From 5b0c1ea0c92a7d26f760108cf332b13217747a65 Mon Sep 17 00:00:00 2001
From: Adrian Chadd <adrian@FreeBSD.org>
Date: Mon, 27 Aug 2012 20:10:38 +0000
Subject: [PATCH] Ensure that all firstep values are available in ANI.

The comparison assumes maxFirstepLevel is a count, rather than a maximum
value.  The array is 3 entries in size however 'maxFirstepLevel' is 2.

This bug also exists in the AR5212 HAL.
---
 sys/dev/ath/ath_hal/ar5416/ar5416_ani.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/sys/dev/ath/ath_hal/ar5416/ar5416_ani.c b/sys/dev/ath/ath_hal/ar5416/ar5416_ani.c
index 1b7ad0084aba..bea7eca7caeb 100644
--- a/sys/dev/ath/ath_hal/ar5416/ar5416_ani.c
+++ b/sys/dev/ath/ath_hal/ar5416/ar5416_ani.c
@@ -422,7 +422,7 @@ ar5416AniOfdmErrTrigger(struct ath_hal *ah)
 			 * If weak sig detect is already off, as last resort,
 			 * raise firstep level 
 			 */
-			if (aniState->firstepLevel+1 < params->maxFirstepLevel) {
+			if (aniState->firstepLevel < params->maxFirstepLevel) {
 				if (ar5416AniControl(ah, HAL_ANI_FIRSTEP_LEVEL,
 						 aniState->firstepLevel + 1))
 					return;
@@ -436,7 +436,7 @@ ar5416AniOfdmErrTrigger(struct ath_hal *ah)
 				ar5416AniControl(ah,
 				    HAL_ANI_OFDM_WEAK_SIGNAL_DETECTION,
 				    AH_TRUE);
-			if (aniState->firstepLevel+1 < params->maxFirstepLevel)
+			if (aniState->firstepLevel < params->maxFirstepLevel)
 				if (ar5416AniControl(ah, HAL_ANI_FIRSTEP_LEVEL,
 				     aniState->firstepLevel + 1))
 				return;
@@ -490,7 +490,7 @@ ar5416AniCckErrTrigger(struct ath_hal *ah)
 			 * Beacon signal in mid and high range,
 			 * raise firstep level.
 			 */
-			if (aniState->firstepLevel+1 < params->maxFirstepLevel)
+			if (aniState->firstepLevel < params->maxFirstepLevel)
 				ar5416AniControl(ah, HAL_ANI_FIRSTEP_LEVEL,
 						 aniState->firstepLevel + 1);
 		} else {
@@ -954,6 +954,8 @@ ar5416AniPoll(struct ath_hal *ah, const struct ieee80211_channel *chan)
 	if (listenTime < 0) {
 		ahp->ah_stats.ast_ani_lneg++;
 		/* restart ANI period if listenTime is invalid */
+		HALDEBUG(ah, HAL_DEBUG_ANI, "%s: invalid listenTime\n",
+		    __func__);
 		ar5416AniRestart(ah, aniState);
 	}
 	/* XXX beware of overflow? */
@@ -973,6 +975,8 @@ ar5416AniPoll(struct ath_hal *ah, const struct ieee80211_channel *chan)
 		    aniState->cckPhyErrCount <= aniState->listenTime *
 		    params->cckTrigLow/1000)
 			ar5416AniLowerImmunity(ah);
+		HALDEBUG(ah, HAL_DEBUG_ANI, "%s: lower immunity\n",
+		    __func__);
 		ar5416AniRestart(ah, aniState);
 	} else if (aniState->listenTime > params->period) {
 		updateMIBStats(ah, aniState);