4 files changed, 52 insertions, 31 deletions

diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 934c3ef4f0bc..cbea0154ee3a 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -419,8 +419,6 @@ struct ieee80211_sub_if_data {
          */
         u64 basic_rates;
 
-        u16 sequence;
-
         /* Fragment table for host-based reassembly */
         struct ieee80211_fragment_entry fragments[IEEE80211_FRAGMENT_MAX];
         unsigned int fragment_next;
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 2e3adcb3ce23..610ed1d9893a 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -162,7 +162,6 @@ int ieee80211_if_change_type(struct ieee80211_sub_if_data *sdata,
         /* reset some values that shouldn't be kept across type changes */
         sdata->basic_rates = 0;
         sdata->drop_unencrypted = 0;
-        sdata->sequence = 0;
 
         return 0;
 }
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 94311dcfe043..109db787ccb7 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -285,6 +285,7 @@ struct sta_info {
         unsigned long tx_fragments;
         int txrate_idx;
         int last_txrate_idx;
+        u16 tid_seq[IEEE80211_QOS_CTL_TID_MASK + 1];
 #ifdef CONFIG_MAC80211_DEBUG_COUNTERS
         unsigned int wme_tx_queue[NUM_RX_DATA_QUEUES];
 #endif
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 8843416e1460..0fbadd8b983c 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -38,16 +38,6 @@
 
 /* misc utils */
 
-static inline void ieee80211_include_sequence(struct ieee80211_sub_if_data *sdata,
-                                              struct ieee80211_hdr *hdr)
-{
-        /* Set the sequence number for this frame. */
-        hdr->seq_ctrl = cpu_to_le16(sdata->sequence);
-
-        /* Increase the sequence number. */
-        sdata->sequence = (sdata->sequence + 0x10) & IEEE80211_SCTL_SEQ;
-}
-
 #ifdef CONFIG_MAC80211_LOWTX_FRAME_DUMP
 static void ieee80211_dump_frame(const char *ifname, const char *title,
                                  const struct sk_buff *skb)
@@ -274,17 +264,6 @@ ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
         return TX_CONTINUE;
 }
 
-static ieee80211_tx_result debug_noinline
-ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
-{
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
-
-        if (ieee80211_hdrlen(hdr->frame_control) >= 24)
-                ieee80211_include_sequence(tx->sdata, hdr);
-
-        return TX_CONTINUE;
-}
-
 /* This function is called whenever the AP is about to exceed the maximum limit
  * of buffered frames for power saving STAs. This situation should not really
  * happen often during normal operation, so dropping the oldest buffered packet
@@ -642,6 +621,49 @@ ieee80211_tx_h_misc(struct ieee80211_tx_data *tx)
 }
 
 static ieee80211_tx_result debug_noinline
+ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
+{
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
+        u16 *seq;
+        u8 *qc;
+        int tid;
+
+        /* only for injected frames */
+        if (unlikely(ieee80211_is_ctl(hdr->frame_control)))
+                return TX_CONTINUE;
+
+        if (ieee80211_hdrlen(hdr->frame_control) < 24)
+                return TX_CONTINUE;
+
+        if (!ieee80211_is_data_qos(hdr->frame_control)) {
+                info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
+                return TX_CONTINUE;
+        }
+
+        /*
+         * This should be true for injected/management frames only, for
+         * management frames we have set the IEEE80211_TX_CTL_ASSIGN_SEQ
+         * above since they are not QoS-data frames.
+         */
+        if (!tx->sta)
+                return TX_CONTINUE;
+
+        /* include per-STA, per-TID sequence counter */
+
+        qc = ieee80211_get_qos_ctl(hdr);
+        tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
+        seq = &tx->sta->tid_seq[tid];
+
+        hdr->seq_ctrl = cpu_to_le16(*seq);
+
+        /* Increase the sequence number. */
+        *seq = (*seq + 0x10) & IEEE80211_SCTL_SEQ;
+
+        return TX_CONTINUE;
+}
+
+static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
@@ -1110,12 +1132,12 @@ static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
                 goto txh_done;
 
         CALL_TXH(ieee80211_tx_h_check_assoc)
-        CALL_TXH(ieee80211_tx_h_sequence)
         CALL_TXH(ieee80211_tx_h_ps_buf)
         CALL_TXH(ieee80211_tx_h_select_key)
         CALL_TXH(ieee80211_tx_h_michael_mic_add)
         CALL_TXH(ieee80211_tx_h_rate_ctrl)
         CALL_TXH(ieee80211_tx_h_misc)
+        CALL_TXH(ieee80211_tx_h_sequence)
         CALL_TXH(ieee80211_tx_h_fragment)
         /* handlers after fragment must be aware of tx info fragmentation! */
         CALL_TXH(ieee80211_tx_h_encrypt)
@@ -1827,9 +1849,6 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
                         memcpy(skb_put(skb, beacon->head_len), beacon->head,
                                beacon->head_len);
 
-                        ieee80211_include_sequence(sdata,
-                                        (struct ieee80211_hdr *)skb->data);
-
                         /*
                          * Not very nice, but we want to allow the driver to call
                          * ieee80211_beacon_get() as a response to the set_tim()
@@ -1919,14 +1938,18 @@ struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
 
         info->control.vif = vif;
         info->tx_rate_idx = rsel.rate_idx;
+
+        info->flags |= IEEE80211_TX_CTL_NO_ACK;
+        info->flags |= IEEE80211_TX_CTL_DO_NOT_ENCRYPT;
+        info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
+        info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
         if (sdata->bss_conf.use_short_preamble &&
             sband->bitrates[rsel.rate_idx].flags & IEEE80211_RATE_SHORT_PREAMBLE)
                 info->flags |= IEEE80211_TX_CTL_SHORT_PREAMBLE;
+
         info->antenna_sel_tx = local->hw.conf.antenna_sel_tx;
-        info->flags |= IEEE80211_TX_CTL_NO_ACK;
-        info->flags |= IEEE80211_TX_CTL_DO_NOT_ENCRYPT;
         info->control.retry_limit = 1;
-        info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
+
         (*num_beacons)++;
 out:
         rcu_read_unlock();