/******************************************************************************
 *
 *  Copyright(c) 2003 - 2004 Intel Corporation. All rights reserved.
 *
 *  This program is free software; you can redistribute it and/or modify it
 *  under the terms of version 2 of the GNU General Public License as
 *  published by the Free Software Foundation.
 *
 *  This program is distributed in the hope that it will be useful, but WITHOUT
 *  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 *  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
 *  more details.
 *
 *  You should have received a copy of the GNU General Public License along with
 *  this program; if not, write to the Free Software Foundation, Inc., 59
 *  Temple Place - Suite 330, Boston, MA  02111-1307, USA.
 *
 *  The full GNU General Public License is included in this distribution in the
 *  file called LICENSE.
 *
 *  Contact Information:
 *  James P. Ketrenos <ipw2100-admin@linux.intel.com>
 *  Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
 *
 *
 *  Few modifications for Realtek's Wi-Fi drivers by
 *  Andrea Merello <andrea.merello@gmail.com>
 *
 *  A special thanks goes to Realtek for their support !
 *
 ******************************************************************************/

#include <linux/compiler.h>
#include <linux/errno.h>
#include <linux/if_arp.h>
#include <linux/in6.h>
#include <linux/in.h>
#include <linux/ip.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/netdevice.h>
#include <linux/pci.h>
#include <linux/proc_fs.h>
#include <linux/skbuff.h>
#include <linux/slab.h>
#include <linux/tcp.h>
#include <linux/types.h>
#include <linux/wireless.h>
#include <linux/etherdevice.h>
#include <linux/uaccess.h>
#include <linux/if_vlan.h>

#include "ieee80211.h"


/*
 *
 *
 * 802.11 Data Frame
 *
 *
 * 802.11 frame_contorl for data frames - 2 bytes
 *      ,-----------------------------------------------------------------------------------------.
 * bits | 0  |  1  |  2  |  3  |  4  |  5  |  6  |  7  |  8  |  9  |  a  |  b  |  c  |  d  |  e   |
 *      |----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|------|
 * val  | 0  |  0  |  0  |  1  |  x  |  0  |  0  |  0  |  1  |  0  |  x  |  x  |  x  |  x  |  x   |
 *      |----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|-----|------|
 * desc | ^-ver-^  |  ^type-^  |  ^-----subtype-----^  | to  |from |more |retry| pwr |more |wep   |
 *      |          |           | x=0 data,x=1 data+ack | DS  | DS  |frag |     | mgm |data |      |
 *      '-----------------------------------------------------------------------------------------'
 *                                                    /\
 *                                                    |
 * 802.11 Data Frame                                  |
 *           ,--------- 'ctrl' expands to >-----------'
 *           |
 *        ,--'---,-------------------------------------------------------------.
 *  Bytes |  2   |  2   |    6    |    6    |    6    |  2   | 0..2312 |   4  |
 *        |------|------|---------|---------|---------|------|---------|------|
 *  Desc. | ctrl | dura |  DA/RA  |   TA    |    SA   | Sequ |  Frame  |  fcs |
 *        |      | tion | (BSSID) |         |         | ence |  data   |      |
 *        `--------------------------------------------------|         |------'
 *  Total: 28 non-data bytes                                 `----.----'
 *                                                                |
 *         .- 'Frame data' expands to <---------------------------'
 *         |
 *         V
 *        ,---------------------------------------------------.
 *  Bytes |  1   |  1   |    1    |    3     |  2   |  0-2304 |
 *        |------|------|---------|----------|------|---------|
 *  Desc. | SNAP | SNAP | Control |Eth Tunnel| Type | IP      |
 *        | DSAP | SSAP |         |          |      | Packet  |
 *        | 0xAA | 0xAA |0x03 (UI)|0x00-00-F8|      |         |
 *        `-----------------------------------------|         |
 *  Total: 8 non-data bytes                         `----.----'
 *                                                       |
 *         .- 'IP Packet' expands, if WEP enabled, to <--'
 *         |
 *         V
 *        ,-----------------------.
 *  Bytes |  4  |   0-2296  |  4  |
 *        |-----|-----------|-----|
 *  Desc. | IV  | Encrypted | ICV |
 *        |     | IP Packet |     |
 *        `-----------------------'
 *  Total: 8 non-data bytes
 *
 *
 *  802.3 Ethernet Data Frame
 *
 *        ,-----------------------------------------.
 *  Bytes |   6   |   6   |  2   |  Variable |   4  |
 *        |-------|-------|------|-----------|------|
 *  Desc. | Dest. | Source| Type | IP Packet |  fcs |
 *        |  MAC  |  MAC  |      |           |      |
 *        `-----------------------------------------'
 *  Total: 18 non-data bytes
 *
 *  In the event that fragmentation is required, the incoming payload is split into
 *  N parts of size ieee->fts.  The first fragment contains the SNAP header and the
 *  remaining packets are just data.
 *
 *  If encryption is enabled, each fragment payload size is reduced by enough space
 *  to add the prefix and postfix (IV and ICV totalling 8 bytes in the case of WEP)
 *  So if you have 1500 bytes of payload with ieee->fts set to 500 without
 *  encryption it will take 3 frames.  With WEP it will take 4 frames as the
 *  payload of each frame is reduced to 492 bytes.
 *
 * SKB visualization
 *
 *  ,- skb->data
 * |
 * |    ETHERNET HEADER        ,-<-- PAYLOAD
 * |                           |     14 bytes from skb->data
 * |  2 bytes for Type --> ,T. |     (sizeof ethhdr)
 * |                       | | |
 * |,-Dest.--. ,--Src.---. | | |
 * |  6 bytes| | 6 bytes | | | |
 * v         | |         | | | |
 * 0         | v       1 | v | v           2
 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
 *     ^     | ^         | ^ |
 *     |     | |         | | |
 *     |     | |         | `T' <---- 2 bytes for Type
 *     |     | |         |
 *     |     | '---SNAP--' <-------- 6 bytes for SNAP
 *     |     |
 *     `-IV--' <-------------------- 4 bytes for IV (WEP)
 *
 *      SNAP HEADER
 *
 */

static u8 P802_1H_OUI[P80211_OUI_LEN] = { 0x00, 0x00, 0xf8 };
static u8 RFC1042_OUI[P80211_OUI_LEN] = { 0x00, 0x00, 0x00 };

static inline int ieee80211_put_snap(u8 *data, u16 h_proto)
{
        struct ieee80211_snap_hdr *snap;
        u8 *oui;

        snap = (struct ieee80211_snap_hdr *)data;
        snap->dsap = 0xaa;
        snap->ssap = 0xaa;
        snap->ctrl = 0x03;

        if (h_proto == 0x8137 || h_proto == 0x80f3)
                oui = P802_1H_OUI;
        else
                oui = RFC1042_OUI;
        snap->oui[0] = oui[0];
        snap->oui[1] = oui[1];
        snap->oui[2] = oui[2];

        *(__be16 *)(data + SNAP_SIZE) = htons(h_proto);

        return SNAP_SIZE + sizeof(u16);
}

int ieee80211_encrypt_fragment(
        struct ieee80211_device *ieee,
        struct sk_buff *frag,
        int hdr_len)
{
        struct ieee80211_crypt_data *crypt = ieee->crypt[ieee->tx_keyidx];
        int res;

        if (!(crypt && crypt->ops))
        {
                printk("=========>%s(), crypt is null\n", __func__);
                return -1;
        }

        if (ieee->tkip_countermeasures &&
            crypt && crypt->ops && strcmp(crypt->ops->name, "TKIP") == 0) {
                if (net_ratelimit()) {
                        struct rtl_80211_hdr_3addrqos *header;

                        header = (struct rtl_80211_hdr_3addrqos *)frag->data;
                        printk(KERN_DEBUG "%s: TKIP countermeasures: dropped "
                               "TX packet to %pM\n",
                               ieee->dev->name, header->addr1);
                }
                return -1;
        }

        /* To encrypt, frame format is:
         * IV (4 bytes), clear payload (including SNAP), ICV (4 bytes)
         */

        // PR: FIXME: Copied from hostap. Check fragmentation/MSDU/MPDU encryption.
        /* Host-based IEEE 802.11 fragmentation for TX is not yet supported, so
         * call both MSDU and MPDU encryption functions from here.
         */
        atomic_inc(&crypt->refcnt);
        res = 0;
        if (crypt->ops->encrypt_msdu)
                res = crypt->ops->encrypt_msdu(frag, hdr_len, crypt->priv);
        if (res == 0 && crypt->ops->encrypt_mpdu)
                res = crypt->ops->encrypt_mpdu(frag, hdr_len, crypt->priv);

        atomic_dec(&crypt->refcnt);
        if (res < 0) {
                printk(KERN_INFO "%s: Encryption failed: len=%d.\n",
                       ieee->dev->name, frag->len);
                ieee->ieee_stats.tx_discards++;
                return -1;
        }

        return 0;
}


void ieee80211_txb_free(struct ieee80211_txb *txb) {
        //int i;
        if (unlikely(!txb))
                return;
        kfree(txb);
}
EXPORT_SYMBOL(ieee80211_txb_free);

static struct ieee80211_txb *ieee80211_alloc_txb(int nr_frags, int txb_size,
                                                 gfp_t gfp_mask)
{
        struct ieee80211_txb *txb;
        int i;
        txb = kmalloc(
                sizeof(struct ieee80211_txb) + (sizeof(u8 *) * nr_frags),
                gfp_mask);
        if (!txb)
                return NULL;

        memset(txb, 0, sizeof(struct ieee80211_txb));
        txb->nr_frags = nr_frags;
        txb->frag_size = __cpu_to_le16(txb_size);

        for (i = 0; i < nr_frags; i++) {
                txb->fragments[i] = dev_alloc_skb(txb_size);
                if (unlikely(!txb->fragments[i])) {
                        i--;
                        break;
                }
                memset(txb->fragments[i]->cb, 0, sizeof(txb->fragments[i]->cb));
        }
        if (unlikely(i != nr_frags)) {
                while (i >= 0)
                        dev_kfree_skb_any(txb->fragments[i--]);
                kfree(txb);
                return NULL;
        }
        return txb;
}

// Classify the to-be send data packet
// Need to acquire the sent queue index.
static int
ieee80211_classify(struct sk_buff *skb, struct ieee80211_network *network)
{
        struct ethhdr *eth;
        struct iphdr *ip;
        eth = (struct ethhdr *)skb->data;
        if (eth->h_proto != htons(ETH_P_IP))
                return 0;

        ip = ip_hdr(skb);
        switch (ip->tos & 0xfc) {
        case 0x20:
                return 2;
        case 0x40:
                return 1;
        case 0x60:
                return 3;
        case 0x80:
                return 4;
        case 0xa0:
                return 5;
        case 0xc0:
                return 6;
        case 0xe0:
                return 7;
        default:
                return 0;
        }
}

#define SN_LESS(a, b)           (((a-b)&0x800)!=0)
static void ieee80211_tx_query_agg_cap(struct ieee80211_device *ieee,
                                       struct sk_buff *skb, struct cb_desc *tcb_desc)
{
        PRT_HIGH_THROUGHPUT     pHTInfo = ieee->pHTInfo;
        PTX_TS_RECORD                   pTxTs = NULL;
        struct rtl_80211_hdr_1addr *hdr = (struct rtl_80211_hdr_1addr *)skb->data;

        if (!pHTInfo->bCurrentHTSupport||!pHTInfo->bEnableHT)
                return;
        if (!IsQoSDataFrame(skb->data))
                return;

        if (is_multicast_ether_addr(hdr->addr1))
                return;
        //check packet and mode later
#ifdef TO_DO_LIST
        if(pTcb->PacketLength >= 4096)
                return;
        // For RTL819X, if pairwisekey = wep/tkip, we don't aggrregation.
        if(!Adapter->HalFunc.GetNmodeSupportBySecCfgHandler(Adapter))
                return;
#endif
        if(!ieee->GetNmodeSupportBySecCfg(ieee->dev))
        {
                return;
        }
        if(pHTInfo->bCurrentAMPDUEnable)
        {
                if (!GetTs(ieee, (PTS_COMMON_INFO *)(&pTxTs), hdr->addr1, skb->priority, TX_DIR, true))
                {
                        printk("===>can't get TS\n");
                        return;
                }
                if (!pTxTs->TxAdmittedBARecord.bValid)
                {
                        TsStartAddBaProcess(ieee, pTxTs);
                        goto FORCED_AGG_SETTING;
                }
                else if (!pTxTs->bUsingBa)
                {
                        if (SN_LESS(pTxTs->TxAdmittedBARecord.BaStartSeqCtrl.field.SeqNum, (pTxTs->TxCurSeq+1)%4096))
                                pTxTs->bUsingBa = true;
                        else
                                goto FORCED_AGG_SETTING;
                }

                if (ieee->iw_mode == IW_MODE_INFRA)
                {
                        tcb_desc->bAMPDUEnable = true;
                        tcb_desc->ampdu_factor = pHTInfo->CurrentAMPDUFactor;
                        tcb_desc->ampdu_density = pHTInfo->CurrentMPDUDensity;
                }
        }
FORCED_AGG_SETTING:
        switch (pHTInfo->ForcedAMPDUMode )
        {
                case HT_AGG_AUTO:
                        break;

                case HT_AGG_FORCE_ENABLE:
                        tcb_desc->bAMPDUEnable = true;
                        tcb_desc->ampdu_density = pHTInfo->ForcedMPDUDensity;
                        tcb_desc->ampdu_factor = pHTInfo->ForcedAMPDUFactor;
                        break;

                case HT_AGG_FORCE_DISABLE:
                        tcb_desc->bAMPDUEnable = false;
                        tcb_desc->ampdu_density = 0;
                        tcb_desc->ampdu_factor = 0;
                        break;

        }
                return;
}

static void ieee80211_qurey_ShortPreambleMode(struct ieee80211_device *ieee,
                                              struct cb_desc *tcb_desc)
{
        tcb_desc->bUseShortPreamble = false;
        if (tcb_desc->data_rate == 2)
        {//// 1M can only use Long Preamble. 11B spec
                return;
        }
        else if (ieee->current_network.capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
        {
                tcb_desc->bUseShortPreamble = true;
        }
        return;
}
static void
ieee80211_query_HTCapShortGI(struct ieee80211_device *ieee, struct cb_desc *tcb_desc)
{
        PRT_HIGH_THROUGHPUT             pHTInfo = ieee->pHTInfo;

        tcb_desc->bUseShortGI           = false;

        if(!pHTInfo->bCurrentHTSupport||!pHTInfo->bEnableHT)
                return;

        if(pHTInfo->bForcedShortGI)
        {
                tcb_desc->bUseShortGI = true;
                return;
        }

        if((pHTInfo->bCurBW40MHz==true) && pHTInfo->bCurShortGI40MHz)
                tcb_desc->bUseShortGI = true;
        else if((pHTInfo->bCurBW40MHz==false) && pHTInfo->bCurShortGI20MHz)
                tcb_desc->bUseShortGI = true;
}

static void ieee80211_query_BandwidthMode(struct ieee80211_device *ieee,
                                          struct cb_desc *tcb_desc)
{
        PRT_HIGH_THROUGHPUT     pHTInfo = ieee->pHTInfo;

        tcb_desc->bPacketBW = false;

        if(!pHTInfo->bCurrentHTSupport||!pHTInfo->bEnableHT)
                return;

        if(tcb_desc->bMulticast || tcb_desc->bBroadcast)
                return;

        if((tcb_desc->data_rate & 0x80)==0) // If using legacy rate, it shall use 20MHz channel.
                return;
        //BandWidthAutoSwitch is for auto switch to 20 or 40 in long distance
        if(pHTInfo->bCurBW40MHz && pHTInfo->bCurTxBW40MHz && !ieee->bandwidth_auto_switch.bforced_tx20Mhz)
                tcb_desc->bPacketBW = true;
        return;
}

static void ieee80211_query_protectionmode(struct ieee80211_device *ieee,
                                           struct cb_desc *tcb_desc,
                                           struct sk_buff *skb)
{
        // Common Settings
        tcb_desc->bRTSSTBC                      = false;
        tcb_desc->bRTSUseShortGI                = false; // Since protection frames are always sent by legacy rate, ShortGI will never be used.
        tcb_desc->bCTSEnable                    = false; // Most of protection using RTS/CTS
        tcb_desc->RTSSC                         = 0;            // 20MHz: Don't care;  40MHz: Duplicate.
        tcb_desc->bRTSBW                        = false; // RTS frame bandwidth is always 20MHz

        if(tcb_desc->bBroadcast || tcb_desc->bMulticast)//only unicast frame will use rts/cts
                return;

        if (is_broadcast_ether_addr(skb->data+16))  //check addr3 as infrastructure add3 is DA.
                return;

        if (ieee->mode < IEEE_N_24G) //b, g mode
        {
                        // (1) RTS_Threshold is compared to the MPDU, not MSDU.
                        // (2) If there are more than one frag in  this MSDU, only the first frag uses protection frame.
                        //              Other fragments are protected by previous fragment.
                        //              So we only need to check the length of first fragment.
                if (skb->len > ieee->rts)
                {
                        tcb_desc->bRTSEnable = true;
                        tcb_desc->rts_rate = MGN_24M;
                }
                else if (ieee->current_network.buseprotection)
                {
                        // Use CTS-to-SELF in protection mode.
                        tcb_desc->bRTSEnable = true;
                        tcb_desc->bCTSEnable = true;
                        tcb_desc->rts_rate = MGN_24M;
                }
                //otherwise return;
                return;
        }
        else
        {// 11n High throughput case.
                PRT_HIGH_THROUGHPUT pHTInfo = ieee->pHTInfo;
                while (true)
                {
                        //check ERP protection
                        if (ieee->current_network.buseprotection)
                        {// CTS-to-SELF
                                tcb_desc->bRTSEnable = true;
                                tcb_desc->bCTSEnable = true;
                                tcb_desc->rts_rate = MGN_24M;
                                break;
                        }
                        //check HT op mode
                        if(pHTInfo->bCurrentHTSupport  && pHTInfo->bEnableHT)
                        {
                                u8 HTOpMode = pHTInfo->CurrentOpMode;
                                if((pHTInfo->bCurBW40MHz && (HTOpMode == 2 || HTOpMode == 3)) ||
                                                        (!pHTInfo->bCurBW40MHz && HTOpMode == 3) )
                                {
                                        tcb_desc->rts_rate = MGN_24M; // Rate is 24Mbps.
                                        tcb_desc->bRTSEnable = true;
                                        break;
                                }
                        }
                        //check rts
                        if (skb->len > ieee->rts)
                        {
                                tcb_desc->rts_rate = MGN_24M; // Rate is 24Mbps.
                                tcb_desc->bRTSEnable = true;
                                break;
                        }
                        //to do list: check MIMO power save condition.
                        //check AMPDU aggregation for TXOP
                        if(tcb_desc->bAMPDUEnable)
                        {
                                tcb_desc->rts_rate = MGN_24M; // Rate is 24Mbps.
                                // According to 8190 design, firmware sends CF-End only if RTS/CTS is enabled. However, it degrads
                                // throughput around 10M, so we disable of this mechanism. 2007.08.03 by Emily
                                tcb_desc->bRTSEnable = false;
                                break;
                        }
                        //check IOT action
                        if(pHTInfo->IOTAction & HT_IOT_ACT_FORCED_CTS2SELF)
                        {
                                tcb_desc->bCTSEnable    = true;
                                tcb_desc->rts_rate  =   MGN_24M;
                                tcb_desc->bRTSEnable = true;
                                break;
                        }
                        // Totally no protection case!!
                        goto NO_PROTECTION;
                }
                }
        // For test , CTS replace with RTS
        if (0) {
                tcb_desc->bCTSEnable    = true;
                tcb_desc->rts_rate = MGN_24M;
                tcb_desc->bRTSEnable    = true;
        }
        if (ieee->current_network.capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
                tcb_desc->bUseShortPreamble = true;
        if (ieee->mode == IW_MODE_MASTER)
                        goto NO_PROTECTION;
        return;
NO_PROTECTION:
        tcb_desc->bRTSEnable    = false;
        tcb_desc->bCTSEnable    = false;
        tcb_desc->rts_rate              = 0;
        tcb_desc->RTSSC         = 0;
        tcb_desc->bRTSBW                = false;
}


static void ieee80211_txrate_selectmode(struct ieee80211_device *ieee,
                                        struct cb_desc *tcb_desc)
{
#ifdef TO_DO_LIST
        if(!IsDataFrame(pFrame))
        {
                pTcb->bTxDisableRateFallBack = true;
                pTcb->bTxUseDriverAssingedRate = true;
                pTcb->RATRIndex = 7;
                return;
        }

        if(pMgntInfo->ForcedDataRate!= 0)
        {
                pTcb->bTxDisableRateFallBack = true;
                pTcb->bTxUseDriverAssingedRate = true;
                return;
        }
#endif
        if(ieee->bTxDisableRateFallBack)
                tcb_desc->bTxDisableRateFallBack = true;

        if(ieee->bTxUseDriverAssingedRate)
                tcb_desc->bTxUseDriverAssingedRate = true;
        if(!tcb_desc->bTxDisableRateFallBack || !tcb_desc->bTxUseDriverAssingedRate)
        {
                if (ieee->iw_mode == IW_MODE_INFRA || ieee->iw_mode == IW_MODE_ADHOC)
                        tcb_desc->RATRIndex = 0;
        }
}

static void ieee80211_query_seqnum(struct ieee80211_device *ieee,
                                   struct sk_buff *skb, u8 *dst)
{
        if (is_multicast_ether_addr(dst))
                return;
        if (IsQoSDataFrame(skb->data)) //we deal qos data only
        {
                PTX_TS_RECORD pTS = NULL;
                if (!GetTs(ieee, (PTS_COMMON_INFO *)(&pTS), dst, skb->priority, TX_DIR, true))
                {
                        return;
                }
                pTS->TxCurSeq = (pTS->TxCurSeq+1)%4096;
        }
}

int ieee80211_xmit(struct sk_buff *skb, struct net_device *dev)
{
        struct ieee80211_device *ieee = netdev_priv(dev);
        struct ieee80211_txb *txb = NULL;
        struct rtl_80211_hdr_3addrqos *frag_hdr;
        int i, bytes_per_frag, nr_frags, bytes_last_frag, frag_size;
        unsigned long flags;
        struct net_device_stats *stats = &ieee->stats;
        int ether_type = 0, encrypt;
        int bytes, fc, qos_ctl = 0, hdr_len;
        struct sk_buff *skb_frag;
        struct rtl_80211_hdr_3addrqos header = { /* Ensure zero initialized */
                .duration_id = 0,
                .seq_ctl = 0,
                .qos_ctl = 0
        };
        u8 dest[ETH_ALEN], src[ETH_ALEN];
        int qos_actived = ieee->current_network.qos_data.active;

        struct ieee80211_crypt_data *crypt;

        struct cb_desc *tcb_desc;

        spin_lock_irqsave(&ieee->lock, flags);

        /* If there is no driver handler to take the TXB, dont' bother
         * creating it...
         */
        if ((!ieee->hard_start_xmit && !(ieee->softmac_features & IEEE_SOFTMAC_TX_QUEUE))||
           ((!ieee->softmac_data_hard_start_xmit && (ieee->softmac_features & IEEE_SOFTMAC_TX_QUEUE)))) {
                printk(KERN_WARNING "%s: No xmit handler.\n",
                       ieee->dev->name);
                goto success;
        }


        if(likely(ieee->raw_tx == 0)){
                if (unlikely(skb->len < SNAP_SIZE + sizeof(u16))) {
                        printk(KERN_WARNING "%s: skb too small (%d).\n",
                        ieee->dev->name, skb->len);
                        goto success;
                }

                memset(skb->cb, 0, sizeof(skb->cb));
                ether_type = ntohs(((struct ethhdr *)skb->data)->h_proto);

                crypt = ieee->crypt[ieee->tx_keyidx];

                encrypt = !(ether_type == ETH_P_PAE && ieee->ieee802_1x) &&
                        ieee->host_encrypt && crypt && crypt->ops;

                if (!encrypt && ieee->ieee802_1x &&
                ieee->drop_unencrypted && ether_type != ETH_P_PAE) {
                        stats->tx_dropped++;
                        goto success;
                }
        #ifdef CONFIG_IEEE80211_DEBUG
                if (crypt && !encrypt && ether_type == ETH_P_PAE) {
                        struct eapol *eap = (struct eapol *)(skb->data +
                                sizeof(struct ethhdr) - SNAP_SIZE - sizeof(u16));
                        IEEE80211_DEBUG_EAP("TX: IEEE 802.11 EAPOL frame: %s\n",
                                eap_get_type(eap->type));
                }
        #endif

                /* Save source and destination addresses */
                memcpy(&dest, skb->data, ETH_ALEN);
                memcpy(&src, skb->data+ETH_ALEN, ETH_ALEN);

                /* Advance the SKB to the start of the payload */
                skb_pull(skb, sizeof(struct ethhdr));

                /* Determine total amount of storage required for TXB packets */
                bytes = skb->len + SNAP_SIZE + sizeof(u16);

                if (encrypt)
                        fc = IEEE80211_FTYPE_DATA | IEEE80211_FCTL_WEP;
                else

                        fc = IEEE80211_FTYPE_DATA;

                //if(ieee->current_network.QoS_Enable)
                if(qos_actived)
                        fc |= IEEE80211_STYPE_QOS_DATA;
                else
                        fc |= IEEE80211_STYPE_DATA;

                if (ieee->iw_mode == IW_MODE_INFRA) {
                        fc |= IEEE80211_FCTL_TODS;
                        /* To DS: Addr1 = BSSID, Addr2 = SA,
                         * Addr3 = DA
                         */
                        memcpy(&header.addr1, ieee->current_network.bssid, ETH_ALEN);
                        memcpy(&header.addr2, &src, ETH_ALEN);
                        memcpy(&header.addr3, &dest, ETH_ALEN);
                } else if (ieee->iw_mode == IW_MODE_ADHOC) {
                        /* not From/To DS: Addr1 = DA, Addr2 = SA,
                         * Addr3 = BSSID
                         */
                        memcpy(&header.addr1, dest, ETH_ALEN);
                        memcpy(&header.addr2, src, ETH_ALEN);
                        memcpy(&header.addr3, ieee->current_network.bssid, ETH_ALEN);
                }

                header.frame_ctl = cpu_to_le16(fc);

                /* Determine fragmentation size based on destination (multicast
                 * and broadcast are not fragmented)
                 */
                if (is_multicast_ether_addr(header.addr1)) {
                        frag_size = MAX_FRAG_THRESHOLD;
                        qos_ctl |= QOS_CTL_NOTCONTAIN_ACK;
                }
                else {
                        frag_size = ieee->fts;//default:392
                        qos_ctl = 0;
                }

                //if (ieee->current_network.QoS_Enable)
                if(qos_actived)
                {
                        hdr_len = IEEE80211_3ADDR_LEN + 2;

                        skb->priority = ieee80211_classify(skb, &ieee->current_network);
                        qos_ctl |= skb->priority; //set in the ieee80211_classify
                        header.qos_ctl = cpu_to_le16(qos_ctl & IEEE80211_QOS_TID);
                } else {
                        hdr_len = IEEE80211_3ADDR_LEN;
                }
                /* Determine amount of payload per fragment.  Regardless of if
                 * this stack is providing the full 802.11 header, one will
                 * eventually be affixed to this fragment -- so we must account for
                 * it when determining the amount of payload space.
                 */
                bytes_per_frag = frag_size - hdr_len;
                if (ieee->config &
                (CFG_IEEE80211_COMPUTE_FCS | CFG_IEEE80211_RESERVE_FCS))
                        bytes_per_frag -= IEEE80211_FCS_LEN;

                /* Each fragment may need to have room for encryption pre/postfix */
                if (encrypt)
                        bytes_per_frag -= crypt->ops->extra_prefix_len +
                                crypt->ops->extra_postfix_len;

                /* Number of fragments is the total bytes_per_frag /
                 * payload_per_fragment
                 */
                nr_frags = bytes / bytes_per_frag;
                bytes_last_frag = bytes % bytes_per_frag;
                if (bytes_last_frag)
                        nr_frags++;
                else
                        bytes_last_frag = bytes_per_frag;

                /* When we allocate the TXB we allocate enough space for the reserve
                 * and full fragment bytes (bytes_per_frag doesn't include prefix,
                 * postfix, header, FCS, etc.)
                 */
                txb = ieee80211_alloc_txb(nr_frags, frag_size + ieee->tx_headroom, GFP_ATOMIC);
                if (unlikely(!txb)) {
                        printk(KERN_WARNING "%s: Could not allocate TXB\n",
                        ieee->dev->name);
                        goto failed;
                }
                txb->encrypted = encrypt;
                txb->payload_size = __cpu_to_le16(bytes);

                //if (ieee->current_network.QoS_Enable)
                if(qos_actived)
                {
                        txb->queue_index = UP2AC(skb->priority);
                } else {
                        txb->queue_index = WME_AC_BK;
                }



                for (i = 0; i < nr_frags; i++) {
                        skb_frag = txb->fragments[i];
                        tcb_desc = (struct cb_desc *)(skb_frag->cb + MAX_DEV_ADDR_SIZE);
                        if(qos_actived){
                                skb_frag->priority = skb->priority;//UP2AC(skb->priority);
                                tcb_desc->queue_index =  UP2AC(skb->priority);
                        } else {
                                skb_frag->priority = WME_AC_BK;
                                tcb_desc->queue_index = WME_AC_BK;
                        }
                        skb_reserve(skb_frag, ieee->tx_headroom);

                        if (encrypt){
                                if (ieee->hwsec_active)
                                        tcb_desc->bHwSec = 1;
                                else
                                        tcb_desc->bHwSec = 0;
                                skb_reserve(skb_frag, crypt->ops->extra_prefix_len);
                        }
                        else
                        {
                                tcb_desc->bHwSec = 0;
                        }
                        frag_hdr = (struct rtl_80211_hdr_3addrqos *)skb_put(skb_frag, hdr_len);
                        memcpy(frag_hdr, &header, hdr_len);

                        /* If this is not the last fragment, then add the MOREFRAGS
                         * bit to the frame control
                         */
                        if (i != nr_frags - 1) {
                                frag_hdr->frame_ctl = cpu_to_le16(
                                        fc | IEEE80211_FCTL_MOREFRAGS);
                                bytes = bytes_per_frag;

                        } else {
                                /* The last fragment takes the remaining length */
                                bytes = bytes_last_frag;
                        }
                        //if(ieee->current_network.QoS_Enable)
                        if(qos_actived)
                        {
                                // add 1 only indicate to corresponding seq number control 2006/7/12
                                frag_hdr->seq_ctl = cpu_to_le16(ieee->seq_ctrl[UP2AC(skb->priority)+1]<<4 | i);
                        } else {
                                frag_hdr->seq_ctl = cpu_to_le16(ieee->seq_ctrl[0]<<4 | i);
                        }

                        /* Put a SNAP header on the first fragment */
                        if (i == 0) {
                                ieee80211_put_snap(
                                        skb_put(skb_frag, SNAP_SIZE + sizeof(u16)),
                                        ether_type);
                                bytes -= SNAP_SIZE + sizeof(u16);
                        }

                        memcpy(skb_put(skb_frag, bytes), skb->data, bytes);

                        /* Advance the SKB... */
                        skb_pull(skb, bytes);

                        /* Encryption routine will move the header forward in order
                         * to insert the IV between the header and the payload
                         */
                        if (encrypt)
                                ieee80211_encrypt_fragment(ieee, skb_frag, hdr_len);
                        if (ieee->config &
                        (CFG_IEEE80211_COMPUTE_FCS | CFG_IEEE80211_RESERVE_FCS))
                                skb_put(skb_frag, 4);
                }

                if(qos_actived)
                {
                  if (ieee->seq_ctrl[UP2AC(skb->priority) + 1] == 0xFFF)
                        ieee->seq_ctrl[UP2AC(skb->priority) + 1] = 0;
                  else
                        ieee->seq_ctrl[UP2AC(skb->priority) + 1]++;
                } else {
                  if (ieee->seq_ctrl[0] == 0xFFF)
                        ieee->seq_ctrl[0] = 0;
                  else
                        ieee->seq_ctrl[0]++;
                }
        }else{
                if (unlikely(skb->len < sizeof(struct rtl_80211_hdr_3addr))) {
                        printk(KERN_WARNING "%s: skb too small (%d).\n",
                        ieee->dev->name, skb->len);
                        goto success;
                }

                txb = ieee80211_alloc_txb(1, skb->len, GFP_ATOMIC);
                if(!txb){
                        printk(KERN_WARNING "%s: Could not allocate TXB\n",
                        ieee->dev->name);
                        goto failed;
                }

                txb->encrypted = 0;
                txb->payload_size = __cpu_to_le16(skb->len);
                memcpy(skb_put(txb->fragments[0],skb->len), skb->data, skb->len);
        }

 success:
//WB add to fill data tcb_desc here. only first fragment is considered, need to change, and you may remove to other place.
        if (txb)
        {
                struct cb_desc *tcb_desc = (struct cb_desc *)(txb->fragments[0]->cb + MAX_DEV_ADDR_SIZE);
                tcb_desc->bTxEnableFwCalcDur = 1;
                if (is_multicast_ether_addr(header.addr1))
                        tcb_desc->bMulticast = 1;
                if (is_broadcast_ether_addr(header.addr1))
                        tcb_desc->bBroadcast = 1;
                ieee80211_txrate_selectmode(ieee, tcb_desc);
                if (tcb_desc->bMulticast ||  tcb_desc->bBroadcast)
                        tcb_desc->data_rate = ieee->basic_rate;
                else
                        tcb_desc->data_rate = CURRENT_RATE(ieee->mode, ieee->rate, ieee->HTCurrentOperaRate);
                ieee80211_qurey_ShortPreambleMode(ieee, tcb_desc);
                ieee80211_tx_query_agg_cap(ieee, txb->fragments[0], tcb_desc);
                ieee80211_query_HTCapShortGI(ieee, tcb_desc);
                ieee80211_query_BandwidthMode(ieee, tcb_desc);
                ieee80211_query_protectionmode(ieee, tcb_desc, txb->fragments[0]);
                ieee80211_query_seqnum(ieee, txb->fragments[0], header.addr1);
        }
        spin_unlock_irqrestore(&ieee->lock, flags);
        dev_kfree_skb_any(skb);
        if (txb) {
                if (ieee->softmac_features & IEEE_SOFTMAC_TX_QUEUE){
                        ieee80211_softmac_xmit(txb, ieee);
                }else{
                        if ((*ieee->hard_start_xmit)(txb, dev) == 0) {
                                stats->tx_packets++;
                                stats->tx_bytes += __le16_to_cpu(txb->payload_size);
                                return 0;
                        }
                        ieee80211_txb_free(txb);
                }
        }

        return 0;

 failed:
        spin_unlock_irqrestore(&ieee->lock, flags);
        netif_stop_queue(dev);
        stats->tx_errors++;
        return 1;

}