carl9170 firmware: fix array-out-of-bounds bug

[carl9170fw.git] / include / shared / wlan.h

diff --git a/include/shared/wlan.h b/include/shared/wlan.h
index f859d89ffd0b05d62c131577550820d81ef97eee..5127c3a9a2cf10fd2bc37cf290dc0032b7df8611 100644 (file)
--- a/include/shared/wlan.h
+++ b/include/shared/wlan.h
@@ -234,7 +234,8 @@ struct ar9170_tx_hw_phy_control {
 struct ar9170_tx_rate_info {
        u8 tries:3;
        u8 erp_prot:2;
-       u8 free:3; /* free for use (e.g.:RIFS/TXOP/AMPDU) */
+       u8 ampdu:1;
+       u8 free:2; /* free for use (e.g.:RIFS/TXOP/AMPDU) */
 } __packed;
 
 struct carl9170_tx_superdesc {
@@ -247,7 +248,8 @@ struct carl9170_tx_superdesc {
        u8 ampdu_commit_density:1;
        u8 ampdu_commit_factor:1;
        u8 ampdu_unused_bit:1;
-       u8 queue:3;
+       u8 queue:2;
+       u8 reserved:1;
        u8 vif_id:3;
        u8 fill_in_tsf:1;
        u8 cab:1;
@@ -293,7 +295,7 @@ struct _ar9170_tx_hwdesc {
 #define        CARL9170_TX_SUPER_AMPDU_COMMIT_FACTOR           0x40
 #define        CARL9170_TX_SUPER_AMPDU_COMMIT_FACTOR_S         6
 
-#define CARL9170_TX_SUPER_MISC_QUEUE                   0x7
+#define CARL9170_TX_SUPER_MISC_QUEUE                   0x3
 #define CARL9170_TX_SUPER_MISC_QUEUE_S                 0
 #define        CARL9170_TX_SUPER_MISC_VIF_ID                   0x38
 #define        CARL9170_TX_SUPER_MISC_VIF_ID_S                 3
@@ -304,6 +306,8 @@ struct _ar9170_tx_hwdesc {
 #define CARL9170_TX_SUPER_RI_TRIES_S                   0
 #define CARL9170_TX_SUPER_RI_ERP_PROT                  0x18
 #define CARL9170_TX_SUPER_RI_ERP_PROT_S                        3
+#define CARL9170_TX_SUPER_RI_AMPDU                     0x20
+#define CARL9170_TX_SUPER_RI_AMPDU_S                   5
 
 struct _carl9170_tx_superdesc {
        __le16 len;
@@ -399,8 +403,6 @@ enum ar9170_txq {
        AR9170_TXQ_BK,
 
        __AR9170_NUM_TXQ,
-
-       AR9170_TXQ_MGMT = 4,
 };
 
 static const u8 ar9170_qmap[__AR9170_NUM_TXQ] = { 2, 1, 0, 3 };