Release 1.0.0.58 QCACLD WLAN Driver

Merge remote-tracking branch 'origin/caf/caf-wlan/master'

* origin/caf/caf-wlan/master:
  Cafstaging Release 1.0.0.58
  KW fix for HTC module
  qcacld/txrx:Avoid redundant PN check on host in certain cases
  qcacld: Fix of kernel panic during modem power state indication
  wlan: Unpause all vdev when system resume
  Fix issues observed in static code analysis.

Change-Id: I28c1ae458bce348c55d2b78c84045e938c275c49

16 files changed, 179 insertions, 46 deletions

diff --git a/CORE/CLD_TXRX/TXRX/ol_rx.c b/CORE/CLD_TXRX/TXRX/ol_rx.c
index a7a3e20b28d0..1a4bb7449941 100644
--- a/CORE/CLD_TXRX/TXRX/ol_rx.c
+++ b/CORE/CLD_TXRX/TXRX/ol_rx.c
@@ -924,6 +924,7 @@ ol_rx_peer_init(struct ol_txrx_pdev_t *pdev, struct ol_txrx_peer_t *peer)
     peer->security[txrx_sec_ucast].sec_type =
         peer->security[txrx_sec_mcast].sec_type = htt_sec_type_none;
     peer->keyinstalled = 0;
+    adf_os_atomic_init(&peer->fw_pn_check);
 }
 
 void
diff --git a/CORE/CLD_TXRX/TXRX/ol_rx_pn.c b/CORE/CLD_TXRX/TXRX/ol_rx_pn.c
index c70b5ea3e59c..3a8eff0ceec6 100644
--- a/CORE/CLD_TXRX/TXRX/ol_rx_pn.c
+++ b/CORE/CLD_TXRX/TXRX/ol_rx_pn.c
@@ -108,6 +108,11 @@ ol_rx_pn_check_base(
     void *rx_desc;
     int last_pn_valid;
 
+    /* Make sure host pn check is not redundant */
+    if (adf_os_atomic_read(&peer->fw_pn_check)) {
+        return msdu_list;
+    }
+
     /* First, check whether the PN check applies */
     rx_desc = htt_rx_msdu_desc_retrieve(pdev->htt_pdev, msdu_list);
     adf_os_assert(htt_rx_msdu_has_wlan_mcast_flag(pdev->htt_pdev, rx_desc));
diff --git a/CORE/CLD_TXRX/TXRX/ol_rx_reorder.c b/CORE/CLD_TXRX/TXRX/ol_rx_reorder.c
index eafe5b732584..aa98ed097801 100644
--- a/CORE/CLD_TXRX/TXRX/ol_rx_reorder.c
+++ b/CORE/CLD_TXRX/TXRX/ol_rx_reorder.c
@@ -604,7 +604,6 @@ ol_rx_pn_ind_handler(
     void *rx_desc;
     struct ol_txrx_peer_t *peer;
     struct ol_rx_reorder_array_elem_t *rx_reorder_array_elem;
-    union htt_rx_pn_t pn;
     unsigned win_sz_mask;
     adf_nbuf_t head_msdu = NULL;
     adf_nbuf_t tail_msdu = NULL;
@@ -618,6 +617,7 @@ ol_rx_pn_ind_handler(
         return;
     }
 
+    adf_os_atomic_set(&peer->fw_pn_check, 1);
     /*TODO: Fragmentation case*/
     win_sz_mask = peer->tids_rx_reorder[tid].win_sz_mask;
     seq_num_start &= win_sz_mask;
@@ -634,6 +634,8 @@ ol_rx_pn_ind_handler(
                 static u_int32_t last_pncheck_print_time = 0;
                 int log_level;
                 u_int32_t current_time_ms;
+                union htt_rx_pn_t pn = {0};
+                int index, pn_len;
 
                 mpdu_head = msdu = rx_reorder_array_elem->head;
                 mpdu_tail = rx_reorder_array_elem->tail;
@@ -641,7 +643,10 @@ ol_rx_pn_ind_handler(
                 pn_ie_cnt--;
                 i++;
                 rx_desc = htt_rx_msdu_desc_retrieve(htt_pdev, msdu);
-                htt_rx_mpdu_desc_pn(htt_pdev, rx_desc, &pn, 16);
+                index = htt_rx_msdu_is_wlan_mcast(pdev->htt_pdev, rx_desc) ?
+                                   txrx_sec_mcast : txrx_sec_ucast;
+                pn_len = pdev->rx_pn[peer->security[index].sec_type].len;
+                htt_rx_mpdu_desc_pn(htt_pdev, rx_desc, &pn, pn_len);
 
                 current_time_ms = adf_os_ticks_to_msecs(adf_os_ticks());
                 if (TXRX_PN_CHECK_FAILURE_PRINT_PERIOD_MS <
diff --git a/CORE/CLD_TXRX/TXRX/ol_txrx_types.h b/CORE/CLD_TXRX/TXRX/ol_txrx_types.h
index 94c62e76d17a..6dd6cddc42c0 100644
--- a/CORE/CLD_TXRX/TXRX/ol_txrx_types.h
+++ b/CORE/CLD_TXRX/TXRX/ol_txrx_types.h
@@ -861,6 +861,9 @@ struct ol_txrx_peer_t {
 	u_int8_t  uapsd_mask;
 	/*flag indicating key installed*/
 	u_int8_t keyinstalled;
+
+        /* Bit to indicate if PN check is done in fw */
+        adf_os_atomic_t fw_pn_check;
 };
 
 #endif /* _OL_TXRX_TYPES__H_ */
diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c
index 93a2fa6aa639..e94a34fc378d 100644
--- a/CORE/HDD/src/wlan_hdd_main.c
+++ b/CORE/HDD/src/wlan_hdd_main.c
@@ -8671,6 +8671,7 @@ void __hdd_wlan_exit(void)
   -------------------------------------------------------------------------*/
 int hdd_wlan_notify_modem_power_state(int state)
 {
+   int status;
    VOS_STATUS vosStatus;
    v_CONTEXT_t pVosContext = NULL;
    hdd_context_t *pHddCtx = NULL;
@@ -8678,11 +8679,20 @@ int hdd_wlan_notify_modem_power_state(int state)
    pVosContext = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
    if (!pVosContext)
       return -1;
+
    pHddCtx = (hdd_context_t *)vos_get_context(VOS_MODULE_ID_HDD, pVosContext);
-   if (!pHddCtx)
+
+   status = wlan_hdd_validate_context(pHddCtx);
+   if (0 != status)
+   {
+       VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                  "%s: HDD context is not valid", __func__);
+       return -1;
+   }
+   if (!pHddCtx->hHal)
       return -1;
 
-   vosStatus = sme_notify_modem_power_state(pHddCtx->pvosContext, state);
+   vosStatus = sme_notify_modem_power_state(pHddCtx->hHal, state);
    if (VOS_STATUS_SUCCESS != vosStatus) {
       hddLog(LOGE, "Fail to send notification with modem power state %d\n",
              state);
diff --git a/CORE/MAC/inc/qwlan_version.h b/CORE/MAC/inc/qwlan_version.h
index dc0982edab08..8c8ecaf3804e 100644
--- a/CORE/MAC/inc/qwlan_version.h
+++ b/CORE/MAC/inc/qwlan_version.h
@@ -42,9 +42,9 @@ BRIEF DESCRIPTION:
 #define QWLAN_VERSION_MINOR            0
 #define QWLAN_VERSION_PATCH            0
 #define QWLAN_VERSION_EXTRA            ""
-#define QWLAN_VERSION_BUILD            57
+#define QWLAN_VERSION_BUILD            58
 
-#define QWLAN_VERSIONSTR               "1.0.0.57"
+#define QWLAN_VERSIONSTR               "1.0.0.58"
 
 #ifdef QCA_WIFI_2_0
 
diff --git a/CORE/MAC/inc/sirApi.h b/CORE/MAC/inc/sirApi.h
index a7860b14deb2..07b21d5439fd 100644
--- a/CORE/MAC/inc/sirApi.h
+++ b/CORE/MAC/inc/sirApi.h
@@ -4866,4 +4866,10 @@ typedef struct sSirTxPowerLimit
     u_int32_t txPower5g;
 } tSirTxPowerLimit;
 
+// Notify MODEM power state to FW
+typedef struct
+{
+    tANI_U32 param;
+} tSirModemPowerStateInd, *tpSirModemPowerStateInd;
+
 #endif /* __SIR_API_H */
diff --git a/CORE/MAC/src/include/sirParams.h b/CORE/MAC/src/include/sirParams.h
index cfea61d3d6ba..9d41e7047ae7 100644
--- a/CORE/MAC/src/include/sirParams.h
+++ b/CORE/MAC/src/include/sirParams.h
@@ -659,6 +659,8 @@ typedef struct sSirMbMsgP2p
 #define SIR_HAL_SET_SAP_INTRABSS_DIS       (SIR_HAL_ITC_MSG_TYPES_BEGIN + 252)
 #define SIR_HAL_FW_STATS_IND               (SIR_HAL_ITC_MSG_TYPES_BEGIN + 253)
 
+#define SIR_HAL_MODEM_POWER_STATE_IND      (SIR_HAL_ITC_MSG_TYPES_BEGIN + 254)
+
 #define SIR_HAL_MSG_TYPES_END              (SIR_HAL_MSG_TYPES_BEGIN + 0x1FF)
 
 // CFG message types
diff --git a/CORE/SERVICES/HTC/htc_send.c b/CORE/SERVICES/HTC/htc_send.c
index 576ea5bd1676..0052ecfb2d0f 100644
--- a/CORE/SERVICES/HTC/htc_send.c
+++ b/CORE/SERVICES/HTC/htc_send.c
@@ -166,11 +166,26 @@ HTC_PACKET *AllocateHTCBundlePacket(HTC_TARGET *target)
                 0,
                 4,
                 FALSE);
-	AR_DEBUG_ASSERT(netbuf);
+        AR_DEBUG_ASSERT(netbuf);
+        if (!netbuf)
+        {
+            return NULL;
+        }
         pPacket = adf_os_mem_alloc(NULL, sizeof(HTC_PACKET));
-	AR_DEBUG_ASSERT(pPacket);
+        AR_DEBUG_ASSERT(pPacket);
+        if (!pPacket)
+        {
+            adf_nbuf_free(netbuf);
+            return NULL;
+        }
         pQueueSave = adf_os_mem_alloc(NULL, sizeof(HTC_PACKET_QUEUE));
-	AR_DEBUG_ASSERT(pQueueSave);
+        AR_DEBUG_ASSERT(pQueueSave);
+        if (!pQueueSave)
+        {
+            adf_nbuf_free(netbuf);
+            A_FREE(pPacket);
+            return NULL;
+        }
         INIT_HTC_PACKET_QUEUE(pQueueSave);
         pPacket->pContext = pQueueSave;
         SET_HTC_PACKET_NET_BUF_CONTEXT(pPacket, netbuf);
@@ -178,11 +193,27 @@ HTC_PACKET *AllocateHTCBundlePacket(HTC_TARGET *target)
     }
 
     pPacket = target->pBundleFreeList;
+    AR_DEBUG_ASSERT(pPacket);
+    if (!pPacket)
+    {
+        UNLOCK_HTC_TX(target);
+        return NULL;
+    }
     target->pBundleFreeList = (HTC_PACKET *)pPacket->ListLink.pNext;
     UNLOCK_HTC_TX(target);
     netbuf = GET_HTC_PACKET_NET_BUF_CONTEXT(pPacket);
+    AR_DEBUG_ASSERT(netbuf);
+    if (!netbuf)
+    {
+        return NULL;
+    }
     adf_nbuf_trim_tail(netbuf, adf_nbuf_len(netbuf));
     pQueueSave = (HTC_PACKET_QUEUE*)pPacket->pContext;
+    AR_DEBUG_ASSERT(pQueueSave);
+    if (!pQueueSave)
+    {
+        return NULL;
+    }
     INIT_HTC_PACKET_QUEUE(pQueueSave);
     pPacket->ListLink.pNext = NULL;
     return pPacket;
@@ -255,6 +286,13 @@ static void HTCIssuePacketsBundle(HTC_TARGET *target,
 
    bundlesSpaceRemaining = HTC_HOST_MAX_MSG_PER_BUNDLE * pEndpoint->TxCreditSize;
    pPacketTx = AllocateHTCBundlePacket(target);
+   if (!pPacketTx)
+   {
+       //good time to panic
+       AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("AllocateHTCBundlePacket failed \n"));
+       AR_DEBUG_ASSERT(FALSE);
+       return;
+   }
    bundleBuf = GET_HTC_PACKET_NET_BUF_CONTEXT(pPacketTx);
    pBundleBuffer = adf_nbuf_data(bundleBuf);
    pQueueSave = (HTC_PACKET_QUEUE*)pPacketTx->pContext;
@@ -283,6 +321,13 @@ static void HTCIssuePacketsBundle(HTC_TARGET *target,
            }
            bundlesSpaceRemaining = HTC_HOST_MAX_MSG_PER_BUNDLE * pEndpoint->TxCreditSize;
            pPacketTx = AllocateHTCBundlePacket(target);
+           if (!pPacketTx)
+           {
+               //good time to panic
+               AR_DEBUG_PRINTF(ATH_DEBUG_ERR, ("AllocateHTCBundlePacket failed \n"));
+               AR_DEBUG_ASSERT(FALSE);
+               return;
+           }
            bundleBuf = GET_HTC_PACKET_NET_BUF_CONTEXT(pPacketTx);
            pBundleBuffer = adf_nbuf_data(bundleBuf);
            pQueueSave = (HTC_PACKET_QUEUE*)pPacketTx->pContext;
diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c
index 6ae193a1bc4c..4b2c3a28459d 100644
--- a/CORE/SERVICES/WMA/wma.c
+++ b/CORE/SERVICES/WMA/wma.c
@@ -12788,6 +12788,14 @@ static VOS_STATUS wma_resume_req(tp_wma_handle wma, tpSirWlanResumeParam info)
 		if (!wma->interfaces[vdev_id].handle)
 			continue;
 
+#ifdef QCA_SUPPORT_TXRX_VDEV_PAUSE_LL
+		/* When host resume, by default, unpause all active vdev */
+		if (wma->interfaces[vdev_id].pause_bitmap) {
+			wdi_in_vdev_unpause(wma->interfaces[vdev_id].handle);
+			wma->interfaces[vdev_id].pause_bitmap = 0;
+		}
+#endif /* QCA_SUPPORT_TXRX_VDEV_PAUSE_LL */
+
 		iface = &wma->interfaces[vdev_id];
 		iface->conn_state = FALSE;
 	}
@@ -15050,6 +15058,26 @@ static void wma_set_vdev_intrabss_fwd(tp_wma_handle wma_handle,
 	wdi_in_vdev_rx_fwd_disabled(txrx_vdev, pdis_intra_fwd->disableintrabssfwd);
 }
 
+VOS_STATUS wma_notify_modem_power_state(void *wda_handle,
+			tSirModemPowerStateInd *pReq)
+{
+	int32_t ret;
+	tp_wma_handle wma = (tp_wma_handle)wda_handle;
+
+	WMA_LOGD("%s: WMA Notify Modem Power State %d", __func__, pReq->param);
+
+	ret = wmi_unified_modem_power_state(wma->wmi_handle, pReq->param);
+	if (ret) {
+		WMA_LOGE("%s: Fail to notify Modem Power State %d",
+		 __func__, pReq->param);
+		return VOS_STATUS_E_FAILURE;
+	}
+
+	WMA_LOGD("Successfully notify Modem Power State %d", pReq->param);
+	return VOS_STATUS_SUCCESS;
+}
+
+
 /*
  * function   : wma_mc_process_msg
  * Descriptin :
@@ -15443,6 +15471,10 @@ VOS_STATUS wma_mc_process_msg(v_VOID_t *vos_context, vos_msg_t *msg)
 			wma_fw_stats_ind(wma_handle, msg->bodyptr);
 			vos_mem_free(msg->bodyptr);
 			break;
+		case WDA_MODEM_POWER_STATE_IND:
+			wma_notify_modem_power_state(wma_handle,
+					(tSirModemPowerStateInd *)msg->bodyptr);
+			vos_mem_free(msg->bodyptr);
 		default:
 			WMA_LOGD("unknow msg type %x", msg->type);
 			/* Do Nothing? MSG Body should be freed at here */
@@ -18452,23 +18484,6 @@ wma_process_ftm_command(tp_wma_handle wma_handle,
 }
 #endif
 
-VOS_STATUS WDA_notify_modem_power_state(void *wda_handle, tANI_U32 value)
-{
-	int32_t ret;
-	tp_wma_handle wma = (tp_wma_handle)wda_handle;
-
-	WMA_LOGD("%s: WMA Notify Modem Power State %d", __func__, value);
-
-	ret = wmi_unified_modem_power_state(wma->wmi_handle, value);
-	if (ret) {
-		WMA_LOGE("%s: Fail to notify Modem Power State %d", __func__, value);
-		return VOS_STATUS_E_FAILURE;
-	}
-
-	WMA_LOGD("Successfully notify Modem Power State %d", value);
-	return VOS_STATUS_SUCCESS;
-}
-
 /* Function to enable/disble Low Power Support(Pdev Specific) */
 VOS_STATUS WDA_SetIdlePsConfig(void *wda_handle, tANI_U32 idle_ps)
 {
diff --git a/CORE/SME/inc/sme_Api.h b/CORE/SME/inc/sme_Api.h
index b518293c17ff..357f9b8d4946 100644
--- a/CORE/SME/inc/sme_Api.h
+++ b/CORE/SME/inc/sme_Api.h
@@ -3400,7 +3400,7 @@ sme_StopBatchScanInd
  * is enabled
  */
 VOS_STATUS sme_SetIdlePowersaveConfig(v_PVOID_t vosContext, tANI_U32 value);
-VOS_STATUS sme_notify_modem_power_state(v_PVOID_t vosContext, tANI_U32 value);
+VOS_STATUS sme_notify_modem_power_state(tHalHandle hHal, tANI_U32 value);
 
 eHalStatus sme_ConfigEnablePowerSave (tHalHandle hHal, tPmcPowerSavingMode psMode);
 eHalStatus sme_ConfigDisablePowerSave (tHalHandle hHal, tPmcPowerSavingMode psMode);
diff --git a/CORE/SME/src/csr/csrApiRoam.c b/CORE/SME/src/csr/csrApiRoam.c
index 896ff1cc080a..115d372ccf1b 100644
--- a/CORE/SME/src/csr/csrApiRoam.c
+++ b/CORE/SME/src/csr/csrApiRoam.c
@@ -11592,13 +11592,13 @@ static void csrRoamGetBssStartParmsFromBssDesc( tpAniSirGlobal pMac, tSirBssDesc
             if (pIes->ExtSuppRates.present)
             {
                 pParam->extendedRateSet.numRates = pIes->ExtSuppRates.num_rates;
-                if(pIes->ExtSuppRates.num_rates > SIR_MAC_EXTENDED_RATE_EID_MAX)
+                if(pIes->ExtSuppRates.num_rates > SIR_MAC_RATESET_EID_MAX)
                 {
                    smsLog(pMac, LOGE, FL("num_rates :%d is more than \
                                          SIR_MAC_RATESET_EID_MAX, resetting to \
                                          SIR_MAC_RATESET_EID_MAX"),
                                          pIes->ExtSuppRates.num_rates);
-                   pIes->ExtSuppRates.num_rates = SIR_MAC_EXTENDED_RATE_EID_MAX;
+                   pIes->ExtSuppRates.num_rates = SIR_MAC_RATESET_EID_MAX;
                 }
                 vos_mem_copy(pParam->extendedRateSet.rate,
                              pIes->ExtSuppRates.rates,
@@ -15967,8 +15967,15 @@ eHalStatus csrRoamOffloadScan(tpAniSirGlobal pMac, tANI_U8 command, tANI_U8 reas
 #endif
     for (i = 0, j = 0; i < pRequestBuf->ConnectedNetwork.ChannelCount; i++)
     {
+        if (j < sizeof(ChannelCacheStr))
+        {
             j += snprintf(ChannelCacheStr + j, sizeof(ChannelCacheStr) - j," %d",
                           pRequestBuf->ConnectedNetwork.ChannelCache[i]);
+        }
+        else
+        {
+            break;
+        }
     }
     VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
               "ChnlCacheType:%d, No of Chnls:%d,Channels: %s",
diff --git a/CORE/SME/src/csr/csrNeighborRoam.c b/CORE/SME/src/csr/csrNeighborRoam.c
index 5841e665f3f0..17affe15b009 100644
--- a/CORE/SME/src/csr/csrNeighborRoam.c
+++ b/CORE/SME/src/csr/csrNeighborRoam.c
@@ -3852,6 +3852,10 @@ VOS_STATUS csrNeighborRoamTransitToCFGChanScan(tpAniSirGlobal pMac)
                              channelList,
                              &numOfChannels);
             }
+            if (numOfChannels > WNI_CFG_VALID_CHANNEL_LIST_LEN)
+            {
+                numOfChannels = WNI_CFG_VALID_CHANNEL_LIST_LEN;
+            }
 
             currChannelListInfo->ChannelList =
                 vos_mem_malloc(numOfChannels*sizeof(tANI_U8));
@@ -3865,10 +3869,6 @@ VOS_STATUS csrNeighborRoamTransitToCFGChanScan(tpAniSirGlobal pMac)
             vos_mem_copy(currChannelListInfo->ChannelList,
                     channelList, numOfChannels * sizeof(tANI_U8));
 #else
-            if (numOfChannels > WNI_CFG_VALID_CHANNEL_LIST_LEN)
-            {
-                numOfChannels = WNI_CFG_VALID_CHANNEL_LIST_LEN;
-            }
             vos_mem_copy(currChannelListInfo->ChannelList,
                     (tANI_U8 *)pMac->roam.validChannelList,
                     numOfChannels * sizeof(tANI_U8));
diff --git a/CORE/SME/src/csr/csrTdlsProcess.c b/CORE/SME/src/csr/csrTdlsProcess.c
index 86c28ac9c697..0eb44719ea27 100644
--- a/CORE/SME/src/csr/csrTdlsProcess.c
+++ b/CORE/SME/src/csr/csrTdlsProcess.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2014 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -170,7 +170,7 @@ eHalStatus csrTdlsChangePeerSta(tHalHandle hHal, tANI_U8 sessionId, tSirMacAddr
     //If connected and in Infra. Only then allow this
     if (CSR_IS_SESSION_VALID( pMac, sessionId ) &&
         csrIsConnStateConnectedInfra( pMac, sessionId ) &&
-        (NULL != peerMac)){
+        (NULL != peerMac) && (NULL != pstaParams)) {
 
         tdlsAddStaCmd = csrGetCommandBuffer(pMac) ;
 
diff --git a/CORE/SME/src/sme_common/sme_Api.c b/CORE/SME/src/sme_common/sme_Api.c
index e781723ecff8..3813718ddb6e 100644
--- a/CORE/SME/src/sme_common/sme_Api.c
+++ b/CORE/SME/src/sme_common/sme_Api.c
@@ -9960,8 +9960,15 @@ eHalStatus sme_ChangeRoamScanChannelList(tHalHandle hHal, tANI_U8 *pChannelList,
         {
             for (i = 0; i < pNeighborRoamInfo->cfgParams.channelInfo.numOfChannels; i++)
             {
-                j += snprintf(oldChannelList + j, sizeof(oldChannelList) - j," %d",
-                pNeighborRoamInfo->cfgParams.channelInfo.ChannelList[i]);
+                if (j < sizeof(oldChannelList))
+                {
+                    j += snprintf(oldChannelList + j, sizeof(oldChannelList) - j," %d",
+                    pNeighborRoamInfo->cfgParams.channelInfo.ChannelList[i]);
+                }
+                else
+                {
+                    break;
+                }
             }
         }
         csrFlushCfgBgScanRoamChannelList(pMac);
@@ -9972,8 +9979,15 @@ eHalStatus sme_ChangeRoamScanChannelList(tHalHandle hHal, tANI_U8 *pChannelList,
             j = 0;
             for (i = 0; i < pNeighborRoamInfo->cfgParams.channelInfo.numOfChannels; i++)
             {
-                j += snprintf(newChannelList + j, sizeof(newChannelList) - j," %d",
-                pNeighborRoamInfo->cfgParams.channelInfo.ChannelList[i]);
+                if (j < sizeof(newChannelList))
+                {
+                    j += snprintf(newChannelList + j, sizeof(newChannelList) - j," %d",
+                           pNeighborRoamInfo->cfgParams.channelInfo.ChannelList[i]);
+                }
+                else
+                {
+                    break;
+                }
             }
         }
         VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_DEBUG,
@@ -11071,23 +11085,40 @@ void activeListCmdTimeoutHandle(void *userData)
     smeGetCommandQStatus((tHalHandle) userData);
 }
 
-VOS_STATUS sme_notify_modem_power_state(v_PVOID_t vosContext, tANI_U32 value)
+VOS_STATUS sme_notify_modem_power_state(tHalHandle hHal, tANI_U32 value)
 {
-   v_PVOID_t wdaContext = vos_get_context(VOS_MODULE_ID_WDA, vosContext);
+   vos_msg_t msg;
+   tpSirModemPowerStateInd pRequestBuf;
+   tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
 
-   if (NULL == wdaContext)
+   if (NULL == pMac)
    {
-      VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
-                "%s: wdaContext is NULL", __func__);
       return VOS_STATUS_E_FAILURE;
    }
 
-   if (VOS_STATUS_SUCCESS != WDA_notify_modem_power_state(wdaContext, value))
+   pRequestBuf = vos_mem_malloc(sizeof(tSirModemPowerStateInd));
+   if (NULL == pRequestBuf)
    {
       VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
-                "Failed to notify modem power state %d", value);
+       "%s: Not able to allocate memory for MODEM POWER STATE IND",
+       __func__);
       return VOS_STATUS_E_FAILURE;
    }
+
+   pRequestBuf->param = value;
+
+   msg.type     = WDA_MODEM_POWER_STATE_IND;
+   msg.reserved = 0;
+   msg.bodyptr  = pRequestBuf;
+   if (!VOS_IS_STATUS_SUCCESS(vos_mq_post_message(VOS_MODULE_ID_WDA, &msg)))
+   {
+       VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+         "%s: Not able to post WDA_MODEM_POWER_STATE_IND message"
+         " to WDA", __func__);
+       vos_mem_free(pRequestBuf);
+       return VOS_STATUS_E_FAILURE;
+   }
+
    return VOS_STATUS_SUCCESS;
 }
 
diff --git a/CORE/WDA/inc/wlan_qct_wda.h b/CORE/WDA/inc/wlan_qct_wda.h
index e2ae45bd7e0e..0afa9f604495 100644
--- a/CORE/WDA/inc/wlan_qct_wda.h
+++ b/CORE/WDA/inc/wlan_qct_wda.h
@@ -1332,6 +1332,9 @@ tSirRetStatus uMacPostCtrlMsg(void* pSirGlobal, tSirMbMsg* pMb);
 #define WDA_DFS_BEACON_TX_SUCCESS_IND   SIR_HAL_BEACON_TX_SUCCESS_IND
 #define WDA_FW_STATS_IND           SIR_HAL_FW_STATS_IND
 
+#define WDA_MODEM_POWER_STATE_IND SIR_HAL_MODEM_POWER_STATE_IND
+
+
 tSirRetStatus wdaPostCtrlMsg(tpAniSirGlobal pMac, tSirMsgQ *pMsg);
 
 #define HAL_USE_BD_RATE2_FOR_MANAGEMENT_FRAME 0x40 // Bit 6 will be used to control BD rate for Management frames