Merge "Release 1.0.0.57 QCACLD WLAN Driver"

23 files changed, 178 insertions, 93 deletions

diff --git a/CORE/CLD_TXRX/HTT/htt_rx.c b/CORE/CLD_TXRX/HTT/htt_rx.c
index 3bbd9301c676..f284b8c68a22 100644
--- a/CORE/CLD_TXRX/HTT/htt_rx.c
+++ b/CORE/CLD_TXRX/HTT/htt_rx.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -1237,6 +1237,9 @@ htt_rx_restitch_mpdu_from_msdus(
 
     prev_buf = mpdu_buf;
     dest = adf_nbuf_put_tail(prev_buf, wifi_hdr_len);
+    if (!dest) {
+        goto mpdu_stitch_fail;
+    }
     adf_os_mem_copy(dest, hdr_desc, wifi_hdr_len);
     hdr_desc += wifi_hdr_len;
 
diff --git a/CORE/CLD_TXRX/TLSHIM/tl_shim.c b/CORE/CLD_TXRX/TLSHIM/tl_shim.c
index db270f9de0f3..e147ca75d02b 100644
--- a/CORE/CLD_TXRX/TLSHIM/tl_shim.c
+++ b/CORE/CLD_TXRX/TLSHIM/tl_shim.c
@@ -648,10 +648,18 @@ static void tl_shim_flush_rx_frames(void *vos_ctx,
 	struct tlshim_sta_info *sta_info = &tl_shim->sta_info[sta_id];
 	struct tlshim_buf *cache_buf, *tmp;
 	VOS_STATUS ret;
+	WLANTL_STARxCBType data_rx = NULL;
 
 	if (test_and_set_bit(TLSHIM_FLUSH_CACHE_IN_PROGRESS, &sta_info->flags))
 		return;
 
+	adf_os_spin_lock_bh(&sta_info->stainfo_lock);
+	if (sta_info->registered)
+		data_rx = sta_info->data_rx;
+	else
+		drop = true;
+	adf_os_spin_unlock_bh(&sta_info->stainfo_lock);
+
 	adf_os_spin_lock_bh(&tl_shim->bufq_lock);
 	list_for_each_entry_safe(cache_buf, tmp,
 				 &sta_info->cached_bufq, list) {
@@ -661,8 +669,7 @@ static void tl_shim_flush_rx_frames(void *vos_ctx,
 			adf_nbuf_free(cache_buf->buf);
 		else {
 			/* Flush the cached frames to HDD */
-			ret = sta_info->data_rx(vos_ctx, cache_buf->buf,
-						sta_id);
+			ret = data_rx(vos_ctx, cache_buf->buf, sta_id);
 			if (ret != VOS_STATUS_SUCCESS)
 				adf_nbuf_free(cache_buf->buf);
 		}
@@ -680,13 +687,19 @@ static void tlshim_data_rx_cb(struct txrx_tl_shim_ctx *tl_shim,
 	struct tlshim_sta_info *sta_info;
 	adf_nbuf_t buf, next_buf;
 	VOS_STATUS ret;
+	WLANTL_STARxCBType data_rx = NULL;
 
 	if (unlikely(!vos_ctx))
 		goto free_buf;
 
 	sta_info = &tl_shim->sta_info[staid];
-	if (unlikely(!sta_info->registered))
+	adf_os_spin_lock_bh(&sta_info->stainfo_lock);
+	if (unlikely(!sta_info->registered)) {
+		adf_os_spin_unlock_bh(&sta_info->stainfo_lock);
 		goto free_buf;
+	}
+	data_rx = sta_info->data_rx;
+	adf_os_spin_unlock_bh(&sta_info->stainfo_lock);
 
 	adf_os_spin_lock_bh(&tl_shim->bufq_lock);
 	if (!list_empty(&sta_info->cached_bufq)) {
@@ -700,7 +713,7 @@ static void tlshim_data_rx_cb(struct txrx_tl_shim_ctx *tl_shim,
 	buf = buf_list;
 	while (buf) {
 		next_buf = adf_nbuf_queue_next(buf);
-		ret = sta_info->data_rx(vos_ctx, buf, staid);
+		ret = data_rx(vos_ctx, buf, staid);
 		if (ret != VOS_STATUS_SUCCESS) {
 			TLSHIM_LOGE("Frame Rx to HDD failed");
 			adf_nbuf_free(buf);
@@ -732,6 +745,7 @@ static void tlshim_data_rx_handler(void *context, u_int16_t staid,
 #endif
 	struct tlshim_sta_info *sta_info;
 	adf_nbuf_t buf, next_buf;
+	WLANTL_STARxCBType data_rx = NULL;
 
 	if (staid >= WLAN_MAX_STA_COUNT) {
 		TLSHIM_LOGE("Invalid sta id :%d", staid);
@@ -741,12 +755,17 @@ static void tlshim_data_rx_handler(void *context, u_int16_t staid,
 	tl_shim = (struct txrx_tl_shim_ctx *) context;
 	sta_info = &tl_shim->sta_info[staid];
 
+	adf_os_spin_lock_bh(&sta_info->stainfo_lock);
+	if (sta_info->registered)
+		data_rx = sta_info->data_rx;
+	adf_os_spin_unlock_bh(&sta_info->stainfo_lock);
+
 	/*
 	 * If there is a data frame from peer before the peer is
 	 * registered for data service, enqueue them on to pending queue
 	 * which will be flushed to HDD once that station is registered.
 	 */
-	if (!sta_info->registered) {
+	if (!data_rx) {
 		struct tlshim_buf *cache_buf;
 		buf = rx_buf_list;
 		while (buf) {
@@ -764,7 +783,7 @@ static void tlshim_data_rx_handler(void *context, u_int16_t staid,
 			}
 			buf = next_buf;
 		}
-	} else if (sta_info->data_rx) { /* Send rx packet to HDD if there is no frame pending in cached_bufq */
+	} else { /* Send rx packet to HDD if there is no frame pending in cached_bufq */
 		/* Suspend frames flush from timer */
 		/*
 		 * TODO: Need to see if acquiring/releasing lock even when
@@ -779,7 +798,7 @@ static void tlshim_data_rx_handler(void *context, u_int16_t staid,
 
 		/* Flush the cached frames to HDD before passing new rx frame */
 		tl_shim_flush_rx_frames(vos_ctx, tl_shim, staid, 0);
-		ret = sta_info->data_rx(vos_ctx, rx_buf_list, staid);
+		ret = data_rx(vos_ctx, rx_buf_list, staid);
 		if (ret == VOS_STATUS_E_INVAL) {
 #endif
 
@@ -833,8 +852,7 @@ static void tlshim_data_rx_handler(void *context, u_int16_t staid,
 #ifdef IPA_OFFLOAD
 	}
 #endif
-	} else /* This should not happen if sta_info->registered is true */
-		goto drop_rx_buf;
+	}
 
 	return;
 
@@ -1442,7 +1460,6 @@ VOS_STATUS WLANTL_ClearSTAClient(void *vos_ctx, u_int8_t sta_id)
 		TLSHIM_LOGE("%s: Failed to get TLSHIM context", __func__);
 		return VOS_STATUS_E_FAILURE;
 	}
-	tl_shim->sta_info[sta_id].registered = 0;
 
 #ifdef QCA_CONFIG_SMP
 	{
@@ -1459,7 +1476,10 @@ VOS_STATUS WLANTL_ClearSTAClient(void *vos_ctx, u_int8_t sta_id)
 	tl_shim->sta_info[sta_id].suspend_flush = 0;
 	adf_os_spin_unlock_bh(&tl_shim->bufq_lock);
 
+	adf_os_spin_lock_bh(&tl_shim->sta_info[sta_id].stainfo_lock);
+	tl_shim->sta_info[sta_id].registered = 0;
 	tl_shim->sta_info[sta_id].data_rx = NULL;
+	adf_os_spin_unlock_bh(&tl_shim->sta_info[sta_id].stainfo_lock);
 
 	return VOS_STATUS_SUCCESS;
 }
@@ -1479,6 +1499,7 @@ VOS_STATUS WLANTL_RegisterSTAClient(void *vos_ctx,
 	struct txrx_tl_shim_ctx *tl_shim;
 	struct ol_txrx_peer_t *peer;
 	ol_txrx_peer_update_param_t param;
+	struct tlshim_sta_info *sta_info;
 
 	ENTER();
 	if (sta_desc->ucSTAId >= WLAN_MAX_STA_COUNT) {
@@ -1496,8 +1517,13 @@ VOS_STATUS WLANTL_RegisterSTAClient(void *vos_ctx,
 		TLSHIM_LOGE("tl_shim is NULL");
 		return VOS_STATUS_E_FAULT;
 	}
-	tl_shim->sta_info[sta_desc->ucSTAId].data_rx = rxcb;
-	tl_shim->sta_info[sta_desc->ucSTAId].registered = true;
+
+	sta_info = &tl_shim->sta_info[sta_desc->ucSTAId];
+	adf_os_spin_lock_bh(&sta_info->stainfo_lock);
+	sta_info->data_rx = rxcb;
+	sta_info->registered = true;
+	adf_os_spin_unlock_bh(&sta_info->stainfo_lock);
+
 	param.qos_capable =  sta_desc->ucQosEnabled;
 	wdi_in_peer_update(peer->vdev, peer->mac_addr.raw, &param,
 			   ol_txrx_peer_update_qos_capable);
@@ -1594,6 +1620,7 @@ VOS_STATUS WLANTL_Open(void *vos_ctx, WLANTL_ConfigInfoType *tl_cfg)
 
 	for (i = 0; i < WLAN_MAX_STA_COUNT; i++) {
 		tl_shim->sta_info[i].suspend_flush = 0;
+		adf_os_spinlock_init(&tl_shim->sta_info[i].stainfo_lock);
 		tl_shim->sta_info[i].flags = 0;
 		INIT_LIST_HEAD(&tl_shim->sta_info[i].cached_bufq);
 	}
@@ -1643,6 +1670,11 @@ void *tl_shim_get_vdev_by_addr(void *vos_context, uint8_t *mac_addr)
 	}
 
 	pdev = vos_get_context(VOS_MODULE_ID_TXRX, vos_context);
+	if (!pdev) {
+		TLSHIM_LOGE("PDEV [%pM] not found", mac_addr);
+		return NULL;
+	}
+
 	peer = ol_txrx_find_peer_by_addr(pdev, mac_addr, &peer_id);
 
 	if (!peer) {
@@ -1667,6 +1699,10 @@ void *tl_shim_get_vdev_by_sta_id(void *vos_context, uint8_t sta_id)
 	}
 
 	pdev = vos_get_context(VOS_MODULE_ID_TXRX, vos_context);
+	if (!pdev) {
+                TLSHIM_LOGE("PDEV not found for sta_id [%d]", sta_id);
+		return NULL;
+	}
 
 	peer = ol_txrx_peer_find_by_local_id(pdev, sta_id);
 
diff --git a/CORE/CLD_TXRX/TLSHIM/tl_shim.h b/CORE/CLD_TXRX/TLSHIM/tl_shim.h
index 31084662b82b..4029179e7743 100644
--- a/CORE/CLD_TXRX/TLSHIM/tl_shim.h
+++ b/CORE/CLD_TXRX/TLSHIM/tl_shim.h
@@ -51,6 +51,8 @@ struct tlshim_sta_info {
 	bool registered;
 	bool suspend_flush;
 	WLANTL_STARxCBType data_rx;
+	/* To protect stainfo data like registered and data_rx */
+	adf_os_spinlock_t stainfo_lock;
 	struct list_head cached_bufq;
 	unsigned long flags;
 };
diff --git a/CORE/CLD_TXRX/TXRX/ol_tx.c b/CORE/CLD_TXRX/TXRX/ol_tx.c
index 2dc7dc6a4fe4..633287f74e40 100644
--- a/CORE/CLD_TXRX/TXRX/ol_tx.c
+++ b/CORE/CLD_TXRX/TXRX/ol_tx.c
@@ -145,23 +145,25 @@ ol_tx_vdev_ll_pause_queue_send_base(struct ol_txrx_vdev_t *vdev)
         max_to_accept--;
         vdev->ll_pause.txq.depth--;
         tx_msdu = vdev->ll_pause.txq.head;
-        vdev->ll_pause.txq.head = adf_nbuf_next(tx_msdu);
-        if (NULL == vdev->ll_pause.txq.head) {
-            vdev->ll_pause.txq.tail = NULL;
-        }
-        adf_nbuf_set_next(tx_msdu, NULL);
-        tx_msdu = ol_tx_ll(vdev, tx_msdu);
-        /*
-         * It is unexpected that ol_tx_ll would reject the frame,
-         * since we checked that there's room for it, though there's
-         * an infinitesimal possibility that between the time we checked
-         * the room available and now, a concurrent batch of tx frames
-         * used up all the room.
-         * For simplicity, just drop the frame.
-         */
         if (tx_msdu) {
-            adf_nbuf_unmap(vdev->pdev->osdev, tx_msdu, ADF_OS_DMA_TO_DEVICE);
-            adf_nbuf_tx_free(tx_msdu, 1 /* error */);
+            vdev->ll_pause.txq.head = adf_nbuf_next(tx_msdu);
+            if (NULL == vdev->ll_pause.txq.head) {
+                vdev->ll_pause.txq.tail = NULL;
+            }
+            adf_nbuf_set_next(tx_msdu, NULL);
+            tx_msdu = ol_tx_ll(vdev, tx_msdu);
+            /*
+             * It is unexpected that ol_tx_ll would reject the frame,
+             * since we checked that there's room for it, though there's
+             * an infinitesimal possibility that between the time we checked
+             * the room available and now, a concurrent batch of tx frames
+             * used up all the room.
+             * For simplicity, just drop the frame.
+             */
+            if (tx_msdu) {
+                adf_nbuf_unmap(vdev->pdev->osdev, tx_msdu, ADF_OS_DMA_TO_DEVICE);
+                adf_nbuf_tx_free(tx_msdu, 1 /* error */);
+            }
         }
     }
     if (vdev->ll_pause.txq.depth) {
diff --git a/CORE/CLD_TXRX/TXRX/ol_txrx.c b/CORE/CLD_TXRX/TXRX/ol_txrx.c
index d0b3b2f63a69..23f9cb21e76a 100644
--- a/CORE/CLD_TXRX/TXRX/ol_txrx.c
+++ b/CORE/CLD_TXRX/TXRX/ol_txrx.c
@@ -211,7 +211,8 @@ OL_TXRX_LOCAL_PEER_ID_FREE(
     struct ol_txrx_peer_t *peer)
 {
     int i = peer->local_id;
-    if (i == OL_TXRX_INVALID_LOCAL_PEER_ID) {
+    if ((i == OL_TXRX_INVALID_LOCAL_PEER_ID) ||
+        (i >= OL_TXRX_NUM_LOCAL_PEER_IDS)) {
         return;
     }
     /* put this ID on the head of the freelist */
@@ -1288,7 +1289,7 @@ ol_txrx_peer_uapsdmask_get(struct ol_txrx_pdev_t *txrx_pdev, u_int16_t peer_id)
 
     struct ol_txrx_peer_t *peer;
     peer = ol_txrx_peer_find_by_id(txrx_pdev, peer_id);
-    if (!peer) {
+    if (peer) {
         return peer->uapsd_mask;
     }
 
diff --git a/CORE/HDD/src/wlan_hdd_cfg80211.c b/CORE/HDD/src/wlan_hdd_cfg80211.c
index c7e0be0adbf2..8dc474d77365 100644
--- a/CORE/HDD/src/wlan_hdd_cfg80211.c
+++ b/CORE/HDD/src/wlan_hdd_cfg80211.c
@@ -6914,9 +6914,16 @@ static int wlan_hdd_cfg80211_join_ibss( struct wiphy *wiphy,
         alloc_bssid = VOS_TRUE;
     }
 
-    pRoamProfile->beaconInterval = 100;
-    if ((params->beacon_interval >= 1) && (params->beacon_interval <= 1000))
+    if ((params->beacon_interval > CFG_BEACON_INTERVAL_MIN)
+        && (params->beacon_interval <= CFG_BEACON_INTERVAL_MAX))
         pRoamProfile->beaconInterval = params->beacon_interval;
+    else {
+        pRoamProfile->beaconInterval = CFG_BEACON_INTERVAL_DEFAULT;
+        hddLog(VOS_TRACE_LEVEL_INFO_HIGH,
+                "%s: input beacon interval %d TU is invalid, use default %d TU",
+                __func__, params->beacon_interval,
+                pRoamProfile->beaconInterval);
+    }
 
     /* Set Channel */
     if (NULL !=
@@ -7552,10 +7559,9 @@ static int wlan_hdd_cfg80211_get_station(struct wiphy *wiphy, struct net_device
             maxRate = (currentRate > maxRate)?currentRate:maxRate;
         }
         /* Get MCS Rate Set --
-           only if we are connected at MCS rates (or)
-           if we are always reporting max speed  (or)
+           Only if we are always reporting max speed  (or)
            if we have good rssi */
-         if (((0 == rssidx) && !(rate_flags & eHAL_TX_RATE_LEGACY)) ||
+         if ((0 == rssidx) ||
               (eHDD_LINK_SPEED_REPORT_MAX == pCfg->reportMaxLinkSpeed))
         {
             if (0 != ccmCfgGetStr(WLAN_HDD_GET_HAL_CTX(pAdapter), WNI_CFG_CURRENT_MCS_SET,
diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c
index 70e3c6fe7150..93a2fa6aa639 100644
--- a/CORE/HDD/src/wlan_hdd_main.c
+++ b/CORE/HDD/src/wlan_hdd_main.c
@@ -6346,10 +6346,6 @@ void hdd_set_station_ops( struct net_device *pWlanDev )
       pWlanDev->do_ioctl = hdd_ioctl;
       pWlanDev->set_mac_address = hdd_set_mac_address;
 #endif
-
-#ifdef QCA_WIFI_2_0
-      pWlanDev->tx_queue_len = 0;
-#endif
 }
 
 static hdd_adapter_t* hdd_alloc_station_adapter( hdd_context_t *pHddCtx, tSirMacAddr macAddr, const char* name )
@@ -7647,9 +7643,6 @@ VOS_STATUS hdd_start_all_adapters( hdd_context_t *pHddCtx )
             pAdapter->scan_info.mScanPending = FALSE;
             pAdapter->scan_info.waitScanResult = FALSE;
 
-            //Trigger the initial scan
-            hdd_wlan_initial_scan(pAdapter);
-
             //Indicate disconnect event to supplicant if associated previously
             if (eConnectionState_Associated == connState ||
                 eConnectionState_IbssConnected == connState )
diff --git a/CORE/HDD/src/wlan_hdd_softap_tx_rx.c b/CORE/HDD/src/wlan_hdd_softap_tx_rx.c
index 880ddb17152c..0579575d32dc 100644
--- a/CORE/HDD/src/wlan_hdd_softap_tx_rx.c
+++ b/CORE/HDD/src/wlan_hdd_softap_tx_rx.c
@@ -1642,7 +1642,6 @@ VOS_STATUS hdd_softap_rx_packet_cbk(v_VOID_t *vosContext,
    pAdapter = pHddCtx->sta_to_adapter[staId];
    if( NULL == pAdapter )
    {
-      VOS_ASSERT(0);
       return VOS_STATUS_E_FAILURE;
    }
 
diff --git a/CORE/HDD/src/wlan_hdd_tx_rx.c b/CORE/HDD/src/wlan_hdd_tx_rx.c
index cf6b2e84521f..d2ae468b6221 100644
--- a/CORE/HDD/src/wlan_hdd_tx_rx.c
+++ b/CORE/HDD/src/wlan_hdd_tx_rx.c
@@ -2002,7 +2002,6 @@ VOS_STATUS hdd_rx_packet_cbk(v_VOID_t *vosContext,
    pAdapter = pHddCtx->sta_to_adapter[staId];
    if( NULL == pAdapter )
    {
-      VOS_ASSERT(0);
       return VOS_STATUS_E_FAILURE;
    }
    ++pAdapter->hdd_stats.hddTxRxStats.rxChains;
diff --git a/CORE/MAC/inc/aniGlobal.h b/CORE/MAC/inc/aniGlobal.h
index 0af94b46f174..ed7d984b0d1a 100644
--- a/CORE/MAC/inc/aniGlobal.h
+++ b/CORE/MAC/inc/aniGlobal.h
@@ -657,7 +657,7 @@ typedef struct sAniSirLim
 
     // admission control policy information
     tLimAdmitPolicyInfo admitPolicyInfo;
-    vos_lock_t lkPeGlobalLock;
+    vos_spin_lock_t lkPeGlobalLock;
     tANI_U8 disableLDPCWithTxbfAP;
 #ifdef FEATURE_WLAN_TDLS
     tANI_U8 gLimTDLSBufStaEnabled;
diff --git a/CORE/MAC/inc/qwlan_version.h b/CORE/MAC/inc/qwlan_version.h
index f73adec99d6e..dc0982edab08 100644
--- a/CORE/MAC/inc/qwlan_version.h
+++ b/CORE/MAC/inc/qwlan_version.h
@@ -42,9 +42,9 @@ BRIEF DESCRIPTION:
 #define QWLAN_VERSION_MINOR            0
 #define QWLAN_VERSION_PATCH            0
 #define QWLAN_VERSION_EXTRA            ""
-#define QWLAN_VERSION_BUILD            56
+#define QWLAN_VERSION_BUILD            57
 
-#define QWLAN_VERSIONSTR               "1.0.0.56"
+#define QWLAN_VERSIONSTR               "1.0.0.57"
 
 #ifdef QCA_WIFI_2_0
 
diff --git a/CORE/MAC/src/pe/lim/limApi.c b/CORE/MAC/src/pe/lim/limApi.c
index 72373be89df6..850f84c9aa7b 100644
--- a/CORE/MAC/src/pe/lim/limApi.c
+++ b/CORE/MAC/src/pe/lim/limApi.c
@@ -1027,7 +1027,7 @@ tSirRetStatus peOpen(tpAniSirGlobal pMac, tMacOpenParameters *pMacOpenParam)
     pMac->lim.mgmtFrameSessionId = 0xff;
     pMac->lim.deferredMsgCnt = 0;
 
-    if( !VOS_IS_STATUS_SUCCESS( vos_lock_init( &pMac->lim.lkPeGlobalLock ) ) )
+    if( !VOS_IS_STATUS_SUCCESS( vos_spin_lock_init( &pMac->lim.lkPeGlobalLock ) ) )
     {
         PELOGE(limLog(pMac, LOGE, FL("pe lock init failed!"));)
         return eSIR_FAILURE;
@@ -1081,7 +1081,7 @@ tSirRetStatus peClose(tpAniSirGlobal pMac)
     */
     vos_mem_free(pMac->pmm.gPmmTim.pTim);
     pMac->pmm.gPmmTim.pTim = NULL;
-    if( !VOS_IS_STATUS_SUCCESS( vos_lock_destroy( &pMac->lim.lkPeGlobalLock ) ) )
+    if( !VOS_IS_STATUS_SUCCESS( vos_spin_lock_destroy( &pMac->lim.lkPeGlobalLock ) ) )
     {
         return eSIR_FAILURE;
     }
@@ -2384,7 +2384,7 @@ eHalStatus pe_AcquireGlobalLock( tAniSirLim *psPe)
 
     if(psPe)
     {
-        if( VOS_IS_STATUS_SUCCESS( vos_lock_acquire( &psPe->lkPeGlobalLock) ) )
+        if( VOS_IS_STATUS_SUCCESS( vos_spin_lock_acquire( &psPe->lkPeGlobalLock) ) )
         {
             status = eHAL_STATUS_SUCCESS;
         }
@@ -2396,7 +2396,7 @@ eHalStatus pe_ReleaseGlobalLock( tAniSirLim *psPe)
     eHalStatus status = eHAL_STATUS_INVALID_PARAMETER;
     if(psPe)
     {
-        if( VOS_IS_STATUS_SUCCESS( vos_lock_release( &psPe->lkPeGlobalLock) ) )
+        if( VOS_IS_STATUS_SUCCESS( vos_spin_lock_release( &psPe->lkPeGlobalLock) ) )
         {
             status = eHAL_STATUS_SUCCESS;
         }
diff --git a/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c b/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
index da534a0ac1d1..fead607d7b60 100644
--- a/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
+++ b/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
@@ -772,7 +772,11 @@ limProcessAssocReqFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,
     if (pStaDs == NULL)
     {
         /// Requesting STA is not currently associated
+#ifdef QCA_WIFI_2_0
+        if (peGetCurrentSTAsCount(pMac) == pMac->lim.gLimAssocStaLimit)
+#else
         if (peGetCurrentSTAsCount(pMac) == pMac->lim.maxStation)
+#endif
         {
             /**
              * Maximum number of STAs that AP can handle reached.
diff --git a/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c b/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c
index 696c81796679..5145839dbd31 100644
--- a/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c
+++ b/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c
@@ -61,6 +61,10 @@
 #include "wlan_qct_wda.h"
 #include "vos_utils.h"
 
+#ifdef QCA_WIFI_2_0
+#define MAX_SUPPORTED_PEERS_WEP 16
+#endif
+
 static void limHandleSmeJoinResult(tpAniSirGlobal, tSirResultCodes, tANI_U16,tpPESession);
 static void limHandleSmeReaasocResult(tpAniSirGlobal, tSirResultCodes, tANI_U16, tpPESession);
 void limProcessMlmScanCnf(tpAniSirGlobal, tANI_U32 *);
@@ -2413,6 +2417,9 @@ limProcessApMlmAddBssRsp( tpAniSirGlobal pMac, tpSirMsgQ limMsgQ)
     tANI_U32 val;
     tpPESession psessionEntry;
 //    tANI_U8     sessionId;
+#ifdef QCA_WIFI_2_0
+    tANI_U8 isWepEnabled = FALSE;
+#endif
     tpAddBssParams pAddBssParams = (tpAddBssParams) limMsgQ->bodyptr;
     if(NULL == pAddBssParams )
     {
@@ -2464,6 +2471,25 @@ limProcessApMlmAddBssRsp( tpAniSirGlobal pMac, tpSirMsgQ limMsgQ)
             psessionEntry->limSystemRole = eLIM_STA_IN_IBSS_ROLE;
         schEdcaProfileUpdate(pMac, psessionEntry);
         limInitPreAuthList(pMac);
+#ifdef QCA_WIFI_2_0
+        /* Check the SAP security configuration.If configured to
+         * WEP then max clients supported is 16
+         */
+        if (psessionEntry->privacy)
+        {
+            if ((psessionEntry->gStartBssRSNIe.present) || (psessionEntry->gStartBssWPAIe.present))
+                limLog(pMac, LOGP, FL("WPA/WPA2 SAP configuration\n"));
+            else
+            {
+                if (pMac->lim.gLimAssocStaLimit > MAX_SUPPORTED_PEERS_WEP)
+                {
+                    limLog(pMac, LOGP, FL("WEP SAP Configuration\n"));
+                    pMac->lim.gLimAssocStaLimit = MAX_SUPPORTED_PEERS_WEP;
+                    isWepEnabled = TRUE;
+                }
+            }
+        }
+#endif
         limInitPeerIdxpool(pMac,psessionEntry);
         // Create timers used by LIM
         if (!pMac->lim.gLimTimersCreated)
@@ -2481,6 +2507,14 @@ limProcessApMlmAddBssRsp( tpAniSirGlobal pMac, tpSirMsgQ limMsgQ)
         pMac->lim.gLimTriggerBackgroundScanDuringQuietBss = (val) ? 1 : 0;
         // Apply previously set configuration at HW
         limApplyConfiguration(pMac,psessionEntry);
+
+#ifdef QCA_WIFI_2_0
+        /* In limApplyConfiguration gLimAssocStaLimit is assigned from cfg.
+         * So update the value to 16 in case SoftAP is configured in WEP.
+         */
+        if ((pMac->lim.gLimAssocStaLimit > MAX_SUPPORTED_PEERS_WEP) && (isWepEnabled))
+            pMac->lim.gLimAssocStaLimit = MAX_SUPPORTED_PEERS_WEP;
+#endif
         psessionEntry->staId = pAddBssParams->staContext.staIdx;
         mlmStartCnf.resultCode  = eSIR_SME_SUCCESS;
     }
diff --git a/CORE/SERVICES/BMI/ol_fw.c b/CORE/SERVICES/BMI/ol_fw.c
index ae87573ec489..bee6c5fda2f2 100644
--- a/CORE/SERVICES/BMI/ol_fw.c
+++ b/CORE/SERVICES/BMI/ol_fw.c
@@ -646,7 +646,7 @@ int ol_copy_ramdump(struct ol_softc *scn)
 		goto out;
 	}
 
-	ret = ol_target_coredump(scn, ramdump_base, TOTAL_DUMP_SIZE);
+	ret = ol_target_coredump(scn, ramdump_base, size);
 	iounmap(ramdump_base);
 
 out:
@@ -1167,7 +1167,8 @@ static int ol_ath_get_reg_table(A_UINT32 target_version,
 	return section_len;
 }
 
-static int ol_diag_read_reg_loc(struct ol_softc *scn, u_int8_t *buffer)
+static int ol_diag_read_reg_loc(struct ol_softc *scn, u_int8_t *buffer,
+		u_int32_t buffer_len)
 {
 	int i, len, section_len, fill_len;
 	int dump_len, result = 0;
@@ -1183,9 +1184,18 @@ static int ol_diag_read_reg_loc(struct ol_softc *scn, u_int8_t *buffer)
 	}
 
 	curr_sec = reg_table.section;
-	for (i=0; i<reg_table.section_size; i++) {
+	for (i = 0; i < reg_table.section_size; i++) {
 
 		dump_len = curr_sec->end_addr - curr_sec->start_addr;
+
+		if ((buffer_len - result) < dump_len) {
+			printk("Not enough memory to dump the registers:"
+					" %d: 0x%08x-0x%08x\n", i,
+					curr_sec->start_addr,
+					curr_sec->end_addr);
+			goto out;
+		}
+
 		len = ol_diag_read(scn, buffer, curr_sec->start_addr, dump_len);
 
 		if (len != -EIO) {
@@ -1202,6 +1212,14 @@ static int ol_diag_read_reg_loc(struct ol_softc *scn, u_int8_t *buffer)
 			next_sec = (tgt_reg_section *)((u_int8_t *)curr_sec
 							+ sizeof(*curr_sec));
 			fill_len = next_sec->start_addr - curr_sec->end_addr;
+			if ((buffer_len - result) < fill_len) {
+				printk("Not enough memory to fill registers:"
+						" %d: 0x%08x-0x%08x\n", i,
+						curr_sec->end_addr,
+						next_sec->start_addr);
+				goto out;
+			}
+
 			if (fill_len) {
 				adf_os_mem_set(buffer,
 					       INVALID_REG_LOC_DUMMY_DATA,
@@ -1272,6 +1290,8 @@ int ol_target_coredump(void *inst, void *memoryBlock, u_int32_t blockLength)
 		case 2:
 			/* REG SECTION */
 			pos = REGISTER_LOCATION;
+			/*  ol_diag_read_reg_loc checks for buffer overrun */
+			readLen = 0;
 			break;
 		case 3:
 			/* AXI SECTION */
@@ -1282,7 +1302,8 @@ int ol_target_coredump(void *inst, void *memoryBlock, u_int32_t blockLength)
 
 		if ((blockLength - amountRead) >= readLen) {
 			if (pos == REGISTER_LOCATION)
-				result = ol_diag_read_reg_loc(scn, bufferLoc);
+				result = ol_diag_read_reg_loc(scn, bufferLoc,
+						blockLength - amountRead);
 			else
 				result = ol_diag_read(scn, bufferLoc,
 						      pos, readLen);
diff --git a/CORE/SERVICES/COMMON/wlan_tgt_def_config.h b/CORE/SERVICES/COMMON/wlan_tgt_def_config.h
index 0eeec932ef7f..b7cdd922b75d 100644
--- a/CORE/SERVICES/COMMON/wlan_tgt_def_config.h
+++ b/CORE/SERVICES/COMMON/wlan_tgt_def_config.h
@@ -101,7 +101,7 @@
 /*
  * keys per peer node
  */
-#define CFG_TGT_NUM_PEER_KEYS           3
+#define CFG_TGT_NUM_PEER_KEYS           2
 /*
  * total number of data TX and RX TIDs
  */
diff --git a/CORE/SERVICES/HIF/PCIe/if_pci.c b/CORE/SERVICES/HIF/PCIe/if_pci.c
index 2fca84aa8ae2..9f11d8d3c074 100644
--- a/CORE/SERVICES/HIF/PCIe/if_pci.c
+++ b/CORE/SERVICES/HIF/PCIe/if_pci.c
@@ -525,6 +525,9 @@ wlan_tasklet(unsigned long data)
     }
 
     (irqreturn_t)HIF_fw_interrupt_handler(sc->irq_event, sc);
+    if (sc->ol_sc->target_status == OL_TRGET_STATUS_RESET)
+        goto irq_handled;
+
     CE_per_engine_service_any(sc->irq_event, sc);
     adf_os_atomic_set(&sc->tasklet_from_intr, 0);
     if (CE_get_rx_pending(sc)) {
@@ -537,7 +540,8 @@ wlan_tasklet(unsigned long data)
         return;
     }
 irq_handled:
-    if (LEGACY_INTERRUPTS(sc)) {
+    if (LEGACY_INTERRUPTS(sc) && (sc->ol_sc->target_status !=
+                                  OL_TRGET_STATUS_RESET)) {
 
         if (sc->hif_init_done == TRUE)
             A_TARGET_ACCESS_BEGIN(hif_state->targid);
diff --git a/CORE/SERVICES/HTC/htc_send.c b/CORE/SERVICES/HTC/htc_send.c
index 5ba4967d470c..576ea5bd1676 100644
--- a/CORE/SERVICES/HTC/htc_send.c
+++ b/CORE/SERVICES/HTC/htc_send.c
@@ -64,8 +64,8 @@ void HTC_dump_counter_info(HTC_HANDLE HTCHandle)
     HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
 
     AR_DEBUG_PRINTF(ATH_DEBUG_ERR,
-                    ("%s: CE_send_cnt = %d, TX_comp_cnt = %d",
-		     __func__, target->CE_send_cnt, target->TX_comp_cnt));
+                    ("\n%s: CE_send_cnt = %d, TX_comp_cnt = %d\n",
+                     __func__, target->CE_send_cnt, target->TX_comp_cnt));
 }
 
 void HTCGetControlEndpointTxHostCredits(HTC_HANDLE HTCHandle, int *credits)
diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c
index e22fcfd03376..6ae193a1bc4c 100644
--- a/CORE/SERVICES/WMA/wma.c
+++ b/CORE/SERVICES/WMA/wma.c
@@ -699,14 +699,6 @@ static v_VOID_t wma_set_default_tgt_config(tp_wma_handle wma_handle)
 	tgt_cfg.num_peers = no_of_peers_supported + CFG_TGT_NUM_VDEV + 2;
 	tgt_cfg.num_tids = (2 * (no_of_peers_supported + CFG_TGT_NUM_VDEV + 2));
 
-        /* Set the num of Keys per peer to 3 and 4 for Rome 1.1 and
-         * Rome 1.3 respectively
-         */
-        if (scn->target_version == AR6320_REV1_1_VERSION)
-            tgt_cfg.num_peer_keys = CFG_TGT_NUM_PEER_KEYS;
-        else
-            tgt_cfg.num_peer_keys = CFG_TGT_NUM_PEER_KEYS + 1;
-
 	WMITLV_SET_HDR(&tgt_cfg.tlv_header,WMITLV_TAG_STRUC_wmi_resource_config,
 		       WMITLV_GET_STRUCT_TLVLEN(wmi_resource_config));
 	/* reduce the peer/vdev if CFG_TGT_NUM_MSDU_DESC exceeds 1000 */
@@ -4010,7 +4002,10 @@ VOS_STATUS wma_get_buf_start_scan_cmd(tp_wma_handle wma_handle,
 		       WMITLV_TAG_ARRAY_UINT32,
 		       (cmd->num_chan * sizeof(u_int32_t)));
 	buf_ptr += WMI_TLV_HDR_SIZE + (cmd->num_chan * sizeof(u_int32_t));
-
+	if (scan_req->numSsid > SIR_SCAN_MAX_NUM_SSID) {
+		WMA_LOGE("Invalid value for numSsid");
+		goto error;
+	}
 	cmd->num_ssids = scan_req->numSsid;
 	WMITLV_SET_HDR(buf_ptr, WMITLV_TAG_ARRAY_FIXED_STRUC,
 		       (cmd->num_ssids * sizeof(wmi_ssid)));
@@ -4985,7 +4980,10 @@ VOS_STATUS wma_roam_scan_offload_init_connect(tp_wma_handle wma_handle)
                 wma_handle->vos_context);
     wmi_start_scan_cmd_fixed_param scan_params;
     wmi_ap_profile ap_profile;
-
+    if (NULL == pMac) {
+            WMA_LOGE("%s: Failed to get pMac", __func__);
+            return VOS_STATUS_E_FAILURE;
+    }
     /* first program the parameters to conservative values so that roaming scan won't be
      * triggered before association completes
      */
diff --git a/CORE/SERVICES/WMI/wmi_unified.c b/CORE/SERVICES/WMI/wmi_unified.c
index 81ee695c394c..5691b9f6d630 100644
--- a/CORE/SERVICES/WMI/wmi_unified.c
+++ b/CORE/SERVICES/WMI/wmi_unified.c
@@ -52,6 +52,7 @@
 #define WMI_SLEEP_TO_FLUSH_HTC_QUEUE 40
 
 static void __wmi_control_rx(struct wmi_unified *wmi_handle, wmi_buf_t evt_buf);
+int wmi_get_host_credits(wmi_unified_t wmi_handle);
 /* WMI buffer APIs */
 
 wmi_buf_t
@@ -529,6 +530,8 @@ int wmi_unified_cmd_send(wmi_unified_t wmi_handle, wmi_buf_t buf, int len,
 	if (adf_os_atomic_read(&wmi_handle->pending_cmds) >= WMI_MAX_CMDS) {
 		vos_context = vos_get_global_context(VOS_MODULE_ID_WDA, NULL);
 		scn = vos_get_context(VOS_MODULE_ID_HIF, vos_context);
+		pr_err("\n%s: hostcredits = %d\n", __func__,
+		       wmi_get_host_credits(wmi_handle));
 		HTC_dump_counter_info(wmi_handle->htc_handle);
 		//dump_CE_register(scn);
 		//dump_CE_debug_register(scn->hif_sc);
diff --git a/CORE/VOSS/src/vos_memory.c b/CORE/VOSS/src/vos_memory.c
index 56be95be94e0..8c183a1dd18b 100644
--- a/CORE/VOSS/src/vos_memory.c
+++ b/CORE/VOSS/src/vos_memory.c
@@ -190,7 +190,7 @@ v_VOID_t * vos_mem_malloc_debug( v_SIZE_t size, char* fileName, v_U32_t lineNum)
        return NULL;
    }
 
-   if (in_interrupt())
+   if (in_interrupt() || in_atomic())
    {
        flags = GFP_ATOMIC;
    }
@@ -273,7 +273,7 @@ v_VOID_t * vos_mem_malloc( v_SIZE_t size )
        VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR, "%s: called with arg > 1024K; passed in %d !!!", __func__,size);
        return NULL;
    }
-   if (in_interrupt() || irqs_disabled())
+   if (in_interrupt() || irqs_disabled() || in_atomic())
    {
       flags = GFP_ATOMIC;
    }
diff --git a/CORE/VOSS/src/vos_nvitem.c b/CORE/VOSS/src/vos_nvitem.c
index fe0be3c31d70..04c6f189b4a0 100644
--- a/CORE/VOSS/src/vos_nvitem.c
+++ b/CORE/VOSS/src/vos_nvitem.c
@@ -3253,18 +3253,6 @@ static int create_linux_regulatory_entry(struct wiphy *wiphy,
                 pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].channels[k].enabled =
                     NV_CHANNEL_DFS;
 
-                /* This is a temporary change for getting the SAP functional on DFS channels
-                 * If the driver is using linux regulatory domain, the hostapd + cfg8211
-                 * reserve the right to allow whether the BSS can be started or not depending
-                 * on the current country, whether the radar is present on the channel and/or
-                 * also the DFS state of the current channel. This is done if the driver supplies
-                 * PASSIVE and DFS flags for DFS channels
-                 * Currently we will not advertise these capabilities until the fix is cleanly
-                 * done the hostapd and cfg80211
-                 */
-                wiphy->bands[i]->channels[j].flags &= ~(IEEE80211_CHAN_RADAR);
-                wiphy->bands[i]->channels[j].flags &= ~(IEEE80211_CHAN_PASSIVE_SCAN);
-
                 /* max_power is in mBm = 100 * dBm */
                 pnvEFSTable->halnv.tables.regDomains[temp_reg_domain].channels[k].pwrLimit =
                     (tANI_S8) ((wiphy->bands[i]->channels[j].max_power));
diff --git a/CORE/VOSS/src/vos_power.c b/CORE/VOSS/src/vos_power.c
index f1e13e6d9a09..7c05c6e0d426 100644
--- a/CORE/VOSS/src/vos_power.c
+++ b/CORE/VOSS/src/vos_power.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2014 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -58,14 +58,6 @@ when       who     what, where, why
 
 ===========================================================================*/
 #include <vos_power.h>
-
-#ifdef MSM_PLATFORM
-#include <mach/mpp.h>
-#include <mach/vreg.h>
-#include <linux/err.h>
-#include <linux/delay.h>
-#endif //MSM_PLATFORM
-
 #include <vos_sched.h>
 
 //To work around issues of fail to turn WIFI back on after turning it off