diff --git a/core/cds/src/cds_regdomain.c b/core/cds/src/cds_regdomain.c index 5c025004c8d6..998eb1a848c8 100644 --- a/core/cds/src/cds_regdomain.c +++ b/core/cds/src/cds_regdomain.c @@ -454,6 +454,7 @@ static bool is_reg_dmn_valid(uint16_t reg_dmn) if (reg_dmn & CTRY_FLAG) { uint16_t cc = reg_dmn & ~CTRY_FLAG; + for (i = 0; i < g_reg_dmn_tbl.all_countries_cnt; i++) if (g_reg_dmn_tbl.all_countries[i].country_code == cc) return true; diff --git a/core/cds/src/cds_utils.c b/core/cds/src/cds_utils.c index c27f5615d825..bf207f3cbb0e 100644 --- a/core/cds/src/cds_utils.c +++ b/core/cds/src/cds_utils.c @@ -290,6 +290,7 @@ uint8_t cds_get_mmie_size(void) static void cds_increase_seq(uint8_t *ipn) { uint64_t value = 0; + if (ipn) { value = (0xffffffffffff) & (*((uint64_t *) ipn)); value = value + 1; diff --git a/core/dp/htt/htt_tx.c b/core/dp/htt/htt_tx.c index afed558ecfbd..ecb7b9ef7f0d 100644 --- a/core/dp/htt/htt_tx.c +++ b/core/dp/htt/htt_tx.c @@ -973,6 +973,7 @@ htt_tx_send_batch(htt_pdev_handle pdev, qdf_nbuf_t head_msdu, int num_msdus) msdu = head_msdu; while (num_msdus--) { qdf_nbuf_t next_msdu = qdf_nbuf_next(msdu); + msdu_id_storage = ol_tx_msdu_id_storage(msdu); msdu_id = *msdu_id_storage; diff --git a/core/dp/txrx/ol_cfg.c b/core/dp/txrx/ol_cfg.c index 6b3559dc655b..16b84f1472a6 100644 --- a/core/dp/txrx/ol_cfg.c +++ b/core/dp/txrx/ol_cfg.c @@ -44,6 +44,7 @@ void ol_tx_set_flow_control_parameters(struct cdp_cfg *cfg_pdev, struct txrx_pdev_cfg_param_t *cfg_param) { struct txrx_pdev_cfg_t *cfg_ctx = (struct txrx_pdev_cfg_t *)cfg_pdev; + cfg_ctx->tx_flow_start_queue_offset = cfg_param->tx_flow_start_queue_offset; cfg_ctx->tx_flow_stop_queue_th = @@ -169,6 +170,7 @@ struct cdp_cfg *ol_pdev_cfg_attach(qdf_device_t osdev, void *pcfg_param) int ol_cfg_is_high_latency(struct cdp_cfg *cfg_pdev) { struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)cfg_pdev; + return cfg->is_high_latency; } @@ -185,18 +187,21 @@ int ol_cfg_max_peer_id(struct cdp_cfg *cfg_pdev) int ol_cfg_max_vdevs(struct cdp_cfg *cfg_pdev) { struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)cfg_pdev; + return cfg->max_vdev; } int ol_cfg_rx_pn_check(struct cdp_cfg *cfg_pdev) { struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)cfg_pdev; + return cfg->rx_pn_check; } int ol_cfg_rx_fwd_check(struct cdp_cfg *cfg_pdev) { struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)cfg_pdev; + return cfg->pn_rx_fwd_check; } @@ -204,18 +209,21 @@ void ol_set_cfg_rx_fwd_disabled(struct cdp_cfg *cfg_pdev, uint8_t disable_rx_fwd) { struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)cfg_pdev; + cfg->rx_fwd_disabled = disable_rx_fwd; } void ol_set_cfg_packet_log_enabled(struct cdp_cfg *cfg_pdev, uint8_t val) { struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)cfg_pdev; + cfg->is_packet_log_enabled = val; } uint8_t ol_cfg_is_packet_log_enabled(struct cdp_cfg *cfg_pdev) { struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)cfg_pdev; + return cfg->is_packet_log_enabled; } @@ -226,6 +234,7 @@ int ol_cfg_rx_fwd_disabled(struct cdp_cfg *cfg_pdev) return 1; #else struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)cfg_pdev; + return cfg->rx_fwd_disabled; #endif } @@ -233,36 +242,42 @@ int ol_cfg_rx_fwd_disabled(struct cdp_cfg *cfg_pdev) int ol_cfg_rx_fwd_inter_bss(struct cdp_cfg *cfg_pdev) { struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)cfg_pdev; + return cfg->rx_fwd_inter_bss; } enum wlan_frm_fmt ol_cfg_frame_type(struct cdp_cfg *cfg_pdev) { struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)cfg_pdev; + return cfg->frame_type; } int ol_cfg_max_thruput_mbps(struct cdp_cfg *cfg_pdev) { struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)cfg_pdev; + return cfg->max_thruput_mbps; } int ol_cfg_netbuf_frags_max(struct cdp_cfg *cfg_pdev) { struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)cfg_pdev; + return cfg->max_nbuf_frags; } int ol_cfg_tx_free_at_download(struct cdp_cfg *cfg_pdev) { struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)cfg_pdev; + return cfg->tx_free_at_download; } void ol_cfg_set_tx_free_at_download(struct cdp_cfg *cfg_pdev) { struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)cfg_pdev; + cfg->tx_free_at_download = 1; } @@ -271,6 +286,7 @@ void ol_cfg_set_tx_free_at_download(struct cdp_cfg *cfg_pdev) uint16_t ol_cfg_target_tx_credit(struct cdp_cfg *cfg_pdev) { struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)cfg_pdev; + return cfg->target_tx_credit; } #else @@ -291,30 +307,35 @@ uint16_t ol_cfg_target_tx_credit(struct cdp_cfg *cfg_pdev) int ol_cfg_tx_download_size(struct cdp_cfg *cfg_pdev) { struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)cfg_pdev; + return cfg->tx_download_size; } int ol_cfg_rx_host_defrag_timeout_duplicate_check(struct cdp_cfg *cfg_pdev) { struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)cfg_pdev; + return cfg->defrag_timeout_check; } int ol_cfg_throttle_period_ms(struct cdp_cfg *cfg_pdev) { struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)cfg_pdev; + return cfg->throttle_period_ms; } int ol_cfg_throttle_duty_cycle_level(struct cdp_cfg *cfg_pdev, int level) { struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)cfg_pdev; + return cfg->dutycycle_level[level]; } int ol_cfg_is_full_reorder_offload(struct cdp_cfg *cfg_pdev) { struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)cfg_pdev; + return cfg->is_full_reorder_offload; } @@ -343,6 +364,7 @@ u_int8_t ol_cfg_is_ptp_rx_opt_enabled(struct cdp_cfg *cfg_pdev) int ol_cfg_is_rx_thread_enabled(struct cdp_cfg *cfg_pdev) { struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)cfg_pdev; + return cfg->enable_rxthread; } @@ -356,6 +378,7 @@ int ol_cfg_is_rx_thread_enabled(struct cdp_cfg *cfg_pdev) int ol_cfg_get_tx_flow_stop_queue_th(struct cdp_cfg *cfg_pdev) { struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)cfg_pdev; + return cfg->tx_flow_stop_queue_th; } @@ -368,6 +391,7 @@ int ol_cfg_get_tx_flow_stop_queue_th(struct cdp_cfg *cfg_pdev) int ol_cfg_get_tx_flow_start_queue_offset(struct cdp_cfg *cfg_pdev) { struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)cfg_pdev; + return cfg->tx_flow_start_queue_offset; } @@ -377,36 +401,42 @@ int ol_cfg_get_tx_flow_start_queue_offset(struct cdp_cfg *cfg_pdev) unsigned int ol_cfg_ipa_uc_offload_enabled(struct cdp_cfg *cfg_pdev) { struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)cfg_pdev; + return (unsigned int)cfg->ipa_uc_rsc.uc_offload_enabled; } unsigned int ol_cfg_ipa_uc_tx_buf_size(struct cdp_cfg *cfg_pdev) { struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)cfg_pdev; + return cfg->ipa_uc_rsc.tx_buf_size; } unsigned int ol_cfg_ipa_uc_tx_max_buf_cnt(struct cdp_cfg *cfg_pdev) { struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)cfg_pdev; + return cfg->ipa_uc_rsc.tx_max_buf_cnt; } unsigned int ol_cfg_ipa_uc_rx_ind_ring_size(struct cdp_cfg *cfg_pdev) { struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)cfg_pdev; + return cfg->ipa_uc_rsc.rx_ind_ring_size; } unsigned int ol_cfg_ipa_uc_tx_partition_base(struct cdp_cfg *cfg_pdev) { struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)cfg_pdev; + return cfg->ipa_uc_rsc.tx_partition_base; } void ol_cfg_set_ipa_uc_tx_partition_base(struct cdp_cfg *cfg_pdev, uint32_t val) { struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)cfg_pdev; + cfg->ipa_uc_rsc.tx_partition_base = val; } #endif /* IPA_OFFLOAD */ @@ -421,6 +451,7 @@ void ol_cfg_set_ipa_uc_tx_partition_base(struct cdp_cfg *cfg_pdev, uint32_t val) bool ol_cfg_is_ce_classify_enabled(struct cdp_cfg *cfg_pdev) { struct txrx_pdev_cfg_t *cfg = (struct txrx_pdev_cfg_t *)cfg_pdev; + return cfg->ce_classify_enabled; } diff --git a/core/dp/txrx/ol_rx.c b/core/dp/txrx/ol_rx.c index a8a4bd791399..2b1a57fb22e4 100644 --- a/core/dp/txrx/ol_rx.c +++ b/core/dp/txrx/ol_rx.c @@ -1700,6 +1700,7 @@ ol_rx_offload_paddr_deliver_ind_handler(htt_pdev_handle htt_pdev, void ol_htt_mon_note_chan(struct cdp_pdev *ppdev, int mon_ch) { struct ol_txrx_pdev_t *pdev = (struct ol_txrx_pdev_t *)ppdev; + htt_rx_mon_note_capture_channel(pdev->htt_pdev, mon_ch); } diff --git a/core/dp/txrx/ol_tx.c b/core/dp/txrx/ol_tx.c index 6bcef6cab599..a4d167ddbc4c 100644 --- a/core/dp/txrx/ol_tx.c +++ b/core/dp/txrx/ol_tx.c @@ -1899,6 +1899,7 @@ ol_txrx_mgmt_tx_cb_set(struct cdp_pdev *ppdev, ol_txrx_mgmt_tx_cb ota_ack_cb, void *ctxt) { struct ol_txrx_pdev_t *pdev = (struct ol_txrx_pdev_t *)ppdev; + TXRX_ASSERT1(type < OL_TXRX_MGMT_NUM_TYPES); pdev->tx_mgmt.callbacks[type].download_cb = download_cb; pdev->tx_mgmt.callbacks[type].ota_ack_cb = ota_ack_cb; diff --git a/core/dp/txrx/ol_tx_classify.c b/core/dp/txrx/ol_tx_classify.c index d770ee381d66..eb4a87bba378 100644 --- a/core/dp/txrx/ol_tx_classify.c +++ b/core/dp/txrx/ol_tx_classify.c @@ -805,6 +805,7 @@ ol_tx_classify_extension( msdu_info->htt.info.ethertype = ethertype; } else { /* 802.11 */ struct llc_snap_hdr_t *llc; + l2_hdr_size = ol_txrx_ieee80211_hdrsize(datap); llc = (struct llc_snap_hdr_t *)(datap + l2_hdr_size); ethertype = (llc->ethertype[0] << 8) | diff --git a/core/dp/txrx/ol_tx_queue.c b/core/dp/txrx/ol_tx_queue.c index 35033ea01c3c..0fcc453663c0 100644 --- a/core/dp/txrx/ol_tx_queue.c +++ b/core/dp/txrx/ol_tx_queue.c @@ -619,6 +619,7 @@ void ol_txrx_vdev_unpause(struct cdp_vdev *pvdev, uint32_t reason) TAILQ_FOREACH(peer, &vdev->peer_list, peer_list_elem) { int i; + for (i = 0; i < QDF_ARRAY_SIZE(peer->txqs); i++) ol_txrx_peer_tid_unpause_base(pdev, peer, i); } @@ -834,6 +835,7 @@ ol_txrx_bad_peer_txctl_set_setting(struct cdp_pdev *ppdev, int enable, int period, int txq_limit) { struct ol_txrx_pdev_t *pdev = (struct ol_txrx_pdev_t *)ppdev; + if (enable) pdev->tx_peer_bal.enabled = ol_tx_peer_bal_enable; else @@ -1781,6 +1783,7 @@ void ol_txrx_vdev_unpause(struct cdp_vdev *pvdev, uint32_t reason) void ol_txrx_vdev_flush(struct cdp_vdev *pvdev) { struct ol_txrx_vdev_t *vdev = (struct ol_txrx_vdev_t *)pvdev; + qdf_spin_lock_bh(&vdev->ll_pause.mutex); qdf_timer_stop(&vdev->ll_pause.timer); vdev->ll_pause.is_q_timer_on = false; @@ -2234,6 +2237,7 @@ u_int32_t ol_tx_txq_group_credit_limit( for (i = 0; i < OL_TX_MAX_GROUPS_PER_QUEUE; i++) { if (txq->group_ptrs[i]) { int group_credit; + group_credit = qdf_atomic_read( &txq->group_ptrs[i]->credit); updated_credit = QDF_MIN(updated_credit, group_credit); diff --git a/core/dp/txrx/ol_tx_send.c b/core/dp/txrx/ol_tx_send.c index 9c0940e72571..8eee570e9f38 100644 --- a/core/dp/txrx/ol_tx_send.c +++ b/core/dp/txrx/ol_tx_send.c @@ -119,6 +119,7 @@ ol_tx_target_credit_incr_int(struct ol_txrx_pdev_t *pdev, int delta) void ol_txrx_flow_control_cb(struct cdp_vdev *pvdev, bool tx_resume) { struct ol_txrx_vdev_t *vdev = (struct ol_txrx_vdev_t *)pvdev; + qdf_spin_lock_bh(&vdev->flow_control_lock); if ((vdev->osif_flow_control_cb) && (vdev->osif_fc_ctx)) vdev->osif_flow_control_cb(vdev->osif_fc_ctx, tx_resume); @@ -136,6 +137,7 @@ void ol_txrx_flow_control_cb(struct cdp_vdev *pvdev, bool tx_resume) static bool ol_txrx_flow_control_is_pause(ol_txrx_vdev_handle vdev) { bool is_pause = false; + if ((vdev->osif_flow_control_is_pause) && (vdev->osif_fc_ctx)) is_pause = vdev->osif_flow_control_is_pause(vdev->osif_fc_ctx); @@ -651,10 +653,10 @@ ol_tx_completion_handler(ol_txrx_pdev_handle pdev, struct htt_tx_compl_ind_append_tx_tstamp *txtstamp_list = NULL; u_int32_t *msg_word = (u_int32_t *)msg; u_int16_t *desc_ids = (u_int16_t *)(msg_word + 1); - union ol_tx_desc_list_elem_t *lcl_freelist = NULL; union ol_tx_desc_list_elem_t *tx_desc_last = NULL; ol_tx_desc_list tx_descs; + TAILQ_INIT(&tx_descs); ol_tx_delay_compute(pdev, status, desc_ids, num_msdus); @@ -1032,6 +1034,7 @@ ol_tx_inspect_handler(ol_txrx_pdev_handle pdev, void ol_tx_set_compute_interval(struct cdp_pdev *ppdev, uint32_t interval) { struct ol_txrx_pdev_t *pdev = (struct ol_txrx_pdev_t *)ppdev; + pdev->tx_delay.avg_period_ticks = qdf_system_msecs_to_ticks(interval); } diff --git a/core/dp/txrx/ol_txrx.c b/core/dp/txrx/ol_txrx.c index 4b80e38d3de7..2986b0de573b 100644 --- a/core/dp/txrx/ol_txrx.c +++ b/core/dp/txrx/ol_txrx.c @@ -325,6 +325,7 @@ ol_txrx_find_peer_by_addr_and_vdev(struct cdp_pdev *ppdev, static QDF_STATUS ol_txrx_get_vdevid(void *ppeer, uint8_t *vdev_id) { struct ol_txrx_peer_t *peer = ppeer; + if (!peer) { QDF_TRACE(QDF_MODULE_ID_TXRX, QDF_TRACE_LEVEL_ERROR, "peer argument is null!!"); @@ -431,6 +432,7 @@ ol_txrx_peer_handle ol_txrx_find_peer_by_addr_inc_ref(ol_txrx_pdev_handle pdev, static uint16_t ol_txrx_local_peer_id(void *ppeer) { ol_txrx_peer_handle peer = ppeer; + return peer->local_id; } @@ -915,6 +917,7 @@ void ol_txrx_hl_tdls_flag_reset(struct cdp_vdev *pvdev, bool flag) { struct ol_txrx_vdev_t *vdev = (struct ol_txrx_vdev_t *)pvdev; + vdev->hlTdlsFlag = flag; } #endif @@ -1282,6 +1285,7 @@ fail0: void htt_pkt_log_init(struct cdp_pdev *ppdev, void *scn) { struct ol_txrx_pdev_t *handle = (struct ol_txrx_pdev_t *)ppdev; + if (handle->pkt_log_init) return; @@ -1832,6 +1836,7 @@ ol_attach_fail: static A_STATUS ol_txrx_pdev_attach_target(struct cdp_pdev *ppdev) { struct ol_txrx_pdev_t *pdev = (struct ol_txrx_pdev_t *)ppdev; + return htt_attach_target(pdev->htt_pdev) == QDF_STATUS_SUCCESS ? 0:1; } @@ -2203,6 +2208,7 @@ static void ol_txrx_vdev_register(struct cdp_vdev *pvdev, struct ol_txrx_ops *txrx_ops) { struct ol_txrx_vdev_t *vdev = (struct ol_txrx_vdev_t *)pvdev; + if (qdf_unlikely(!vdev) || qdf_unlikely(!txrx_ops)) { qdf_print("%s: vdev/txrx_ops is NULL!\n", __func__); qdf_assert(0); @@ -2735,6 +2741,7 @@ static uint8_t * ol_txrx_peer_get_peer_mac_addr(void *ppeer) { ol_txrx_peer_handle peer = ppeer; + if (!peer) return NULL; @@ -2777,6 +2784,7 @@ ol_txrx_get_pn_info(void *ppeer, uint8_t **last_pn_valid, static int ol_txrx_get_opmode(struct cdp_vdev *pvdev) { struct ol_txrx_vdev_t *vdev = (struct ol_txrx_vdev_t *)pvdev; + return vdev->opmode; } @@ -2789,6 +2797,7 @@ static int ol_txrx_get_opmode(struct cdp_vdev *pvdev) static int ol_txrx_get_peer_state(void *ppeer) { ol_txrx_peer_handle peer = ppeer; + return peer->state; } @@ -2801,6 +2810,7 @@ static int ol_txrx_get_peer_state(void *ppeer) static struct cdp_vdev *ol_txrx_get_vdev_for_peer(void *ppeer) { ol_txrx_peer_handle peer = ppeer; + return (struct cdp_vdev *)peer->vdev; } @@ -2814,6 +2824,7 @@ static uint8_t * ol_txrx_get_vdev_mac_addr(struct cdp_vdev *pvdev) { struct ol_txrx_vdev_t *vdev = (struct ol_txrx_vdev_t *)pvdev; + if (!vdev) return NULL; @@ -2858,6 +2869,7 @@ static struct cdp_cfg * ol_txrx_get_ctrl_pdev_from_vdev(struct cdp_vdev *pvdev) { struct ol_txrx_vdev_t *vdev = (struct ol_txrx_vdev_t *)pvdev; + return vdev->pdev->ctrl_pdev; } @@ -3006,6 +3018,7 @@ static void ol_txrx_set_ocb_chan_info(struct cdp_vdev *pvdev, struct ol_txrx_ocb_set_chan ocb_set_chan) { struct ol_txrx_vdev_t *vdev = (struct ol_txrx_vdev_t *)pvdev; + vdev->ocb_channel_info = ocb_set_chan.ocb_channel_info; vdev->ocb_channel_count = ocb_set_chan.ocb_channel_count; } @@ -3020,6 +3033,7 @@ static struct ol_txrx_ocb_chan_info * ol_txrx_get_ocb_chan_info(struct cdp_vdev *pvdev) { struct ol_txrx_vdev_t *vdev = (struct ol_txrx_vdev_t *)pvdev; + return vdev->ocb_channel_info; } @@ -3618,6 +3632,7 @@ ol_txrx_peer_handle ol_txrx_peer_find_by_addr(struct ol_txrx_pdev_t *pdev, uint8_t *peer_mac_addr) { struct ol_txrx_peer_t *peer; + peer = ol_txrx_peer_find_hash_find_inc_ref(pdev, peer_mac_addr, 0, 0); if (peer) { ol_txrx_info_high( @@ -4424,6 +4439,7 @@ ol_txrx_peer_stats_copy(ol_txrx_pdev_handle pdev, static void ol_vdev_rx_set_intrabss_fwd(struct cdp_vdev *pvdev, bool val) { struct ol_txrx_vdev_t *vdev = (struct ol_txrx_vdev_t *)pvdev; + if (NULL == vdev) return; @@ -4836,6 +4852,7 @@ static inline void ol_txrx_drop_frames( qdf_nbuf_t rx_buf_list) { uint32_t dropped = ol_txrx_drop_nbuf_list(rx_buf_list); + bufqi->dropped += dropped; bufqi->qdepth_no_thresh += dropped; @@ -5317,6 +5334,7 @@ static QDF_STATUS ol_txrx_set_wisa_mode(struct cdp_vdev *pvdev, bool enable) static uint16_t ol_txrx_get_vdev_id(struct cdp_vdev *pvdev) { struct ol_txrx_vdev_t *vdev = (struct ol_txrx_vdev_t *)pvdev; + return vdev->vdev_id; } @@ -5770,6 +5788,7 @@ struct cdp_soc_t *ol_txrx_soc_attach(void *scn_handle, struct ol_if_ops *dp_ol_if_ops) { struct cdp_soc_t *soc = qdf_mem_malloc(sizeof(struct cdp_soc_t)); + if (!soc) { QDF_TRACE(QDF_MODULE_ID_TXRX, QDF_TRACE_LEVEL_ERROR, "%s: OL SOC memory allocation failed\n", __func__); diff --git a/core/dp/txrx/ol_txrx_peer_find.c b/core/dp/txrx/ol_txrx_peer_find.c index 62521cc6e699..1c564ee29b2a 100644 --- a/core/dp/txrx/ol_txrx_peer_find.c +++ b/core/dp/txrx/ol_txrx_peer_find.c @@ -508,6 +508,7 @@ ol_rx_peer_map_handler(ol_txrx_pdev_handle pdev, void ol_txrx_peer_tx_ready_handler(ol_txrx_pdev_handle pdev, uint16_t peer_id) { struct ol_txrx_peer_t *peer; + peer = ol_txrx_peer_find_by_id(pdev, peer_id); if (peer) { int i; diff --git a/core/mac/src/cfg/cfg_proc_msg.c b/core/mac/src/cfg/cfg_proc_msg.c index 8fc13cd24934..23305c01cc94 100644 --- a/core/mac/src/cfg/cfg_proc_msg.c +++ b/core/mac/src/cfg/cfg_proc_msg.c @@ -2408,6 +2408,7 @@ process_cfg_download_req(tpAniSirGlobal pMac) pMac->cfg.gCfgIBuf[index] = cfg_static[i].cfgIVal; } else { uint8_t maxSavedLen; + if ((pMac->cfg.gCfgEntry[i].control & CFG_CTL_VALID) == 0) continue; if (index >= pMac->cfg.gCfgMaxSBufSize) { diff --git a/core/mac/src/include/utils_api.h b/core/mac/src/include/utils_api.h index e1b434d78c10..54f9e4b4da77 100644 --- a/core/mac/src/include/utils_api.h +++ b/core/mac/src/include/utils_api.h @@ -498,6 +498,7 @@ static inline void sir_copy_mac_addr(uint8_t to[], uint8_t from[]) { #if defined(_X86_) uint32_t align = (0x3 & ((uint32_t) to | (uint32_t) from)); + if (align == 0) { *((uint16_t *) &(to[4])) = *((uint16_t *) &(from[4])); *((uint32_t *) to) = *((uint32_t *) from); @@ -561,6 +562,7 @@ static inline uint8_t sir_compare_mac_addr(uint8_t addr1[], uint8_t addr2[]) static inline uint8_t convert_cw(uint16_t cw) { uint8_t val = 0; + while (cw > 0) { val++; cw >>= 1; diff --git a/core/mac/src/pe/lim/lim_admit_control.c b/core/mac/src/pe/lim/lim_admit_control.c index 669dca7c2354..f33844d9963f 100644 --- a/core/mac/src/pe/lim/lim_admit_control.c +++ b/core/mac/src/pe/lim/lim_admit_control.c @@ -193,6 +193,7 @@ lim_validate_tspec(tpAniSirGlobal pMac, tSirMacTspecIE *pTspec, tpPESession psessionEntry) { tSirRetStatus retval = eSIR_SUCCESS; + switch (pTspec->tsinfo.traffic.accessPolicy) { case SIR_MAC_ACCESSPOLICY_EDCA: retval = lim_validate_tspec_edca(pMac, pTspec, psessionEntry); @@ -554,6 +555,7 @@ tSirRetStatus lim_tspec_add(tpAniSirGlobal pMac, * LIM TSPEC list and add this new entry */ uint8_t ctspec = 0; + for (ctspec = 0, pTspecList = &pMac->lim.tspecInfo[0]; ctspec < LIM_NUM_TSPEC_MAX; ctspec++, pTspecList++) { @@ -832,6 +834,7 @@ tSirRetStatus lim_admit_control_init(tpAniSirGlobal pMac) tSirRetStatus lim_update_admit_policy(tpAniSirGlobal pMac) { uint32_t val; + if (wlan_cfg_get_int(pMac, WNI_CFG_ADMIT_POLICY, &val) != eSIR_SUCCESS) { pe_err("Unable to get CFG_ADMIT_POLICY"); return eSIR_FAILURE; @@ -880,6 +883,7 @@ lim_send_hal_msg_add_ts(tpAniSirGlobal pMac, tpAddTsParams pAddTsParam; tpPESession psessionEntry = pe_find_session_by_session_id(pMac, sessionId); + if (psessionEntry == NULL) { pe_err("Unable to get Session for session Id: %d", sessionId); diff --git a/core/mac/src/pe/lim/lim_api.c b/core/mac/src/pe/lim/lim_api.c index 35e85974dbe9..a5a8cab90c66 100644 --- a/core/mac/src/pe/lim/lim_api.c +++ b/core/mac/src/pe/lim/lim_api.c @@ -266,6 +266,7 @@ static void __lim_init_vars(tpAniSirGlobal pMac) static void __lim_init_assoc_vars(tpAniSirGlobal pMac) { uint32_t val; + if (wlan_cfg_get_int(pMac, WNI_CFG_ASSOC_STA_LIMIT, &val) != eSIR_SUCCESS) pe_err("cfg get assoc sta limit failed"); @@ -1336,6 +1337,7 @@ lim_update_overlap_sta_param(tpAniSirGlobal pMac, tSirMacAddr bssId, tpLimProtStaParams pStaParams) { int i; + if (!pStaParams->numSta) { qdf_mem_copy(pMac->lim.protStaOverlapCache[0].addr, bssId, sizeof(tSirMacAddr)); @@ -1466,6 +1468,7 @@ lim_handle_ibss_coalescing(tpAniSirGlobal pMac, uint32_t ieLen; uint16_t tsfLater; uint8_t *pIEs; + ieLen = WMA_GET_RX_PAYLOAD_LEN(pRxPacketInfo); tsfLater = WMA_GET_RX_TSF_LATER(pRxPacketInfo); pIEs = WMA_GET_RX_MPDU_DATA(pRxPacketInfo); @@ -1836,6 +1839,7 @@ void lim_ps_offload_handle_missed_beacon_ind(tpAniSirGlobal pMac, void lim_fill_join_rsp_ht_caps(tpPESession session, tpSirSmeJoinRsp join_rsp) { tSirSmeHTProfile *ht_profile; + if (session == NULL) { pe_err("Invalid Session"); return; @@ -1876,6 +1880,7 @@ static void sir_parse_bcn_fixed_fields(tpAniSirGlobal mac_ctx, uint8_t *buf) { tDot11fFfCapabilities dst; + beacon_struct->timeStamp[0] = lim_get_u32(buf); beacon_struct->timeStamp[1] = lim_get_u32(buf + 4); buf += 8; @@ -2479,6 +2484,7 @@ QDF_STATUS pe_acquire_global_lock(tAniSirLim *psPe) QDF_STATUS pe_release_global_lock(tAniSirLim *psPe) { QDF_STATUS status = QDF_STATUS_E_INVAL; + if (psPe) { if (QDF_IS_STATUS_SUCCESS (qdf_mutex_release(&psPe->lkPeGlobalLock))) { diff --git a/core/mac/src/pe/lim/lim_assoc_utils.c b/core/mac/src/pe/lim/lim_assoc_utils.c index 2895c8137a94..e895a8016571 100644 --- a/core/mac/src/pe/lim/lim_assoc_utils.c +++ b/core/mac/src/pe/lim/lim_assoc_utils.c @@ -1646,8 +1646,7 @@ lim_populate_peer_rate_set(tpAniSirGlobal pMac, { tSirMacRateSet tempRateSet; tSirMacRateSet tempRateSet2; - uint32_t i, j, val, min, isArate; - isArate = 0; + uint32_t i, j, val, min, isArate = 0; /* copy operational rate set from psessionEntry */ if (psessionEntry->rateSet.numRates <= SIR_MAC_RATESET_EID_MAX) { @@ -1695,6 +1694,7 @@ lim_populate_peer_rate_set(tpAniSirGlobal pMac, { uint8_t aRateIndex = 0; uint8_t bRateIndex = 0; + qdf_mem_set((uint8_t *) pRates, sizeof(tSirSupportedRates), 0); for (i = 0; i < tempRateSet.numRates; i++) { min = 0; @@ -4590,6 +4590,7 @@ void lim_init_pre_auth_timer_table(tpAniSirGlobal pMac, { uint32_t cfgValue; uint32_t authNodeIdx; + tLimPreAuthNode **pAuthNode = pPreAuthTimerTable->pTable; /* Get AUTH_RSP Timers value */ @@ -4628,6 +4629,7 @@ tLimPreAuthNode *lim_acquire_free_pre_auth_node(tpAniSirGlobal pMac, { uint32_t i; tLimPreAuthNode **pTempNode = pPreAuthTimerTable->pTable; + for (i = 0; i < pPreAuthTimerTable->numEntry; i++) { if (pTempNode[i]->fFree == 1) { pTempNode[i]->fFree = 0; diff --git a/core/mac/src/pe/lim/lim_ft.c b/core/mac/src/pe/lim/lim_ft.c index 3439d11482ee..4835ec32f09c 100644 --- a/core/mac/src/pe/lim/lim_ft.c +++ b/core/mac/src/pe/lim/lim_ft.c @@ -846,6 +846,7 @@ lim_ft_send_aggr_qos_rsp(tpAniSirGlobal pMac, uint8_t rspReqd, { tpSirAggrQosRsp rsp; int i = 0; + if (!rspReqd) { return; } @@ -884,6 +885,7 @@ void lim_process_ft_aggr_qo_s_rsp(tpAniSirGlobal pMac, uint8_t rspReqd = 1; tpPESession psessionEntry = NULL; int i = 0; + pe_debug(" Received AGGR_QOS_RSP from HAL"); SET_LIM_PROCESS_DEFD_MESGS(pMac, true); pAggrQosRspMsg = (tpAggrAddTsParams) (limMsg->bodyptr); diff --git a/core/mac/src/pe/lim/lim_ibss_peer_mgmt.c b/core/mac/src/pe/lim/lim_ibss_peer_mgmt.c index 21c55503a98e..c32999b9973a 100644 --- a/core/mac/src/pe/lim/lim_ibss_peer_mgmt.c +++ b/core/mac/src/pe/lim/lim_ibss_peer_mgmt.c @@ -107,6 +107,7 @@ ibss_peer_add(tpAniSirGlobal pMac, tLimIbssPeerNode *pPeerNode) * Delete last entry & add new entry at the beginning. */ tLimIbssPeerNode *pTemp, *pPrev; + pTemp = pPrev = pMac->lim.gLimIbssPeerList; while (pTemp->next != NULL) { pPrev = pTemp; @@ -595,6 +596,7 @@ static void ibss_bss_add(tpAniSirGlobal pMac, tpPESession psessionEntry) static void ibss_bss_delete(tpAniSirGlobal pMac, tpPESession psessionEntry) { tSirRetStatus status; + pe_debug("Initiating IBSS Delete BSS"); if (psessionEntry->limMlmState != eLIM_MLM_BSS_STARTED_STATE) { pe_warn("Incorrect LIM MLM state for delBss: %d", diff --git a/core/mac/src/pe/lim/lim_link_monitoring_algo.c b/core/mac/src/pe/lim/lim_link_monitoring_algo.c index d371fc0679d3..d8b9e5277cee 100644 --- a/core/mac/src/pe/lim/lim_link_monitoring_algo.c +++ b/core/mac/src/pe/lim/lim_link_monitoring_algo.c @@ -137,6 +137,7 @@ static void lim_delete_sta_util(tpAniSirGlobal mac_ctx, tpDeleteStaContext msg, #endif /* TearDownLink with AP */ tLimMlmDeauthInd mlm_deauth_ind; + pe_debug("Delete Station (staId: %d, assocId: %d)", msg->staId, msg->assocId); diff --git a/core/mac/src/pe/lim/lim_p2p.c b/core/mac/src/pe/lim/lim_p2p.c index 654bbed2d7ed..7d8eda84bbd9 100644 --- a/core/mac/src/pe/lim/lim_p2p.c +++ b/core/mac/src/pe/lim/lim_p2p.c @@ -89,6 +89,7 @@ void lim_convert_active_channel_to_passive_channel(tpAniSirGlobal pMac) uint64_t lastTime = 0; uint64_t timeDiff; uint8_t i; + currentTime = (uint64_t)qdf_mc_timer_get_system_time(); for (i = 1; i < SIR_MAX_24G_5G_CHANNEL_RANGE; i++) { if ((pMac->lim.dfschannelList.timeStamp[i]) != 0) { diff --git a/core/mac/src/pe/lim/lim_process_action_frame.c b/core/mac/src/pe/lim/lim_process_action_frame.c index 73a63afbb2a8..31f1e3096503 100644 --- a/core/mac/src/pe/lim/lim_process_action_frame.c +++ b/core/mac/src/pe/lim/lim_process_action_frame.c @@ -1084,6 +1084,7 @@ static void __lim_process_qos_map_configure_frame(tpAniSirGlobal mac_ctx, uint32_t frame_len; uint8_t *body_ptr; tSirRetStatus retval; + mac_hdr = WMA_GET_RX_MAC_HEADER(rx_pkt_info); body_ptr = WMA_GET_RX_MPDU_DATA(rx_pkt_info); frame_len = WMA_GET_RX_PAYLOAD_LEN(rx_pkt_info); @@ -1189,6 +1190,7 @@ __lim_process_tpc_request_frame(tpAniSirGlobal pMac, uint8_t *pRxPacketInfo, uint8_t *pBody; tpSirMacTpcReqActionFrame pTpcReqFrame; uint32_t frameLen; + pHdr = WMA_GET_RX_MAC_HEADER(pRxPacketInfo); pBody = WMA_GET_RX_MPDU_DATA(pRxPacketInfo); frameLen = WMA_GET_RX_PAYLOAD_LEN(pRxPacketInfo); diff --git a/core/mac/src/pe/lim/lim_process_assoc_rsp_frame.c b/core/mac/src/pe/lim/lim_process_assoc_rsp_frame.c index e6a9111a46ca..34920473ec33 100644 --- a/core/mac/src/pe/lim/lim_process_assoc_rsp_frame.c +++ b/core/mac/src/pe/lim/lim_process_assoc_rsp_frame.c @@ -228,6 +228,7 @@ void lim_update_assoc_sta_datas(tpAniSirGlobal mac_ctx, if (qos_mode) { if (assoc_rsp->edcaPresent) { tSirRetStatus status; + status = sch_beacon_edca_process(mac_ctx, &assoc_rsp->edca, session_entry); @@ -247,6 +248,7 @@ void lim_update_assoc_sta_datas(tpAniSirGlobal mac_ctx, sta_ds->wsmEnabled = 0; if (session_entry->limWmeEnabled && assoc_rsp->wmeEdcaPresent) { tSirRetStatus status; + status = sch_beacon_edca_process(mac_ctx, &assoc_rsp->edca, session_entry); pe_debug("WME Edca set update based on AssocRsp: status %d", @@ -440,6 +442,7 @@ static void lim_update_stads_ext_cap(tpAniSirGlobal mac_ctx, tpDphHashNode sta_ds) { struct s_ext_cap *ext_cap; + if (!assoc_rsp->ExtCap.present) { sta_ds->timingMeasCap = 0; #ifdef FEATURE_WLAN_TDLS diff --git a/core/mac/src/pe/lim/lim_process_auth_frame.c b/core/mac/src/pe/lim/lim_process_auth_frame.c index d2682c6d3982..f670fd4fc07a 100644 --- a/core/mac/src/pe/lim/lim_process_auth_frame.c +++ b/core/mac/src/pe/lim/lim_process_auth_frame.c @@ -1273,6 +1273,7 @@ lim_process_auth_frame(tpAniSirGlobal mac_ctx, uint8_t *rx_pkt_info, if (LIM_IS_AP_ROLE(pe_session)) { tpSirKeys key_ptr; + key_ptr = &pe_session->WEPKeyMaterial[key_id].key[0]; qdf_mem_copy(defaultkey, key_ptr->key, key_ptr->keyLength); diff --git a/core/mac/src/pe/lim/lim_process_message_queue.c b/core/mac/src/pe/lim/lim_process_message_queue.c index 530ebbfd82e2..fa7ecd398f16 100644 --- a/core/mac/src/pe/lim/lim_process_message_queue.c +++ b/core/mac/src/pe/lim/lim_process_message_queue.c @@ -661,8 +661,8 @@ static void __lim_handle_beacon(tpAniSirGlobal pMac, struct scheduler_msg *pMsg, tpPESession psessionEntry) { - /* checking for global SME state... */ uint8_t *pRxPacketInfo; + lim_get_b_dfrom_rx_packet(pMac, pMsg->bodyptr, (uint32_t **) &pRxPacketInfo); diff --git a/core/mac/src/pe/lim/lim_process_mlm_req_messages.c b/core/mac/src/pe/lim/lim_process_mlm_req_messages.c index 1f0dcf0b3d51..d64d6913cf67 100644 --- a/core/mac/src/pe/lim/lim_process_mlm_req_messages.c +++ b/core/mac/src/pe/lim/lim_process_mlm_req_messages.c @@ -1516,6 +1516,7 @@ void lim_clean_up_disassoc_deauth_req(tpAniSirGlobal mac_ctx, { tLimMlmDisassocReq *mlm_disassoc_req; tLimMlmDeauthReq *mlm_deauth_req; + mlm_disassoc_req = mac_ctx->lim.limDisassocDeauthCnfReq.pMlmDisassocReq; if (mlm_disassoc_req && (!qdf_mem_cmp((uint8_t *) sta_mac, @@ -2628,6 +2629,7 @@ void lim_set_channel(tpAniSirGlobal mac_ctx, uint8_t channel, uint32_t dfs_regdomain) { tpPESession pe_session; + pe_session = pe_find_session_by_session_id(mac_ctx, pe_session_id); if (NULL == pe_session) { diff --git a/core/mac/src/pe/lim/lim_process_mlm_rsp_messages.c b/core/mac/src/pe/lim/lim_process_mlm_rsp_messages.c index aaf4d55e81b2..615a091c140f 100644 --- a/core/mac/src/pe/lim/lim_process_mlm_rsp_messages.c +++ b/core/mac/src/pe/lim/lim_process_mlm_rsp_messages.c @@ -811,6 +811,7 @@ void lim_process_mlm_assoc_ind(tpAniSirGlobal pMac, uint32_t *pMsgBuf) tSirSmeAssocInd *pSirSmeAssocInd; tpDphHashNode pStaDs = 0; tpPESession psessionEntry; + if (pMsgBuf == NULL) { pe_err("Buffer is Pointing to NULL"); return; @@ -889,6 +890,7 @@ void lim_process_mlm_disassoc_ind(tpAniSirGlobal pMac, uint32_t *pMsgBuf) { tLimMlmDisassocInd *pMlmDisassocInd; tpPESession psessionEntry; + pMlmDisassocInd = (tLimMlmDisassocInd *) pMsgBuf; psessionEntry = pe_find_session_by_session_id(pMac, pMlmDisassocInd->sessionId); @@ -930,6 +932,7 @@ void lim_process_mlm_disassoc_cnf(tpAniSirGlobal mac_ctx, tSirResultCodes result_code; tLimMlmDisassocCnf *disassoc_cnf; tpPESession session_entry; + disassoc_cnf = (tLimMlmDisassocCnf *) msg; session_entry = @@ -1017,6 +1020,7 @@ void lim_process_mlm_deauth_ind(tpAniSirGlobal pMac, uint32_t *pMsgBuf) tLimMlmDeauthInd *pMlmDeauthInd; tpPESession psessionEntry; uint8_t sessionId; + pMlmDeauthInd = (tLimMlmDeauthInd *) pMsgBuf; psessionEntry = pe_find_session_by_bssid(pMac, pMlmDeauthInd->peerMacAddr, &sessionId); @@ -1146,6 +1150,7 @@ void lim_process_mlm_purge_sta_ind(tpAniSirGlobal pMac, uint32_t *pMsgBuf) tSirResultCodes resultCode; tpLimMlmPurgeStaInd pMlmPurgeStaInd; tpPESession psessionEntry; + if (pMsgBuf == NULL) { pe_err("Buffer is Pointing to NULL"); return; @@ -1499,6 +1504,7 @@ void lim_process_sta_mlm_add_sta_rsp(tpAniSirGlobal mac_ctx, if (session_entry->limSmeState == eLIM_SME_WT_REASSOC_STATE) { /* check if we have keys(PTK)to install in case of 11r */ tpftPEContext ft_ctx = &session_entry->ftPEContext; + ft_session = pe_find_session_by_bssid(mac_ctx, session_entry->limReAssocbssId, &ft_session_id); if (ft_session != NULL && @@ -1758,6 +1764,7 @@ void lim_process_mlm_del_sta_rsp(tpAniSirGlobal mac_ctx, */ tpPESession session_entry; tpDeleteStaParams del_sta_params; + del_sta_params = (tpDeleteStaParams) msg->bodyptr; if (NULL == del_sta_params) { pe_err("null pointer del_sta_params msg"); @@ -1862,6 +1869,7 @@ void lim_process_ap_mlm_del_sta_rsp(tpAniSirGlobal mac_ctx, */ if (sta_ds->qos.addtsPresent) { tpLimTspecInfo pTspecInfo; + if (eSIR_SUCCESS == lim_tspec_find_by_assoc_id(mac_ctx, sta_ds->assocId, @@ -1902,6 +1910,7 @@ void lim_process_sta_mlm_del_sta_rsp(tpAniSirGlobal pMac, tSirResultCodes statusCode = eSIR_SME_SUCCESS; tpDeleteStaParams pDelStaParams = (tpDeleteStaParams) limMsgQ->bodyptr; tpDphHashNode pStaDs = NULL; + if (NULL == pDelStaParams) { pe_err("Encountered NULL Pointer"); goto end; @@ -2060,6 +2069,7 @@ static void lim_process_ap_mlm_add_bss_rsp(tpAniSirGlobal pMac, tpPESession psessionEntry; uint8_t isWepEnabled = false; tpAddBssParams pAddBssParams = (tpAddBssParams) limMsgQ->bodyptr; + if (NULL == pAddBssParams) { pe_err("Encountered NULL Pointer"); goto end; @@ -2417,6 +2427,7 @@ lim_process_sta_mlm_add_bss_rsp(tpAniSirGlobal mac_ctx, tpDphHashNode sta_ds = NULL; uint16_t sta_idx = STA_INVALID_IDX; uint8_t update_sta = false; + mlm_assoc_cnf.resultCode = eSIR_SME_SUCCESS; if (eLIM_MLM_WT_ADD_BSS_RSP_PREASSOC_STATE == @@ -2897,6 +2908,7 @@ static void lim_process_switch_channel_re_assoc_req(tpAniSirGlobal pMac, { tLimMlmReassocCnf mlmReassocCnf; tLimMlmReassocReq *pMlmReassocReq; + pMlmReassocReq = (tLimMlmReassocReq *) (psessionEntry->pLimMlmReassocReq); if (pMlmReassocReq == NULL) { @@ -2963,6 +2975,7 @@ static void lim_process_switch_channel_join_req( { tSirMacSSid ssId; tLimMlmJoinCnf join_cnf; + if (status != QDF_STATUS_SUCCESS) { pe_err("Change channel failed!!"); goto error; diff --git a/core/mac/src/pe/lim/lim_process_probe_req_frame.c b/core/mac/src/pe/lim/lim_process_probe_req_frame.c index d0d84f9954f5..7a1362fa66dd 100644 --- a/core/mac/src/pe/lim/lim_process_probe_req_frame.c +++ b/core/mac/src/pe/lim/lim_process_probe_req_frame.c @@ -150,6 +150,7 @@ void lim_remove_pbc_sessions(tpAniSirGlobal mac, struct qdf_mac_addr remove_mac, tpPESession session_entry) { tSirWPSPBCSession *pbc, *prev = NULL; + prev = pbc = session_entry->pAPWPSPBCSession; while (pbc) { @@ -473,6 +474,7 @@ lim_process_probe_req_frame(tpAniSirGlobal mac_ctx, uint8_t *rx_pkt_info, QDF_P2P_GO_MODE) { uint8_t direct_ssid[7] = "DIRECT-"; uint8_t direct_ssid_len = 7; + if (!qdf_mem_cmp((uint8_t *) &direct_ssid, (uint8_t *) &(probe_req.ssId.ssId), (uint8_t) (direct_ssid_len))) { diff --git a/core/mac/src/pe/lim/lim_process_sme_req_messages.c b/core/mac/src/pe/lim/lim_process_sme_req_messages.c index 6a485ab3a026..b5b5c06fe2d5 100644 --- a/core/mac/src/pe/lim/lim_process_sme_req_messages.c +++ b/core/mac/src/pe/lim/lim_process_sme_req_messages.c @@ -1205,6 +1205,7 @@ static bool __lim_process_sme_start_bss_req(tpAniSirGlobal pMac, void lim_get_random_bssid(tpAniSirGlobal pMac, uint8_t *data) { uint32_t random[2]; + random[0] = tx_time_get(); random[0] |= (random[0] << 15); random[1] = random[0] >> 1; @@ -2000,6 +2001,7 @@ uint8_t lim_get_max_tx_power(int8_t regMax, int8_t apTxPower, { uint8_t maxTxPower = 0; uint8_t txPower = QDF_MIN(regMax, (apTxPower)); + txPower = QDF_MIN(txPower, iniTxPower); if ((txPower >= MIN_TX_PWR_CAP) && (txPower <= MAX_TX_PWR_CAP)) maxTxPower = txPower; @@ -2942,6 +2944,7 @@ __lim_process_sme_set_context_req(tpAniSirGlobal mac_ctx, uint32_t *msg_buf) LIM_IS_AP_ROLE(session_entry)) { if (set_context_req->keyMaterial.key[0].keyLength) { uint8_t key_id; + key_id = set_context_req->keyMaterial.key[0].keyId; qdf_mem_copy((uint8_t *) @@ -2950,6 +2953,7 @@ __lim_process_sme_set_context_req(tpAniSirGlobal mac_ctx, uint32_t *msg_buf) sizeof(tSirKeyMaterial)); } else { uint32_t i; + for (i = 0; i < SIR_MAC_MAX_NUM_OF_DEFAULT_KEYS; i++) { qdf_mem_copy((uint8_t *) @@ -3185,6 +3189,7 @@ lim_get_wpspbc_sessions_end: static void __lim_counter_measures(tpAniSirGlobal pMac, tpPESession psessionEntry) { tSirMacAddr mac = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF }; + if (LIM_IS_AP_ROLE(psessionEntry)) lim_send_disassoc_mgmt_frame(pMac, eSIR_MAC_MIC_FAILURE_REASON, mac, psessionEntry, false); @@ -3270,6 +3275,7 @@ __lim_handle_sme_stop_bss_request(tpAniSirGlobal pMac, uint32_t *pMsgBuf) if (!LIM_IS_IBSS_ROLE(psessionEntry) && !LIM_IS_NDI_ROLE(psessionEntry)) { tSirMacAddr bcAddr = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF }; + if (stopBssReq.reasonCode == eSIR_SME_MIC_COUNTER_MEASURES) /* Send disassoc all stations associated thru TKIP */ __lim_counter_measures(pMac, psessionEntry); @@ -3777,6 +3783,7 @@ void lim_process_sme_addts_rsp_timeout(tpAniSirGlobal pMac, uint32_t param) { /* fetch the sessionEntry based on the sessionId */ tpPESession psessionEntry; + psessionEntry = pe_find_session_by_session_id(pMac, pMac->lim.limTimers.gLimAddtsRspTimer. sessionId); @@ -4479,6 +4486,7 @@ __lim_process_sme_reset_ap_caps_change(tpAniSirGlobal pMac, uint32_t *pMsgBuf) tpSirResetAPCapsChange pResetCapsChange; tpPESession psessionEntry; uint8_t sessionId = 0; + if (pMsgBuf == NULL) { pe_err("Buffer is Pointing to NULL"); return; diff --git a/core/mac/src/pe/lim/lim_process_tdls.c b/core/mac/src/pe/lim/lim_process_tdls.c index 0f55b41433ba..ce3da04f7834 100644 --- a/core/mac/src/pe/lim/lim_process_tdls.c +++ b/core/mac/src/pe/lim/lim_process_tdls.c @@ -939,6 +939,7 @@ static tSirRetStatus lim_send_tdls_dis_rsp_frame(tpAniSirGlobal pMac, { tpSirMacMgmtHdr pMacHdr; + pMacHdr = (tpSirMacMgmtHdr) pFrame; pMacHdr->fc.toDS = ANI_TXDIR_IBSS; pMacHdr->fc.powerMgmt = 0; @@ -2251,6 +2252,7 @@ lim_tdls_populate_matching_rate_set(tpAniSirGlobal mac_ctx, tpDphHashNode stads, uint8_t a_rateindex = 0; uint8_t b_rateindex = 0; uint8_t nss; + is_a_rate = 0; temp_rate_set2.numRates = 0; @@ -2651,6 +2653,7 @@ static QDF_STATUS lim_send_sme_tdls_add_sta_rsp(tpAniSirGlobal pMac, { struct scheduler_msg mmhMsg = { 0 }; tSirTdlsAddStaRsp *addStaRsp = NULL; + mmhMsg.type = eWNI_SME_TDLS_ADD_STA_RSP; addStaRsp = qdf_mem_malloc(sizeof(tSirTdlsAddStaRsp)); @@ -2921,6 +2924,7 @@ static QDF_STATUS lim_send_sme_tdls_del_sta_rsp(tpAniSirGlobal pMac, { struct scheduler_msg mmhMsg = { 0 }; tSirTdlsDelStaRsp *pDelSta = NULL; + mmhMsg.type = eWNI_SME_TDLS_DEL_STA_RSP; pDelSta = qdf_mem_malloc(sizeof(tSirTdlsDelStaRsp)); diff --git a/core/mac/src/pe/lim/lim_reassoc_utils.c b/core/mac/src/pe/lim/lim_reassoc_utils.c index 2e19b8e6380a..e6b4aa3c051e 100644 --- a/core/mac/src/pe/lim/lim_reassoc_utils.c +++ b/core/mac/src/pe/lim/lim_reassoc_utils.c @@ -129,6 +129,7 @@ void lim_handle_del_bss_in_re_assoc_context(tpAniSirGlobal pMac, tpDphHashNode pStaDs; tSirRetStatus retStatus = eSIR_SUCCESS; tpSchBeaconStruct beacon_struct; + beacon_struct = qdf_mem_malloc(sizeof(tSchBeaconStruct)); if (NULL == beacon_struct) { pe_err("beaconStruct alloc failed"); @@ -259,6 +260,7 @@ void lim_handle_add_bss_in_re_assoc_context(tpAniSirGlobal pMac, tpDphHashNode pStaDs; tSirRetStatus retStatus = eSIR_SUCCESS; tSchBeaconStruct *pBeaconStruct; + pBeaconStruct = qdf_mem_malloc(sizeof(tSchBeaconStruct)); if (NULL == pBeaconStruct) { diff --git a/core/mac/src/pe/lim/lim_roam_timer_utils.c b/core/mac/src/pe/lim/lim_roam_timer_utils.c index 827c1b4edc98..7a77351ae06d 100644 --- a/core/mac/src/pe/lim/lim_roam_timer_utils.c +++ b/core/mac/src/pe/lim/lim_roam_timer_utils.c @@ -40,6 +40,7 @@ uint32_t lim_create_timers_host_roam(tpAniSirGlobal mac_ctx) { uint32_t cfg_value; + if (wlan_cfg_get_int(mac_ctx, WNI_CFG_REASSOCIATION_FAILURE_TIMEOUT, &cfg_value) != eSIR_SUCCESS) pe_warn("could not retrieve ReassocFailureTimeout value"); diff --git a/core/mac/src/pe/lim/lim_security_utils.c b/core/mac/src/pe/lim/lim_security_utils.c index c81b5f7a0d04..5fae864edf9a 100644 --- a/core/mac/src/pe/lim/lim_security_utils.c +++ b/core/mac/src/pe/lim/lim_security_utils.c @@ -656,6 +656,7 @@ lim_rc4(uint8_t *pDest, uint8_t *pSrc, uint8_t *seed, uint32_t keyLength, k = 0; for (i = 0; i < 256; i++) { uint8_t temp; + if (k < LIM_SEED_LENGTH) j = (uint8_t) (j + ctx.sbox[i] + seed[k]); temp = ctx.sbox[i]; @@ -727,6 +728,7 @@ lim_decrypt_auth_frame(tpAniSirGlobal pMac, uint8_t *pKey, uint8_t *pEncrBody, { uint8_t seed[LIM_SEED_LENGTH], icv[SIR_MAC_WEP_ICV_LENGTH]; int i; + keyLength += 3; /* Bytes 0-2 of seed is received IV */ diff --git a/core/mac/src/pe/lim/lim_send_frames_host_roam.c b/core/mac/src/pe/lim/lim_send_frames_host_roam.c index 94caf5bcc0d7..c5c74b20491b 100644 --- a/core/mac/src/pe/lim/lim_send_frames_host_roam.c +++ b/core/mac/src/pe/lim/lim_send_frames_host_roam.c @@ -480,6 +480,7 @@ void lim_send_retry_reassoc_req_frame(tpAniSirGlobal pMac, { tLimMlmReassocCnf mlmReassocCnf; /* keep sme */ tLimMlmReassocReq *pTmpMlmReassocReq = NULL; + if (NULL == pTmpMlmReassocReq) { pTmpMlmReassocReq = qdf_mem_malloc(sizeof(tLimMlmReassocReq)); if (NULL == pTmpMlmReassocReq) diff --git a/core/mac/src/pe/lim/lim_send_management_frames.c b/core/mac/src/pe/lim/lim_send_management_frames.c index 699af8ed2fb1..1e5939307420 100644 --- a/core/mac/src/pe/lim/lim_send_management_frames.c +++ b/core/mac/src/pe/lim/lim_send_management_frames.c @@ -2688,6 +2688,7 @@ lim_send_disassoc_mgmt_frame(tpAniSirGlobal pMac, uint8_t txFlag = 0; uint32_t val = 0; uint8_t smeSessionId = 0; + if (NULL == psessionEntry) { return; } diff --git a/core/mac/src/pe/lim/lim_send_messages.c b/core/mac/src/pe/lim/lim_send_messages.c index ae4ae44e50f2..389921f71c9c 100644 --- a/core/mac/src/pe/lim/lim_send_messages.c +++ b/core/mac/src/pe/lim/lim_send_messages.c @@ -212,6 +212,7 @@ tSirRetStatus lim_send_switch_chnl_params(tpAniSirGlobal pMac, tpSwitchChannelParams pChnlParams = NULL; struct scheduler_msg msgQ = {0}; tpPESession pSessionEntry; + pSessionEntry = pe_find_session_by_session_id(pMac, peSessionId); if (pSessionEntry == NULL) { pe_err("Unable to get Session for session Id %d", diff --git a/core/mac/src/pe/lim/lim_session.c b/core/mac/src/pe/lim/lim_session.c index 6d2b68d7ecf5..82748bcfaf13 100644 --- a/core/mac/src/pe/lim/lim_session.c +++ b/core/mac/src/pe/lim/lim_session.c @@ -404,6 +404,7 @@ pe_create_session(tpAniSirGlobal pMac, uint8_t *bssid, uint8_t *sessionId, QDF_STATUS status; uint8_t i; tpPESession session_ptr; + for (i = 0; i < pMac->lim.maxBssId; i++) { /* Find first free room in session table */ if (pMac->lim.gpSession[i].valid == true) @@ -593,6 +594,7 @@ tpPESession pe_find_session_by_bssid(tpAniSirGlobal pMac, uint8_t *bssid, tpPESession pe_find_session_by_bss_idx(tpAniSirGlobal pMac, uint8_t bssIdx) { uint8_t i; + for (i = 0; i < pMac->lim.maxBssId; i++) { /* If BSSID matches return corresponding tables address */ if ((pMac->lim.gpSession[i].valid) diff --git a/core/mac/src/pe/lim/lim_session_utils.c b/core/mac/src/pe/lim/lim_session_utils.c index 95eb89da2433..1b39f85328fb 100644 --- a/core/mac/src/pe/lim/lim_session_utils.c +++ b/core/mac/src/pe/lim/lim_session_utils.c @@ -134,6 +134,7 @@ uint8_t pe_get_current_stas_count(tpAniSirGlobal mac_ctx) { uint8_t i; uint8_t stacount = 0; + for (i = 0; i < mac_ctx->lim.maxBssId; i++) if (mac_ctx->lim.gpSession[i].valid == true) stacount += diff --git a/core/mac/src/pe/lim/lim_utils.c b/core/mac/src/pe/lim/lim_utils.c index 37f3efb2ee57..8921d5321c74 100644 --- a/core/mac/src/pe/lim/lim_utils.c +++ b/core/mac/src/pe/lim/lim_utils.c @@ -626,6 +626,7 @@ void lim_deactivate_timers(tpAniSirGlobal mac_ctx) void lim_cleanup_mlm(tpAniSirGlobal mac_ctx) { uint32_t n; + tLimPreAuthNode **pAuthNode; tLimTimers *lim_timer = NULL; @@ -721,6 +722,7 @@ void lim_cleanup_mlm(tpAniSirGlobal mac_ctx) uint8_t lim_is_addr_bc(tSirMacAddr macAddr) { int i; + for (i = 0; i < 6; i++) { if ((macAddr[i] & 0xFF) != 0xFF) return false; @@ -891,6 +893,7 @@ uint8_t lim_write_deferred_msg_q(tpAniSirGlobal mac_ctx, (LIM_DEFERRED_Q_CHECK_THRESHOLD < mac_ctx->lim.gLimDeferredMsgQ.size)) { uint16_t idx, count = 0; + for (idx = 0; idx < mac_ctx->lim.gLimDeferredMsgQ.size; idx++) { if (SIR_BB_XPORT_MGMT_MSG == @@ -1695,6 +1698,7 @@ lim_decide_sta_protection_on_assoc(tpAniSirGlobal pMac, /* protection related factors other than HT operating mode. Applies to 2.4 GHZ as well as 5 GHZ. */ if ((psessionEntry->htCapability) && (pBeaconStruct->HTInfo.present)) { tDot11fIEHTInfo htInfo = pBeaconStruct->HTInfo; + psessionEntry->beaconParams.fRIFSMode = (uint8_t) htInfo.rifsMode; psessionEntry->beaconParams.llnNonGFCoexist = @@ -2433,6 +2437,7 @@ void lim_process_quiet_bss_timeout(tpAniSirGlobal mac_ctx) void lim_start_quiet_timer(tpAniSirGlobal pMac, uint8_t sessionId) { tpPESession psessionEntry; + psessionEntry = pe_find_session_by_session_id(pMac, sessionId); if (psessionEntry == NULL) { @@ -2722,6 +2727,7 @@ uint8_t lim_active_scan_allowed(tpAniSirGlobal pMac, uint8_t channelNum) uint32_t i; uint8_t channelPair[WNI_CFG_SCAN_CONTROL_LIST_LEN]; uint32_t len = WNI_CFG_SCAN_CONTROL_LIST_LEN; + if (wlan_cfg_get_str(pMac, WNI_CFG_SCAN_CONTROL_LIST, channelPair, &len) != eSIR_SUCCESS) { pe_err("Unable to get scan control list"); @@ -5420,6 +5426,7 @@ void lim_handle_heart_beat_timeout_for_session(tpAniSirGlobal mac_ctx, uint8_t lim_get_current_operating_channel(tpAniSirGlobal pMac) { uint8_t i; + for (i = 0; i < pMac->lim.maxBssId; i++) { if (pMac->lim.gpSession[i].valid == true) { if ((pMac->lim.gpSession[i].bssType == @@ -5642,6 +5649,7 @@ void lim_diag_event_report(tpAniSirGlobal pMac, uint16_t eventType, uint16_t reasonCode) { tSirMacAddr nullBssid = { 0, 0, 0, 0, 0, 0 }; + WLAN_HOST_DIAG_EVENT_DEF(peEvent, host_event_wlan_pe_payload_type); qdf_mem_set(&peEvent, sizeof(host_event_wlan_pe_payload_type), 0); @@ -5804,6 +5812,7 @@ void pe_set_resume_channel(tpAniSirGlobal pMac, uint16_t channel, bool lim_is_noa_insert_reqd(tpAniSirGlobal pMac) { uint8_t i; + for (i = 0; i < pMac->lim.maxBssId; i++) { if (pMac->lim.gpSession[i].valid == true) { if ((eLIM_AP_ROLE == diff --git a/core/mac/src/pe/nan/nan_datapath.c b/core/mac/src/pe/nan/nan_datapath.c index b95db10efba1..3343d59aecdc 100644 --- a/core/mac/src/pe/nan/nan_datapath.c +++ b/core/mac/src/pe/nan/nan_datapath.c @@ -544,6 +544,7 @@ QDF_STATUS lim_handle_ndp_event_message(tpAniSirGlobal mac_ctx, switch (msg->type) { case SIR_HAL_NDP_CONFIRM: { struct ndp_confirm_event *ndp_confirm = msg->bodyptr; + if (ndp_confirm->rsp_code != NDP_RESPONSE_ACCEPT && ndp_confirm->num_active_ndps_on_peer == 0) { /* @@ -570,6 +571,7 @@ QDF_STATUS lim_handle_ndp_event_message(tpAniSirGlobal mac_ctx, break; case SIR_HAL_NDP_INDICATION: { struct ndp_indication_event *ndp_ind = msg->bodyptr; + status = lim_handle_ndp_indication_event(mac_ctx, ndp_ind); break; } diff --git a/core/mac/src/pe/rrm/rrm_api.c b/core/mac/src/pe/rrm/rrm_api.c index 36dde837d0ce..d50eb6fc06b3 100644 --- a/core/mac/src/pe/rrm/rrm_api.c +++ b/core/mac/src/pe/rrm/rrm_api.c @@ -60,6 +60,7 @@ rrm_get_min_of_max_tx_power(tpAniSirGlobal pMac, { uint8_t maxTxPower = 0; uint8_t txPower = QDF_MIN(regMax, (apTxPower)); + if ((txPower >= RRM_MIN_TX_PWR_CAP) && (txPower <= RRM_MAX_TX_PWR_CAP)) maxTxPower = txPower; else if (txPower < RRM_MIN_TX_PWR_CAP) @@ -639,6 +640,7 @@ rrm_process_beacon_report_req(tpAniSirGlobal pMac, uint8_t *ch_lst = pSmeBcnReportReq->channelList.channelNumber; uint8_t len; uint16_t ch_ctr = 0; + for (num_APChanReport = 0; num_APChanReport < pBeaconReq->measurement_request.Beacon.num_APChannelReport; diff --git a/core/mac/src/pe/sch/sch_beacon_gen.c b/core/mac/src/pe/sch/sch_beacon_gen.c index cac0047a0df0..37a70a302d61 100644 --- a/core/mac/src/pe/sch/sch_beacon_gen.c +++ b/core/mac/src/pe/sch/sch_beacon_gen.c @@ -567,6 +567,7 @@ tSirRetStatus lim_update_probe_rsp_template_ie_bitmap_beacon1(tpAniSirGlobal pMa { uint32_t *DefProbeRspIeBitmap; tDot11fProbeResponse *prb_rsp; + if (!psessionEntry) { pe_debug("PESession is null!"); return eSIR_FAILURE; @@ -882,10 +883,10 @@ void sch_generate_tim(tpAniSirGlobal pMac, uint8_t **pPtr, uint16_t *timLength, uint32_t val = 0; uint32_t minAid = 1; /* Always start with AID 1 as minimum */ uint32_t maxAid = HAL_NUM_STA; - /* Generate partial virtual bitmap */ uint8_t N1 = minAid / 8; uint8_t N2 = maxAid / 8; + if (N1 & 1) N1--; @@ -965,6 +966,7 @@ void sch_process_pre_beacon_ind(tpAniSirGlobal pMac, &psessionEntry->pSchBeaconFrameBegin[psessionEntry-> schBeaconOffsetBegin]; uint16_t timLength = 0; + if (psessionEntry->statypeForBss == STA_ENTRY_SELF) { sch_generate_tim(pMac, &ptr, &timLength, psessionEntry->dtimPeriod); diff --git a/core/mac/src/pe/sch/sch_beacon_process.c b/core/mac/src/pe/sch/sch_beacon_process.c index cbe1e54032ae..a267f81a1bc4 100644 --- a/core/mac/src/pe/sch/sch_beacon_process.c +++ b/core/mac/src/pe/sch/sch_beacon_process.c @@ -72,6 +72,7 @@ ap_beacon_process_5_ghz(tpAniSirGlobal mac_ctx, uint8_t *rx_pkt_info, uint32_t phy_mode) { tpSirMacMgmtHdr mac_hdr = WMA_GET_RX_MAC_HEADER(rx_pkt_info); + if (!session->htCapability) return; @@ -801,6 +802,7 @@ static void __sch_beacon_process_for_session(tpAniSirGlobal mac_ctx, uint8_t sendProbeReq = false; tpSirMacMgmtHdr pMh = WMA_GET_RX_MAC_HEADER(rx_pkt_info); int8_t regMax = 0, maxTxPower = 0, local_constraint; + qdf_mem_zero(&beaconParams, sizeof(tUpdateBeaconParams)); beaconParams.paramChangeBitmap = 0; diff --git a/core/mac/src/pe/sch/sch_message.c b/core/mac/src/pe/sch/sch_message.c index 5c0d2d449f48..8d5578dde951 100644 --- a/core/mac/src/pe/sch/sch_message.c +++ b/core/mac/src/pe/sch/sch_message.c @@ -254,6 +254,7 @@ sch_get_params(tpAniSirGlobal pMac, for (i = 0; i < 4; i++) { uint8_t data[WNI_CFG_EDCA_ANI_ACBK_LEN]; uint32_t len = WNI_CFG_EDCA_ANI_ACBK_LOCAL_LEN; + if (wlan_cfg_get_str (pMac, (uint16_t) prf[i], (uint8_t *) &data[0], &len) != eSIR_SUCCESS) { @@ -539,6 +540,7 @@ get_wmm_local_params(tpAniSirGlobal pMac, for (i = 0; i < 4; i++) { uint8_t data[WNI_CFG_EDCA_ANI_ACBK_LEN]; uint32_t len = WNI_CFG_EDCA_ANI_ACBK_LOCAL_LEN; + if (wlan_cfg_get_str (pMac, (uint16_t) prf[i], (uint8_t *) &data[0], &len) != eSIR_SUCCESS) { diff --git a/core/mac/src/sys/legacy/src/platform/src/sys_wrapper.c b/core/mac/src/sys/legacy/src/platform/src/sys_wrapper.c index b2e787293504..c8496adabb9a 100644 --- a/core/mac/src/sys/legacy/src/platform/src/sys_wrapper.c +++ b/core/mac/src/sys/legacy/src/platform/src/sys_wrapper.c @@ -263,6 +263,7 @@ static void tx_main_timer_func(void *functionContext) /* check if this needs to be rescheduled */ if (0 != timer_ptr->rescheduleTimeInMsecs) { QDF_STATUS status; + status = qdf_mc_timer_start(&timer_ptr->qdf_timer, timer_ptr->rescheduleTimeInMsecs); timer_ptr->rescheduleTimeInMsecs = 0; diff --git a/core/mac/src/sys/legacy/src/system/src/mac_init_api.c b/core/mac/src/sys/legacy/src/system/src/mac_init_api.c index cc86bae11aa3..c02924aa30b9 100644 --- a/core/mac/src/sys/legacy/src/system/src/mac_init_api.c +++ b/core/mac/src/sys/legacy/src/system/src/mac_init_api.c @@ -86,6 +86,7 @@ tSirRetStatus mac_start(tHalHandle hHal, void *pHalMacStartParams) QDF_STATUS mac_stop(tHalHandle hHal, tHalStopType stopType) { tpAniSirGlobal pMac = (tpAniSirGlobal) hHal; + pe_stop(pMac); cfg_cleanup(pMac); diff --git a/core/mac/src/sys/legacy/src/utils/src/parser_api.c b/core/mac/src/sys/legacy/src/utils/src/parser_api.c index fe40aecca1c4..34253b4ee0f6 100644 --- a/core/mac/src/sys/legacy/src/utils/src/parser_api.c +++ b/core/mac/src/sys/legacy/src/utils/src/parser_api.c @@ -852,6 +852,7 @@ static void lim_log_operating_mode(tpAniSirGlobal pMac, static void lim_log_qos_map_set(tpAniSirGlobal pMac, tSirQosMapSet *pQosMapSet) { uint8_t i; + if (pQosMapSet->num_dscp_exceptions > QOS_MAP_MAX_EX) pQosMapSet->num_dscp_exceptions = QOS_MAP_MAX_EX; @@ -1353,6 +1354,7 @@ populate_dot11f_ibss_params(tpAniSirGlobal pMac, tpPESession psessionEntry) { uint32_t val = 0; + if (LIM_IS_IBSS_ROLE(psessionEntry)) { if (wlan_cfg_get_int(pMac, WNI_CFG_IBSS_ATIM_WIN_SIZE, @@ -2794,6 +2796,7 @@ sir_convert_assoc_req_frame2_struct(tpAniSirGlobal pMac, } if (ar->ExtCap.present) { struct s_ext_cap *ext_cap; + qdf_mem_copy(&pAssocReq->ExtCap, &ar->ExtCap, sizeof(tDot11fIEExtCap)); ext_cap = (struct s_ext_cap *)&pAssocReq->ExtCap.bytes; @@ -3098,6 +3101,7 @@ sir_convert_assoc_resp_frame2_struct(tpAniSirGlobal pMac, if (ar->ExtCap.present) { struct s_ext_cap *ext_cap; + qdf_mem_copy(&pAssocRsp->ExtCap, &ar->ExtCap, sizeof(tDot11fIEExtCap)); ext_cap = (struct s_ext_cap *)&pAssocRsp->ExtCap.bytes; @@ -3316,6 +3320,7 @@ sir_convert_reassoc_req_frame2_struct(tpAniSirGlobal pMac, } if (ar.ExtCap.present) { struct s_ext_cap *ext_cap; + qdf_mem_copy(&pAssocReq->ExtCap, &ar.ExtCap, sizeof(tDot11fIEExtCap)); ext_cap = (struct s_ext_cap *)&pAssocReq->ExtCap.bytes; @@ -4758,6 +4763,7 @@ sir_convert_qos_map_configure_frame2_struct(tpAniSirGlobal pMac, { tDot11fQosMapConfigure mapConfigure; uint32_t status; + status = dot11f_unpack_qos_map_configure(pMac, pFrame, nFrame, &mapConfigure, false); @@ -4786,6 +4792,7 @@ sir_convert_tpc_req_frame2_struct(tpAniSirGlobal pMac, { tDot11fTPCRequest req; uint32_t status; + qdf_mem_set((uint8_t *) pTpcReqFrame, sizeof(tSirMacTpcReqActionFrame), 0); status = dot11f_unpack_tpc_request(pMac, pFrame, nFrame, &req, false); @@ -4978,6 +4985,7 @@ tSirRetStatus populate_dot11f_ese_cckm_opaque(tpAniSirGlobal pMac, tDot11fIEESECckmOpaque *pDot11f) { int idx; + if (pCCKMie->length) { idx = find_ie_location(pMac, (tpSirRSNie) pCCKMie, DOT11F_EID_ESECCKMOPAQUE); diff --git a/core/mac/src/sys/legacy/src/utils/src/utils_parser.c b/core/mac/src/sys/legacy/src/utils/src/utils_parser.c index 27835d215af2..f8aa56592596 100644 --- a/core/mac/src/sys/legacy/src/utils/src/utils_parser.c +++ b/core/mac/src/sys/legacy/src/utils/src/utils_parser.c @@ -93,6 +93,7 @@ tSirRetStatus convert_wpa(tpAniSirGlobal pMac, /* array... */ uint8_t buffer[257]; uint32_t status, written = 0, nbuffer = 257; + status = dot11f_pack_ie_wpa(pMac, pNew, buffer, nbuffer, &written); if (DOT11F_FAILED(status)) { pe_err("Failed to re-pack the WPA IE (0x%0x8)", status); @@ -198,6 +199,7 @@ tSirRetStatus convert_rsn(tpAniSirGlobal pMac, { uint8_t buffer[257]; uint32_t status, written = 0, nbuffer = 257; + status = dot11f_pack_ie_rsn(pMac, pNew, buffer, nbuffer, &written); if (DOT11F_FAILED(status)) { pe_err("Failed to re-pack the RSN IE (0x%0x8)", status); diff --git a/core/sap/dfs/src/dfs.c b/core/sap/dfs/src/dfs.c index fb6f5359b8ab..1db896213a6f 100644 --- a/core/sap/dfs/src/dfs.c +++ b/core/sap/dfs/src/dfs.c @@ -209,6 +209,7 @@ static os_timer_func(dfs_testtimer_task) static int dfs_get_debug_info(struct ieee80211com *ic, int type, void *data) { struct ath_dfs *dfs = (struct ath_dfs *)ic->ic_dfs; + if (data) { *(uint32_t *) data = dfs->dfs_proc_phyerr; } @@ -529,6 +530,7 @@ void dfs_detach(struct ieee80211com *ic) OS_CANCEL_TIMER(&dfs->sc_dfs_war_timer); if (dfs->dfs_nol != NULL) { struct dfs_nolelem *nol, *next; + nol = dfs->dfs_nol; /* Bug 29099 - each NOL element has its own timer, cancel it and free the element */ @@ -644,17 +646,15 @@ int dfs_radar_enable(struct ieee80211com *ic, int is_ext_ch; int is_fastclk = 0; int radar_filters_init_status = 0; - /* uint32_t rfilt; */ struct ath_dfs *dfs; struct dfs_state *rs_pri, *rs_ext; struct dfs_ieee80211_channel *chan = ic->ic_curchan, *ext_ch = NULL; + is_ext_ch = IEEE80211_IS_CHAN_11N_HT40(ic->ic_curchan); dfs = (struct ath_dfs *)ic->ic_dfs; rs_pri = NULL; rs_ext = NULL; -#if 0 - int i; -#endif + if (dfs == NULL) { DFS_DPRINTK(dfs, ATH_DEBUG_DFS, "%s: ic_dfs is NULL\n", __func__); @@ -1110,12 +1110,14 @@ dfs_get_thresholds(struct ieee80211com *ic, struct ath_dfs_phyerr_param *param) uint16_t dfs_usenol(struct ieee80211com *ic) { struct ath_dfs *dfs = (struct ath_dfs *)ic->ic_dfs; + return dfs ? (uint16_t) dfs->dfs_rinfo.rn_use_nol : 0; } uint16_t dfs_isdfsregdomain(struct ieee80211com *ic) { struct ath_dfs *dfs = (struct ath_dfs *)ic->ic_dfs; + return dfs ? dfs->dfsdomain : 0; } diff --git a/core/sap/dfs/src/dfs_init.c b/core/sap/dfs/src/dfs_init.c index 167868560566..12cb49b9caa3 100644 --- a/core/sap/dfs/src/dfs_init.c +++ b/core/sap/dfs/src/dfs_init.c @@ -183,6 +183,7 @@ void dfs_reset_delayline(struct dfs_delayline *dl) void dfs_reset_radarq(struct ath_dfs *dfs) { struct dfs_event *event; + if (dfs == NULL) { DFS_DPRINTK(dfs, ATH_DEBUG_DFS, "%s: sc_dfs is NULL", __func__); return; @@ -310,6 +311,7 @@ int dfs_init_radar_filters(struct ieee80211com *ic, max_pulsedur = ft->ft_maxdur; for (i = ft->ft_mindur; i <= ft->ft_maxdur; i++) { uint32_t stop = 0, tableindex = 0; + while ((tableindex < DFS_MAX_RADAR_OVERLAP) && (!stop)) { if ((dfs-> @@ -486,6 +488,7 @@ bad4: void dfs_clear_stats(struct ieee80211com *ic) { struct ath_dfs *dfs = (struct ath_dfs *)ic->ic_dfs; + if (dfs == NULL) return; OS_MEMZERO(&dfs->ath_dfs_stats, sizeof(struct dfs_stats)); diff --git a/core/sap/dfs/src/dfs_misc.c b/core/sap/dfs/src/dfs_misc.c index c06d790d4833..e9716ded80a3 100644 --- a/core/sap/dfs/src/dfs_misc.c +++ b/core/sap/dfs/src/dfs_misc.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2002-2016 The Linux Foundation. All rights reserved. + * Copyright (c) 2002-2017 The Linux Foundation. All rights reserved. * * Previously licensed under the ISC license by Qualcomm Atheros, Inc. * @@ -208,6 +208,7 @@ uint32_t dfs_round(int32_t val) struct dfs_ieee80211_channel *ieee80211_get_extchan(struct ieee80211com *ic) { int chan_offset = 0; + if (IEEE80211_IS_CHAN_HT40PLUS_CAPABLE(ic->ic_curchan)) { chan_offset = 20; } else if (IEEE80211_IS_CHAN_HT40MINUS_CAPABLE(ic->ic_curchan)) { diff --git a/core/sap/src/sap_api_link_cntl.c b/core/sap/src/sap_api_link_cntl.c index bff1d3d8acd2..2c690cd9212f 100644 --- a/core/sap/src/sap_api_link_cntl.c +++ b/core/sap/src/sap_api_link_cntl.c @@ -278,6 +278,7 @@ static QDF_STATUS sap_hdd_signal_event_handler(void *ctx) { struct sap_context *sap_ctx = ctx; QDF_STATUS status; + if (NULL == sap_ctx) { QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_ERROR, FL("sap context is not valid")); @@ -650,6 +651,7 @@ wlansap_roam_process_dfs_chansw_update(tHalHandle hHal, /* Issue channel change req for each sapctx */ for (intf = 0; intf < SAP_MAX_NUM_SESSION; intf++) { struct sap_context *pSapContext; + if (!((QDF_SAP_MODE == mac_ctx->sap.sapCtxList[intf].sapPersona) && (mac_ctx->sap.sapCtxList[intf].pSapContext != NULL))) continue; @@ -693,6 +695,7 @@ wlansap_roam_process_dfs_radar_found(tpAniSirGlobal mac_ctx, { QDF_STATUS qdf_status; tWLAN_SAPEvent sap_event; + if (eSAP_DFS_CAC_WAIT == sap_ctx->sapsMachine) { if (sap_ctx->csr_roamProfile.disableDFSChSwitch) { QDF_TRACE(QDF_MODULE_ID_SAP, @@ -791,6 +794,7 @@ wlansap_roam_process_infra_assoc_ind(struct sap_context *sap_ctx, QDF_STATUS *ret_status) { QDF_STATUS qdf_status; + QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_INFO_HIGH, FL("CSR roam_result = eCSR_ROAM_RESULT_INFRA_ASSOCIATION_IND (%d)"), roam_result); diff --git a/core/sap/src/sap_ch_select.c b/core/sap/src/sap_ch_select.c index f77297aabe75..2d3a88b7818b 100644 --- a/core/sap/src/sap_ch_select.c +++ b/core/sap/src/sap_ch_select.c @@ -1241,6 +1241,7 @@ static void sap_interference_rssi_count_5G(tSapSpectChInfo *spect_ch, { uint16_t num_ch; int32_t offset = 0; + if (NULL == spect_ch) { QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_ERROR, FL("spect_ch is NULL")); diff --git a/core/sap/src/sap_fsm.c b/core/sap/src/sap_fsm.c index 188ac7fae091..df0a821c73cb 100644 --- a/core/sap/src/sap_fsm.c +++ b/core/sap/src/sap_fsm.c @@ -2440,6 +2440,7 @@ QDF_STATUS sap_signal_hdd_event(struct sap_context *sap_ctx, #ifdef FEATURE_WLAN_WAPI if (csr_roaminfo->wapiIELen) { uint8_t len = reassoc_complete->iesLen; + reassoc_complete->iesLen += csr_roaminfo->wapiIELen; qdf_mem_copy(&reassoc_complete->ies[len], csr_roaminfo->pwapiIE, @@ -2448,6 +2449,7 @@ QDF_STATUS sap_signal_hdd_event(struct sap_context *sap_ctx, #endif if (csr_roaminfo->addIELen) { uint8_t len = reassoc_complete->iesLen; + reassoc_complete->iesLen += csr_roaminfo->addIELen; qdf_mem_copy(&reassoc_complete->ies[len], csr_roaminfo->paddIE, @@ -3899,6 +3901,7 @@ sap_search_mac_list(struct qdf_mac_addr *macList, { int32_t nRes = -1; int8_t nStart = 0, nEnd, nMiddle; + nEnd = num_mac - 1; if ((NULL == macList) || (num_mac > MAX_ACL_MAC_ADDRESS)) { @@ -4007,6 +4010,7 @@ void sap_print_acl(struct qdf_mac_addr *macList, uint8_t size) { int i; uint8_t *macArray; + QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_INFO_HIGH, "print acl entered"); @@ -4173,6 +4177,7 @@ static QDF_STATUS sap_get_channel_list(struct sap_context *sap_ctx, #endif #ifdef FEATURE_WLAN_AP_AP_ACS_OPTIMIZE uint8_t ch; + ch = WLAN_REG_CH_NUM(loop_count); if ((sap_ctx->acs_cfg->skip_scan_status == eSAP_DO_PAR_ACS_SCAN)) { @@ -4358,6 +4363,7 @@ static int sap_stop_dfs_cac_timer(struct sap_context *sapContext) { tHalHandle hHal; tpAniSirGlobal pMac; + if (sapContext == NULL) return 0; diff --git a/core/sap/src/sap_module.c b/core/sap/src/sap_module.c index 5b625c48795e..7eadba126bbd 100644 --- a/core/sap/src/sap_module.c +++ b/core/sap/src/sap_module.c @@ -1997,6 +1997,7 @@ QDF_STATUS wlan_sap_set_channel_avoidance(tHalHandle hal, bool sap_channel_avoidance) { tpAniSirGlobal mac_ctx = NULL; + if (NULL != hal) mac_ctx = PMAC_STRUCT(hal); if (mac_ctx == NULL || hal == NULL) { @@ -2617,6 +2618,7 @@ QDF_STATUS wlansap_acs_chselect(struct sap_context *sap_context, void wlan_sap_enable_phy_error_logs(tHalHandle hal, bool enable_log) { tpAniSirGlobal mac_ctx = PMAC_STRUCT(hal); + mac_ctx->sap.enable_dfs_phy_error_logs = enable_log; } diff --git a/core/sme/src/common/sme_api.c b/core/sme/src/common/sme_api.c index 20db3ff4efec..da8315e8e2a3 100644 --- a/core/sme/src/common/sme_api.c +++ b/core/sme/src/common/sme_api.c @@ -4347,6 +4347,7 @@ QDF_STATUS sme_wow_add_pattern(tHalHandle hal, struct wow_add_pattern *ptrn; tSirRetStatus ret_code = eSIR_SUCCESS; struct scheduler_msg msg_q = {0}; + MTRACE(qdf_trace(QDF_MODULE_ID_SME, TRACE_CODE_SME_RX_HDD_WOWL_ADDBCAST_PATTERN, session_id, 0)); @@ -4387,6 +4388,7 @@ QDF_STATUS sme_wow_delete_pattern(tHalHandle hal, struct wow_delete_pattern *delete_ptrn; tSirRetStatus ret_code = eSIR_SUCCESS; struct scheduler_msg msg_q = {0}; + MTRACE(qdf_trace(QDF_MODULE_ID_SME, TRACE_CODE_SME_RX_HDD_WOWL_DELBCAST_PATTERN, sessionId, 0)); diff --git a/core/sme/src/csr/csr_api_roam.c b/core/sme/src/csr/csr_api_roam.c index c5901a1b8387..2142a311bfde 100644 --- a/core/sme/src/csr/csr_api_roam.c +++ b/core/sme/src/csr/csr_api_roam.c @@ -708,6 +708,7 @@ csr_scan_chan_list_2g[SCAN_CHAN_LIST_2G_LEN] = { 1, 6, 11 }; static QDF_STATUS csr_emu_chan_req(uint32_t channel) { int i; + if (WLAN_REG_IS_24GHZ_CH(channel)) { for (i = 0; i < QDF_ARRAY_SIZE(csr_scan_chan_list_2g); i++) { if (csr_scan_chan_list_2g[i] == channel) @@ -5453,8 +5454,9 @@ static void csr_set_abort_roaming_command(tpAniSirGlobal pMac, */ static bool csr_roam_select_bss(tpAniSirGlobal mac_ctx, tListElem *roam_bss_entry, tCsrScanResultInfo **csr_result_info, - struct tag_csrscan_result **csr_scan_result, uint32_t - session_id, uint32_t roam_id, enum csr_join_state *roam_state, + struct tag_csrscan_result **csr_scan_result, + uint32_t session_id, uint32_t roam_id, + enum csr_join_state *roam_state, struct scan_result_list *bss_list) { uint8_t conc_channel = 0; @@ -19247,6 +19249,7 @@ static enum wlan_serialization_cmd_type csr_get_roam_cmd_type( tSmeCmd *sme_cmd) { enum wlan_serialization_cmd_type cmd_type = WLAN_SER_CMD_MAX; + switch (sme_cmd->u.roamCmd.roamReason) { case eCsrForcedDisassoc: cmd_type = WLAN_SER_CMD_FORCE_DISASSOC; diff --git a/core/sme/src/csr/csr_api_scan.c b/core/sme/src/csr/csr_api_scan.c index 1a70487e1c4d..d4e6f419dcc7 100644 --- a/core/sme/src/csr/csr_api_scan.c +++ b/core/sme/src/csr/csr_api_scan.c @@ -1708,6 +1708,7 @@ struct tag_csrscan_result *csr_scan_append_bss_description(tpAniSirGlobal pMac, bool fForced, uint8_t sessionId) { struct tag_csrscan_result *pCsrBssDescription = NULL; + pCsrBssDescription = csr_scan_save_bss_description(pMac, pSirBssDescription, pIes, sessionId); @@ -4700,6 +4701,7 @@ QDF_STATUS csr_scan_abort_mac_scan_not_for_connect(tpAniSirGlobal pMac, uint8_t sessionId) { QDF_STATUS status = QDF_STATUS_SUCCESS; + if (!csr_is_scan_for_roam_command_active(pMac, sessionId)) { /* * Only abort the scan if it is not used for other roam/connect diff --git a/core/wma/src/wma_dev_if.c b/core/wma/src/wma_dev_if.c index c096cae1215f..cec3bf650916 100644 --- a/core/wma/src/wma_dev_if.c +++ b/core/wma/src/wma_dev_if.c @@ -2811,6 +2811,7 @@ void wma_hold_req_timer(void *data) } else if ((tgt_req->msg_type == WMA_DELETE_STA_REQ) && (tgt_req->type == WMA_DEL_P2P_SELF_STA_RSP_START)) { struct del_sta_self_rsp_params *del_sta; + del_sta = (struct del_sta_self_rsp_params *)tgt_req->user_data; del_sta->self_sta_param->status = QDF_STATUS_E_TIMEOUT; WMA_LOGA(FL("wma delete sta p2p request timed out")); diff --git a/core/wma/src/wma_features.c b/core/wma/src/wma_features.c index 8ead700f6a11..3e02d3519796 100644 --- a/core/wma/src/wma_features.c +++ b/core/wma/src/wma_features.c @@ -2894,6 +2894,7 @@ QDF_STATUS wma_wow_exit(tp_wma_handle wma, tpSirHalWowlExitParams info) void wma_calculate_and_update_conn_state(tp_wma_handle wma) { int i; + for (i = 0; i < wma->max_bssid; i++) { wma->interfaces[i].conn_state = !!(wma_is_vdev_up(i) && @@ -2913,6 +2914,7 @@ void wma_calculate_and_update_conn_state(tp_wma_handle wma) void wma_update_conn_state(tp_wma_handle wma, uint32_t conn_mask) { int i; + for (i = 0; i < wma->max_bssid; i++) { if (conn_mask & (1 << i)) wma->interfaces[i].conn_state = true; diff --git a/core/wma/src/wma_main.c b/core/wma/src/wma_main.c index 28755cb0e7b8..f98e04d8871a 100644 --- a/core/wma/src/wma_main.c +++ b/core/wma/src/wma_main.c @@ -7123,6 +7123,7 @@ static QDF_STATUS wma_mc_process_msg(struct scheduler_msg *msg) QDF_STATUS qdf_status = QDF_STATUS_SUCCESS; tp_wma_handle wma_handle; struct cdp_vdev *txrx_vdev_handle = NULL; + extern uint8_t *mac_trace_get_wma_msg_string(uint16_t wmaMsg); void *soc = cds_get_context(QDF_MODULE_ID_SOC); diff --git a/core/wma/src/wma_mgmt.c b/core/wma/src/wma_mgmt.c index b69a79d77817..e5d04f990c88 100644 --- a/core/wma/src/wma_mgmt.c +++ b/core/wma/src/wma_mgmt.c @@ -2282,6 +2282,7 @@ QDF_STATUS wma_process_update_edca_param_req(WMA_HANDLE handle, uint8_t vdev_id; QDF_STATUS status; void *soc = cds_get_context(QDF_MODULE_ID_SOC); + vdev_id = edca_params->bssIdx; for (ac = 0; ac < WME_NUM_AC; ac++) { diff --git a/core/wma/src/wma_scan_roam.c b/core/wma/src/wma_scan_roam.c index 23b7fd74a0e2..12893ada58b9 100644 --- a/core/wma/src/wma_scan_roam.c +++ b/core/wma/src/wma_scan_roam.c @@ -2260,6 +2260,7 @@ void wma_process_roam_synch_fail(WMA_HANDLE handle, struct roam_offload_synch_fail *synch_fail) { tp_wma_handle wma_handle = (tp_wma_handle) handle; + if (!wma_handle || !wma_handle->wmi_handle) { WMA_LOGE("%s: WMA is closed, can not clean-up roam synch", __func__); diff --git a/core/wma/src/wma_utils.c b/core/wma/src/wma_utils.c index eb59603cd0ce..50aaf24c27d4 100644 --- a/core/wma/src/wma_utils.c +++ b/core/wma/src/wma_utils.c @@ -4572,6 +4572,7 @@ QDF_STATUS wma_send_vdev_stop_to_fw(t_wma_handle *wma, uint8_t vdev_id) bool wma_is_service_enabled(WMI_SERVICE service_type) { tp_wma_handle wma; + wma = cds_get_context(QDF_MODULE_ID_WMA); if (!wma) { WMA_LOGE("%s: Invalid WMA handle", __func__);