carl9170 firmware: fix array-out-of-bounds bug

[carl9170fw.git] / include / shared / wlan.h

diff --git a/include/shared/wlan.h b/include/shared/wlan.h
index 35e2e4f884850bfce009a3252e82b455f8f34946..5127c3a9a2cf10fd2bc37cf290dc0032b7df8611 100644 (file)
--- a/include/shared/wlan.h
+++ b/include/shared/wlan.h
@@ -56,7 +56,8 @@
 
 #define        AR9170_RX_ENC_SOFTWARE                  0x8
 
-#define        AR9170_RX_STATUS_MODULATION_MASK        0x03
+#define        AR9170_RX_STATUS_MODULATION             0x03
+#define        AR9170_RX_STATUS_MODULATION_S           0
 #define        AR9170_RX_STATUS_MODULATION_CCK         0x00
 #define        AR9170_RX_STATUS_MODULATION_OFDM        0x01
 #define        AR9170_RX_STATUS_MODULATION_HT          0x02
@@ -66,7 +67,8 @@
 #define        AR9170_RX_STATUS_SHORT_PREAMBLE         0x08
 #define        AR9170_RX_STATUS_GREENFIELD             0x08
 
-#define        AR9170_RX_STATUS_MPDU_MASK              0x30
+#define        AR9170_RX_STATUS_MPDU                   0x30
+#define        AR9170_RX_STATUS_MPDU_S                 4
 #define        AR9170_RX_STATUS_MPDU_SINGLE            0x00
 #define        AR9170_RX_STATUS_MPDU_FIRST             0x20
 #define        AR9170_RX_STATUS_MPDU_MIDDLE            0x30
@@ -84,7 +86,7 @@
 /* these are either-or */
 #define        AR9170_TX_MAC_PROT_RTS                  0x0001
 #define        AR9170_TX_MAC_PROT_CTS                  0x0002
-#define        AR9170_TX_MAC_PROT_MASK                 0x0003
+#define        AR9170_TX_MAC_PROT                      0x0003
 
 #define        AR9170_TX_MAC_NO_ACK                    0x0004
 /* if unset, MAC will only do SIFS space before frame */
@@ -229,6 +231,13 @@ struct ar9170_tx_hw_phy_control {
        } __packed;
 } __packed;
 
+struct ar9170_tx_rate_info {
+       u8 tries:3;
+       u8 erp_prot:2;
+       u8 ampdu:1;
+       u8 free:2; /* free for use (e.g.:RIFS/TXOP/AMPDU) */
+} __packed;
+
 struct carl9170_tx_superdesc {
        __le16 len;
        u8 rix;
@@ -239,12 +248,13 @@ struct carl9170_tx_superdesc {
        u8 ampdu_commit_density:1;
        u8 ampdu_commit_factor:1;
        u8 ampdu_unused_bit:1;
-       u8 queue:3;
+       u8 queue:2;
+       u8 reserved:1;
        u8 vif_id:3;
        u8 fill_in_tsf:1;
        u8 cab:1;
        u8 padding2;
-       u8 tries[CARL9170_TX_MAX_RATES];
+       struct ar9170_tx_rate_info ri[CARL9170_TX_MAX_RATES];
        struct ar9170_tx_hw_phy_control rr[CARL9170_TX_MAX_RETRY_RATES];
 } __packed;
 
@@ -285,13 +295,20 @@ struct _ar9170_tx_hwdesc {
 #define        CARL9170_TX_SUPER_AMPDU_COMMIT_FACTOR           0x40
 #define        CARL9170_TX_SUPER_AMPDU_COMMIT_FACTOR_S         6
 
-#define CARL9170_TX_SUPER_MISC_QUEUE                   0x7
+#define CARL9170_TX_SUPER_MISC_QUEUE                   0x3
 #define CARL9170_TX_SUPER_MISC_QUEUE_S                 0
 #define        CARL9170_TX_SUPER_MISC_VIF_ID                   0x38
 #define        CARL9170_TX_SUPER_MISC_VIF_ID_S                 3
 #define        CARL9170_TX_SUPER_MISC_FILL_IN_TSF              0x40
 #define        CARL9170_TX_SUPER_MISC_CAB                      0x80
 
+#define CARL9170_TX_SUPER_RI_TRIES                     0x7
+#define CARL9170_TX_SUPER_RI_TRIES_S                   0
+#define CARL9170_TX_SUPER_RI_ERP_PROT                  0x18
+#define CARL9170_TX_SUPER_RI_ERP_PROT_S                        3
+#define CARL9170_TX_SUPER_RI_AMPDU                     0x20
+#define CARL9170_TX_SUPER_RI_AMPDU_S                   5
+
 struct _carl9170_tx_superdesc {
        __le16 len;
        u8 rix;
@@ -300,7 +317,7 @@ struct _carl9170_tx_superdesc {
        u8 ampdu_settings;
        u8 misc;
        u8 padding;
-       u8 tries[CARL9170_TX_MAX_RATES];
+       u8 ri[CARL9170_TX_MAX_RATES];
        __le32 rr[CARL9170_TX_MAX_RETRY_RATES];
 } __packed;
 
@@ -386,8 +403,6 @@ enum ar9170_txq {
        AR9170_TXQ_BK,
 
        __AR9170_NUM_TXQ,
-
-       AR9170_TXQ_MGMT = 4,
 };
 
 static const u8 ar9170_qmap[__AR9170_NUM_TXQ] = { 2, 1, 0, 3 };