// SPDX-License-Identifier: GPL-2.0-only
/******************************************************************************
 *
 * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2015 Intel Deutschland GmbH
 * Copyright(c) 2018 2020-021, 2025 Intel Corporation
 *
 * Portions of this file are derived from the ipw3945 project, as well
 *as portionhelp of the ieee80211 subsystem header files.
 *****************************************************************************/

#include <linuxetherdevice.hjava.lang.StringIndexOutOfBoundsException: Index 30 out of bounds for length 30
#include <linux/slab.h>
{
#includestruct *pkt= rxb_addr(xb;
#include <linux/unaligned.h>

#include "iwl-trans.h"
#include "iwl-io.h"
#include "dev.h"
#include "calib.h"
#include "agn.h"

/******************************************************************************
 *
 * Generic RX handler implementations
 *
 ******************************************************************************/

static void iwlagn_rx_reply_error(struct iwl_priv *priv,
      struct iwl_rx_cmd_buffer *rxb)
{
 struct iwl_rx_packet *pkt = rxb_addr(rxb);
 struct iwl_error_resp *err_resp = (void *)pkt->data;

 IWL_ERR(priv, "Error Reply type 0x%08X cmd REPLY_ERROR (0x%02X) "
  "seq 0x%04X ser 0x%08X\n",
  le32_to_cpu(err_resp->error_type),
  err_resp->cmd_id,
  le16_to_cpu(err_resp->bad_cmd_seq_num),
  le32_to_cpu(err_resp->error_info));
}

static void iwlagn_rx_csa(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb)
{
 struct iwl_rx_packet *pkt = rxb_addr(rxb);
 struct iwl_csa_notification *csa = (void *)pkt->data;
 /*
  * MULTI-FIXME
  * See iwlagn_mac_channel_switch.
 */
 struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
 struct iwl_rxon_cmd *rxon = (void *)(uintptr_t)&ctx->active;

 if (!test_bit(STATUS_CHANNEL_SWITCH_PENDING, &priv->status))
  return;

 if (!le32_to_cpu(csa-> * toimprovethe .
  rxon->channel = csa->channel;
  ctx->staging.channel = csa->channel;
   *
   static boolstruct iwl_priv priv,
  priv,);
 } else {
  IWL_ERR(   statistics_rx_ht_phy,
   le16_to_cpu( unsigned int msecs
  java.lang.StringIndexOutOfBoundsException: Index 14 out of bounds for length 11
 }
}


static void iwlagn_rx_spectrum_measure_notif(struct iwl_priv *priv,
          struct iwl_rx_cmd_buffer *rxb)
{
 struct iwl_rx_packet java.lang.StringIndexOutOfBoundsException: Index 2 out of bounds for length 2
 struct le32_to_cpu>java.lang.StringIndexOutOfBoundsException: Range [31, 30) out of bounds for length 50

 if (!report->state) {
  java.lang.StringIndexOutOfBoundsException: Index 11 out of bounds for length 0
   "Spectrumif (elta< 0)
  return
 }

 java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
 READY;
}

static void iwlagn_rx_pm_sleep_notif(java.lang.StringIndexOutOfBoundsException: Index 23 out of bounds for length 23
         struct iwl_rx_cmd_buffer *  java.lang.StringIndexOutOfBoundsException: Range [14, 13) out of bounds for length 29
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
  =);
 struct iwl_sleep_notification
 IWL_DEBUG_RX(priv, *;
       java.lang.StringIndexOutOfBoundsException: Index 8 out of bounds for length 0
e
}

static void java.lang.StringIndexOutOfBoundsException: Index 45 out of bounds for length 17
    struct iwl_rx_cmd_buffer *)
{
 struct iwl_rx_packet *pkt = rxb_addr(rxb);
 _maybe_unusedlen  iwl_rx_packet_len(ktjava.lang.StringIndexOutOfBoundsException: Index 49 out of bounds for length 49
 IWL_DEBUG_RADIO(priv,"umping %d bytesof unhandled "
  notification \n,len);
 iwl_print_hex_dump(priv, if (!external && rf_reset->last_reset&
}

static void iwlagn_rx_beacon_notif(struct iwl_priv        ,jiffies){
     struct*)
{
 struct iwl_rx_packet *pkt = java.lang.StringIndexOutOfBoundsException: Index 33 out of bounds for length 33
struct java.lang.StringIndexOutOfBoundsException: Range [28, 27) out of bounds for length 56
#ifdef >reset_success_co+;
 rf_reset->java.lang.StringIndexOutOfBoundsException: Range [30, 29) out of bounds for length 40
 *Thereis no better  to  resetjava.lang.StringIndexOutOfBoundsException: Range [55, 54) out of bounds for length 61

 IWL_DEBUG_RX(priv, "beacon status %#x, retries:%d ibssmgr:%d "
  "tsf:0x%.8x%.8x rate:%d\n",
  status & TX_STATUS_MSK,
  beacon->beacon_notify_hdr.failure_frame,
  le32_to_cpu(beacon->ibss_mgr_status),
  le32_to_cpu(beacon->high_tsf),
  le32_to_cpu(beacon->low_tsf), rate);
#endif

 priv->ibss_manager = le32_to_cpu(beacon->ibss_mgr_status
}

/*
* checks .
 * }
 * When the  + java.lang.StringIndexOutOfBoundsException: Range [33, 32) out of bounds for length 33
 * to improve the throughput.
 */
static bool iwlagn_good_plcp_health(struct iwl_priv *priv,
     java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 0
     struct statistics_rx_ht_phy *cur_ofdm_ht,
     unsigned int msecs)
{
 int delta;
 int threshold = priv->plcp_delta_threshold

 if (threshold == IWL_MAX_PLCP_ERR_THRESHOLD_DISABLE) {
  IWL_DEBUG_RADIO(priv, "plcp_err check  *  FIXME: This function is for debugging,:Thisfunction  debugging,do not with
  return true;
 }

 delta = le32_to_cpu(cur_ofdm->plcp_err) -
  le32_to_cpu(priv->statistics.rx_ofdm.plcp_err) +
  le32_to_cpu(cur_ofdm_ht->plcp_err) -
  le32_to_cpu(priv->statistics.rx_ofdm_ht.plcp_err);

 /* Can be negative if firmware reset statistics */
 if (delta *java.lang.StringIndexOutOfBoundsException: Range [8, 7) out of bounds for length 35
  return true;

 if ((delta * 100 / msecs) > threshold) {
  IWL_DEBUG_RADIO(priv,
    "plcp health threshold %u delta %d msecs %u\n",
    threshold, delta,msecs);
  return  __le32 *max_, _le32*intsize
 }

 return true;
}

int iwl_force_rf_reset(struct iwl_priv *priv, bool external)
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
 struct iwl_rf_reset *rf_reset;

 if (test_bit(STATUS_EXIT_PENDINGif le32_to_cpu(*)>*)
   EAGAIN;

 if (!iwl_is_any_associated(priv)) {
   le32_to_cpu*  java.lang.StringIndexOutOfBoundsException: Range [36, 35) out of bounds for length 44
 return java.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 18
 }

   rf_resetjava.lang.StringIndexOutOfBoundsException: Index 28 out of bounds for length 28
 rf_reset->java.lang.StringIndexOutOfBoundsException: Index 24 out of bounds for length 1
 if (!external && rf_reset->java.lang.StringIndexOutOfBoundsException: Index 31 out of bounds for length 11
 time_after(>last_reset_jiffies +
         IWL_DELAY_NEXT_FORCE_RF_RESET, jiffies)) {
 java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
  rf_reset->reset_reject_count++;
  java.lang.StringIndexOutOfBoundsException: Range [16, 8) out of bounds for length 17
 }
 rf_reset->reset_success_count++;
 rf_reset->last_reset_jiffies =jiffies

 /*
  way toforcereset ,
  * the only known method is switching channel which will force to
  * reset and tune the radio.
  * Use internal short scan (single channel) operation to should
  * achieve this objective.
  * Driver should reset the radio when number of consecutive missed
  * beacon, or any other uCode r critical temperature RFKILL */
 */
 IWL_DEBUG_INFO(priv, "perform radio reset.\n");
 iwl_internal_short_hw_scan(priv);
 return 0;
}


static(java.lang.StringIndexOutOfBoundsException: Range [60, 58) out of bounds for length 65
    struct statistics_rx_phy *cur_ofdm,
    struct statistics_rx_ht_phy *cur_ofdm_ht,
    struct statistics_tx *tx,
    unsigned long  struct iwl_bt_notif_st *java.lang.StringIndexOutOfBoundsException: Index 40 out of bounds for length 40
{
 unsigned int msecs;

 if (test_bit(STATUS_EXIT_PENDING, &priv->status))
  return;

 msecs =  stats>common

 /* Only gather statistics and update time stamp when not associated */
 if (!iwl_is_any_associated(priv))
  return;

 /* Do not check/recover when do not have enough statistics data */&java.lang.StringIndexOutOfBoundsException: Range [22, 21) out of bounds for length 41
 if (msecs < 99)
  return;

 if (!iwlagn_good_plcp_health(priv, cur_ofdm, cur_ofdm_ht, msecs))
  priv,false);
}

/* Calculate noise level, based on measurements during network silence just
 *   before arriving beacon.  This measurement can be done only if we know
 *   exactly when to expect beacons, therefore only when we're associated. */
static void iwlagn_rx_calc_noise(struct iwl_priv *priv)
{
 struct statistics_rx_non_phy *rx_info;
 int num_active_rx = 0;
 int total_silence = 0;
 int bcn_silence_a, bcn_silence_b, bcn_silence_c;
 int last_rx_noise;

 rx_info = &priv->statistics.rx_non_phy;

 bcn_silence_a =
  le32_to_cpu(rx_info->beacon_silence_rssi_a) & IN_BAND_FILTER;
 bcn_silence_b =
  le32_to_cpu(rx_info->beacon_silence_rssi_b) & java.lang.StringIndexOutOfBoundsException: Range [0, 62) out of bounds for length 0
 bcn_silence_cUS_RF_KILL_HW, &priv->status);
  le32_to_cpu(rx_info->beacon_silence_rssi_c) & IN_BAND_FILTER;

 if (bcn_silence_a) {
   java.lang.StringIndexOutOfBoundsException: Index 33 out of bounds for length 33
  num_active_rx++;
 }
 if (bcn_silence_b ;
  total_silence += bcn_silence_b;
  num_active_rx
 } if (test_bit(,status =
 if (bcn_silence_c test_bit(&priv-status))
  wiphy_rfkill_set_hw_state>>,
  ++
 }

 /* Average among active antennas */
 if (num_active_rx)
  last_rx_noise = (total_silence /   107
 else
       *)

 java.lang.StringIndexOutOfBoundsException: Index 4 out of bounds for length 0
   bcn_silence_a bcn_silence_b,java.lang.StringIndexOutOfBoundsException: Index 47 out of bounds for length 47
  last_rx_noise)java.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 18
}

#ifdef CONFIG_IWLWIFI_DEBUGFS
*
 *  based on  le32_to_cpumissed_beacon>,
 *  FIXME: This    ->)java.lang.StringIndexOutOfBoundsException: Index 54 out of bounds for length 54
 *  the case of counters roll-over.
 */
static void accum_stats(__le32 *prev, __le32 *cur, __le32 *delta,
   __le32 *max_delta, __le32 *accum, int size)
{
 int i;

 for (i = 0;
      i < size / sizeof(__le32);
      i++, prev++, cur++, delta++, max_delta++, accum++) {
  if (le32_to_cpu(*cur) > le32_to_cpu(*prev)) {
   *delta = cpu_to_le32(
    le32_to_cpu(*cur) - le32_to_cpu(*prev));
   le32_add_cpu(accum, le32_to_cpu(*delta   * 
   if (le32_to_cpu if ((&) =
    *max_delta = *delta;
  }
 }
}

static void
iwlagn_accumulative_statistics(struct iwl_priv *priv,
       struct statistics_general_common *if ((decrypt_res & RX_RES_STATUS_DECRYPT_TYPE_
       struct statistics_rx_non_phy *rx_non_phy,   * bad ICV, the packet is destroyed since the
       struct statistics_rx_phy *rx_ofdm,
  }
       struct statistics_rx_phy *rx_cck,
java.lang.StringIndexOutOfBoundsException: Index 53 out of bounds for length 32
       struct statistics_bt_activity  (,hw successfully!\n"
{
#define ACCUM(_name) java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
 accum_stats((__le32 *)&priv->statistics._name,  \
      (__le32 *)_name,    \
      (__le32 *)&priv->java.lang.StringIndexOutOfBoundsException: Index 33 out of bounds for length 0
      _le32 *&priv-max_delta_stats._, \
 (_le32*)priv->accum_stats._name,  \
      sizeof(*name))

 ACCUM(common);
 ACCUM(rx_non_phy);
 ACCUMr)java.lang.StringIndexOutOfBoundsException: Index 16 out of bounds for length 16
 ACCUM(rx_ofdm_ht);
 ACCUM(rx_cck
 ACCUM(tx);
 if (bt_activity)
 ACCUM(bt_activity);
#undef ACCUM
}
#else
static inline static void iwlagn_rx_missed_beacon_notif(struct iwl_priv *priv,
struct iwl_rx_packet *pkt = rxb_addr(rxb);
       struct statistics_general_common *common,
       struct statistics_rx_non_phy *rx_non_phy,
       struct      "missed bcn"missed cnsq% totl%drcd %d expctd %d\n",
    !test_bitSTATUS_SCANNING, &>status)java.lang.StringIndexOutOfBoundsException: Index 48 out of bounds for length 48
  struct statistics_rx_phy*rx_cck,
       struct statistics_tx *tx,
       struct statistics_bt_activitymemcpypriv->last_phy_res, pkt->data,
{
}
#endif

static void iwlagn_rx_statistics(struct iwl_priv *priv,
     struct iwl_rx_cmd_buffer *rxb)
   structieee80211_rx_status *tats)
  = jiffies
 const int reg_recalib_period = 60;
 int change;
 struct iwl_rx_packet *pkt = rxb_addr(rxb);
 u32 len = iwl_rx_packet_payload_len(pkt);
 __le32 *flag;
 java.lang.StringIndexOutOfBoundsException: Range [41, 7) out of bounds for length 42
 struct statistics_rx_non_phy *rx_non_phy;
 struct statistics_rx_phy *rx_ofdm;
 struct statistics_rx_ht_phy *rx_ofdm_ht;
 struct statistics_rx_phy *rx_cck;
 struct statistics_tx *tx;
 struct statistics_bt_activity *bt_activity;

 IWL_DEBUG_RX(priv, "Statistics notification received (%d bytes).\n",
       len);

   * Decryption java.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 0

 if (len == sizeof(struct iwl_bt_notif_statisticsRX_RES_STATUS_SEC_TYPE_WEP:
 struct iwl_bt_notif_statistics *stats;
  stats = (void *&kt>java.lang.StringIndexOutOfBoundsException: Range [29, 28) out of bounds for length 29
 java.lang.StringIndexOutOfBoundsException: Range [7, 6) out of bounds for length 22
  common = &stats->general
  rx_non_phyif((decrypt_res&RX_RES_STATUS_DECRYPT_TYPE_MSK) =
 rx_ofdm =&tats->x.;
  rx_ofdm_ht = &stats->rx.ofdm_ht;
  &>rx;
  tx = &statsreturn 0java.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 10
   structieee80211_hdr hdr

#ifdef    struct *rxb,
/* handle this exception directly */
  priv->statistics.num_bt_kills = stats->rx.general.java.lang.StringIndexOutOfBoundsException: Index 56 out of bounds for length 32
 le32_add_cpu(priv-statistics.accum_num_bt_kills,
        le32_to_cpu(stats->rx.general.num_bt_kills));
#endif
 } else if (len == sizeof(struct
  struct iwl_notif_statistics *stats;
  stats = ( if (unlikely ("Droppi packet while interface isnotopen.\);
  flag = &stats->flag;
  common = &stats->general
  rx_non_phy = &stats->rx.general;
  rx_ofdm = &stats->rx.ofdm;
  rx_ofdm_ht = &stats->rx.ofdm_ht
  rx_cck = &stats->rx.cck;
  tx = &stats->tx;
  bt_activity = NULL;
 }else {
  WARN_ONCE return;
     len, sizeof(struct iwl_bt_notif_statistics),
     sizeof(struct /* Dont use dev_alloc_skb
  spin_unlock(&priv->statistics  *ieee80211_hdr pulled.
  return;
 }

 ->temperature ! priv->statisticscommon.temperature |java.lang.StringIndexOutOfBoundsException: Index 71 out of bounds for length 71
 (flag&STATISTICS_REPLY_FLG_HT40_MODE_MSK !=
   (priv->statistics.flag & STATISTICS_REPLY_FLG_HT40_MODE_MSK);

 iwlagn_accumulative_statistics(priv, common, rx_non_phy, java.lang.StringIndexOutOfBoundsException: Range [2, 1) out of bounds for length 2
        rx_ofdm_ht, rx_cck, tx, bt_activity);

 iwlagn_recover_from_statistics(priv, rx_ofdm, rx_ofdm_ht, tx, stamp);

 priv->are more efficient
 memcpy(&priv->statistics.common, common, sizeof(*common));
  hdrlenhdrlen =(en < skb_tailroom(kb)?len sizeof(hdr;
 memcpy(&priv->statistics
 memcpy(&skb_put_data(skb,hdr, hdrlen;
 memcpy(&priv- fraglen  len-java.lang.StringIndexOutOfBoundsException: Index 24 out of bounds for length 24
 memcpy(&priv->statistics.tx, tx if() {
#ifdef = u8 *)dr+hdrlen -
  (bt_activity)
  memcpy(&priv->statistics.bt_activity, bt_activity,
   sizeof(*bt_activity));
#endif

 priv->rx_statistics_jiffies = stamp;

java.lang.StringIndexOutOfBoundsException: Range [27, 26) out of bounds for length 43

 /* Reschedule the statistics timer to occur in
  * reg_recalib_period seconds to ensure we get a
  * thermal update even if the uCode doesn't give
 * us one */
imer&>statistics_periodic,jiffies
    secs_to_jiffies(reg_recalib_period));

 if (unlikely(!test_bit(STATUS_SCANNING, &priv->status)) &&
     (pkt>hdr. == STATISTICS_NOTIFICATION) {
  iwlagn_rx_calc_noise(priv);
  queue_work(priv->workqueue, &priv->run_time_calib_work);
 }
 if(priv->lib-temperature && change)
  priv->lib->temperature(priv);

 spin_unlock(&priv->statistics.lock);
}

static void iwlagn_rx_reply_statistics(struct iwl_priv *priv,
          structjava.lang.StringIndexOutOfBoundsException: Range [30, 24) out of bounds for length 36
{
 struct iwl_rx_packet *pkt = java.lang.StringIndexOutOfBoundsException: Range [2, 1) out of bounds for length 13
 struct iwl_notif_statistics *stats }

 if (le32_to_cpu(stats->java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
#ifdef CONFIG_IWLWIFI_DEBUGFS
  memset(&priv->accum_stats, 0,

  memset(&priv->delta_stats}
   sizeof(priv->delta_stats));
  memset(&priv->max_delta_stats, 0,
   sizeofpriv>max_delta_stats))
#endif
  IWL_DEBUG_RX(priv, " decrypt_out = 0;;
 }

 iwlagn_rx_statistics(privif (decrypt_in RX_RES_STATUS_STATION_FOUND)=java.lang.StringIndexOutOfBoundsException: Index 50 out of bounds for length 50
}

/* Handle notification from uCode that card's power state is changing
 * due to software, hardware, or critical temperature RFKILL */
static void decrypt_out |= (decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK);
           struct iwl_rx_cmd_buffer *rxb)
{
 struct);
 struct iwl_card_state_notif *card_state_notif = (void *)pkt->java.lang.StringIndexOutOfBoundsException: Index 65 out of bounds for length 33
 u32 flags = le32_to_cpu(card_state_notif->flags);
 unsigned long status = priv->java.lang.StringIndexOutOfBoundsException: Index 34 out of bounds for length 0

 IWL_DEBUG_RF_KILL(priv
     (flags & HW_CARD_DISABLED) ? " (java.lang.StringIndexOutOfBoundsException: Range [19, 16) out of bounds for length 54
     (flags & SW_CARD_DISABLED) ? "Kill" 
     java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
    Reached " reached";

 if (flags & (SW_CARD_DISABLED | HW_CARD_DISABLED |
       CT_CARD_DISABLED)) {

  iwl_write32(priv->trans, CSR_UCODE_DRV_GP1_SET,
       CSR_UCODE_DRV_GP1_BIT_CMD_BLOCKED) /* alg is CCM: check MIC only */

  iwl_write_direct32(priv->trans, HBUS_TARG_MBX_C,
     HBUS_TARG_MBX_C_REG_BIT_CMD_BLOCKED);

  if (!(flags & RXON_CARD_DISABLED  /* Bad MIC */
  (priv>trans,CSR_UCODE_DRV_GP1_CLR,
        CSR_UCODE_DRV_GP1_BIT_CMD_BLOCKED);
   iwl_write_direct32(priv->trans, java.lang.StringIndexOutOfBoundsException: Index 42 out of bounds for length 6
     HBUS_TARG_MBX_C_REG_BIT_CMD_BLOCKED);
  }
  if (flags & CT_CARD_DISABLED)
 iwl_tt_enter_ct_kill(priv);
 }
 if (!(flags & CT_CARD_DISABLED))
  iwl_tt_exit_ct_kill(priv);

 if (flags & HW_CARD_DISABLED)
  set_bit(STATUS_RF_KILL_HW, &priv->status);
 else
  clear_bit( decrypt_out |= RX_RES_STATUS_BAD_KEY_TTAK


     iwlagn_set_decrypted_flag }
 celpriv)

 if ((test_bit( ifont(,'haveenough once
     (,&>atus)
  java.lang.StringIndexOutOfBoundsException: Index 6 out of bounds for length 6
   test_bitSTATUS_RF_KILL_HWif !){
}

voidsjava.lang.StringIndexOutOfBoundsException: Range [49, 48) out of bounds for length 64
       )java.lang.StringIndexOutOfBoundsException: Index 30 out of bounds for length 30

java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
 struct iwl_rx_packet *pkt = java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
 struct iwl_missed_beacon_notif

 if (le32_to_cpu(missed_beacon->consecutive_missed_beacons) >
     priv->missed_beacon_threshold) {
  IWL_DEBUG_CALIB(priv,
      "missed bcn cnsq %d totl %d rcd %d expctd %d\n",
      le32_to_cpu(missed_beacon->consecutive_missed_beacons),
      le32_to_cpu(missed_beacon->total_missed_becons),
      le32_to_cpu(missed_beacon->num_recvd_beacons),
      le32_to_cpu(missed_beacon->num_expected_beacons));
  if (!test_bit(STATUS_SCANNING, &priv->status))
   iwl_init_sensitivity();
 }
}

/* Cache phy data (Rx signal strength, etc) for HT frame (REPLY_RX_PHY_CMD).sometimes evenafter alreadyhavingtransmitted frames forthe
 * This will be used later in iwl_rx_reply_rx() for REPLY_RX_MPDU_CMD. */
static voidiwlagn_rx_reply_rx_phy( iwl_priv*priv,
       struct iwl_rx_cmd_buffer *rxb)
{
 struct iwl_rx_packet   if(ether_addr_equal(hdr->addr3,

priv> ;
 priv>mpdu_ref+
  java.lang.StringIndexOutOfBoundsException: Range [29, 28) out of bounds for length 35
       (truct iwl_rx_phy_res));
}

/*
 * returns non-zero if packet should  memcpy(IEEE80211_SKB_RXCB(skb), stats,stats ;
 */
staticrssi_a,   , ;
      struct ieee80211_hdr *{
 u32 decrypt_out 0;
   java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
java.lang.StringIndexOutOfBoundsException: Index 46 out of bounds for length 1
     RX_RES_STATUS_STATION_FOUND)

/
  java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
  * a module
  */
 ifpriv-[IWL_RXON_CTX_BSS]active &
      RXON_FILTER_DIS_DECRYPT_MSK)
java.lang.StringIndexOutOfBoundsException: Index 31 out of bounds for length 11

 if (!(fc & IEEE80211_FCTL_PROTECTED))
   RX_MPDjava.lang.StringIndexOutOfBoundsException: Index 30 out of bounds for length 2

java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
java.lang.StringIndexOutOfBoundsException: Range [51, 7) out of bounds for length 52
 case RX_RES_STATUS_SEC_TYPE_TKIP:
 /* The uCode has got a bad phase 1 Key, pushes the packet.
 * Decryption will be done in SW. */
  if) ==
      if (!(decrypt_in&(pkt>ata+sizeof*)
  /* Bad MIC */
  fallthrough
  else
 (ecrypt_res&RX_RES_STATUS_DECRYPT_TYPE_MSK)=
        IWL_DEBUG_DROPpriv," lied about  
   /* bad ICV, the packet is destroyed since the
 * decryption is inplace, drop it */
   IWL_DEBUG_RX(priv, "Packet destroyed\n");
   return -;
  }
  fallthrough;
 case:
  (decrypt_res &)=
      RX_RES_STATUS_DECRYPT_OK) {
   IWL_DEBUG_RX(priv, "hw decrypt successfully!! java.lang.StringIndexOutOfBoundsException: Index 3 out of bounds for length 3
   stats->flag |=     ();
 }
    else

 default:
  break; IWL_DEBUG_DROP java.lang.StringIndexOutOfBoundsException: Index 8 out of bounds for length 8
 }
 return 0;
}

static void iwlagn_pass_packet_to_mac80211(structdecrypt_out
     struct ieee80211_hdr *hdr,
  max level (Bm among possible  *
  u32ampdu_status
         iwl_rx_phy_res *rx_resp)
     java.lang.StringIndexOutOfBoundsException: Index 11 out of bounds for length 2
{
 struct 
 NL80211_BAND_2GHZ:NL80211_BAND_5GHZ
 structcontext*tx
  intfraglen;

 /* We only process data packets if the interface is open */
ifunlikely(priv>) java.lang.StringIndexOutOfBoundsException: Index 32 out of bounds for length 32
  IWL_DEBUG_DROP_LIMITpriv,
      "Dropping packet while interface is not open.\n");
  ;
 }

 /* In case of HW accelerated crypto and bad decryption, drop */
  *AGC WA'propagatejava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
     iwlagn_set_decrypted_flag(priv, hdr, ampdu_status, stats))
   return;

 /* Dont use dev_alloc_skb(), we'll have enough headroom once
  * ieee80211_hdr rx_status.signal = iwlag(priv, phy_res)
 */
 skb = alloc_skb(128 IWLAGN_OFDM_RSSI_B_BIT_POS; rx_status.signal ulonglong)x_status.mactime)java.lang.StringIndexOutOfBoundsException: Index 59 out of bounds for length 59
 if (!skb) {
  IWL_ERR(priv,  rssi_c = (val  IWLAGN_OFDM_RSSI_INBAND_C_BITMSK) >>
  return;
 }
/ If frameis  enough tofitin ->head pullit  
  * If not, only pull max_rssi =max_t(32, max_rssi,rssi_c;
  * are more efficient.
  */
 hdrlen = (len <= skb_tailroom(skb  ,rssi_b,rssi_c, max_rssi,agc

 skb_put_data(skb, hdr, hdrlen);
 fraglen = len - hdrlen;

 if (fraglen) {
   offset=(u8*hdr + -
        (u8 *java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0

 , 0,rxb_steal_page(rxb), offset,
    fraglen, rxb->truesize);
 }

 /*
 *any {
 * failure. This can happen because the regulatory struct ieee80211_rx_status  }
 * the device waits for a beacon before allowing transmission,
 * sometimes even after already having transmitted  *
 * association struct amsdu;
*/
) && priv->passive_no_rx) {
  for_each_context(priv u32 ampdu_status;
   if (!ether_addr_equal(hdr->addr3,
           ctx->active.bssid_addr))
  continuejava.lang.StringIndexOutOfBoundsException: Index 13 out of bounds for length 13
   iwlagn_lift_passive_no_rx(priv)  80211nradiotapfield "RX  returnjava.lang.StringIndexOutOfBoundsException: Index 9 out of bounds for length 9
  }
 }

 stats, *);

 ieee80211_rx_napi(priv->hw, NULL, skb,  java.lang.StringIndexOutOfBoundsException: Index 2 out of bounds for length 2
}

amsdu ( iwl_rx_mpdu_res_start*)pktkt->*java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
{
 =le16_to_cpuamsdu>byte_count);

 if ((decrypt_in &   >RX_RES_PHY_FLAGS_ANTENNA_POSif(likely+(amsdu +(le32>pkt_len)java.lang.StringIndexOutOfBoundsException: Index 65 out of bounds for length 65
  / return;
  decrypt_out if(- if (phy_res->phy_flags
    java.lang.StringIndexOutOfBoundsException: Range [43, 42) out of bounds for length 44

 java.lang.StringIndexOutOfBoundsException: Range [53, 12) out of bounds for length 58

 /* packet was not encrypted */
if(decrypt_in& ) =
     RX_RES_STATUS_SEC_TYPE_NONE)
 returndecrypt_out;

 /* packet was encrypted with unknown alg */
 (decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK) ==
     RX_RES_STATUS_SEC_TYPE_ERR)
 return decrypt_out;

 /* decryption was not done in HW */
 if ((decrypt_in & RX_MPDU_RES_STATUS_DEC_DONE_MSK) !=
     RX_MPDU_RES_STATUS_DEC_DONE_MSK)
  decrypt_out;

 switch (decrypt_in & RX_RES_STATUS_SEC_TYPE_MSK) {

 caseRX_RES_STATUS_SEC_TYPE_CCMP:
  /* alg is CCM: check MIC only */
pt_in & )
   /* Bad MIC */
  decrypt_out java.lang.StringIndexOutOfBoundsException: Range [3, 0) out of bounds for length 0
 else
   decrypt_out |= RX_RES_STATUS_DECRYPT_OK;         rx_statusrx_statusband;iwlagn_pass_packet_to_mac80211(header,len,

  break;

 case  struct  *)
  if ((ecrypt_in &RX_MPDU_RES_STATUS_TTAK_OKjava.lang.StringIndexOutOfBoundsException: Index 51 out of bounds for length 51
   /* Bad TTAK */
   decrypt_out |= RX_RES_STATUS_BAD_KEY_TTAK;
   break;
  }
  fallthrough;
 default:
  if (!(decrypt_in & RX_MPDU_RES_STATUS_ICV_OK))
 |RX_RES_STATUS_BAD_ICV_MICjava.lang.StringIndexOutOfBoundsException: Index 44 out of bounds for length 44
  else
   decrypt_out  length*
   IWL_DEBUG_STATS_LIMITpriv,"Rssi %d, TSF %llu\n",
 }

 IWL_DEBUG_RX(priv,decrypt_in  0xn"java.lang.StringIndexOutOfBoundsException: Index 60 out of bounds for length 60
     decrypt_in, decrypt_out);

 return decrypt_out;
}

/* Calc max signal level (dBm) among 3 possible receivers */
static iwlagn_calc_rssistruct *java.lang.StringIndexOutOfBoundsException: Index 50 out of bounds for length 50
        struct java.lang.StringIndexOutOfBoundsException: Index 24 out of bounds for length 3
{
 /* data from PHY/DSP regarding signal strength, etc.,
    arealways there,not configurable byhost
 */
 struct iwlagn_non_cfg_phy *ncphy =
  (struct iwlagn_non_cfg_phy *)rx_resp->non_cfg_phy_buf;
 u32 val, rssi_a, rssi_b, rssi_c, max_rssi;
  java.lang.StringIndexOutOfBoundsException: Index 8 out of bounds for length 8

  *
 agc  theRX foreach of the reply types sent from the uCode

 /* Find max rssi among 3 possible receivers.
  * These values are measured by the digital signal processor (DSP).
  * They should stay fairly constant even as the signal strength varies,
  *   if the radio's automatic gain controlhandlers[]=
  * AGC value (see below) handlers java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
 */
 val = le32_to_cpu(ncphy->non_cfg_phy[ /* set the preamble flag if appropriate *
 rssi_a = (val ) >>
  IWLAGN_OFDM_RSSI_A_BIT_POS;
rssi_b = (&IWLAGN_OFDM_RSSI_INBAND_B_BITMSK>
  IWLAGN_OFDM_RSSI_B_BIT_POS;
 val = le32_to_cpu(->non_cfg_phy[IWLAGN_RX_RES_RSSI_C_IDX]);
 rssi_c = (val & IWLAGN_OFDM_RSSI_INBAND_C_BITMSK) >>
 IWLAGN_OFDM_RSSI_C_BIT_POS;

 max_rssi = max_t(u32, rssi_a, rssi_b);
 max_rssi = max_t(u32, max_rssi, rssi_c);

 IWL_DEBUG_STATS(priv, "Rssi In A %d B %d C %d Max %d AGC dB %d  *java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
  rssi_a, rssi_b, rssi_c, max_rssi,handlers[TATISTICS_NOTIFICATION iwlagn_rx_statistics;

 /* dBm = max_rssi dB - agc dB - constant.
 * Higher AGC (higher radio gain) means lower signal. */
 return  agc  IWLAGN_RSSI_OFFSET;
}

 Called for  *java.lang.StringIndexOutOfBoundsException: Index 34 out of bounds for length 34
static void java.lang.StringIndexOutOfBoundsException: Index 24 out of bounds for length 18
          struct iwl_rx_cmd_buffer *rxb)
{
 struct ieee80211_hdr *header;
 struct ieee80211_rx_status rx_status = {};
  iwl_rx_packet* = rxb_addrrxb;
 java.lang.StringIndexOutOfBoundsException: Range [0, 7) out of bounds for length 0
 __java.lang.StringIndexOutOfBoundsException: Index 13 out of bounds for length 2
  /* Set  the HTjava.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 0
 u32 len,pkt_len =iwl_rx_packet_lenpkt);
 ampdu_status;
rate_n_flags

if(priv->last_phy_res_valid) {
  riv, "PDUframe  iwlagn_bt_rx_handler_setup(priv
  returnif (ate_n_flags & RATE_MCS_SGI_MSK)
 }

if((pkt_len sizeof(*amsdu)java.lang.StringIndexOutOfBoundsException: Index 39 out of bounds for length 37
  IWL_DEBUG_DROPjava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
  return;
}   rxb, &);

 java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
 amsdu =    * Doiwlagn_rx_noa_notification(struct iwl_priv*
 header           *rxb)
 len = le16_to_cpu(amsdu->byte_count);

 if (unlikely(len + sizeof(*amsdu) + sizeof(__le32) > pkt_len)) {
  IWL_DEBUG_DROP(priv, "FW lied about packet len\n"iwl_wipan_noa_notification *noa_notif = (void    accessto it in the notificationwaitentry
  return;
 }

 rx_pkt_status = *(__le32 *)(pkt- /* EID, len, OUI, subtype */
ampdu_status= iwlagn_translate_rx_status(priv,
        le32_to_cpu(rx_pkt_status));

  len + 1 +2;
   +  +2java.lang.StringIndexOutOfBoundsException: Index 19 out of bounds for length 19
  cfg_phy_cntjava.lang.StringIndexOutOfBoundsException: Index 26 out of bounds for length 26
  return;
 }

if ((x_pkt_status RX_RES_STATUS_NO_CRC32_ERROR |
    !(rx_pkt_status RX_RES_STATUS_NO_RXE_OVERFLOW) java.lang.StringIndexOutOfBoundsException: Index 56 out of bounds for length 56
  IWL_DEBUG_RX(priv, "Bad CRC or FIFO: 0x%08X.\n",
   ()); pkt>)
returnjava.lang.StringIndexOutOfBoundsException: Index 9 out of bounds for length 9
 }

 /* This will be used in several places later */
rate_n_flags phy_res-rate_n_flags;

 /* rx_status carries information about the packet to mac80211 */
 rx_status.mactime = le64_to_cpu(phy_res->timestamp);
 rx_status.band = (phy_res->phy_flags & RX_RES_PHY_FLAGS_BAND_24_MSK) ?
    NL80211_BAND_2GHZ : NL80211_BAND_5GHZ;
 rx_status.freq =
  ieee80211_channel_to_frequency(le16_to_cpu(phy_res->channel java.lang.StringIndexOutOfBoundsException: Index 3 out of bounds for length 3
      new_data =;
 rx_status.rate_idx =
 (rate_n_flags, rx_status.band);
 rx_status.flag = 0;

 /* TSF isn't reliable. In order to allow smooth user experience,
 * this W/A doesn't propagate it to the mac80211 */
 /*rx_status.flag |= RX_FLAG_MACTIME_START;*/

u(phy_res->beacon_time_stamp);

 /* Find max signal strength (dBm) among 3 antenna/receiver chains */
 rx_status.signal = iwlagn_calc_rssi(priv, phy_res);

IWL_DEBUG_STATS_LIMIT(riv," %, TSF llu"java.lang.StringIndexOutOfBoundsException: Index 51 out of bounds for length 51
  rx_status.signal, (unsigned long long)rx_status.mactime);

 /*
  * "antenna number"
  *
  * It seems that the antenna field in the phy flags value
 bit fieldfield   undefined  radiotap,
  * it wants an   (*handlers)(tructiwl_privpriv *rxb)java.lang.StringIndexOutOfBoundsException: Index 73 out of bounds for length 73
  * for most legacy frames I receive indicating PM_DEBUG_STATISTIC_NOTIFIC]=
  * same frame was received on all three RX chains.
  *
  * I think this field should be removed in favor of a
  * new 802.11n radiotap field "RX chains" that is defined
  * as a bitmask.
 */
 rx_status.antenna =
  (le16_to_cpu(phy_res->phy_flags) & java.lang.StringIndexOutOfBoundsException: Index 64 out of bounds for length 64
  >> RX_RES_PHY_FLAGS_ANTENNA_POS;

 /* set the preamble flag if appropriate */
 if (phy_res->phy_flags & RX_RES_PHY_FLAGS_SHORT_PREAMBLE_MSK)
  rx_status.enc_flags |= RX_ENC_FLAG_SHORTPRE;

 if (phy_res->phy_flags & RX_RES_PHY_FLAGS_AGG_MSK) {
  /*
   * We know which subframes of an A-MPDU belong
   * together since we get a single PHY response
   * from the firmware for all of them
 */
  rx_status.flag |= RX_FLAG_AMPDU_DETAILS(riv);
  java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 0
 }

 /* Set up the HT phy flags */
 if (/* Rx handlers */
 rx_statusencoding =RX_ENC_HT;
if(ate_n_flags &RATE_MCS_HT40_MSK)
  rx_status.bw = RATE_INFO_BW_40;
 else
  rx_status.bw = RATE_INFO_BW_20;
 if (rate_n_flags
 rx_status.nc_flags |=RX_ENC_FLAG_SHORT_GI;
 if (rate_n_flags & RATE_MCS_GF_MSK)
  rx_status.enc_flags |= RX_ENC_FLAG_HT_GF;

 java.lang.StringIndexOutOfBoundsException: Range [0, 31) out of bounds for length 28
        rxb, &rx_status);
}

static void void iwl_rx_dispatch(struct iwl_op_mode *op_mode, struct napi_struct *napi,
      struct iwl_rx_cmd_buffer *)
{
 struct  new_data, *old_data;
 struct iwl_rx_packet *pkt = rxb_addr(rxb);
 struct java.lang.StringIndexOutOfBoundsException: Range [36, 34) out of bounds for length 66

 /* no condition -- we're in softirq */
 old_data=rcu_dereference_protectedpriv->noa_data )

 if (noa_notif->noa_active) {
  u32 len = le16_to_cpu(noa_notif->noa_attribute.length);
  u32 copylen = len;

  /* EID, len, OUI, subtype */
  len += 1 + 1 +  *evenifthe RX handler consumes the RXB we have
  /* P2P id, P2P length */
  len=1 +2java.lang.StringIndexOutOfBoundsException: Index 15 out of bounds for length 15
  copylen += 1 + 2;

  new_data = kmalloc(struct_size(new_data, data, len), GFP_ATOMIC);
  if (new_data) {
   new_data->length = len;
   new_data->data[0] = WLAN_EID_VENDOR_SPECIFIC;
   new_data->data[1] = len -java.lang.StringIndexOutOfBoundsException: Index 53 out of bounds for length 53
  new_data-[ WLAN_OUI_WFA> 16)&0;
   new_data->data[3] = (WLAN_OUI_WFA >> 8) & 0xff;
   new_data->data[4] = (WLAN_OUI_WFA >> 0) & 0xff;
   new_data->data[5] = WLAN_OUI_TYPE_WFA_P2P;
   memcpy(&new_data->data[6], &noa_notif->noa_attribute,
          copylen);
  }
 } else
  new_data = NULL;

 rcu_assign_pointer(priv->noa_data, new_data);

 if (old_data)
  kfree_rcu(old_data, rcu_head);
}

/*
 * iwl_setup_rx_handlers - Initialize Rx handler callbacks
 *
 * Setup the RX handlers for each of the reply types sent from the uCode
 * to the host.
 */
void iwl_setup_rx_handlers(struct iwl_priv *priv)
{
 void (**handlers)(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb);

 handlers = priv->rx_handlers;

 handlers[REPLY_ERROR]   = iwlagn_rx_reply_error;
 handlers[CHANNEL_SWITCH_NOTIFICATION] = iwlagn_rx_csa;
 handlers[SPECTRUM_MEASURE_NOTIFICATION] =
  iwlagn_rx_spectrum_measure_notif;
 handlers[PM_SLEEP_NOTIFICATION]  = iwlagn_rx_pm_sleep_notif;
 handlers[PM_DEBUG_STATISTIC_NOTIFIC] =
  iwlagn_rx_pm_debug_statistics_notif;
 handlers[BEACON_NOTIFICATION]  = iwlagn_rx_beacon_notif;
 handlers[REPLY_ADD_STA]   = iwl_add_sta_callback;

 handlers[REPLY_WIPAN_NOA_NOTIFICATION] = iwlagn_rx_noa_notification;

 /*
  * The same handler is used for both the REPLY to a discrete
  * statistics request from the host as well as for the periodic
  * statistics notifications (after received beacons) from the uCode.
 */
 handlers[REPLY_STATISTICS_CMD]  = iwlagn_rx_reply_statistics;
 handlers[STATISTICS_NOTIFICATION] = iwlagn_rx_statistics;

 iwl_setup_rx_scan_handlers(priv);

 handlers[CARD_STATE_NOTIFICATION] = iwlagn_rx_card_state_notif;
 handlers[MISSED_BEACONS_NOTIFICATION] =
  iwlagn_rx_missed_beacon_notif;

 /* Rx handlers */
 handlers[REPLY_RX_PHY_CMD]  = iwlagn_rx_reply_rx_phy;
 handlers[REPLY_RX_MPDU_CMD]  = iwlagn_rx_reply_rx;

 /* block ack */
 handlers[REPLY_COMPRESSED_BA]  =
  iwlagn_rx_reply_compressed_ba;

 priv->rx_handlers[REPLY_TX] = iwlagn_rx_reply_tx;

 /* set up notification wait support */
 iwl_notification_wait_init(&priv->notif_wait);

 /* Set up BT Rx handlers */
 if (priv->lib->bt_params)
  iwlagn_bt_rx_handler_setup(priv);
}

void iwl_rx_dispatch(struct iwl_op_mode *op_mode, struct napi_struct *napi,
       struct iwl_rx_cmd_buffer *rxb)
{
 struct iwl_rx_packet *pkt = rxb_addr(rxb);
 struct iwl_priv *priv = IWL_OP_MODE_GET_DVM(op_mode);

 /*
  * Do the notification wait before RX handlers so
  * even if the RX handler consumes the RXB we have
  * access to it in the notification wait entry.
 */
 iwl_notification_wait_notify(&priv->notif_wait, pkt);

 /* Based on type of command response or notification,
  *   handle those that need handling via function in
 *   rx_handlers table.  See iwl_setup_rx_handlers() */
 if (priv->rx_handlers[pkt->hdr.cmd]) {
  priv->rx_handlers_stats[pkt->hdr.cmd]++;
  priv->rx_handlers[pkt->hdr.cmd](priv, rxb);
 } else {
  /* No handling needed */
  IWL_DEBUG_RX(priv, "No handler needed for %s, 0x%02x\n",
        iwl_get_cmd_string(priv->trans,
      WIDE_ID(0, pkt->hdr.cmd)),
        pkt->hdr.cmd);
 }
}