From 80341fff1d7097a1d5ed18918d27a9326ba569f6 Mon Sep 17 00:00:00 2001
From: Bala Shanmugam Kamatchi <bkamatch@qti.qualcomm.com>
Date: Fri, 14 Mar 2014 05:50:00 +0530
Subject: qcacld: hdd: Update WMM status properly

When ACM bit is not set do not update WMM state variable
to ensure access to a specific AC is maintained.
Update WMM state while handling DELTS request.

Change-Id: I2cac960b5e695fdb9be6d2e300a152ecf3efaf24
CRs-Fixed: 627289, 622699
---
 CORE/HDD/src/wlan_hdd_wmm.c | 24 +++++++++++++++---------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/CORE/HDD/src/wlan_hdd_wmm.c b/CORE/HDD/src/wlan_hdd_wmm.c
index 49a36b76ebef..d9ac2c1b4c32 100644
--- a/CORE/HDD/src/wlan_hdd_wmm.c
+++ b/CORE/HDD/src/wlan_hdd_wmm.c
@@ -792,6 +792,7 @@ static eHalStatus hdd_wmm_sme_callback (tHalHandle hHal,
                 "%s: Setup Invalid Params, notify TL",
                 __func__);
       // QoS setup failed
+      pAc->wmmAcAccessAllowed = VOS_FALSE;
 
       if (HDD_WMM_HANDLE_IMPLICIT == pQosContext->handle)
       {
@@ -975,7 +976,6 @@ static eHalStatus hdd_wmm_sme_callback (tHalHandle hHal,
       VOS_TRACE(VOS_MODULE_ID_HDD, WMM_TRACE_LEVEL_INFO,
                 "%s: Release is complete",
                 __func__);
-      pAc->wmmAcAccessGranted = VOS_FALSE;
 
       if (pCurrentQosInfo)
       {
@@ -1001,6 +1001,9 @@ static eHalStatus hdd_wmm_sme_callback (tHalHandle hHal,
          // this is the last flow active for this AC so update the AC state
          pAc->wmmAcTspecValid = VOS_FALSE;
 
+         // DELTS is successful, do not allow
+         pAc->wmmAcAccessAllowed = VOS_FALSE;
+
          // need to tell TL to update its UAPSD handling
          hdd_wmm_disable_tl_uapsd(pQosContext);
       }
@@ -1046,6 +1049,8 @@ static eHalStatus hdd_wmm_sme_callback (tHalHandle hHal,
 
       // current TSPEC is no longer valid
       pAc->wmmAcTspecValid = VOS_FALSE;
+      // AP has sent DELTS, do not allow
+      pAc->wmmAcAccessAllowed = VOS_FALSE;
 
       // need to tell TL to update its UAPSD handling
       hdd_wmm_disable_tl_uapsd(pQosContext);
@@ -1211,20 +1216,21 @@ static eHalStatus hdd_wmm_sme_callback (tHalHandle hHal,
       VOS_ASSERT(0);
    }
 
+#ifndef QCA_WIFI_2_0
    // our access to the particular access category may have changed.
    // some of the implicit QoS cases above may have already set this
    // prior to invoking TL (so that we will properly service the
    // Tx queues) but let's consistently handle all cases here
    pAc->wmmAcAccessAllowed = hdd_wmm_is_access_allowed(pAdapter, pAc);
-
-   //hdd_wmm_is_access_allowed returns true for explicit case. This is
-   //not always true. If Access to particular AC fails and if
-   //admission is required for that particular AC, then access is not
-   //allowed to that AC.
-   if ((pAc->wmmAcAccessFailed && pAc->wmmAcAccessRequired) ||
-        !pAc->wmmAcAccessGranted) {
+#else
+   // if Tspec only allows downstream traffic then access is not allowed
+   if (pAc->wmmAcTspecInfo.ts_info.direction == SME_QOS_WMM_TS_DIR_DOWNLINK)
       pAc->wmmAcAccessAllowed = VOS_FALSE;
-   }
+
+   // if ACM bit is not set, allow access
+   if (!(pAc->wmmAcAccessRequired))
+      pAc->wmmAcAccessAllowed = VOS_TRUE;
+#endif
 
    VOS_TRACE(VOS_MODULE_ID_HDD, WMM_TRACE_LEVEL_INFO,
              "%s: complete, access for TL AC %d is%sallowed",
-- 
cgit v1.2.3


From 918707606835462bfb15bda3f9c79e7dd40fd3c5 Mon Sep 17 00:00:00 2001
From: Rajeev Kumar <rajekuma@qca.qualcomm.com>
Date: Wed, 12 Mar 2014 19:30:56 -0700
Subject: qcacld: Fix of memory leak in wma_dfs_attach

Fix of memory leak in wma_dfs_attach reported by kmemleak utility

Change-Id: Ic1b92e9c3423544cd80222f6f00c676143a29513
CRs-Fixed: 630779
---
 CORE/SERVICES/WMA/wma.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c
index 3ac974a12531..9e5e14ea05a3 100644
--- a/CORE/SERVICES/WMA/wma.c
+++ b/CORE/SERVICES/WMA/wma.c
@@ -16785,6 +16785,15 @@ VOS_STATUS wma_wmi_service_close(v_VOID_t *vos_ctx)
 }
 
 
+/*
+ * Detach DFS methods
+ */
+static void wma_dfs_detach(struct ieee80211com *dfs_ic)
+{
+	dfs_detach(dfs_ic);
+	OS_FREE(dfs_ic);
+}
+
 /* function   : wma_close
  * Descriptin :
  * Args       :
@@ -16858,6 +16867,11 @@ VOS_STATUS wma_close(v_VOID_t *vos_ctx)
 		wma_utf_detach(wma_handle);
 #endif
 
+	if (NULL != wma_handle->dfs_ic){
+		wma_dfs_detach(wma_handle->dfs_ic);
+		wma_handle->dfs_ic = NULL;
+	}
+
 	WMA_LOGD("%s: Exit", __func__);
 	return VOS_STATUS_SUCCESS;
 }
-- 
cgit v1.2.3


From 9d84d30fefc9314dd02e01722ec1aafbd2cef102 Mon Sep 17 00:00:00 2001
From: Rajeev Kumar <rajekuma@qca.qualcomm.com>
Date: Wed, 12 Mar 2014 19:53:43 -0700
Subject: qcacld: Fix of Memory leak in HIF_PCIDeviceProbed

Fix of memory leak in HIF_PCIDeviceProbed() for sc->hif_device

Change-Id: I5127d07c38626aa59ec82afb1c5bdcafd152f434
CRs-Fixed: 630802
---
 CORE/SERVICES/HIF/PCIe/if_pci.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CORE/SERVICES/HIF/PCIe/if_pci.c b/CORE/SERVICES/HIF/PCIe/if_pci.c
index 9f11d8d3c074..b9be432a0b9f 100644
--- a/CORE/SERVICES/HIF/PCIe/if_pci.c
+++ b/CORE/SERVICES/HIF/PCIe/if_pci.c
@@ -1459,6 +1459,7 @@ hif_pci_remove(struct pci_dev *pdev)
 
     pci_disable_msi(pdev);
     A_FREE(scn);
+    A_FREE(sc->hif_device);
     A_FREE(sc);
     pci_set_drvdata(pdev, NULL);
     pci_iounmap(pdev, mem);
-- 
cgit v1.2.3


From c2c4418b207eb0717cfddb3c62e63aca0f389dcd Mon Sep 17 00:00:00 2001
From: Kiran Kumar Lokere <klokere@qca.qualcomm.com>
Date: Tue, 11 Mar 2014 14:51:53 -0700
Subject: qcacld: Fix the kernel warning reported in WLAN

Since mutex locks are used in a function which is protected with
spinlocks, observed the kernel warning about sleeping function.
Instead of using the spin lock protection, serializing the
function call to MC thread will avoid the race condition between
ack timeout and tx complete confirm for dis-assoc and deauth
frames.Ack timeout function does the clean up in MC thread
and tx complete does clean up in txrx workqueue context. When
tx complete and ack timeout happens at same time then race
condition occurs. To avoid the race condition, serializing the
limSendDisassocCnf function call to MC thread context.

Change-Id: I9e74ced2c70f737500e6e7912572aca5e76c533d
CRs-Fixed: 626936
---
 CORE/MAC/inc/aniGlobal.h                       |  3 +-
 CORE/MAC/src/include/sirParams.h               |  3 ++
 CORE/MAC/src/pe/lim/limApi.c                   | 21 ++---------
 CORE/MAC/src/pe/lim/limProcessMessageQueue.c   |  8 ++++
 CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c | 42 ---------------------
 CORE/MAC/src/pe/lim/limSendManagementFrames.c  | 38 +------------------
 CORE/MAC/src/pe/lim/limTypes.h                 |  4 ++
 CORE/SERVICES/WMA/wma.c                        | 52 ++++++++++++++++++++------
 CORE/WDA/inc/wlan_qct_wda.h                    |  2 +
 9 files changed, 65 insertions(+), 108 deletions(-)

diff --git a/CORE/MAC/inc/aniGlobal.h b/CORE/MAC/inc/aniGlobal.h
index ed7d984b0d1a..1529b7b4950a 100644
--- a/CORE/MAC/inc/aniGlobal.h
+++ b/CORE/MAC/inc/aniGlobal.h
@@ -261,7 +261,6 @@ typedef struct sLimTimers
 typedef struct {
     void *pMlmDisassocReq;
     void *pMlmDeauthReq;
-    vos_spin_lock_t deauthDisassocInprogress;
 }tLimDisassocDeauthCnfReq;
 
 typedef struct sAniSirLim
@@ -657,7 +656,7 @@ typedef struct sAniSirLim
 
     // admission control policy information
     tLimAdmitPolicyInfo admitPolicyInfo;
-    vos_spin_lock_t lkPeGlobalLock;
+    vos_lock_t lkPeGlobalLock;
     tANI_U8 disableLDPCWithTxbfAP;
 #ifdef FEATURE_WLAN_TDLS
     tANI_U8 gLimTDLSBufStaEnabled;
diff --git a/CORE/MAC/src/include/sirParams.h b/CORE/MAC/src/include/sirParams.h
index 9d41e7047ae7..cf952d6257cd 100644
--- a/CORE/MAC/src/include/sirParams.h
+++ b/CORE/MAC/src/include/sirParams.h
@@ -661,6 +661,9 @@ typedef struct sSirMbMsgP2p
 
 #define SIR_HAL_MODEM_POWER_STATE_IND      (SIR_HAL_ITC_MSG_TYPES_BEGIN + 254)
 
+#define SIR_HAL_DISASSOC_TX_COMP           (SIR_HAL_ITC_MSG_TYPES_BEGIN + 255)
+#define SIR_HAL_DEAUTH_TX_COMP             (SIR_HAL_ITC_MSG_TYPES_BEGIN + 256)
+
 #define SIR_HAL_MSG_TYPES_END              (SIR_HAL_MSG_TYPES_BEGIN + 0x1FF)
 
 // CFG message types
diff --git a/CORE/MAC/src/pe/lim/limApi.c b/CORE/MAC/src/pe/lim/limApi.c
index 850f84c9aa7b..754644abbdd1 100644
--- a/CORE/MAC/src/pe/lim/limApi.c
+++ b/CORE/MAC/src/pe/lim/limApi.c
@@ -1027,18 +1027,11 @@ tSirRetStatus peOpen(tpAniSirGlobal pMac, tMacOpenParameters *pMacOpenParam)
     pMac->lim.mgmtFrameSessionId = 0xff;
     pMac->lim.deferredMsgCnt = 0;
 
-    if( !VOS_IS_STATUS_SUCCESS( vos_spin_lock_init( &pMac->lim.lkPeGlobalLock ) ) )
+    if( !VOS_IS_STATUS_SUCCESS( vos_lock_init( &pMac->lim.lkPeGlobalLock ) ) )
     {
         PELOGE(limLog(pMac, LOGE, FL("pe lock init failed!"));)
         return eSIR_FAILURE;
     }
-
-    if (!VOS_IS_STATUS_SUCCESS(
-        vos_spin_lock_init(&pMac->lim.limDisassocDeauthCnfReq.deauthDisassocInprogress)))
-    {
-        PELOGE(limLog(pMac, LOGE, FL("deauth/disassoc process lock init failed!"));)
-        return eSIR_FAILURE;
-    }
     pMac->lim.deauthMsgCnt = 0;
     return eSIR_SUCCESS;
 }
@@ -1081,14 +1074,8 @@ tSirRetStatus peClose(tpAniSirGlobal pMac)
     */
     vos_mem_free(pMac->pmm.gPmmTim.pTim);
     pMac->pmm.gPmmTim.pTim = NULL;
-    if( !VOS_IS_STATUS_SUCCESS( vos_spin_lock_destroy( &pMac->lim.lkPeGlobalLock ) ) )
-    {
-        return eSIR_FAILURE;
-    }
-    if (!VOS_IS_STATUS_SUCCESS(
-        vos_spin_lock_destroy(&pMac->lim.limDisassocDeauthCnfReq.deauthDisassocInprogress)))
+    if( !VOS_IS_STATUS_SUCCESS( vos_lock_destroy( &pMac->lim.lkPeGlobalLock ) ) )
     {
-        PELOGE(limLog(pMac, LOGE, FL("deauth/disassoc process lock destroy failed!"));)
         return eSIR_FAILURE;
     }
     return eSIR_SUCCESS;
@@ -2384,7 +2371,7 @@ eHalStatus pe_AcquireGlobalLock( tAniSirLim *psPe)
 
     if(psPe)
     {
-        if( VOS_IS_STATUS_SUCCESS( vos_spin_lock_acquire( &psPe->lkPeGlobalLock) ) )
+        if( VOS_IS_STATUS_SUCCESS( vos_lock_acquire( &psPe->lkPeGlobalLock) ) )
         {
             status = eHAL_STATUS_SUCCESS;
         }
@@ -2396,7 +2383,7 @@ eHalStatus pe_ReleaseGlobalLock( tAniSirLim *psPe)
     eHalStatus status = eHAL_STATUS_INVALID_PARAMETER;
     if(psPe)
     {
-        if( VOS_IS_STATUS_SUCCESS( vos_spin_lock_release( &psPe->lkPeGlobalLock) ) )
+        if( VOS_IS_STATUS_SUCCESS( vos_lock_release( &psPe->lkPeGlobalLock) ) )
         {
             status = eHAL_STATUS_SUCCESS;
         }
diff --git a/CORE/MAC/src/pe/lim/limProcessMessageQueue.c b/CORE/MAC/src/pe/lim/limProcessMessageQueue.c
index 381534be6bc2..663490708222 100644
--- a/CORE/MAC/src/pe/lim/limProcessMessageQueue.c
+++ b/CORE/MAC/src/pe/lim/limProcessMessageQueue.c
@@ -2086,6 +2086,14 @@ limProcessMessages(tpAniSirGlobal pMac, tpSirMsgQ  limMsg)
         limMsg->bodyptr = NULL;
         break;
 
+    case WDA_DISASSOC_TX_COMP:
+        limDisassocTxCompleteCnf(pMac , limMsg->bodyval);
+        break;
+
+    case WDA_DEAUTH_TX_COMP:
+        limDeauthTxCompleteCnf(pMac, limMsg->bodyval);
+        break;
+
     case eWNI_SME_DFS_BEACON_CHAN_SW_IE_REQ:
         limProcessSmeReqMessages(pMac, limMsg);
         vos_mem_free((v_VOID_t*)limMsg->bodyptr);
diff --git a/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c b/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c
index b1281419aab6..04bef5d98ac1 100644
--- a/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c
+++ b/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c
@@ -2923,21 +2923,7 @@ limProcessMlmDisassocReqNtf(tpAniSirGlobal pMac, eHalStatus suspendStatus, tANI_
                                  psessionEntry, FALSE);
 
              /* Send Disassoc CNF and receive path cleanup */
-             if (!VOS_IS_STATUS_SUCCESS(vos_spin_lock_acquire
-                 (&pMac->lim.limDisassocDeauthCnfReq.deauthDisassocInprogress)))
-             {
-                 PELOGE(limLog(pMac, LOGE, FL
-                     ("deauth/disassoc process lock aquire failed!"));)
-                 return;
-             }
              limSendDisassocCnf(pMac);
-             if (!VOS_IS_STATUS_SUCCESS(vos_spin_lock_release
-                 (&pMac->lim.limDisassocDeauthCnfReq.deauthDisassocInprogress)))
-             {
-                 PELOGE(limLog(pMac, LOGE, FL
-                     ("deauth/disassoc process lock release failed!"));)
-                 return;
-             }
         }
         else
         {
@@ -3062,21 +3048,7 @@ void limCleanUpDisassocDeauthReq(tpAniSirGlobal pMac,
 
 void limProcessDisassocAckTimeout(tpAniSirGlobal pMac)
 {
-    if (!VOS_IS_STATUS_SUCCESS(vos_spin_lock_acquire
-         (&pMac->lim.limDisassocDeauthCnfReq.deauthDisassocInprogress)))
-    {
-        PELOGE(limLog(pMac, LOGE, FL
-                     ("deauth/disassoc process lock aquire failed!"));)
-        return;
-    }
     limSendDisassocCnf(pMac);
-    if (!VOS_IS_STATUS_SUCCESS(vos_spin_lock_release
-         (&pMac->lim.limDisassocDeauthCnfReq.deauthDisassocInprogress)))
-    {
-        PELOGE(limLog(pMac, LOGE, FL
-                     ("deauth/disassoc process lock release failed!"));)
-        return;
-    }
 }
 
 /**
@@ -3355,21 +3327,7 @@ end:
 
 void limProcessDeauthAckTimeout(tpAniSirGlobal pMac)
 {
-    if (!VOS_IS_STATUS_SUCCESS(vos_spin_lock_acquire
-         (&pMac->lim.limDisassocDeauthCnfReq.deauthDisassocInprogress)))
-    {
-        PELOGE(limLog(pMac, LOGE, FL
-                     ("deauth/disassoc process lock aquire failed!"));)
-        return;
-    }
     limSendDeauthCnf(pMac);
-    if (!VOS_IS_STATUS_SUCCESS(vos_spin_lock_release
-         (&pMac->lim.limDisassocDeauthCnfReq.deauthDisassocInprogress)))
-    {
-        PELOGE(limLog(pMac, LOGE, FL
-                     ("deauth/disassoc process lock release failed!"));)
-        return;
-    }
 }
 
 /**
diff --git a/CORE/MAC/src/pe/lim/limSendManagementFrames.c b/CORE/MAC/src/pe/lim/limSendManagementFrames.c
index b9637a6b31b7..4f3e59825296 100644
--- a/CORE/MAC/src/pe/lim/limSendManagementFrames.c
+++ b/CORE/MAC/src/pe/lim/limSendManagementFrames.c
@@ -3853,46 +3853,12 @@ end:
 
 eHalStatus limDisassocTxCompleteCnf(tpAniSirGlobal pMac, tANI_U32 txCompleteSuccess)
 {
-    eHalStatus status = eHAL_STATUS_FAILURE;
-
-    if (!VOS_IS_STATUS_SUCCESS(vos_spin_lock_acquire
-         (&pMac->lim.limDisassocDeauthCnfReq.deauthDisassocInprogress)))
-    {
-        PELOGE(limLog(pMac, LOGE, FL
-                     ("deauth/disassoc process lock aquire failed!"));)
-        return status;
-    }
-    status = limSendDisassocCnf(pMac);
-    if (!VOS_IS_STATUS_SUCCESS(vos_spin_lock_release
-         (&pMac->lim.limDisassocDeauthCnfReq.deauthDisassocInprogress)))
-    {
-        PELOGE(limLog(pMac, LOGE, FL
-                     ("deauth/disassoc process lock release failed!"));)
-        return eHAL_STATUS_FAILURE;
-    }
-    return status;
+    return limSendDisassocCnf(pMac);
 }
 
 eHalStatus limDeauthTxCompleteCnf(tpAniSirGlobal pMac, tANI_U32 txCompleteSuccess)
 {
-    eHalStatus status = eHAL_STATUS_FAILURE;
-
-    if (!VOS_IS_STATUS_SUCCESS(vos_spin_lock_acquire
-         (&pMac->lim.limDisassocDeauthCnfReq.deauthDisassocInprogress)))
-    {
-        PELOGE(limLog(pMac, LOGE, FL
-                     ("deauth/disassoc process lock aquire failed!"));)
-        return status;
-    }
-    status = limSendDeauthCnf(pMac);
-    if (!VOS_IS_STATUS_SUCCESS(vos_spin_lock_release
-         (&pMac->lim.limDisassocDeauthCnfReq.deauthDisassocInprogress)))
-    {
-        PELOGE(limLog(pMac, LOGE, FL
-                     ("deauth/disassoc process lock release failed!"));)
-        return eHAL_STATUS_FAILURE;
-    }
-    return status;
+    return limSendDeauthCnf(pMac);
 }
 
 /**
diff --git a/CORE/MAC/src/pe/lim/limTypes.h b/CORE/MAC/src/pe/lim/limTypes.h
index 3a00a8fc5167..8b06fac3d11f 100644
--- a/CORE/MAC/src/pe/lim/limTypes.h
+++ b/CORE/MAC/src/pe/lim/limTypes.h
@@ -1089,6 +1089,10 @@ void limProcessDisassocAckTimeout(tpAniSirGlobal pMac);
 void limProcessDeauthAckTimeout(tpAniSirGlobal pMac);
 eHalStatus limSendDisassocCnf(tpAniSirGlobal pMac);
 eHalStatus limSendDeauthCnf(tpAniSirGlobal pMac);
+eHalStatus limDisassocTxCompleteCnf(tpAniSirGlobal pMac,
+                tANI_U32 txCompleteSuccess);
+eHalStatus limDeauthTxCompleteCnf(tpAniSirGlobal pMac,
+                tANI_U32 txCompleteSuccess);
 
 #ifdef WLAN_FEATURE_VOWIFI_11R
 typedef struct sSetLinkCbackParams
diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c
index 9e5e14ea05a3..3287bff46bdc 100644
--- a/CORE/SERVICES/WMA/wma.c
+++ b/CORE/SERVICES/WMA/wma.c
@@ -15602,6 +15602,29 @@ static void wma_mgmt_tx_ack_work_handler(struct work_struct *ack_work)
 	wma_handle->ack_work_ctx = NULL;
 }
 
+/* function   : wma_mgmt_tx_comp_conf_ind
+ * Descriptin : Post mgmt tx complete indication to PE.
+ * Args       :
+                wma_handle  : Pointer to WMA handle
+ *              sub_type    : Tx mgmt frame sub type
+ *              status      : Mgmt frame tx status
+ * Returns    :
+ */
+static void
+wma_mgmt_tx_comp_conf_ind(tp_wma_handle wma_handle, u_int8_t sub_type,
+							int32_t status)
+{
+	int32_t tx_comp_status;
+
+	tx_comp_status = status ? 0 : 1;
+	if(sub_type == SIR_MAC_MGMT_DISASSOC) {
+		wma_send_msg(wma_handle, WDA_DISASSOC_TX_COMP, NULL, tx_comp_status);
+	}
+	else if(sub_type == SIR_MAC_MGMT_DEAUTH) {
+		wma_send_msg(wma_handle, WDA_DEAUTH_TX_COMP, NULL, tx_comp_status);
+	}
+}
+
 /**
   * wma_mgmt_tx_ack_comp_hdlr - handles tx ack mgmt completion
   * @context: context with which the handler is registered
@@ -15620,20 +15643,27 @@ wma_mgmt_tx_ack_comp_hdlr(void *wma_context,
 	tp_wma_handle wma_handle = (tp_wma_handle)wma_context;
 
 	if(wma_handle && wma_handle->umac_ota_ack_cb[pFc->subType]) {
-		struct wma_tx_ack_work_ctx *ack_work;
+		if((pFc->subType == SIR_MAC_MGMT_DISASSOC) ||
+			(pFc->subType == SIR_MAC_MGMT_DEAUTH)) {
+			wma_mgmt_tx_comp_conf_ind(wma_handle, (u_int8_t)pFc->subType,
+										status);
+		}
+		else {
+			struct wma_tx_ack_work_ctx *ack_work;
 
-		ack_work =
-		adf_os_mem_alloc(NULL, sizeof(struct wma_tx_ack_work_ctx));
+			ack_work =
+			adf_os_mem_alloc(NULL, sizeof(struct wma_tx_ack_work_ctx));
 
-		if(ack_work) {
-			INIT_WORK(&ack_work->ack_cmp_work,
-					wma_mgmt_tx_ack_work_handler);
-			ack_work->wma_handle = wma_handle;
-			ack_work->sub_type = pFc->subType;
-			ack_work->status = status;
+			if(ack_work) {
+				INIT_WORK(&ack_work->ack_cmp_work,
+						wma_mgmt_tx_ack_work_handler);
+				ack_work->wma_handle = wma_handle;
+				ack_work->sub_type = pFc->subType;
+				ack_work->status = status;
 
-			/* Schedue the Work */
-			schedule_work(&ack_work->ack_cmp_work);
+				/* Schedue the Work */
+				schedule_work(&ack_work->ack_cmp_work);
+			}
 		}
 	}
 }
diff --git a/CORE/WDA/inc/wlan_qct_wda.h b/CORE/WDA/inc/wlan_qct_wda.h
index 0afa9f604495..6aa98677253e 100644
--- a/CORE/WDA/inc/wlan_qct_wda.h
+++ b/CORE/WDA/inc/wlan_qct_wda.h
@@ -1331,6 +1331,8 @@ tSirRetStatus uMacPostCtrlMsg(void* pSirGlobal, tSirMbMsg* pMb);
  */
 #define WDA_DFS_BEACON_TX_SUCCESS_IND   SIR_HAL_BEACON_TX_SUCCESS_IND
 #define WDA_FW_STATS_IND           SIR_HAL_FW_STATS_IND
+#define WDA_DISASSOC_TX_COMP       SIR_HAL_DISASSOC_TX_COMP
+#define WDA_DEAUTH_TX_COMP         SIR_HAL_DEAUTH_TX_COMP
 
 #define WDA_MODEM_POWER_STATE_IND SIR_HAL_MODEM_POWER_STATE_IND
 
-- 
cgit v1.2.3


From 090c1f4d18d0b91f373869d6731229da2a717a17 Mon Sep 17 00:00:00 2001
From: Sundar Subramaniyan <subrams@qti.qualcomm.com>
Date: Wed, 12 Mar 2014 00:17:39 +0530
Subject: qcacld: Add session ID to PNO scan completion event

When firmware sends the PNO scan completion event, WDA_RX_SCAN_EVENT
is posted to UMAC without setting the session ID. The allocated
scan_event buffer is also not memset to zero and so this could lead
to use of invalid session ID. So set the vdev ID from the NLO event
as the session ID for which PNO was started. Also mem zero the allocated
scan_event buffer.

Change-Id: I9e9574e31e4c538a99a980b976416c33f8bda3f7
CRs-Fixed: 620847
---
 CORE/SERVICES/WMA/wma.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c
index 3287bff46bdc..106da5caf51c 100644
--- a/CORE/SERVICES/WMA/wma.c
+++ b/CORE/SERVICES/WMA/wma.c
@@ -15914,8 +15914,10 @@ static int wma_nlo_scan_cmp_evt_handler(void *handle, u_int8_t *event,
 		/* Posting scan completion msg would take scan cache result
 		 * from LIM module and update in scan cache maintained in SME.*/
 		WMA_LOGD("Posting Scan completion to umac");
+		vos_mem_zero(scan_event, sizeof(tSirScanOffloadEvent));
 		scan_event->reasonCode = eSIR_SME_SUCCESS;
 		scan_event->event = SCAN_EVENT_COMPLETED;
+		scan_event->sessionId = nlo_event->vdev_id;
 		wma_send_msg(wma, WDA_RX_SCAN_EVENT,
 			     (void *) scan_event, 0);
 	} else {
-- 
cgit v1.2.3


From de2f21a12165e13621c7134677a1317ebf70c1e5 Mon Sep 17 00:00:00 2001
From: Sundar Subramaniyan <subrams@qti.qualcomm.com>
Date: Wed, 12 Mar 2014 19:10:32 +0530
Subject: qcacld: CSR: Process the PNO scan result in all roam states

The PNO scan results are processed only when the current CSR roam
state is in SCANNING and dropped in other states. When PNO is started,
the current CSR state is saved and it is set to SCANNING state.
When the PNO scan response comes from firmware and posted to UMAC
the results are processed and cached into SME scan cache only when
the CSR state is still in SCANNING state.

But when a connect request is issued from supplicant or framework,
the CSR state will be moved to JOINING and after connection is
successful it will be moved to JOINED state. But if the PNO scan
results arrive at this time, they are not processed. So it is better
to handle the PNO scan responses irrespective of the CSR current roam
state.

The PNO scan cannot be added to SME queue as the PNO scan response
is asynchronous and comes from firmware only when the preferred APs
are found. So handle the PNO responses alone irrespective of the
current roam state is in. Using PNO Start and PNO Stop as indication,
the stateless processing of PNO scan results is done. This will avoid
any dependency on the CSR current roam state.

Change-Id: Ie91b5c8cb82745ae40a95b408995a5af29fc503e
CRs-Fixed: 620847
---
 CORE/SME/inc/csrInternal.h        |  3 +--
 CORE/SME/inc/sme_Api.h            |  3 ---
 CORE/SME/src/csr/csrApiScan.c     | 23 -----------------------
 CORE/SME/src/csr/csrCmdProcess.c  | 34 +++++++++++++++++++++++++++++++++-
 CORE/SME/src/pmc/pmcApi.c         |  6 +++++-
 CORE/SME/src/sme_common/sme_Api.c | 28 ----------------------------
 6 files changed, 39 insertions(+), 58 deletions(-)

diff --git a/CORE/SME/inc/csrInternal.h b/CORE/SME/inc/csrInternal.h
index d2784584de32..e15b1e3c34fe 100644
--- a/CORE/SME/inc/csrInternal.h
+++ b/CORE/SME/inc/csrInternal.h
@@ -959,7 +959,7 @@ typedef struct tagCsrRoamSession
     //ht config
     tSirHTConfig        htConfig;
 #ifdef FEATURE_WLAN_SCAN_PNO
-    eCsrRoamState lastRoamStateBeforePno;
+    tANI_BOOLEAN pnoStarted;
 #endif
 } tCsrRoamSession;
 
@@ -1396,7 +1396,6 @@ void csrSetOppositeBandChannelInfo( tpAniSirGlobal pMac );
 void csrConstructCurrentValidChannelList( tpAniSirGlobal pMac, tDblLinkList *pChannelSetList,
                                             tANI_U8 *pChannelList, tANI_U8 bSize, tANI_U8 *pNumChannels );
 #ifdef FEATURE_WLAN_SCAN_PNO
-void csrMoveToScanStateForPno( tpAniSirGlobal pMac, tANI_U8 sessionId );
 eHalStatus csrScanSavePreferredNetworkFound(tpAniSirGlobal pMac,
             tSirPrefNetworkFoundInd *pPrefNetworkFoundInd);
 #endif
diff --git a/CORE/SME/inc/sme_Api.h b/CORE/SME/inc/sme_Api.h
index f88d31766636..d7293f526292 100644
--- a/CORE/SME/inc/sme_Api.h
+++ b/CORE/SME/inc/sme_Api.h
@@ -3417,9 +3417,6 @@ ePhyChanBondState sme_GetCBPhyStateFromCBIniValue(tANI_U32 cb_ini_value);
 int sme_UpdateHTConfig(tHalHandle hHal, tANI_U8 sessionId, tANI_U16 htCapab,
                          int value);
 tANI_S16 sme_GetHTConfig(tHalHandle hHal, tANI_U8 session_id, tANI_U16 ht_capab);
-#ifdef FEATURE_WLAN_SCAN_PNO
-eHalStatus sme_MoveCsrToScanStateForPno (tHalHandle hHal, tANI_U8 sessionId);
-#endif
 #ifdef QCA_WIFI_2_0
 eHalStatus sme_getChannelInfo(tHalHandle hHal, tANI_U8 chanId,
                               tSmeChannelInfo *chanInfo);
diff --git a/CORE/SME/src/csr/csrApiScan.c b/CORE/SME/src/csr/csrApiScan.c
index c8405294d123..b5702aa2cefa 100644
--- a/CORE/SME/src/csr/csrApiScan.c
+++ b/CORE/SME/src/csr/csrApiScan.c
@@ -5077,14 +5077,6 @@ eHalStatus csrSavePnoScanResults(tpAniSirGlobal pMac, tSirSmeScanRsp *pScanRsp)
                               cbBssDesc );
     }
 
-    if ( eSIR_SME_SUCCESS == pScanRsp->statusCode )
-    {
-           // PNO is completed, rollback csr to old state
-           csrRoamStateChange(pMac,
-                       pMac->roam.roamSession[pScanRsp->sessionId].lastRoamStateBeforePno,
-                       pScanRsp->sessionId);
-    }
-
     return eHAL_STATUS_SUCCESS;
 }
 #endif
@@ -7994,21 +7986,6 @@ tANI_BOOLEAN csrRoamIsValidChannel( tpAniSirGlobal pMac, tANI_U8 channel )
     return fValid;
 }
 
-#ifdef FEATURE_WLAN_SCAN_PNO
-void csrMoveToScanStateForPno( tpAniSirGlobal pMac, tANI_U8 sessionId )
-{
-    tCsrRoamSession *pSession = &pMac->roam.roamSession[sessionId];
-
-    smsLog( pMac, LOG3, "Moving CSR to Scanning state for PNO");
-
-    // Take a back up of previous CSR state before moving to scanning state.
-    // CSR will be moved to previous state from scanning state after PNO
-    // completion.
-    pSession->lastRoamStateBeforePno =
-               csrRoamStateChange(pMac, eCSR_ROAMING_STATE_SCANNING, sessionId);
-}
-#endif
-
 #ifdef FEATURE_WLAN_SCAN_PNO
 eHalStatus csrScanSavePreferredNetworkFound(tpAniSirGlobal pMac,
             tSirPrefNetworkFoundInd *pPrefNetworkFoundInd)
diff --git a/CORE/SME/src/csr/csrCmdProcess.c b/CORE/SME/src/csr/csrCmdProcess.c
index 49fc5b5a00d0..0c412068760f 100644
--- a/CORE/SME/src/csr/csrCmdProcess.c
+++ b/CORE/SME/src/csr/csrCmdProcess.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -48,12 +48,44 @@ eHalStatus csrMsgProcessor( tpAniSirGlobal pMac,  void *pMsgBuf )
 {
     eHalStatus status = eHAL_STATUS_SUCCESS;
     tSirSmeRsp *pSmeRsp = (tSirSmeRsp *)pMsgBuf;
+#ifdef FEATURE_WLAN_SCAN_PNO
+    tSirMbMsg *pMsg = (tSirMbMsg *)pMsgBuf;
+    tCsrRoamSession *pSession;
+#endif
 
     smsLog( pMac, LOG2, "  Message %d[0x%04X] received in curState %d and substate %d",
                 pSmeRsp->messageType, pSmeRsp->messageType,
                 pMac->roam.curState[pSmeRsp->sessionId],
                 pMac->roam.curSubState[pSmeRsp->sessionId] );
 
+#ifdef FEATURE_WLAN_SCAN_PNO
+    /*
+     * PNO scan responses have to be handled irrespective of CSR roam state.
+     * Check if PNO has been started and only then process the PNO scan results.
+     * Also note that normal scan is not allowed when PNO scan is in progress
+     * and so the scan responses reaching here when PNO is started must be
+     * PNO responses. For normal scan, the PNO started flag will be FALSE and
+     * it will be processed as usual based on the current CSR roam state.
+     */
+    pSession = CSR_GET_SESSION(pMac, pSmeRsp->sessionId);
+    if(!pSession)
+    {
+        smsLog(pMac, LOGE, FL(" session %d not found"), pSmeRsp->sessionId);
+        return eHAL_STATUS_FAILURE;
+    }
+
+    if((eWNI_SME_SCAN_RSP == pMsg->type) && (TRUE == pSession->pnoStarted))
+    {
+        status = csrScanningStateMsgProcessor(pMac, pMsgBuf);
+        if (eHAL_STATUS_SUCCESS != status)
+        {
+            smsLog(pMac, LOGE, FL(" handling PNO scan resp msg 0x%X CSR state is %d"),
+                   pSmeRsp->messageType, pMac->roam.curState[pSmeRsp->sessionId]);
+        }
+        return (status);
+    }
+#endif
+
     // Process the message based on the state of the roaming states...
 
 #if defined( ANI_RTT_DEBUG )
diff --git a/CORE/SME/src/pmc/pmcApi.c b/CORE/SME/src/pmc/pmcApi.c
index b9cb962bd6e2..5139d232915b 100644
--- a/CORE/SME/src/pmc/pmcApi.c
+++ b/CORE/SME/src/pmc/pmcApi.c
@@ -3013,7 +3013,11 @@ eHalStatus pmcSetPreferredNetworkList
     {
        if (pRequestBuf->enable)
        {
-           sme_MoveCsrToScanStateForPno(hHal, sessionId);
+           pSession->pnoStarted = TRUE;
+       }
+       else
+       {
+           pSession->pnoStarted = FALSE;
        }
 
        pRequestBuf->sessionId = sessionId;
diff --git a/CORE/SME/src/sme_common/sme_Api.c b/CORE/SME/src/sme_common/sme_Api.c
index 58f2168a6c9a..fbc1db7e58bc 100644
--- a/CORE/SME/src/sme_common/sme_Api.c
+++ b/CORE/SME/src/sme_common/sme_Api.c
@@ -11323,34 +11323,6 @@ int sme_UpdateHTConfig(tHalHandle hHal, tANI_U8 sessionId, tANI_U16 htCapab,
    return 0;
 }
 
-#ifdef FEATURE_WLAN_SCAN_PNO
-/*--------------------------------------------------------------------------
-
-  \brief sme_MoveCsrToScanStateForPno() - Request CSR module to be in Scan state
-                                          for PNO operation.
-
-  \param hHal - The handle returned by macOpen.
-  \param sessionId - A previous opened session's ID.
-
-  \return eHAL_STATUS_SUCCESS - CSR moved to Scan state.
-          eHAL_STATUS_INVALID_PARAMETER - Failed to acquire sme lock
-  --------------------------------------------------------------------------*/
-eHalStatus sme_MoveCsrToScanStateForPno (tHalHandle hHal, tANI_U8 sessionId)
-{
-    tpAniSirGlobal pMac = PMAC_STRUCT( hHal );
-    eHalStatus status;
-
-    status = sme_AcquireGlobalLock( &pMac->sme );
-    if ( HAL_STATUS_SUCCESS( status ) )
-    {
-        csrMoveToScanStateForPno( pMac, sessionId );
-        sme_ReleaseGlobalLock( &pMac->sme );
-    }
-
-    return status;
-}
-#endif
-
 #define HT20_SHORT_GI_MCS7_RATE 722
 /* ---------------------------------------------------------------------------
     \fn sme_SendRateUpdateInd
-- 
cgit v1.2.3


From 1ff86dade0426f3a379ba8ac0c2db32263bf1af6 Mon Sep 17 00:00:00 2001
From: Rajeev Kumar <rajekuma@qca.qualcomm.com>
Date: Tue, 11 Mar 2014 11:16:49 -0700
Subject: qcacld: Fix of kernel panic in ol_vdev_rx_set_intrabss_fwd

wma_vdev_detach() is freeing vdev id 0 and clearing vdev handle
in iface->handle and same vdev is accessed in ol_vdev_rx_set_intrabss_fwd
leading to panic. Add check for null vdev in ol_vdev_rx_set_intrabss_fwd
before de-referencing it.

Change-Id: Idd394163302f78f413317f4785e314b3f2dc5d0e
CRs-Fixed: 629718
---
 CORE/CLD_TXRX/TXRX/ol_txrx.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/CORE/CLD_TXRX/TXRX/ol_txrx.c b/CORE/CLD_TXRX/TXRX/ol_txrx.c
index 23f9cb21e76a..b8dbec773ac7 100644
--- a/CORE/CLD_TXRX/TXRX/ol_txrx.c
+++ b/CORE/CLD_TXRX/TXRX/ol_txrx.c
@@ -1965,6 +1965,9 @@ ol_vdev_rx_set_intrabss_fwd(
     ol_txrx_vdev_handle vdev,
     a_bool_t val)
 {
+    if (NULL == vdev)
+        return;
+
     vdev->disable_intrabss_fwd = val;
 }
 
-- 
cgit v1.2.3


From 348b06fb536890dc355c230af4c8f3ca822483bc Mon Sep 17 00:00:00 2001
From: Amar Singhal <asinghal@qca.qualcomm.com>
Date: Thu, 6 Mar 2014 15:41:17 -0800
Subject: qcacld: Define new INI item gRegulatoryChangeCountry

Define new item gRegulatoryChangeCountry. This item is used to indicate
to vos modue whether the user wants to use custom regulatory even if
the default country is not WORLD.

Change-Id: Iecfc567544ed93e380a1f08fa121b0c1090e0bcb
CRs-Fixed: 623406
---
 CORE/HDD/inc/wlan_hdd_cfg.h |  6 ++++++
 CORE/HDD/src/wlan_hdd_cfg.c | 10 ++++++++++
 CORE/VOSS/src/vos_nvitem.c  | 35 ++++++++++++++++++++++++-----------
 3 files changed, 40 insertions(+), 11 deletions(-)

diff --git a/CORE/HDD/inc/wlan_hdd_cfg.h b/CORE/HDD/inc/wlan_hdd_cfg.h
index 445a4a06236f..07ea944f6541 100644
--- a/CORE/HDD/inc/wlan_hdd_cfg.h
+++ b/CORE/HDD/inc/wlan_hdd_cfg.h
@@ -269,6 +269,11 @@
 #define CFG_ENABLE_ADAPT_RX_DRAIN_DEFAULT   WNI_CFG_ENABLE_ADAPT_RX_DRAIN_STADEF
 
 
+#define CFG_REG_CHANGE_DEF_COUNTRY_NAME          "gRegulatoryChangeCountry"
+#define CFG_REG_CHANGE_DEF_COUNTRY_DEFAULT       ( 0 )
+#define CFG_REG_CHANGE_DEF_COUNTRY_MIN           ( 0 )
+#define CFG_REG_CHANGE_DEF_COUNTRY_MAX           ( 1 )
+
 typedef enum
 {
     eHDD_DOT11_MODE_AUTO = 0, //covers all things we support
@@ -2727,6 +2732,7 @@ typedef struct
    v_BOOL_t                    fDfsPhyerrFilterOffload;
    v_BOOL_t                    gEnableOverLapCh;
    char                        acsAllowedChnls[CFG_MAX_STR_LEN];
+   v_BOOL_t                    fRegChangeDefCountry;
 } hdd_config_t;
 /*---------------------------------------------------------------------------
   Function declarations and documenation
diff --git a/CORE/HDD/src/wlan_hdd_cfg.c b/CORE/HDD/src/wlan_hdd_cfg.c
index 64c77d3c9c0c..fe9255d8b412 100644
--- a/CORE/HDD/src/wlan_hdd_cfg.c
+++ b/CORE/HDD/src/wlan_hdd_cfg.c
@@ -3167,16 +3167,26 @@ REG_VARIABLE( CFG_ENABLE_DFS_PHYERR_FILTEROFFLOAD_NAME, WLAN_PARAM_Integer,
               CFG_ENABLE_DFS_PHYERR_FILTEROFFLOAD_DEFAULT,
               CFG_ENABLE_DFS_PHYERR_FILTEROFFLOAD_MIN,
               CFG_ENABLE_DFS_PHYERR_FILTEROFFLOAD_MAX ),
+
 REG_VARIABLE( CFG_ENABLE_OVERLAP_CH, WLAN_PARAM_Integer,
                hdd_config_t, gEnableOverLapCh,
                VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK,
                CFG_ENABLE_OVERLAP_CH_DEFAULT,
                CFG_ENABLE_OVERLAP_CH_MIN,
                CFG_ENABLE_OVERLAP_CH_MAX ),
+
 REG_VARIABLE_STRING( CFG_ONLY_ALLOWED_CHANNELS, WLAN_PARAM_String,
                      hdd_config_t, acsAllowedChnls,
                      VAR_FLAGS_OPTIONAL,
                      (void *)CFG_ONLY_ALLOWED_CHANNELS_DEFAULT),
+
+REG_VARIABLE( CFG_REG_CHANGE_DEF_COUNTRY_NAME, WLAN_PARAM_Integer,
+              hdd_config_t, fRegChangeDefCountry,
+              VAR_FLAGS_OPTIONAL | VAR_FLAGS_RANGE_CHECK_ASSUME_DEFAULT,
+              CFG_REG_CHANGE_DEF_COUNTRY_DEFAULT,
+              CFG_REG_CHANGE_DEF_COUNTRY_MIN,
+              CFG_REG_CHANGE_DEF_COUNTRY_MAX),
+
 };
 
 /*
diff --git a/CORE/VOSS/src/vos_nvitem.c b/CORE/VOSS/src/vos_nvitem.c
index 04c6f189b4a0..2c1a02e0bae8 100644
--- a/CORE/VOSS/src/vos_nvitem.c
+++ b/CORE/VOSS/src/vos_nvitem.c
@@ -821,7 +821,13 @@ bool is_world_regd(u_int32_t regd)
 static const struct ieee80211_regdomain *vos_default_world_regdomain(void)
 {
    /* this is the most restrictive */
-   return &vos_world_regdom_64;
+    return &vos_world_regdom_64;
+}
+
+static const struct ieee80211_regdomain *vos_custom_world_regdomain(void)
+{
+   /* this is the most restrictive */
+    return &vos_world_regdom_60_61_62;
 }
 
 static const
@@ -1028,17 +1034,24 @@ static void vos_reg_apply_world_flags(struct wiphy *wiphy,
    }
 }
 
-static int regd_init_wiphy(struct regulatory *reg,
+static int regd_init_wiphy(hdd_context_t *pHddCtx, struct regulatory *reg,
       struct wiphy *wiphy)
 {
    const struct ieee80211_regdomain *regd;
 
-   if (is_world_regd(reg->reg_domain)) {
-      regd = vos_world_regdomain(reg);
-      wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY;
-   } else {
-      regd = vos_default_world_regdomain();
-      wiphy->flags |= WIPHY_FLAG_STRICT_REGULATORY;
+   if  (pHddCtx->cfg_ini->fRegChangeDefCountry) {
+       regd = vos_custom_world_regdomain();
+       wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY;
+   }
+   else if (is_world_regd(reg->reg_domain))
+   {
+       regd = vos_world_regdomain(reg);
+       wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY;
+   }
+   else
+   {
+       regd = vos_default_world_regdomain();
+       wiphy->flags |= WIPHY_FLAG_STRICT_REGULATORY;
    }
    wiphy_apply_custom_regulatory(wiphy, regd);
    vos_reg_apply_radar_flags(wiphy);
@@ -1046,7 +1059,7 @@ static int regd_init_wiphy(struct regulatory *reg,
    return 0;
 }
 
-static int reg_init_from_eeprom(struct regulatory *reg,
+static int reg_init_from_eeprom(hdd_context_t *pHddCtx, struct regulatory *reg,
       struct wiphy *wiphy)
 {
    int ret_val = 0;
@@ -1062,7 +1075,7 @@ static int reg_init_from_eeprom(struct regulatory *reg,
    pnvEFSTable->halnv.tables.defaultCountryTable.countryCode[1] =
       reg->alpha2[1];
 
-   regd_init_wiphy(reg, wiphy);
+   regd_init_wiphy(pHddCtx, reg, wiphy);
 
    return ret_val;
 }
@@ -3482,7 +3495,7 @@ VOS_STATUS vos_init_wiphy_from_eeprom(void)
 
    wiphy = pHddCtx->wiphy;
 
-   if (reg_init_from_eeprom(&pHddCtx->reg, wiphy))
+   if (reg_init_from_eeprom(pHddCtx, &pHddCtx->reg, wiphy))
    {
       VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_ERROR,
             ("Error during regulatory init from EEPROM"));
-- 
cgit v1.2.3


From 132fe9b30cda41af0d65a8428bf8179a90ebc77f Mon Sep 17 00:00:00 2001
From: Nirav Shah <nnshah@qti.qualcomm.com>
Date: Wed, 12 Mar 2014 09:59:12 +0530
Subject: WMA: Changes adf_os_mem_alloc to vos_mem_malloc

Changing adf_os_mem_alloc with vos_mem_malloc
in wma_peer_sta_kickout_event_handler, ol_rx_err and
wma_dfs_indicate_radar  as memory allocated
from adf_os_mem_alloc creates panic
while freeing with vos_mem_free if SLUB_DEBUG is
ON in kernel

Change-Id: I49579fc718ee740d8643e2b39e2c215f76cc0b1c
CRs-Fixed: 630130
---
 CORE/SERVICES/WMA/wma.c | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c
index 106da5caf51c..6db0bcd453d7 100644
--- a/CORE/SERVICES/WMA/wma.c
+++ b/CORE/SERVICES/WMA/wma.c
@@ -835,10 +835,9 @@ static int wma_peer_sta_kickout_event_handler(void *handle, u8 *event, u32 len)
 
 	if (kickout_event->reason == WMI_PEER_STA_KICKOUT_REASON_IBSS_DISCONNECT) {
 		p_inactivity = (tpSirIbssPeerInactivityInd)
-			adf_os_mem_alloc(NULL,
-					 sizeof(tSirIbssPeerInactivityInd));
+			vos_mem_malloc(sizeof(tSirIbssPeerInactivityInd));
 		if (!p_inactivity) {
-			WMA_LOGE("Memory Alloc Failed for tSirIbssPeerInactivity");
+			WMA_LOGE("VOS MEM Alloc Failed for tSirIbssPeerInactivity");
 			return -EINVAL;
 		}
 
@@ -848,10 +847,9 @@ static int wma_peer_sta_kickout_event_handler(void *handle, u8 *event, u32 len)
 	}
 	else {
 		del_sta_ctx =
-			(tpDeleteStaContext)adf_os_mem_alloc(NULL,
-					sizeof(tDeleteStaContext));
+			(tpDeleteStaContext)vos_mem_malloc(sizeof(tDeleteStaContext));
 		if (!del_sta_ctx) {
-			WMA_LOGE("Memory Alloc Failed for tDeleteStaContext");
+			WMA_LOGE("VOS MEM Alloc Failed for tDeleteStaContext");
 			return -EINVAL;
 		}
 
@@ -19222,9 +19220,7 @@ wma_dfs_indicate_radar(struct ieee80211com *ic,
         return (0);
     }
     radar_event = (struct wma_dfs_radar_indication *)
-                   OS_MALLOC(NULL,
-                             sizeof(struct wma_dfs_radar_indication),
-                             GFP_ATOMIC);
+                   vos_mem_malloc(sizeof(struct wma_dfs_radar_indication));
     if (radar_event == NULL)
     {
         WMA_LOGE("%s:DFS- Invalid radar_event",__func__);
@@ -19331,7 +19327,7 @@ void ol_rx_err(ol_pdev_handle pdev, u_int8_t vdev_id,
 	if (adf_nbuf_len(rx_frame) < sizeof(*eth_hdr))
 		return;
 	eth_hdr = (struct ether_header *) adf_nbuf_data(rx_frame);
-	mic_err_ind = adf_os_mem_alloc(NULL, sizeof(*mic_err_ind));
+	mic_err_ind = vos_mem_malloc(sizeof(*mic_err_ind));
 	if (!mic_err_ind) {
 		WMA_LOGE("%s: Failed to allocate memory for MIC indication message", __func__);
 		return;
-- 
cgit v1.2.3


From 658eecd17698d0e9f3aa55d5beeae08c72f3c3b0 Mon Sep 17 00:00:00 2001
From: Kiran Kumar Lokere <klokere@qca.qualcomm.com>
Date: Thu, 13 Mar 2014 17:10:29 -0700
Subject: Fix assoc response tx fail when max stations are reached

Fixes the assoc response tx failure when max supported stations
are connected to SAP.

Change-Id: If481c976a899a365126e9105c2f118a22dd24a13
CRs-Fixed: 627341
---
 CORE/MAC/src/pe/lim/limSendManagementFrames.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/CORE/MAC/src/pe/lim/limSendManagementFrames.c b/CORE/MAC/src/pe/lim/limSendManagementFrames.c
index 4f3e59825296..c000ece0653c 100644
--- a/CORE/MAC/src/pe/lim/limSendManagementFrames.c
+++ b/CORE/MAC/src/pe/lim/limSendManagementFrames.c
@@ -1386,7 +1386,7 @@ limSendAssocRspMgmtFrame(tpAniSirGlobal pMac,
     tANI_BOOLEAN         isVHTEnabled = eANI_BOOLEAN_FALSE;
     tANI_U16             addStripoffIELen = 0;
     tDot11fIEExtCap      extractedExtCap;
-    tANI_BOOLEAN         extractedExtCapFlag = eANI_BOOLEAN_TRUE;
+    tANI_BOOLEAN         extractedExtCapFlag = eANI_BOOLEAN_FALSE;
     if(NULL == psessionEntry)
     {
         return;
@@ -1575,13 +1575,16 @@ limSendAssocRspMgmtFrame(tpAniSirGlobal pMac,
                                       &addIE[0],
                                       &addStripoffIELen,
                                       &extractedExtCap );
-                    addnIELen = addStripoffIELen;
                     if(eSIR_SUCCESS != nSirStatus)
                     {
-                        extractedExtCapFlag = eANI_BOOLEAN_FALSE;
                         limLog(pMac, LOG1,
                             FL("Unable to Stripoff ExtCap IE from Assoc Rsp"));
                     }
+                    else
+                    {
+                        addnIELen = addStripoffIELen;
+                        extractedExtCapFlag = eANI_BOOLEAN_TRUE;
+                    }
                     nBytes = nBytes + addnIELen;
                 }
             }
-- 
cgit v1.2.3


From 5cb171469f4e0a7fad3a0898bf26ebece178d82f Mon Sep 17 00:00:00 2001
From: Rajeev Kumar <rajekuma@qca.qualcomm.com>
Date: Thu, 13 Mar 2014 17:34:16 -0700
Subject: qcacld: Fix of memory leak in wma for WDA_UPDATE_OP_MODE

Memory allocated by LIM for message WDA_UPDATE_OP_MODE is
not freed in WMA. Free message body pointer in WMA for msg
WDA_UPDATE_OP_MODE handling

Change-Id: Ic4b407498f31efbbf43b10b04d090c367073b673
CRs-Fixed: 631548
---
 CORE/SERVICES/WMA/wma.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c
index 6db0bcd453d7..d835a3df1468 100644
--- a/CORE/SERVICES/WMA/wma.c
+++ b/CORE/SERVICES/WMA/wma.c
@@ -15287,6 +15287,7 @@ VOS_STATUS wma_mc_process_msg(v_VOID_t *vos_context, vos_msg_t *msg)
                 case WDA_UPDATE_OP_MODE:
                         wma_process_update_opmode(wma_handle,
                                        (tUpdateVHTOpMode *)msg->bodyptr);
+                        vos_mem_free(msg->bodyptr);
                         break;
 #ifdef WLAN_FEATURE_11AC
                 case WDA_UPDATE_MEMBERSHIP:
-- 
cgit v1.2.3


From d34bcc22c70cf9f628b518825798360b0932f914 Mon Sep 17 00:00:00 2001
From: Sanjay Devnani <sdevnani@qca.qualcomm.com>
Date: Wed, 12 Mar 2014 13:19:46 -0700
Subject: wlan: fix format specifier in logs - DFS

This is to remove the compiler warnings on a 64 bit machine. use a
generic specifier like %zu instead of %d to print size_t.

Change-Id: I59778caf17881f43d624a57db2f0c1c0cdaea97f
CRs-fixed: 630534
---
 CORE/SERVICES/DFS/src/dfs_phyerr_tlv.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/CORE/SERVICES/DFS/src/dfs_phyerr_tlv.c b/CORE/SERVICES/DFS/src/dfs_phyerr_tlv.c
index bbdcf8d6d463..c9049c31471a 100644
--- a/CORE/SERVICES/DFS/src/dfs_phyerr_tlv.c
+++ b/CORE/SERVICES/DFS/src/dfs_phyerr_tlv.c
@@ -175,7 +175,7 @@ radar_summary_parse(struct ath_dfs *dfs, const char *buf, size_t len,
    if (len < sizeof(rs)) {
       DFS_DPRINTK(dfs, ATH_DEBUG_DFS_PHYERR |
           ATH_DEBUG_DFS_PHYERR_SUM,
-          "%s: len (%d) < expected (%zu)!",
+          "%s: len (%zu) < expected (%zu)!",
           __func__,
           len,
           sizeof(rs));
@@ -223,7 +223,7 @@ radar_fft_search_report_parse(struct ath_dfs *dfs, const char *buf, size_t len,
    if (len < sizeof(rs)) {
       DFS_DPRINTK(dfs, ATH_DEBUG_DFS_PHYERR |
           ATH_DEBUG_DFS_PHYERR_SUM,
-          "%s: len (%d) < expected (%zu)!",
+          "%s: len (%zu) < expected (%zu)!",
           __func__,
           len,
           sizeof(rs));
@@ -282,7 +282,7 @@ tlv_parse_frame(struct ath_dfs *dfs, struct rx_radar_status *rs,
       if ((len - i) < sizeof(tlv_hdr)) {
          DFS_DPRINTK(dfs, ATH_DEBUG_DFS_PHYERR |
              ATH_DEBUG_DFS_PHYERR_SUM,
-             "%s: ran out of bytes, len=%d, i=%d",
+             "%s: ran out of bytes, len=%zu, i=%d",
              __func__, len, i);
          return (0);
       }
@@ -309,7 +309,7 @@ tlv_parse_frame(struct ath_dfs *dfs, struct rx_radar_status *rs,
        */
       if (MS(tlv_hdr[TLV_REG], TLV_LEN) + i >= len) {
          DFS_DPRINTK(dfs, ATH_DEBUG_DFS_PHYERR,
-             "%s: TLV oversize: TLV LEN=%d, available=%d, "
+             "%s: TLV oversize: TLV LEN=%zu, available=%d, "
              "i=%d",
              __func__,
              MS(tlv_hdr[TLV_REG], TLV_LEN),
-- 
cgit v1.2.3


From a55d0f8c29b382fa14ff1c6d977cec0b1f917867 Mon Sep 17 00:00:00 2001
From: Pitani Venkata Rajesh Kumar <c_vpitan@qti.qualcomm.com>
Date: Fri, 14 Mar 2014 12:44:13 +0530
Subject: Cafstaging Release 1.0.0.62

Cafstaging Release 1.0.0.62

Change-Id: Ic6a82650a9ddf9faf08c50d55cee762798f3c366
---
 CORE/MAC/inc/qwlan_version.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CORE/MAC/inc/qwlan_version.h b/CORE/MAC/inc/qwlan_version.h
index 05d81dc504cf..69dd21b6c149 100644
--- a/CORE/MAC/inc/qwlan_version.h
+++ b/CORE/MAC/inc/qwlan_version.h
@@ -42,9 +42,9 @@ BRIEF DESCRIPTION:
 #define QWLAN_VERSION_MINOR            0
 #define QWLAN_VERSION_PATCH            0
 #define QWLAN_VERSION_EXTRA            ""
-#define QWLAN_VERSION_BUILD            61
+#define QWLAN_VERSION_BUILD            62
 
-#define QWLAN_VERSIONSTR               "1.0.0.61"
+#define QWLAN_VERSIONSTR               "1.0.0.62"
 
 #ifdef QCA_WIFI_2_0
 
-- 
cgit v1.2.3