Update bcm43xx-mac80211 to latest git pull, mostly debugging improvements

SVN-Revision: 7830

diff --git a/package/bcm43xx-mac80211/src/bcm43xx/bcm43xx_debugfs.c b/package/bcm43xx-mac80211/src/bcm43xx/bcm43xx_debugfs.c
index 3ea9d08a272a0da4f06344e2e961edfa8216a85b..e623cfd05e16f1a4a218ce456c1950666dfc2530 100644 (file)
--- a/package/bcm43xx-mac80211/src/bcm43xx/bcm43xx_debugfs.c
+++ b/package/bcm43xx-mac80211/src/bcm43xx/bcm43xx_debugfs.c
@@ -437,6 +437,7 @@ static void bcm43xx_add_dynamic_debug(struct bcm43xx_wldev *dev)
 
        add_dyn_dbg("debug_xmitpower", BCM43xx_DBG_XMITPOWER, 0);
        add_dyn_dbg("debug_dmaoverflow", BCM43xx_DBG_DMAOVERFLOW, 0);
+       add_dyn_dbg("debug_dmaverbose", BCM43xx_DBG_DMAVERBOSE, 0);
        add_dyn_dbg("debug_pwork_fast", BCM43xx_DBG_PWORK_FAST, 0);
        add_dyn_dbg("debug_pwork_stop", BCM43xx_DBG_PWORK_STOP, 0);
 

diff --git a/package/bcm43xx-mac80211/src/bcm43xx/bcm43xx_debugfs.h b/package/bcm43xx-mac80211/src/bcm43xx/bcm43xx_debugfs.h
index 892299d550d962cd7282cbb338ca298bcb218ba8..bf31754b0cbed4e93191272e1faf720015aade31 100644 (file)
--- a/package/bcm43xx-mac80211/src/bcm43xx/bcm43xx_debugfs.h
+++ b/package/bcm43xx-mac80211/src/bcm43xx/bcm43xx_debugfs.h
@@ -7,6 +7,7 @@ struct bcm43xx_txstatus;
 enum bcm43xx_dyndbg { /* Dynamic debugging features */
        BCM43xx_DBG_XMITPOWER,
        BCM43xx_DBG_DMAOVERFLOW,
+       BCM43xx_DBG_DMAVERBOSE,
        BCM43xx_DBG_PWORK_FAST,
        BCM43xx_DBG_PWORK_STOP,
        __BCM43xx_NR_DYNDBG,

diff --git a/package/bcm43xx-mac80211/src/bcm43xx/bcm43xx_dma.c b/package/bcm43xx-mac80211/src/bcm43xx/bcm43xx_dma.c
index c8b5cddc3b6018344e7bb27938a99d06cf7b2b1c..814e1ad075aabe94b6cee5c22383462379b577e8 100644 (file)
--- a/package/bcm43xx-mac80211/src/bcm43xx/bcm43xx_dma.c
+++ b/package/bcm43xx-mac80211/src/bcm43xx/bcm43xx_dma.c
@@ -259,6 +259,28 @@ static inline int prev_slot(struct bcm43xx_dmaring *ring, int slot)
        return slot - 1;
 }
 
+#ifdef CONFIG_BCM43XX_MAC80211_DEBUG
+static void update_max_used_slots(struct bcm43xx_dmaring *ring,
+                                 int current_used_slots)
+{
+       if (current_used_slots <= ring->max_used_slots)
+               return;
+       ring->max_used_slots = current_used_slots;
+       if (bcm43xx_debug(ring->dev, BCM43xx_DBG_DMAVERBOSE)) {
+               dprintk(KERN_DEBUG PFX
+                       "max_used_slots increased to %d on %s ring %d\n",
+                       ring->max_used_slots,
+                       ring->tx ? "TX" : "RX",
+                       ring->index);
+       }
+}
+#else
+static inline
+void update_max_used_slots(struct bcm43xx_dmaring *ring,
+                          int current_used_slots)
+{ }
+#endif /* DEBUG */
+
 /* Request a slot for usage. */
 static inline
 int request_slot(struct bcm43xx_dmaring *ring)
@@ -273,23 +295,11 @@ int request_slot(struct bcm43xx_dmaring *ring)
        ring->current_slot = slot;
        ring->used_slots++;
 
-#ifdef CONFIG_BCM43XX_MAC80211_DEBUG
-       if (ring->used_slots > ring->max_used_slots)
-               ring->max_used_slots = ring->used_slots;
-#endif /* CONFIG_BCM43XX_MAC80211_DEBUG*/
+       update_max_used_slots(ring, ring->used_slots);
 
        return slot;
 }
 
-/* Return a slot to the free slots. */
-static inline
-void return_slot(struct bcm43xx_dmaring *ring, int slot)
-{
-       assert(ring->tx);
-
-       ring->used_slots--;
-}
-
 /* Mac80211-queue to bcm43xx-ring mapping */
 static struct bcm43xx_dmaring * priority_to_txring(struct bcm43xx_wldev *dev,
                                                   int queue_priority)
@@ -1254,6 +1264,10 @@ int bcm43xx_dma_tx(struct bcm43xx_wldev *dev,
                /* This TX ring is full. */
                ieee80211_stop_queue(dev->wl->hw, txring_to_priority(ring));
                ring->stopped = 1;
+               if (bcm43xx_debug(dev, BCM43xx_DBG_DMAVERBOSE)) {
+                       dprintk(KERN_DEBUG PFX "Stopped TX ring %d\n",
+                               ring->index);
+               }
        }
 out_unlock:
        spin_unlock_irqrestore(&ring->lock, flags);
@@ -1305,10 +1319,9 @@ void bcm43xx_dma_handle_txstatus(struct bcm43xx_wldev *dev,
                         */
                        assert(meta->skb == NULL);
                }
-               /* Everything belonging to the slot is unmapped
-                * and freed, so we can return it.
-                */
-               return_slot(ring, slot);
+
+               /* Everything unmapped and free'd. So it's not used anymore. */
+               ring->used_slots--;
 
                if (meta->is_last_fragment)
                        break;
@@ -1319,6 +1332,10 @@ void bcm43xx_dma_handle_txstatus(struct bcm43xx_wldev *dev,
                assert(free_slots(ring) >= SLOTS_PER_PACKET);
                ieee80211_wake_queue(dev->wl->hw, txring_to_priority(ring));
                ring->stopped = 0;
+               if (bcm43xx_debug(dev, BCM43xx_DBG_DMAVERBOSE)) {
+                       dprintk(KERN_DEBUG PFX "Woke up TX ring %d\n",
+                               ring->index);
+               }
        }
 
        spin_unlock(&ring->lock);
@@ -1445,9 +1462,7 @@ void bcm43xx_dma_rx(struct bcm43xx_dmaring *ring)
 {
        const struct bcm43xx_dma_ops *ops = ring->ops;
        int slot, current_slot;
-#ifdef CONFIG_BCM43XX_MAC80211_DEBUG
        int used_slots = 0;
-#endif
 
        assert(!ring->tx);
        current_slot = ops->get_current_rxslot(ring);
@@ -1456,10 +1471,7 @@ void bcm43xx_dma_rx(struct bcm43xx_dmaring *ring)
        slot = ring->current_slot;
        for ( ; slot != current_slot; slot = next_slot(ring, slot)) {
                dma_rx(ring, &slot);
-#ifdef CONFIG_BCM43XX_MAC80211_DEBUG
-               if (++used_slots > ring->max_used_slots)
-                       ring->max_used_slots = used_slots;
-#endif
+               update_max_used_slots(ring, ++used_slots);
        }
        ops->set_current_rxslot(ring, slot);
        ring->current_slot = slot;

diff --git a/package/bcm43xx-mac80211/src/bcm43xx/bcm43xx_main.c b/package/bcm43xx-mac80211/src/bcm43xx/bcm43xx_main.c
index 5b7ff9293d29e9333b4d0fe65b171372e5405281..e13c1168ef2dccced4d5d32b3acb90a7766aa096 100644 (file)
--- a/package/bcm43xx-mac80211/src/bcm43xx/bcm43xx_main.c
+++ b/package/bcm43xx-mac80211/src/bcm43xx/bcm43xx_main.c
@@ -1080,21 +1080,13 @@ static void bcm43xx_write_probe_resp_plcp(struct bcm43xx_wldev *dev,
 {
        struct bcm43xx_plcp_hdr4 plcp;
        u32 tmp;
-       u16 packet_time;
+       __le16 dur;
 
        plcp.data = 0;
        bcm43xx_generate_plcp_hdr(&plcp, size + FCS_LEN, rate);
-       /*
-        * 144 + 48 + 10 = preamble + PLCP + SIFS,
-        * taken from mac80211 timings calculation.
-        *
-        * FIXME: long preamble assumed!
-        *
-        */
-       packet_time = 202 + (size + FCS_LEN) * 16 / rate;
-       if ((size + FCS_LEN) * 16 % rate >= rate / 2)
-               ++packet_time;
-
+       dur = ieee80211_generic_frame_duration(dev->wl->hw,
+                                              size,
+                                              BCM43xx_RATE_TO_BASE100KBPS(rate));
        /* Write PLCP in two parts and timing for packet transfer */
        tmp = le32_to_cpu(plcp.data);
        bcm43xx_shm_write16(dev, BCM43xx_SHM_SHARED, shm_offset,
@@ -1102,7 +1094,7 @@ static void bcm43xx_write_probe_resp_plcp(struct bcm43xx_wldev *dev,
        bcm43xx_shm_write16(dev, BCM43xx_SHM_SHARED, shm_offset + 2,
                            tmp >> 16);
        bcm43xx_shm_write16(dev, BCM43xx_SHM_SHARED, shm_offset + 6,
-                           packet_time);
+                           le16_to_cpu(dur));
 }
 
 /* Instead of using custom probe response template, this function
@@ -1116,7 +1108,9 @@ static u8 * bcm43xx_generate_probe_resp(struct bcm43xx_wldev *dev,
 {
        const u8 *src_data;
        u8 *dest_data;
-       u16 src_size, elem_size, src_pos, dest_pos, tmp;
+       u16 src_size, elem_size, src_pos, dest_pos;
+       __le16 dur;
+       struct ieee80211_hdr *hdr;
 
        assert(dev->cached_beacon);
        src_size = dev->cached_beacon->len;
@@ -1146,26 +1140,15 @@ static u8 * bcm43xx_generate_probe_resp(struct bcm43xx_wldev *dev,
                }
        }
        *dest_size = dest_pos;
+       hdr = (struct ieee80211_hdr *)dest_data;
 
        /* Set the frame control. */
-       dest_data[0] = (IEEE80211_FTYPE_MGMT |
-                       IEEE80211_STYPE_PROBE_RESP);
-       dest_data[1] = 0;
-
-       /* Set the duration field.
-        *
-        * 144 + 48 + 10 = preamble + PLCP + SIFS,
-        * taken from mac80211 timings calculation.
-        *
-        * FIXME: long preamble assumed!
-        *
-        */
-       tmp = 202 + (14 + FCS_LEN) * 16 / rate;
-       if ((14 + FCS_LEN) * 16 % rate >= rate / 2)
-               ++tmp;
-
-       dest_data[2] = tmp & 0xFF;
-       dest_data[3] = (tmp >> 8) & 0xFF;
+       hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                        IEEE80211_STYPE_PROBE_RESP);
+       dur = ieee80211_generic_frame_duration(dev->wl->hw,
+                                              *dest_size,
+                                              BCM43xx_RATE_TO_BASE100KBPS(rate));
+       hdr->duration_id = dur;
 
        return dest_data;
 }

diff --git a/package/bcm43xx-mac80211/src/bcm43xx/bcm43xx_xmit.c b/package/bcm43xx-mac80211/src/bcm43xx/bcm43xx_xmit.c
index 8ad39386cf9e27dae1d5df72981c5c08dc9ed950..a15196b1ff8fdc12ea617fa56f0c3faa8fda2b45 100644 (file)
--- a/package/bcm43xx-mac80211/src/bcm43xx/bcm43xx_xmit.c
+++ b/package/bcm43xx-mac80211/src/bcm43xx/bcm43xx_xmit.c
@@ -466,12 +466,19 @@ void bcm43xx_rx(struct bcm43xx_wldev *dev,
 
        /* Skip PLCP and padding */
        padding = (macstat & BCM43xx_RX_MAC_PADDING) ? 2 : 0;
+       if (unlikely(skb->len < (sizeof(struct bcm43xx_plcp_hdr6) + padding))) {
+               dprintkl(KERN_DEBUG PFX "RX: Packet size underrun (1)\n");
+               goto drop;
+       }
        plcp = (struct bcm43xx_plcp_hdr6 *)(skb->data + padding);
        skb_pull(skb, sizeof(struct bcm43xx_plcp_hdr6) + padding);
        /* The skb contains the Wireless Header + payload data now */
+       if (unlikely(skb->len < (2+2+6/*minimum hdr*/ + FCS_LEN))) {
+               dprintkl(KERN_DEBUG PFX "RX: Packet size underrun (2)\n");
+               goto drop;
+       }
        wlhdr = (struct ieee80211_hdr *)(skb->data);
        fctl = le16_to_cpu(wlhdr->frame_control);
-
        skb_trim(skb, skb->len - FCS_LEN);
 
        if ((macstat & BCM43xx_RX_MAC_DEC) &&
@@ -496,6 +503,11 @@ void bcm43xx_rx(struct bcm43xx_wldev *dev,
                        wlhdr->frame_control = cpu_to_le16(fctl);
 
                        wlhdr_len = ieee80211_get_hdrlen(fctl);
+                       if (unlikely(skb->len < (wlhdr_len + 3))) {
+                               dprintkl(KERN_DEBUG PFX
+                                        "RX: Packet size underrun (3)\n");
+                               goto drop;
+                       }
                        if (skb->data[wlhdr_len + 3] & (1 << 5)) {
                                /* The Ext-IV Bit is set in the "KeyID"
                                 * octet of the IV.
@@ -506,7 +518,11 @@ void bcm43xx_rx(struct bcm43xx_wldev *dev,
                                iv_len = 4;
                                icv_len = 4;
                        }
-
+                       if (unlikely(skb->len < (wlhdr_len + iv_len + icv_len))) {
+                               dprintkl(KERN_DEBUG PFX
+                                        "RX: Packet size underrun (4)\n");
+                               goto drop;
+                       }
                        /* Remove the IV */
                        memmove(skb->data + iv_len, skb->data, wlhdr_len);
                        skb_pull(skb, iv_len);
@@ -553,6 +569,11 @@ void bcm43xx_rx(struct bcm43xx_wldev *dev,
 
        dev->stats.last_rx = jiffies;
        ieee80211_rx_irqsafe(dev->wl->hw, skb, &status);
+
+       return;
+drop:
+       dprintkl(KERN_DEBUG PFX "RX: Packet dropped\n");
+       dev_kfree_skb_any(skb);
 }
 
 void bcm43xx_handle_txstatus(struct bcm43xx_wldev *dev,