_ALEN);
2111                 pMACHeader->wFrameCtl |= FC_FROMDS;
2112         } else {
2113                 if (pDevice->op_mode == NL80211_IFTYPE_ADHOC) {
2114                         memcpy(&(pMACHeader->abyAddr1[0]), &(psEthHeader->abyDstAddr[0]), ETH_ALEN);
2115                         memcpy(&(pMACHeader->abyAddr2[0]), &(psEthHeader->abySrcAddr[0]), ETH_ALEN);
2116                         memcpy(&(pMACHeader->abyAddr3[0]), &(pDevice->abyBSSID[0]), ETH_ALEN);
2117                 } else {
2118                         memcpy(&(pMACHeader->abyAddr3[0]), &(psEthHeader->abyDstAddr[0]), ETH_ALEN);
2119                         memcpy(&(pMACHeader->abyAddr2[0]), &(psEthHeader->abySrcAddr[0]), ETH_ALEN);
2120                         memcpy(&(pMACHeader->abyAddr1[0]), &(pDevice->abyBSSID[0]), ETH_ALEN);
2121                         pMACHeader->wFrameCtl |= FC_TODS;
2122                 }
2123         }
2124
2125         if (bNeedEncrypt)
2126                 pMACHeader->wFrameCtl |= cpu_to_le16((unsigned short)WLAN_SET_FC_ISWEP(1));
2127
2128         pMACHeader->wDurationID = le16_to_cpu(wDuration);
2129
2130         if (pDevice->bLongHeader) {
2131                 PWLAN_80211HDR_A4 pMACA4Header  = (PWLAN_80211HDR_A4) pbyBufferAddr;
2132
2133                 pMACHeader->wFrameCtl |= (FC_TODS | FC_FROMDS);
2134                 memcpy(pMACA4Header->abyAddr4, pDevice->abyBSSID, WLAN_ADDR_LEN);
2135         }
2136         pMACHeader->wSeqCtl = cpu_to_le16(pDevice->wSeqCounter << 4);
2137
2138         //Set FragNumber in Sequence Control
2139         pMACHeader->wSeqCtl |= cpu_to_le16((unsigned short)uFragIdx);
2140
2141         if ((wFragType == FRAGCTL_ENDFRAG) || (wFragType == FRAGCTL_NONFRAG)) {
2142                 pDevice->wSeqCounter++;
2143                 if (pDevice->wSeqCounter > 0x0fff)
2144                         pDevice->wSeqCounter = 0;
2145         }
2146
2147         if ((wFragType == FRAGCTL_STAFRAG) || (wFragType == FRAGCTL_MIDFRAG)) //StartFrag or MidFrag
2148                 pMACHeader->wFrameCtl |= FC_MOREFRAG;
2149 }
2150
2151 CMD_STATUS csMgmt_xmit(struct vnt_private *pDevice, PSTxMgmtPacket pPacket)
2152 {
2153         PSTxDesc        pFrstTD;
2154         unsigned char byPktType;
2155         unsigned char *pbyTxBufferAddr;
2156         void *pvRTS;
2157         struct vnt_cts *pCTS;
2158         void *pvTxDataHd;
2159         unsigned int uDuration;
2160         unsigned int cbReqCount;
2161         PS802_11Header  pMACHeader;
2162         unsigned int cbHeaderSize;
2163         unsigned int cbFrameBodySize;
2164         bool bNeedACK;
2165         bool bIsPSPOLL = false;
2166         PSTxBufHead     pTxBufHead;
2167         unsigned int cbFrameSize;
2168         unsigned int cbIVlen = 0;
2169         unsigned int cbICVlen = 0;
2170         unsigned int cbMIClen = 0;
2171         unsigned int cbFCSlen = 4;
2172         unsigned int uPadding = 0;
2173         unsigned short wTxBufSize;
2174         unsigned int cbMacHdLen;
2175         SEthernetHeader sEthHeader;
2176         void *pvRrvTime;
2177         void *pMICHDR;
2178         PSMgmtObject    pMgmt = pDevice->pMgmt;
2179         unsigned short wCurrentRate = RATE_1M;
2180
2181         if (AVAIL_TD(pDevice, TYPE_TXDMA0) <= 0)
2182                 return CMD_STATUS_RESOURCES;
2183
2184         pFrstTD = pDevice->apCurrTD[TYPE_TXDMA0];
2185         pbyTxBufferAddr = (unsigned char *)pFrstTD->pTDInfo->buf;
2186         cbFrameBodySize = pPacket->cbPayloadLen;
2187         pTxBufHead = (PSTxBufHead) pbyTxBufferAddr;
2188         wTxBufSize = sizeof(STxBufHead);
2189         memset(pTxBufHead, 0, wTxBufSize);
2190
2191         if (pDevice->eCurrentPHYType == PHY_TYPE_11A) {
2192                 wCurrentRate = RATE_6M;
2193                 byPktType = PK_TYPE_11A;
2194         } else {
2195                 wCurrentRate = RATE_1M;
2196                 byPktType = PK_TYPE_11B;
2197         }
2198
2199         // SetPower will cause error power TX state for OFDM Date packet in TX buffer.
2200         // 2004.11.11 Kyle -- Using OFDM power to tx MngPkt will decrease the connection capability.
2201         //                    And cmd timer will wait data pkt TX finish before scanning so it's OK
2202         //                    to set power here.
2203         if (pDevice->pMgmt->eScanState != WMAC_NO_SCANNING)
2204                 RFbSetPower(pDevice, wCurrentRate, pDevice->byCurrentCh);
2205         else
2206                 RFbSetPower(pDevice, wCurrentRate, pMgmt->uCurrChannel);
2207
2208         pTxBufHead->byTxPower = pDevice->byCurPwr;
2209         //+++++++++++++++++++++ Patch VT3253 A1 performance +++++++++++++++++++++++++++
2210         if (pDevice->byFOETuning) {
2211                 if ((pPacket->p80211Header->sA3.wFrameCtl & TYPE_DATE_NULL) == TYPE_DATE_NULL) {
2212                         wCurrentRate = RATE_24M;
2213                         byPktType = PK_TYPE_11GA;
2214                 }
2215         }
2216
2217         //Set packet type
2218         if (byPktType == PK_TYPE_11A) {//0000 0000 0000 0000
2219                 pTxBufHead->wFIFOCtl = 0;
2220         } else if (byPktType == PK_TYPE_11B) {//0000 0001 0000 0000
2221                 pTxBufHead->wFIFOCtl |= FIFOCTL_11B;
2222         } else if (byPktType == PK_TYPE_11GB) {//0000 0010 0000 0000
2223                 pTxBufHead->wFIFOCtl |= FIFOCTL_11GB;
2224         } else if (byPktType == PK_TYPE_11GA) {//0000 0011 0000 0000
2225                 pTxBufHead->wFIFOCtl |= FIFOCTL_11GA;
2226         }
2227
2228         pTxBufHead->wFIFOCtl |= FIFOCTL_TMOEN;
2229         pTxBufHead->wTimeStamp = cpu_to_le16(DEFAULT_MGN_LIFETIME_RES_64us);
2230
2231         if (is_multicast_ether_addr(&(pPacket->p80211Header->sA3.abyAddr1[0])))
2232                 bNeedACK = false;
2233         else {
2234                 bNeedACK = true;
2235                 pTxBufHead->wFIFOCtl |= FIFOCTL_NEEDACK;
2236         }
2237
2238         if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) ||
2239             (pMgmt->eCurrMode == WMAC_MODE_IBSS_STA)) {
2240                 pTxBufHead->wFIFOCtl |= FIFOCTL_LRETRY;
2241         }
2242
2243         pTxBufHead->wFIFOCtl |= (FIFOCTL_GENINT | FIFOCTL_ISDMA0);
2244
2245         if ((pPacket->p80211Header->sA4.wFrameCtl & TYPE_SUBTYPE_MASK) == TYPE_CTL_PSPOLL) {
2246                 bIsPSPOLL = true;
2247                 cbMacHdLen = WLAN_HDR_ADDR2_LEN;
2248         } else {
2249                 cbMacHdLen = WLAN_HDR_ADDR3_LEN;
2250         }
2251
2252         //Set FRAGCTL_MACHDCNT
2253         pTxBufHead->wFragCtl |= cpu_to_le16((unsigned short)(cbMacHdLen << 10));
2254
2255         // Notes:
2256         // Although spec says MMPDU can be fragmented; In most cases,
2257         // no one will send a MMPDU under fragmentation. With RTS may occur.
2258         pDevice->bAES = false;  //Set FRAGCTL_WEPTYP
2259
2260         if (WLAN_GET_FC_ISWEP(pPacket->p80211Header->sA4.wFrameCtl) != 0) {
2261                 if (pDevice->eEncryptionStatus == Ndis802_11Encryption1Enabled) {
2262                         cbIVlen = 4;
2263                         cbICVlen = 4;
2264                         pTxBufHead->wFragCtl |= FRAGCTL_LEGACY;
2265                 } else if (pDevice->eEncryptionStatus == Ndis802_11Encryption2Enabled) {
2266                         cbIVlen = 8;//IV+ExtIV
2267                         cbMIClen = 8;
2268                         cbICVlen = 4;
2269                         pTxBufHead->wFragCtl |= FRAGCTL_TKIP;
2270                         //We need to get seed here for filling TxKey entry.
2271                 } else if (pDevice->eEncryptionStatus == Ndis802_11Encryption3Enabled) {
2272                         cbIVlen = 8;//RSN Header
2273                         cbICVlen = 8;//MIC
2274                         pTxBufHead->wFragCtl |= FRAGCTL_AES;
2275                         pDevice->bAES = true;
2276                 }
2277                 //MAC Header should be padding 0 to DW alignment.
2278                 uPadding = 4 - (cbMacHdLen%4);
2279                 uPadding %= 4;
2280         }
2281
2282         cbFrameSize = cbMacHdLen + cbFrameBodySize + cbIVlen + cbMIClen + cbICVlen + cbFCSlen;
2283
2284         //Set FIFOCTL_GrpAckPolicy
2285         if (pDevice->bGrpAckPolicy == true) //0000 0100 0000 0000
2286                 pTxBufHead->wFIFOCtl |= FIFOCTL_GRPACK;
2287
2288         //the rest of pTxBufHead->wFragCtl:FragTyp will be set later in s_vFillFragParameter()
2289
2290         //Set RrvTime/RTS/CTS Buffer
2291         if (byPktType == PK_TYPE_11GB || byPktType == PK_TYPE_11GA) {//802.11g packet
2292                 pvRrvTime = (void *) (pbyTxBufferAddr + wTxBufSize);
2293                 pMICHDR = NULL;
2294                 pvRTS = NULL;
2295                 pCTS = (struct vnt_cts *)(pbyTxBufferAddr + wTxBufSize +
2296                                         sizeof(struct vnt_rrv_time_cts));
2297                 pvTxDataHd = (void *)(pbyTxBufferAddr + wTxBufSize +
2298                                 sizeof(struct vnt_rrv_time_cts) + sizeof(struct vnt_cts));
2299                 cbHeaderSize = wTxBufSize + sizeof(struct vnt_rrv_time_cts) +
2300                                 sizeof(struct vnt_cts) + sizeof(struct vnt_tx_datahead_g);
2301         } else { // 802.11a/b packet
2302                 pvRrvTime = (void *)(pbyTxBufferAddr + wTxBufSize);
2303                 pMICHDR = NULL;
2304                 pvRTS = NULL;
2305                 pCTS = NULL;
2306                 pvTxDataHd = (void *)(pbyTxBufferAddr + wTxBufSize +
2307                         sizeof(struct vnt_rrv_time_ab));
2308                 cbHeaderSize = wTxBufSize + sizeof(struct vnt_rrv_time_ab) +
2309                         sizeof(struct vnt_tx_datahead_ab);
2310         }
2311
2312         memset((void *)(pbyTxBufferAddr + wTxBufSize), 0, (cbHeaderSize - wTxBufSize));
2313
2314         memcpy(&(sEthHeader.abyDstAddr[0]), &(pPacket->p80211Header->sA3.abyAddr1[0]), ETH_ALEN);
2315         memcpy(&(sEthHeader.abySrcAddr[0]), &(pPacket->p80211Header->sA3.abyAddr2[0]), ETH_ALEN);
2316         //=========================
2317         //    No Fragmentation
2318         //=========================
2319         pTxBufHead->wFragCtl |= (unsigned short)FRAGCTL_NONFRAG;
2320
2321         //Fill FIFO,RrvTime,RTS,and CTS
2322         s_vGenerateTxParameter(pDevice, byPktType, pbyTxBufferAddr, pvRrvTime, pvRTS, pCTS,
2323                                cbFrameSize, bNeedACK, TYPE_TXDMA0, &sEthHeader, wCurrentRate);
2324
2325         //Fill DataHead
2326         uDuration = s_uFillDataHead(pDevice, byPktType, pvTxDataHd, cbFrameSize, TYPE_TXDMA0, bNeedACK,
2327                                     0, 0, 1, AUTO_FB_NONE, wCurrentRate);
2328
2329         pMACHeader = (PS802_11Header) (pbyTxBufferAddr + cbHeaderSize);
2330
2331         cbReqCount = cbHeaderSize + cbMacHdLen + uPadding + cbIVlen + cbFrameBodySize;
2332
2333         if (WLAN_GET_FC_ISWEP(pPacket->p80211Header->sA4.wFrameCtl) != 0) {
2334                 unsigned char *pbyIVHead;
2335                 unsigned char *pbyPayloadHead;
2336                 unsigned char *pbyBSSID;
2337                 PSKeyItem       pTransmitKey = NULL;
2338
2339                 pbyIVHead = (unsigned char *)(pbyTxBufferAddr + cbHeaderSize + cbMacHdLen + uPadding);
2340                 pbyPayloadHead = (unsigned char *)(pbyTxBufferAddr + cbHeaderSize + cbMacHdLen + uPadding + cbIVlen);
2341
2342                 //Fill TXKEY
2343                 //Kyle: Need fix: TKIP and AES did't encrypt Mnt Packet.
2344                 //s_vFillTxKey(pDevice, (unsigned char *)pTxBufHead->adwTxKey, NULL);
2345
2346                 //Fill IV(ExtIV,RSNHDR)
2347                 //s_vFillPrePayload(pDevice, pbyIVHead, NULL);
2348                 //---------------------------
2349                 // S/W or H/W Encryption
2350                 //---------------------------
2351                 do {
2352                         if ((pDevice->op_mode == NL80211_IFTYPE_STATION) &&
2353                             (pDevice->bLinkPass == true)) {
2354                                 pbyBSSID = pDevice->abyBSSID;
2355                                 // get pairwise key
2356                                 if (KeybGetTransmitKey(&(pDevice->sKey), pbyBSSID, PAIRWISE_KEY, &pTransmitKey) == false) {
2357                                         // get group key
2358                                         if (KeybGetTransmitKey(&(pDevice->sKey), pbyBSSID, GROUP_KEY, &pTransmitKey) == true) {
2359                                                 pr_debug("Get GTK\n");
2360                                                 break;
2361                                         }
2362                                 } else {
2363                                         pr_debug("Get PTK\n");
2364                                         break;
2365                                 }
2366                         }
2367                         // get group key
2368                         pbyBSSID = pDevice->abyBroadcastAddr;
2369                         if (KeybGetTransmitKey(&(pDevice->sKey), pbyBSSID, GROUP_KEY, &pTransmitKey) == false) {
2370                                 pTransmitKey = NULL;
2371                                 pr_debug("KEY is NULL. OP Mode[%d]\n",
2372                                          pDevice->op_mode);
2373                         } else {
2374                                 pr_debug("Get GTK\n");
2375                         }
2376                 } while (false);
2377                 //Fill TXKEY
2378                 s_vFillTxKey(pDevice, (unsigned char *)(pTxBufHead->adwTxKey), pbyIVHead, pTransmitKey,
2379                              (unsigned char *)pMACHeader, (unsigned short)cbFrameBodySize, NULL);
2380
2381                 memcpy(pMACHeader, pPacket->p80211Header, cbMacHdLen);
2382                 memcpy(pbyPayloadHead, ((unsigned char *)(pPacket->p80211Header) + cbMacHdLen),
2383                        cbFrameBodySize);
2384         } else {
2385                 // Copy the Packet into a tx Buffer
2386                 memcpy(pMACHeader, pPacket->p80211Header, pPacket->cbMPDULen);
2387         }
2388
2389         pMACHeader->wSeqCtl = cpu_to_le16(pDevice->wSeqCounter << 4);
2390         pDevice->wSeqCounter++;
2391         if (pDevice->wSeqCounter > 0x0fff)
2392                 pDevice->wSeqCounter = 0;
2393
2394         if (bIsPSPOLL) {
2395                 // The MAC will automatically replace the Duration-field of MAC header by Duration-field
2396                 // of  FIFO control header.
2397                 // This will cause AID-field of PS-POLL packet to be incorrect (Because PS-POLL's AID field is
2398                 // in the same place of other packet's Duration-field).
2399                 // And it will cause Cisco-AP to issue Disassociation-packet
2400                 if (byPktType == PK_TYPE_11GB || byPktType == PK_TYPE_11GA) {
2401                         ((struct vnt_tx_datahead_g *)pvTxDataHd)->duration_a = cpu_to_le16(pPacket->p80211Header->sA2.wDurationID);
2402                         ((struct vnt_tx_datahead_g *)pvTxDataHd)->duration_b = cpu_to_le16(pPacket->p80211Header->sA2.wDurationID);
2403                 } else {
2404                         ((struct vnt_tx_datahead_ab *)pvTxDataHd)->duration = cpu_to_le16(pPacket->p80211Header->sA2.wDurationID);
2405                 }
2406         }
2407
2408         // first TD is the only TD
2409         //Set TSR1 & ReqCount in TxDescHead
2410         pFrstTD->m_td1TD1.byTCR = (TCR_STP | TCR_EDP | EDMSDU);
2411         pFrstTD->pTDInfo->skb_dma = pFrstTD->pTDInfo->buf_dma;
2412         pFrstTD->m_td1TD1.wReqCount = cpu_to_le16((unsigned short)(cbReqCount));
2413         pFrstTD->buff_addr = cpu_to_le32(pFrstTD->pTDInfo->skb_dma);
2414         pFrstTD->pTDInfo->byFlags = 0;
2415
2416         if (MACbIsRegBitsOn(pDevice->PortOffset, MAC_REG_PSCTL, PSCTL_PS)) {
2417                 // Disable PS
2418                 MACbPSWakeup(pDevice->PortOffset);
2419         }
2420         pDevice->bPWBitOn = false;
2421
2422         wmb();
2423         pFrstTD->m_td0TD0.f1Owner = OWNED_BY_NIC;
2424         wmb();
2425
2426         pDevice->iTDUsed[TYPE_TXDMA0]++;
2427
2428         if (AVAIL_TD(pDevice, TYPE_TXDMA0) <= 1)
2429                 pr_debug(" available td0 <= 1\n");
2430
2431         pDevice->apCurrTD[TYPE_TXDMA0] = pFrstTD->next;
2432
2433         pDevice->nTxDataTimeCout = 0; //2008-8-21 chester <add> for send null packet
2434
2435         // Poll Transmit the adapter
2436         MACvTransmit0(pDevice->PortOffset);
2437
2438         return CMD_STATUS_PENDING;
2439 }
2440
2441 CMD_STATUS csBeacon_xmit(struct vnt_private *pDevice, PSTxMgmtPacket pPacket)
2442 {
2443         unsigned char byPktType;
2444         unsigned char *pbyBuffer = (unsigned char *)pDevice->tx_beacon_bufs;
2445         unsigned int cbFrameSize = pPacket->cbMPDULen + WLAN_FCS_LEN;
2446         unsigned int cbHeaderSize = 0;
2447         struct vnt_tx_short_buf_head *short_head =
2448                                 (struct vnt_tx_short_buf_head *)pbyBuffer;
2449         PS802_11Header   pMACHeader;
2450         unsigned short wCurrentRate;
2451
2452         memset(short_head, 0, sizeof(*short_head));
2453
2454         if (pDevice->eCurrentPHYType == PHY_TYPE_11A) {
2455                 wCurrentRate = RATE_6M;
2456                 byPktType = PK_TYPE_11A;
2457         } else {
2458                 wCurrentRate = RATE_2M;
2459                 byPktType = PK_TYPE_11B;
2460         }
2461
2462         //Set Preamble type always long
2463         pDevice->byPreambleType = PREAMBLE_LONG;
2464
2465         /* Set FIFOCTL_GENINT */
2466         short_head->fifo_ctl |= cpu_to_le16(FIFOCTL_GENINT);
2467
2468         /* Set packet type & Get Duration */
2469         if (byPktType == PK_TYPE_11A) {//0000 0000 0000 0000
2470                 short_head->duration =
2471                         cpu_to_le16((u16)s_uGetDataDuration(pDevice, DATADUR_A,
2472                                     cbFrameSize, byPktType, wCurrentRate, false,
2473                                     0, 0, 1, AUTO_FB_NONE));
2474         } else if (byPktType == PK_TYPE_11B) {//0000 0001 0000 0000
2475                 short_head->fifo_ctl |= cpu_to_le16(FIFOCTL_11B);
2476
2477                 short_head->duration =
2478                         cpu_to_le16((u16)s_uGetDataDuration(pDevice, DATADUR_B,
2479                                     cbFrameSize, byPktType, wCurrentRate, false,
2480                                     0, 0, 1, AUTO_FB_NONE));
2481         }
2482
2483         vnt_get_phy_field(pDevice, cbFrameSize,
2484                           wCurrentRate, byPktType, &short_head->ab);
2485
2486         /* Get TimeStampOff */
2487         short_head->time_stamp_off = vnt_time_stamp_off(pDevice, wCurrentRate);
2488         cbHeaderSize = sizeof(struct vnt_tx_short_buf_head);
2489
2490         //Generate Beacon Header
2491         pMACHeader = (PS802_11Header)(pbyBuffer + cbHeaderSize);
2492         memcpy(pMACHeader, pPacket->p80211Header, pPacket->cbMPDULen);
2493
2494         pMACHeader->wDurationID = 0;
2495         pMACHeader->wSeqCtl = cpu_to_le16(pDevice->wSeqCounter << 4);
2496         pDevice->wSeqCounter++;
2497         if (pDevice->wSeqCounter > 0x0fff)
2498                 pDevice->wSeqCounter = 0;
2499
2500         // Set Beacon buffer length
2501         pDevice->wBCNBufLen = pPacket->cbMPDULen + cbHeaderSize;
2502
2503         MACvSetCurrBCNTxDescAddr(pDevice->PortOffset, (pDevice->tx_beacon_dma));
2504
2505         MACvSetCurrBCNLength(pDevice->PortOffset, pDevice->wBCNBufLen);
2506         // Set auto Transmit on
2507         MACvRegBitsOn(pDevice->PortOffset, MAC_REG_TCR, TCR_AUTOBCNTX);
2508         // Poll Transmit the adapter
2509         MACvTransmitBCN(pDevice->PortOffset);
2510
2511         return CMD_STATUS_PENDING;
2512 }
2513
2514 unsigned int
2515 cbGetFragCount(
2516         struct vnt_private *pDevice,
2517         PSKeyItem        pTransmitKey,
2518         unsigned int cbFrameBodySize,
2519         PSEthernetHeader psEthHeader
2520 )
2521 {
2522         unsigned int cbMACHdLen;
2523         unsigned int cbFrameSize;
2524         unsigned int cbFragmentSize; //Hdr+(IV)+payoad+(MIC)+(ICV)+FCS
2525         unsigned int cbFragPayloadSize;
2526         unsigned int cbLastFragPayloadSize;
2527         unsigned int cbIVlen = 0;
2528         unsigned int cbICVlen = 0;
2529         unsigned int cbMIClen = 0;
2530         unsigned int cbFCSlen = 4;
2531         unsigned int uMACfragNum = 1;
2532         bool bNeedACK;
2533
2534         if ((pDevice->op_mode == NL80211_IFTYPE_ADHOC) ||
2535             (pDevice->op_mode == NL80211_IFTYPE_AP)) {
2536                 if (is_multicast_ether_addr(&(psEthHeader->abyDstAddr[0])))
2537                         bNeedACK = false;
2538                 else
2539                         bNeedACK = true;
2540         } else {
2541                 // MSDUs in Infra mode always need ACK
2542                 bNeedACK = true;
2543         }
2544
2545         if (pDevice->bLongHeader)
2546                 cbMACHdLen = WLAN_HDR_ADDR3_LEN + 6;
2547         else
2548                 cbMACHdLen = WLAN_HDR_ADDR3_LEN;
2549
2550         if (pDevice->bEncryptionEnable == true) {
2551                 if (pTransmitKey == NULL) {
2552                         if ((pDevice->eEncryptionStatus == Ndis802_11Encryption1Enabled) ||
2553                             (pDevice->pMgmt->eAuthenMode < WMAC_AUTH_WPA)) {
2554                                 cbIVlen = 4;
2555                                 cbICVlen = 4;
2556                         } else if (pDevice->eEncryptionStatus == Ndis802_11Encryption2Enabled) {
2557                                 cbIVlen = 8;//IV+ExtIV
2558                                 cbMIClen = 8;
2559                                 cbICVlen = 4;
2560                         } else if (pDevice->eEncryptionStatus == Ndis802_11Encryption3Enabled) {
2561                                 cbIVlen = 8;//RSN Header
2562                                 cbICVlen = 8;//MIC
2563                         }
2564                 } else if (pTransmitKey->byCipherSuite == KEY_CTL_WEP) {
2565                         cbIVlen = 4;
2566                         cbICVlen = 4;
2567                 } else if (pTransmitKey->byCipherSuite == KEY_CTL_TKIP) {
2568                         cbIVlen = 8;//IV+ExtIV
2569                         cbMIClen = 8;
2570                         cbICVlen = 4;
2571                 } else if (pTransmitKey->byCipherSuite == KEY_CTL_CCMP) {
2572                         cbIVlen = 8;//RSN Header
2573                         cbICVlen = 8;//MIC
2574                 }
2575         }
2576
2577         cbFrameSize = cbMACHdLen + cbIVlen + (cbFrameBodySize + cbMIClen) + cbICVlen + cbFCSlen;
2578
2579         if ((cbFrameSize > pDevice->wFragmentationThreshold) && (bNeedACK == true)) {
2580                 // Fragmentation
2581                 cbFragmentSize = pDevice->wFragmentationThreshold;
2582                 cbFragPayloadSize = cbFragmentSize - cbMACHdLen - cbIVlen - cbICVlen - cbFCSlen;
2583                 uMACfragNum = (unsigned short) ((cbFrameBodySize + cbMIClen) / cbFragPayloadSize);
2584                 cbLastFragPayloadSize = (cbFrameBodySize + cbMIClen) % cbFragPayloadSize;
2585                 if (cbLastFragPayloadSize == 0)
2586                         cbLastFragPayloadSize = cbFragPayloadSize;
2587                 else
2588                         uMACfragNum++;
2589         }
2590         return uMACfragNum;
2591 }
2592
2593 void vDMA0_tx_80211(struct vnt_private *pDevice, struct sk_buff *skb,
2594                     unsigned char *pbMPDU, unsigned int cbMPDULen)
2595 {
2596         PSTxDesc        pFrstTD;
2597         unsigned char byPktType;
2598         unsigned char *pbyTxBufferAddr;
2599         void *pvRTS;
2600         void *pvCTS;
2601         void *pvTxDataHd;
2602         unsigned int uDuration;
2603         unsigned int cbReqCount;
2604         PS802_11Header  pMACHeader;
2605         unsigned int cbHeaderSize;
2606         unsigned int cbFrameBodySize;
2607         bool bNeedACK;
2608         bool bIsPSPOLL = false;
2609         PSTxBufHead     pTxBufHead;
2610         unsigned int cbFrameSize;
2611         unsigned int cbIVlen = 0;
2612         unsigned int cbICVlen = 0;
2613         unsigned int cbMIClen = 0;
2614         unsigned int cbFCSlen = 4;
2615         unsigned int uPadding = 0;
2616         unsigned int cbMICHDR = 0;
2617         unsigned int uLength = 0;
2618         u32 dwMICKey0, dwMICKey1;
2619         u32 dwMIC_Priority;
2620         u32 *pdwMIC_L;
2621         u32 *pdwMIC_R;
2622         unsigned short wTxBufSize;
2623         unsigned int cbMacHdLen;
2624         SEthernetHeader sEthHeader;
2625         void *pvRrvTime;
2626         void *pMICHDR;
2627         PSMgmtObject    pMgmt = pDevice->pMgmt;
2628         unsigned short wCurrentRate = RATE_1M;
2629         PUWLAN_80211HDR  p80211Header;
2630         unsigned int uNodeIndex = 0;
2631         bool bNodeExist = false;
2632         SKeyItem        STempKey;
2633         PSKeyItem       pTransmitKey = NULL;
2634         unsigned char *pbyIVHead;
2635         unsigned char *pbyPayloadHead;
2636         unsigned char *pbyMacHdr;
2637
2638         unsigned int cbExtSuppRate = 0;
2639
2640         pvRrvTime = pMICHDR = pvRTS = pvCTS = pvTxDataHd = NULL;
2641
2642         if (cbMPDULen <= WLAN_HDR_ADDR3_LEN)
2643                 cbFrameBodySize = 0;
2644         else
2645                 cbFrameBodySize = cbMPDULen - WLAN_HDR_ADDR3_LEN;
2646
2647         p80211Header = (PUWLAN_80211HDR)pbMPDU;
2648
2649         pFrstTD = pDevice->apCurrTD[TYPE_TXDMA0];
2650         pbyTxBufferAddr = (unsigned char *)pFrstTD->pTDInfo->buf;
2651         pTxBufHead = (PSTxBufHead) pbyTxBufferAddr;
2652         wTxBufSize = sizeof(STxBufHead);
2653         memset(pTxBufHead, 0, wTxBufSize);
2654
2655         if (pDevice->eCurrentPHYType == PHY_TYPE_11A) {
2656                 wCurrentRate = RATE_6M;
2657                 byPktType = PK_TYPE_11A;
2658         } else {
2659                 wCurrentRate = RATE_1M;
2660                 byPktType = PK_TYPE_11B;
2661         }
2662
2663         // SetPower will cause error power TX state for OFDM Date packet in TX buffer.
2664         // 2004.11.11 Kyle -- Using OFDM power to tx MngPkt will decrease the connection capability.
2665         //                    And cmd timer will wait data pkt TX to finish before scanning so it's OK
2666         //                    to set power here.
2667         if (pDevice->pMgmt->eScanState != WMAC_NO_SCANNING)
2668                 RFbSetPower(pDevice, wCurrentRate, pDevice->byCurrentCh);
2669         else
2670                 RFbSetPower(pDevice, wCurrentRate, pMgmt->uCurrChannel);
2671
2672         pTxBufHead->byTxPower = pDevice->byCurPwr;
2673
2674         //+++++++++++++++++++++ Patch VT3253 A1 performance +++++++++++++++++++++++++++
2675         if (pDevice->byFOETuning) {
2676                 if ((p80211Header->sA3.wFrameCtl & TYPE_DATE_NULL) == TYPE_DATE_NULL) {
2677                         wCurrentRate = RATE_24M;
2678                         byPktType = PK_TYPE_11GA;
2679                 }
2680         }
2681
2682         pr_debug("vDMA0_tx_80211: p80211Header->sA3.wFrameCtl = %x\n",
2683                  p80211Header->sA3.wFrameCtl);
2684
2685         //Set packet type
2686         if (byPktType == PK_TYPE_11A) {//0000 0000 0000 0000
2687                 pTxBufHead->wFIFOCtl = 0;
2688         } else if (byPktType == PK_TYPE_11B) {//0000 0001 0000 0000
2689                 pTxBufHead->wFIFOCtl |= FIFOCTL_11B;
2690         } else if (byPktType == PK_TYPE_11GB) {//0000 0010 0000 0000
2691                 pTxBufHead->wFIFOCtl |= FIFOCTL_11GB;
2692         } else if (byPktType == PK_TYPE_11GA) {//0000 0011 0000 0000
2693                 pTxBufHead->wFIFOCtl |= FIFOCTL_11GA;
2694         }
2695
2696         pTxBufHead->wFIFOCtl |= FIFOCTL_TMOEN;
2697         pTxBufHead->wTimeStamp = cpu_to_le16(DEFAULT_MGN_LIFETIME_RES_64us);
2698
2699         if (is_multicast_ether_addr(&(p80211Header->sA3.abyAddr1[0]))) {
2700                 bNeedACK = false;
2701                 if (pDevice->bEnableHostWEP) {
2702                         uNodeIndex = 0;
2703                         bNodeExist = true;
2704                 }
2705         } else {
2706                 if (pDevice->bEnableHostWEP) {
2707                         if (BSSDBbIsSTAInNodeDB(pDevice->pMgmt, (unsigned char *)(p80211Header->sA3.abyAddr1), &uNodeIndex))
2708                                 bNodeExist = true;
2709                 }
2710                 bNeedACK = true;
2711                 pTxBufHead->wFIFOCtl |= FIFOCTL_NEEDACK;
2712         }
2713
2714         if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) ||
2715             (pMgmt->eCurrMode == WMAC_MODE_IBSS_STA)) {
2716                 pTxBufHead->wFIFOCtl |= FIFOCTL_LRETRY;
2717         }
2718
2719         pTxBufHead->wFIFOCtl |= (FIFOCTL_GENINT | FIFOCTL_ISDMA0);
2720
2721         if ((p80211Header->sA4.wFrameCtl & TYPE_SUBTYPE_MASK) == TYPE_CTL_PSPOLL) {
2722                 bIsPSPOLL = true;
2723                 cbMacHdLen = WLAN_HDR_ADDR2_LEN;
2724         } else {
2725                 cbMacHdLen = WLAN_HDR_ADDR3_LEN;
2726         }
2727
2728         // hostapd deamon ext support rate patch
2729         if (WLAN_GET_FC_FSTYPE(p80211Header->sA4.wFrameCtl) == WLAN_FSTYPE_ASSOCRESP) {
2730                 if (((PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates)->len != 0)
2731                         cbExtSuppRate += ((PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates)->len + WLAN_IEHDR_LEN;
2732
2733                 if (((PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates)->len != 0)
2734                         cbExtSuppRate += ((PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates)->len + WLAN_IEHDR_LEN;
2735
2736                 if (cbExtSuppRate > 0)
2737                         cbFrameBodySize = WLAN_ASSOCRESP_OFF_SUPP_RATES;
2738         }
2739
2740         //Set FRAGCTL_MACHDCNT
2741         pTxBufHead->wFragCtl |= cpu_to_le16((unsigned short)cbMacHdLen << 10);
2742
2743         // Notes:
2744         // Although spec says MMPDU can be fragmented; In most cases,
2745         // no one will send a MMPDU under fragmentation. With RTS may occur.
2746         pDevice->bAES = false;  //Set FRAGCTL_WEPTYP
2747
2748         if (WLAN_GET_FC_ISWEP(p80211Header->sA4.wFrameCtl) != 0) {
2749                 if (pDevice->eEncryptionStatus == Ndis802_11Encryption1Enabled) {
2750                         cbIVlen = 4;
2751                         cbICVlen = 4;
2752                         pTxBufHead->wFragCtl |= FRAGCTL_LEGACY;
2753                 } else if (pDevice->eEncryptionStatus == Ndis802_11Encryption2Enabled) {
2754                         cbIVlen = 8;//IV+ExtIV
2755                         cbMIClen = 8;
2756                         cbICVlen = 4;
2757                         pTxBufHead->wFragCtl |= FRAGCTL_TKIP;
2758                         //We need to get seed here for filling TxKey entry.
2759                 } else if (pDevice->eEncryptionStatus == Ndis802_11Encryption3Enabled) {
2760                         cbIVlen = 8;//RSN Header
2761                         cbICVlen = 8;//MIC
2762                         cbMICHDR = sizeof(struct vnt_mic_hdr);
2763                         pTxBufHead->wFragCtl |= FRAGCTL_AES;
2764                         pDevice->bAES = true;
2765                 }
2766                 //MAC Header should be padding 0 to DW alignment.
2767                 uPadding = 4 - (cbMacHdLen%4);
2768                 uPadding %= 4;
2769         }
2770
2771         cbFrameSize = cbMacHdLen + cbFrameBodySize + cbIVlen + cbMIClen + cbICVlen + cbFCSlen + cbExtSuppRate;
2772
2773         //Set FIFOCTL_GrpAckPolicy
2774         if (pDevice->bGrpAckPolicy == true) //0000 0100 0000 0000
2775                 pTxBufHead->wFIFOCtl |= FIFOCTL_GRPACK;
2776
2777         //the rest of pTxBufHead->wFragCtl:FragTyp will be set later in s_vFillFragParameter()
2778
2779         if (byPktType == PK_TYPE_11GB || byPktType == PK_TYPE_11GA) {//802.11g packet
2780
2781                 pvRrvTime = (void *)(pbyTxBufferAddr + wTxBufSize);
2782                 pMICHDR = (struct vnt_mic_hdr *)(pbyTxBufferAddr + wTxBufSize +
2783                                         sizeof(struct vnt_rrv_time_cts));
2784                 pvRTS = NULL;
2785                 pvCTS = (struct vnt_cts *)(pbyTxBufferAddr + wTxBufSize +
2786                                 sizeof(struct vnt_rrv_time_cts) + cbMICHDR);
2787                 pvTxDataHd = (void *)(pbyTxBufferAddr + wTxBufSize +
2788                         sizeof(struct vnt_rrv_time_cts) + cbMICHDR + sizeof(struct vnt_cts));
2789                 cbHeaderSize = wTxBufSize + sizeof(struct vnt_rrv_time_cts) +
2790                                 cbMICHDR + sizeof(struct vnt_cts) + sizeof(struct vnt_tx_datahead_g);
2791
2792         } else {//802.11a/b packet
2793
2794                 pvRrvTime = (void *)(pbyTxBufferAddr + wTxBufSize);
2795                 pMICHDR = (struct vnt_mic_hdr *) (pbyTxBufferAddr +
2796                                 wTxBufSize + sizeof(struct vnt_rrv_time_ab));
2797                 pvRTS = NULL;
2798                 pvCTS = NULL;
2799                 pvTxDataHd = (void *)(pbyTxBufferAddr +
2800                         wTxBufSize + sizeof(struct vnt_rrv_time_ab) + cbMICHDR);
2801                 cbHeaderSize = wTxBufSize + sizeof(struct vnt_rrv_time_ab) +
2802                                 cbMICHDR + sizeof(struct vnt_tx_datahead_ab);
2803
2804         }
2805
2806         memset((void *)(pbyTxBufferAddr + wTxBufSize), 0, (cbHeaderSize - wTxBufSize));
2807         memcpy(&(sEthHeader.abyDstAddr[0]), &(p80211Header->sA3.abyAddr1[0]), ETH_ALEN);
2808         memcpy(&(sEthHeader.abySrcAddr[0]), &(p80211Header->sA3.abyAddr2[0]), ETH_ALEN);
2809         //=========================
2810         //    No Fragmentation
2811         //=========================
2812         pTxBufHead->wFragCtl |= (unsigned short)FRAGCTL_NONFRAG;
2813
2814         //Fill FIFO,RrvTime,RTS,and CTS
2815         s_vGenerateTxParameter(pDevice, byPktType, pbyTxBufferAddr, pvRrvTime, pvRTS, pvCTS,
2816                                cbFrameSize, bNeedACK, TYPE_TXDMA0, &sEthHeader, wCurrentRate);
2817
2818         //Fill DataHead
2819         uDuration = s_uFillDataHead(pDevice, byPktType, pvTxDataHd, cbFrameSize, TYPE_TXDMA0, bNeedACK,
2820                                     0, 0, 1, AUTO_FB_NONE, wCurrentRate);
2821
2822         pMACHeader = (PS802_11Header) (pbyTxBufferAddr + cbHeaderSize);
2823
2824         cbReqCount = cbHeaderSize + cbMacHdLen + uPadding + cbIVlen + (cbFrameBodySize + cbMIClen) + cbExtSuppRate;
2825
2826         pbyMacHdr = (unsigned char *)(pbyTxBufferAddr + cbHeaderSize);
2827         pbyPayloadHead = (unsigned char *)(pbyMacHdr + cbMacHdLen + uPadding + cbIVlen);
2828         pbyIVHead = (unsigned char *)(pbyMacHdr + cbMacHdLen + uPadding);
2829
2830         // Copy the Packet into a tx Buffer
2831         memcpy(pbyMacHdr, pbMPDU, cbMacHdLen);
2832
2833         // version set to 0, patch for hostapd deamon
2834         pMACHeader->wFrameCtl &= cpu_to_le16(0xfffc);
2835         memcpy(pbyPayloadHead, (pbMPDU + cbMacHdLen), cbFrameBodySize);
2836
2837         // replace support rate, patch for hostapd deamon(only support 11M)
2838         if (WLAN_GET_FC_FSTYPE(p80211Header->sA4.wFrameCtl) == WLAN_FSTYPE_ASSOCRESP) {
2839                 if (cbExtSuppRate != 0) {
2840                         if (((PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates)->len != 0)
2841                                 memcpy((pbyPayloadHead + cbFrameBodySize),
2842                                        pMgmt->abyCurrSuppRates,
2843                                        ((PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates)->len + WLAN_IEHDR_LEN
2844 );
2845                         if (((PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates)->len != 0)
2846                                 memcpy((pbyPayloadHead + cbFrameBodySize) + ((PWLAN_IE_SUPP_RATES)pMgmt->abyCurrSuppRates)->len + WLAN_IEHDR_LEN,
2847                                        pMgmt->abyCurrExtSuppRates,
2848                                        ((PWLAN_IE_SUPP_RATES)pMgmt->abyCurrExtSuppRates)->len + WLAN_IEHDR_LEN
2849 );
2850                 }
2851         }
2852
2853         // Set wep
2854         if (WLAN_GET_FC_ISWEP(p80211Header->sA4.wFrameCtl) != 0) {
2855                 if (pDevice->bEnableHostWEP) {
2856                         pTransmitKey = &STempKey;
2857                         pTransmitKey->byCipherSuite = pMgmt->sNodeDBTable[uNodeIndex].byCipherSuite;
2858                         pTransmitKey->dwKeyIndex = pMgmt->sNodeDBTable[uNodeIndex].dwKeyIndex;
2859                         pTransmitKey->uKeyLength = pMgmt->sNodeDBTable[uNodeIndex].uWepKeyLength;
2860                         pTransmitKey->dwTSC47_16 = pMgmt->sNodeDBTable[uNodeIndex].dwTSC47_16;
2861                         pTransmitKey->wTSC15_0 = pMgmt->sNodeDBTable[uNodeIndex].wTSC15_0;
2862                         memcpy(pTransmitKey->abyKey,
2863                                &pMgmt->sNodeDBTable[uNodeIndex].abyWepKey[0],
2864                                pTransmitKey->uKeyLength
2865 );
2866                 }
2867
2868                 if ((pTransmitKey != NULL) && (pTransmitKey->byCipherSuite == KEY_CTL_TKIP)) {
2869                         dwMICKey0 = *(u32 *)(&pTransmitKey->abyKey[16]);
2870                         dwMICKey1 = *(u32 *)(&pTransmitKey->abyKey[20]);
2871
2872                         // DO Software Michael
2873                         MIC_vInit(dwMICKey0, dwMICKey1);
2874                         MIC_vAppend((unsigned char *)&(sEthHeader.abyDstAddr[0]), 12);
2875                         dwMIC_Priority = 0;
2876                         MIC_vAppend((unsigned char *)&dwMIC_Priority, 4);
2877                         pr_debug("DMA0_tx_8021:MIC KEY: %X, %X\n",
2878                                  dwMICKey0, dwMICKey1);
2879
2880                         uLength = cbHeaderSize + cbMacHdLen + uPadding + cbIVlen;
2881
2882                         MIC_vAppend((pbyTxBufferAddr + uLength), cbFrameBodySize);
2883
2884                         pdwMIC_L = (u32 *)(pbyTxBufferAddr + uLength + cbFrameBodySize);
2885                         pdwMIC_R = (u32 *)(pbyTxBufferAddr + uLength + cbFrameBodySize + 4);
2886
2887                         MIC_vGetMIC(pdwMIC_L, pdwMIC_R);
2888                         MIC_vUnInit();
2889
2890                         if (pDevice->bTxMICFail == true) {
2891                                 *pdwMIC_L = 0;
2892                                 *pdwMIC_R = 0;
2893                                 pDevice->bTxMICFail = false;
2894                         }
2895
2896                         pr_debug("uLength: %d, %d\n", uLength, cbFrameBodySize);
2897                         pr_debug("cbReqCount:%d, %d, %d, %d\n",
2898                                  cbReqCount, cbHeaderSize, uPadding, cbIVlen);
2899                         pr_debug("MIC:%x, %x\n", *pdwMIC_L, *pdwMIC_R);
2900
2901                 }
2902
2903                 s_vFillTxKey(pDevice, (unsigned char *)(pTxBufHead->adwTxKey), pbyIVHead, pTransmitKey,
2904                              pbyMacHdr, (unsigned short)cbFrameBodySize, (unsigned char *)pMICHDR);
2905
2906                 if (pDevice->bEnableHostWEP) {
2907                         pMgmt->sNodeDBTable[uNodeIndex].dwTSC47_16 = pTransmitKey->dwTSC47_16;
2908                         pMgmt->sNodeDBTable[uNodeIndex].wTSC15_0 = pTransmitKey->wTSC15_0;
2909                 }
2910
2911                 if ((pDevice->byLocalID <= REV_ID_VT3253_A1))
2912                         s_vSWencryption(pDevice, pTransmitKey, pbyPayloadHead, (unsigned short)(cbFrameBodySize + cbMIClen));
2913         }
2914
2915         pMACHeader->wSeqCtl = cpu_to_le16(pDevice->wSeqCounter << 4);
2916         pDevice->wSeqCounter++;
2917         if (pDevice->wSeqCounter > 0x0fff)
2918                 pDevice->wSeqCounter = 0;
2919
2920         if (bIsPSPOLL) {
2921                 // The MAC will automatically replace the Duration-field of MAC header by Duration-field
2922                 // of  FIFO control header.
2923                 // This will cause AID-field of PS-POLL packet be incorrect (Because PS-POLL's AID field is
2924                 // in the same place of other packet's Duration-field).
2925                 // And it will cause Cisco-AP to issue Disassociation-packet
2926                 if (byPktType == PK_TYPE_11GB || byPktType == PK_TYPE_11GA) {
2927                         ((struct vnt_tx_datahead_g *)pvTxDataHd)->duration_a = cpu_to_le16(p80211Header->sA2.wDurationID);
2928                         ((struct vnt_tx_datahead_g *)pvTxDataHd)->duration_b = cpu_to_le16(p80211Header->sA2.wDurationID);
2929                 } else {
2930                         ((struct vnt_tx_datahead_ab *)pvTxDataHd)->duration = cpu_to_le16(p80211Header->sA2.wDurationID);
2931                 }
2932         }
2933
2934         // first TD is the only TD
2935         //Set TSR1 & ReqCount in TxDescHead
2936         pFrstTD->pTDInfo->skb = skb;
2937         pFrstTD->m_td1TD1.byTCR = (TCR_STP | TCR_EDP | EDMSDU);
2938         pFrstTD->pTDInfo->skb_dma = pFrstTD->pTDInfo->buf_dma;
2939         pFrstTD->m_td1TD1.wReqCount = cpu_to_le16(cbReqCount);
2940         pFrstTD->buff_addr = cpu_to_le32(pFrstTD->pTDInfo->skb_dma);
2941         pFrstTD->pTDInfo->byFlags = 0;
2942         pFrstTD->pTDInfo->byFlags |= TD_FLAGS_PRIV_SKB;
2943
2944         if (MACbIsRegBitsOn(pDevice->PortOffset, MAC_REG_PSCTL, PSCTL_PS)) {
2945                 // Disable PS
2946                 MACbPSWakeup(pDevice->PortOffset);
2947         }
2948         pDevice->bPWBitOn = false;
2949
2950         wmb();
2951         pFrstTD->m_td0TD0.f1Owner = OWNED_BY_NIC;
2952         wmb();
2953
2954         pDevice->iTDUsed[TYPE_TXDMA0]++;
2955
2956         if (AVAIL_TD(pDevice, TYPE_TXDMA0) <= 1)
2957                 pr_debug(" available td0 <= 1\n");
2958
2959         pDevice->apCurrTD[TYPE_TXDMA0] = pFrstTD->next;
2960
2961         // Poll Transmit the adapter
2962         MACvTransmit0(pDevice->PortOffset);
2963 }