b43: Fix DMA buffer size handling

This fixes hidden bugs in the size handling of the DMA buffers.
This sets the RX buffer size to the theoretical max packet size and
fixes passing of the size values to the device (must not subtract the header offset).

These bugs are hidden and don't actually trigger due to the magic +100
offset for the buffer size.

Signed-off-by: Michael Buesch <mb@bu3sch.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

2 files changed, 7 insertions, 15 deletions

diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
index 0f021c666d08..38246046a42f 100644
--- a/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@ -74,8 +74,7 @@ static void op32_fill_descriptor(struct b43_dmaring *ring,
         addrext = (u32) (dmaaddr & SSB_DMA_TRANSLATION_MASK)
             >> SSB_DMA_TRANSLATION_SHIFT;
         addr |= ssb_dma_translation(ring->dev->dev);
-        ctl = (bufsize - ring->frameoffset)
-            & B43_DMA32_DCTL_BYTECNT;
+        ctl = bufsize & B43_DMA32_DCTL_BYTECNT;
         if (slot == ring->nr_slots - 1)
                 ctl |= B43_DMA32_DCTL_DTABLEEND;
         if (start)
@@ -177,8 +176,7 @@ static void op64_fill_descriptor(struct b43_dmaring *ring,
                 ctl0 |= B43_DMA64_DCTL0_FRAMEEND;
         if (irq)
                 ctl0 |= B43_DMA64_DCTL0_IRQ;
-        ctl1 |= (bufsize - ring->frameoffset)
-            & B43_DMA64_DCTL1_BYTECNT;
+        ctl1 |= bufsize & B43_DMA64_DCTL1_BYTECNT;
         ctl1 |= (addrext << B43_DMA64_DCTL1_ADDREXT_SHIFT)
             & B43_DMA64_DCTL1_ADDREXT_MASK;
 
@@ -830,9 +828,6 @@ struct b43_dmaring *b43_setup_dmaring(struct b43_wldev *dev,
                 if (ring->index == 0) {
                         ring->rx_buffersize = B43_DMA0_RX_BUFFERSIZE;
                         ring->frameoffset = B43_DMA0_RX_FRAMEOFFSET;
-                } else if (ring->index == 3) {
-                        ring->rx_buffersize = B43_DMA3_RX_BUFFERSIZE;
-                        ring->frameoffset = B43_DMA3_RX_FRAMEOFFSET;
                 } else
                         B43_WARN_ON(1);
         }
diff --git a/drivers/net/wireless/b43/dma.h b/drivers/net/wireless/b43/dma.h
index d1eb5c0848a5..4ec24e8f4fd7 100644
--- a/drivers/net/wireless/b43/dma.h
+++ b/drivers/net/wireless/b43/dma.h
@@ -1,14 +1,12 @@
 #ifndef B43_DMA_H_
 #define B43_DMA_H_
 
-#include <linux/list.h>
+#include <linux/ieee80211.h>
 #include <linux/spinlock.h>
-#include <linux/workqueue.h>
-#include <linux/linkage.h>
-#include <asm/atomic.h>
 
 #include "b43.h"
 
+
 /* DMA-Interrupt reasons. */
 #define B43_DMAIRQ_FATALMASK    ((1 << 10) | (1 << 11) | (1 << 12) \
                                          | (1 << 14) | (1 << 15))
@@ -161,14 +159,13 @@ struct b43_dmadesc_generic {
 
 /* Misc DMA constants */
 #define B43_DMA_RINGMEMSIZE             PAGE_SIZE
-#define B43_DMA0_RX_FRAMEOFFSET 30
-#define B43_DMA3_RX_FRAMEOFFSET 0
+#define B43_DMA0_RX_FRAMEOFFSET         30
 
 /* DMA engine tuning knobs */
 #define B43_TXRING_SLOTS                128
 #define B43_RXRING_SLOTS                64
-#define B43_DMA0_RX_BUFFERSIZE  (2304 + 100)
-#define B43_DMA3_RX_BUFFERSIZE  16
+#define B43_DMA0_RX_BUFFERSIZE          IEEE80211_MAX_FRAME_LEN
+
 
 struct sk_buff;
 struct b43_private;