Date: Fri, 28 Oct 2011 15:44:09 +0000 (UTC) From: Adrian Chadd <adrian@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r226884 - head/sys/dev/ath Message-ID: <201110281544.p9SFi9wm066993@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: adrian Date: Fri Oct 28 15:44:09 2011 New Revision: 226884 URL: http://svn.freebsd.org/changeset/base/226884 Log: When punting frames to the RX tap, free the mbufs since we've tampered with their length. Without this, an error frame mbuf would: * have its size adjusted; * thrown at the radiotap code; * then since it's never consumed, the rxbuf/mbuf is then re-added to the RX descriptor list with the small size; * .. and the hardware ends up (sometimes) only DMA'ing part of a frame into the small buffer, chaining RX frames together (setting the more flag). I discovered this particular issue when doing some promiscuous radiotap testing; I found that I'd occasionally get rs_more set in RX descriptors w/ the first frame length being very small (sub-100 bytes.) The driver handles 2-descriptor RX frames (but not more), so this still worked; it was just odd. This is suboptimal and may benefit from being replaced with caching the m_pkthdr_len and m_len fields, then restoring them after completion. Modified: head/sys/dev/ath/if_ath.c Modified: head/sys/dev/ath/if_ath.c ============================================================================== --- head/sys/dev/ath/if_ath.c Fri Oct 28 15:38:11 2011 (r226883) +++ head/sys/dev/ath/if_ath.c Fri Oct 28 15:44:09 2011 (r226884) @@ -3624,8 +3624,10 @@ rx_error: /* NB: bpf needs the mbuf length setup */ len = rs->rs_datalen; m->m_pkthdr.len = m->m_len = len; + bf->bf_m = NULL; ath_rx_tap(ifp, m, rs, tsf, nf); ieee80211_radiotap_rx_all(ic, m); + m_freem(m); } /* XXX pass MIC errors up for s/w reclaculation */ goto rx_next;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201110281544.p9SFi9wm066993>