Promotion of wlan-cmn.driver.lnx.1.0-00127.

CRs      Change ID                                   Subject
--------------------------------------------------------------------------------------------------------------
1104731   I5e07cad4f90e5e9b3c461268b8fa3635c3128b9f   qcacmn: Do not copy buffer to user-space if diag read fa
688141   I4347e5840f633d5ebd0049262effb2a04316f065   Release 5.1.0.27P
2002277   I4dafdef4de892531bb2935befaa9c7c5d63cbcf8   qcacmn: Free htc_messages when callback missing
688141   I5dc630254b2d4e4bb1b56e855c517266b12968ce   Release 5.1.0.27N
1074551   I950108b9d1c9094ce3d285493ee36bda4f9d7e41   qcacmn: Add support to dump few bytes of rx packet in DP
1115364   I1a2852189664fff31e29b487d7a8c66ee83931c5   qcacmn: Add support to dump ICMPV6 RS and RA in wow wake
688141   I6130d346cc07aeacc149b8e7f66861052557775f   Release 5.1.0.27O
688141   I3a3ee42a41b4dcb1eaa16a669443e78603305f19   Release 5.1.0.27M
688141   Ibe78baca2c211dbbbfb7a7d2a50a0527696c3c8b   Release 5.1.0.27L
1096384   I02502f05d2305f62cbde47db2893770673d19fc3   qcacmn: Fix incorrect data type assignment
1114632   I95fa6e7b2789dd97c0c500d0854210240feaac17   qcacmn: Allocate memory tracking node for nbuf clone and
688141   I1480b4d2ebdf673c8564c8fb5204d00265d21573   Release 5.1.0.27Q
2003475   Ib4ec89a2bf784a760ec67eeff7054a8733ca3cb2   qcacmn: Skip checking for NAPI in hif_lro_flush_cb_dereg

Change-Id: I9c276d993fcea6869fc68f0eab23eeeea5683ee7
CRs-Fixed: 1114632, 1096384, 2002277, 2003475, 1115364, 688141, 1104731, 1074551

9 files changed, 133 insertions, 35 deletions

diff --git a/VERSION.txt b/VERSION.txt
index e641faf4cfde..2d9075dafb34 100644
--- a/VERSION.txt
+++ b/VERSION.txt
@@ -1,2 +1,2 @@
-Current Component wlan-cmn.driver.lnx.1.0 version 5.1.0.27K
+Current Component wlan-cmn.driver.lnx.1.0 version 5.1.0.27Q
 Matches Component wlan-cld3.driver.lnx.1.1 version 5.1.0.22D
diff --git a/hif/src/ath_procfs.c b/hif/src/ath_procfs.c
index 0a19c65eaa58..f1cb6f06fd31 100644
--- a/hif/src/ath_procfs.c
+++ b/hif/src/ath_procfs.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2014, 2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2014, 2016-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -104,6 +104,8 @@ static ssize_t ath_procfs_diag_read(struct file *file, char __user *buf,
 	}
 
 out:
+	if (rv)
+		return -EIO;
 
 	if (copy_to_user(buf, read_buffer, count)) {
 		qdf_mem_free(read_buffer);
@@ -113,11 +115,7 @@ out:
 	} else
 		qdf_mem_free(read_buffer);
 
-	if (rv == 0) {
-		return count;
-	} else {
-		return -EIO;
-	}
+	return count;
 }
 
 static ssize_t ath_procfs_diag_write(struct file *file,
diff --git a/hif/src/hif_main.c b/hif/src/hif_main.c
index b00c25aac852..ea94367389f6 100644
--- a/hif/src/hif_main.c
+++ b/hif/src/hif_main.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2015-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -850,10 +850,8 @@ int hif_get_rx_ctx_id(int ctx_id, struct hif_opaque_softc *hif_hdl)
 void hif_lro_flush_cb_deregister(struct hif_opaque_softc *hif_hdl,
 				 void (lro_deinit_cb)(void *))
 {
-	if (hif_napi_enabled(hif_hdl, -1))
-		hif_napi_lro_flush_cb_deregister(hif_hdl, lro_deinit_cb);
-	else
-		ce_lro_flush_cb_deregister(hif_hdl, lro_deinit_cb);
+	hif_napi_lro_flush_cb_deregister(hif_hdl, lro_deinit_cb);
+	ce_lro_flush_cb_deregister(hif_hdl, lro_deinit_cb);
 }
 #else /* !defined(FEATURE_LRO) */
 int hif_get_rx_ctx_id(int ctx_id, struct hif_opaque_softc *hif_hdl)
diff --git a/htc/htc_recv.c b/htc/htc_recv.c
index 4e6e6e2b95ad..c4593b2fb223 100644
--- a/htc/htc_recv.c
+++ b/htc/htc_recv.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -114,6 +114,7 @@ static void do_recv_completion(HTC_ENDPOINT *pEndpoint,
 							("HTC ep %d has NULL recv callback on packet %p\n",
 							 pEndpoint->Id,
 							 pPacket));
+					qdf_nbuf_free(pPacket->pPktContext);
 					continue;
 				}
 				AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
diff --git a/qdf/inc/qdf_nbuf.h b/qdf/inc/qdf_nbuf.h
index 9e70ced04641..eeac76def3a9 100644
--- a/qdf/inc/qdf_nbuf.h
+++ b/qdf/inc/qdf_nbuf.h
@@ -196,6 +196,10 @@ struct mon_rx_status {
 #define ICMPV6_SUBTYPE_OFFSET         54
 #define ICMPV6_REQUEST                0x80
 #define ICMPV6_RESPONSE               0x81
+#define ICMPV6_RS                     0x85
+#define ICMPV6_RA                     0x86
+#define ICMPV6_NS                     0x87
+#define ICMPV6_NA                     0x88
 
 #define QDF_NBUF_IPA_CHECK_MASK		0x80000000
 
@@ -236,6 +240,10 @@ enum qdf_proto_type {
  * @QDF_PROTO_ICMP_RES - icmp response
  * @QDF_PROTO_ICMPV6_REQ - icmpv6 request
  * @QDF_PROTO_ICMPV6_RES - icmpv6 response
+ * @QDF_PROTO_ICMPV6_RS - icmpv6 rs packet
+ * @QDF_PROTO_ICMPV6_RA - icmpv6 ra packet
+ * @QDF_PROTO_ICMPV6_NS - icmpv6 ns packet
+ * @QDF_PROTO_ICMPV6_NA - icmpv6 na packet
  * @QDF_PROTO_IPV4_UDP - ipv4 udp
  * @QDF_PROTO_IPV4_TCP - ipv4 tcp
  * @QDF_PROTO_IPV6_UDP - ipv6 udp
@@ -268,6 +276,10 @@ enum qdf_proto_subtype {
 	QDF_PROTO_ICMP_RES,
 	QDF_PROTO_ICMPV6_REQ,
 	QDF_PROTO_ICMPV6_RES,
+	QDF_PROTO_ICMPV6_RS,
+	QDF_PROTO_ICMPV6_RA,
+	QDF_PROTO_ICMPV6_NS,
+	QDF_PROTO_ICMPV6_NA,
 	QDF_PROTO_IPV4_UDP,
 	QDF_PROTO_IPV4_TCP,
 	QDF_PROTO_IPV6_UDP,
@@ -613,6 +625,65 @@ static inline void qdf_nbuf_free(qdf_nbuf_t net_buf)
 	__qdf_nbuf_free(net_buf);
 }
 
+#define qdf_nbuf_clone(buf)     \
+	qdf_nbuf_clone_debug(buf, __FILE__, __LINE__)
+
+/**
+ * qdf_nbuf_clone_debug() - clone the nbuf (copy is readonly)
+ * @buf: nbuf to clone from
+ * @file_name: pointer to file name
+ * @line_num: line number
+ *
+ * This function clones the nbuf and creates a memory tracking
+ * node corresponding to that cloned skbuff structure.
+ *
+ * Return: cloned buffer
+ */
+static inline qdf_nbuf_t
+qdf_nbuf_clone_debug(qdf_nbuf_t buf, uint8_t *file_name,
+			uint32_t line_num)
+{
+	qdf_nbuf_t cloned_buf;
+
+	cloned_buf = __qdf_nbuf_clone(buf);
+
+	/* Store SKB in internal QDF tracking table */
+	if (qdf_likely(cloned_buf))
+		qdf_net_buf_debug_add_node(cloned_buf, 0, file_name, line_num);
+
+	return cloned_buf;
+}
+
+#define qdf_nbuf_copy(buf)     \
+	qdf_nbuf_copy_debug(buf, __FILE__, __LINE__)
+
+/**
+ * qdf_nbuf_copy_debug() - returns a private copy of the buf
+ * @buf: nbuf to copy from
+ * @file_name: pointer to file name
+ * @line_num: line number
+ *
+ * This API returns a private copy of the buf, the buf returned is completely
+ * modifiable by callers. It also creates a memory tracking node corresponding
+ * to that new skbuff structure.
+ *
+ * Return: copied buffer
+ */
+static inline qdf_nbuf_t
+qdf_nbuf_copy_debug(qdf_nbuf_t buf, uint8_t *file_name,
+			uint32_t line_num)
+{
+	qdf_nbuf_t copied_buf;
+
+	copied_buf = __qdf_nbuf_copy(buf);
+
+	/* Store SKB in internal QDF tracking table */
+	if (qdf_likely(copied_buf))
+		qdf_net_buf_debug_add_node(copied_buf, 0, file_name, line_num);
+
+	return copied_buf;
+}
+
 #else
 
 static inline void qdf_net_buf_debug_release_skb(qdf_nbuf_t net_buf)
@@ -634,6 +705,34 @@ static inline void qdf_nbuf_free(qdf_nbuf_t buf)
 	__qdf_nbuf_free(buf);
 }
 
+/**
+ * qdf_nbuf_clone() - clone the nbuf (copy is readonly)
+ * @buf: Pointer to network buffer
+ *
+ * This function clones the nbuf and returns new sk_buff
+ * structure.
+ *
+ * Return: cloned skb
+ */
+static inline qdf_nbuf_t qdf_nbuf_clone(qdf_nbuf_t buf)
+{
+	return __qdf_nbuf_clone(buf);
+}
+
+/**
+ * qdf_nbuf_copy() - returns a private copy of the buf
+ * @buf: Pointer to network buffer
+ *
+ * This API returns a private copy of the buf, the buf returned is completely
+ *  modifiable by callers
+ *
+ * Return: skb or NULL
+ */
+static inline qdf_nbuf_t qdf_nbuf_copy(qdf_nbuf_t buf)
+{
+	return __qdf_nbuf_copy(buf);
+}
+
 #endif
 
 #ifdef WLAN_FEATURE_FASTPATH
@@ -668,11 +767,6 @@ static inline int qdf_nbuf_shared(qdf_nbuf_t buf)
 	return __qdf_nbuf_shared(buf);
 }
 
-static inline qdf_nbuf_t qdf_nbuf_copy(qdf_nbuf_t buf)
-{
-	return __qdf_nbuf_copy(buf);
-}
-
 static inline QDF_STATUS qdf_nbuf_cat(qdf_nbuf_t dst, qdf_nbuf_t src)
 {
 	return __qdf_nbuf_cat(dst, src);
@@ -693,16 +787,6 @@ qdf_nbuf_copy_bits(qdf_nbuf_t nbuf, uint32_t offset, uint32_t len, void *to)
 	return __qdf_nbuf_copy_bits(nbuf, offset, len, to);
 }
 
-/**
- * qdf_nbuf_clone() - clone the nbuf (copy is readonly)
- * @buf: nbuf to clone from
- *
- * Return: cloned buffer
- */
-static inline qdf_nbuf_t qdf_nbuf_clone(qdf_nbuf_t buf)
-{
-	return __qdf_nbuf_clone(buf);
-}
 
 /* nbuf manipulation routines */
 
diff --git a/qdf/inc/qdf_trace.h b/qdf/inc/qdf_trace.h
index 375257cdb34d..1505d54504e8 100644
--- a/qdf/inc/qdf_trace.h
+++ b/qdf/inc/qdf_trace.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -173,7 +173,8 @@ typedef struct s_qdf_trace_data {
  * @QDF_DP_TRACE_HIF_PACKET_PTR_RECORD - hif packet ptr record
  * @QDF_DP_TRACE_RX_TXRX_PACKET_PTR_RECORD - txrx packet ptr record
  * @QDF_DP_TRACE_MED_VERBOSITY - below this are part of med verbosity
- * @QDF_DP_TRACE_HDD_TX_PACKET_RECORD - record 32 bytes at HDD
+ * @QDF_DP_TRACE_HDD_TX_PACKET_RECORD - record 32 bytes of tx pkt at HDD
+ * @QDF_DP_TRACE_HDD_RX_PACKET_RECORD - record 32 bytes of rx pkt at HDD
  * @QDF_DP_TRACE_HIGH_VERBOSITY - below this are part of high verbosity
  */
 enum  QDF_DP_TRACE_ID {
@@ -204,6 +205,7 @@ enum  QDF_DP_TRACE_ID {
 	QDF_DP_TRACE_RX_TXRX_PACKET_PTR_RECORD,
 	QDF_DP_TRACE_MED_VERBOSITY,
 	QDF_DP_TRACE_HDD_TX_PACKET_RECORD,
+	QDF_DP_TRACE_HDD_RX_PACKET_RECORD,
 	QDF_DP_TRACE_HIGH_VERBOSITY,
 	QDF_DP_TRACE_MAX
 };
diff --git a/qdf/linux/src/qdf_nbuf.c b/qdf/linux/src/qdf_nbuf.c
index 88ba0722d7e3..60f97cbe98fb 100644
--- a/qdf/linux/src/qdf_nbuf.c
+++ b/qdf/linux/src/qdf_nbuf.c
@@ -651,6 +651,18 @@ __qdf_nbuf_data_get_icmpv6_subtype(uint8_t *data)
 	case ICMPV6_RESPONSE:
 		proto_subtype = QDF_PROTO_ICMPV6_RES;
 		break;
+	case ICMPV6_RS:
+		proto_subtype = QDF_PROTO_ICMPV6_RS;
+		break;
+	case ICMPV6_RA:
+		proto_subtype = QDF_PROTO_ICMPV6_RA;
+		break;
+	case ICMPV6_NS:
+		proto_subtype = QDF_PROTO_ICMPV6_NS;
+		break;
+	case ICMPV6_NA:
+		proto_subtype = QDF_PROTO_ICMPV6_NA;
+		break;
 	default:
 		break;
 	}
diff --git a/qdf/linux/src/qdf_trace.c b/qdf/linux/src/qdf_trace.c
index 79604f5925ae..eaf3d0c9e691 100644
--- a/qdf/linux/src/qdf_trace.c
+++ b/qdf/linux/src/qdf_trace.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2016 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -998,6 +998,8 @@ const char *qdf_dp_code_to_string(enum QDF_DP_TRACE_ID code)
 		return "HTT: RX: OF: PTR:";
 	case QDF_DP_TRACE_RX_HDD_PACKET_PTR_RECORD:
 		return "HDD: RX: PTR:";
+	case QDF_DP_TRACE_HDD_RX_PACKET_RECORD:
+		return "HDD: RX: DATA:";
 	case QDF_DP_TRACE_TXRX_QUEUE_PACKET_PTR_RECORD:
 		return "TXRX: TX: Q: PTR:";
 	case QDF_DP_TRACE_TXRX_PACKET_PTR_RECORD:
@@ -1570,6 +1572,7 @@ void qdf_dp_display_record(struct qdf_dp_trace_record_s *pRecord,
 		DPTRACE_PRINT("DPT: HDD SoftAP TX Timeout\n");
 		break;
 	case QDF_DP_TRACE_HDD_TX_PACKET_RECORD:
+	case QDF_DP_TRACE_HDD_RX_PACKET_RECORD:
 		dump_hex_trace("DATA", pRecord->data, pRecord->size);
 		break;
 	default:
diff --git a/wmi/src/wmi_unified_tlv.c b/wmi/src/wmi_unified_tlv.c
index f91efdc0ba3a..c764fa4cf13d 100644
--- a/wmi/src/wmi_unified_tlv.c
+++ b/wmi/src/wmi_unified_tlv.c
@@ -5314,10 +5314,10 @@ static QDF_STATUS wmi_get_buf_extscan_change_monitor_cmd(wmi_unified_t wmi_handl
 	uint8_t *buf_ptr;
 	int j;
 	int len = sizeof(*cmd);
-	int numap = psigchange->num_ap;
+	uint32_t numap = psigchange->num_ap;
 	struct ap_threshold_params *src_ap = psigchange->ap;
 
-	if (!numap) {
+	if (!numap || (numap > WMI_WLAN_EXTSCAN_MAX_SIGNIFICANT_CHANGE_APS)) {
 		WMI_LOGE("%s: Invalid number of bssid's", __func__);
 		return QDF_STATUS_E_INVAL;
 	}
@@ -11250,7 +11250,7 @@ QDF_STATUS send_get_buf_extscan_hotlist_cmd_tlv(wmi_unified_t wmi_handle,
 	int cmd_len = 0;
 	int num_entries;
 	int min_entries = 0;
-	int numap = photlist->numAp;
+	uint32_t numap = photlist->numAp;
 	int len = sizeof(*cmd);
 
 	len += WMI_TLV_HDR_SIZE;
@@ -11262,7 +11262,7 @@ QDF_STATUS send_get_buf_extscan_hotlist_cmd_tlv(wmi_unified_t wmi_handle,
 	/* setbssid hotlist expects the bssid list
 	 * to be non zero value
 	 */
-	if ((numap <= 0) || (numap > WMI_WLAN_EXTSCAN_MAX_HOTLIST_APS)) {
+	if (!numap || (numap > WMI_WLAN_EXTSCAN_MAX_HOTLIST_APS)) {
 		WMI_LOGE("Invalid number of APs: %d", numap);
 		return QDF_STATUS_E_INVAL;
 	}