Merge 13a8e87f1c508c23a47032bac0c1353afbdd2368 on remote branch

Change-Id: Idae17c24fc2e9171c9d98f9b4f0fc179cd8c8cd4
Fix for IMPS Req sent to Firmware in connected state

Due to race condition between reception of Deauth frame from AP
and disconnect from Upper layer, driver sends IMPS Request
to firmware when firmware is in connected state.As a result
Firmware crashes.So when deauth req comes from upper layer
read the status of FW state and accordingly return the error
code so that SME does not issue IMPS request.

Change-Id: Ie2cbdb8021e0920b6778708946a9f3e1a92586b8
CRs-fixed: 604928
wlan: reprogram skb data buffer if all the headroom is available

It has been seen that in certain scenarios the skb data buffer
is programmed in the the DMA engine in such a way that the skb
data buffer points to the skb tail pointer, in such cases the
dma engine will overwrite a memory region being referenced by
the skb tail pointer corrupting the memory. This can result in
various crashes, so before programming the DMA engine with data
buffere try to use the skb headroom when the error condition is
met, but if WLAN_BUG_ON_SKB_ERROR is defined panic the device
so that extra information can be obtained.

Change-Id: Ia76de4b572cf0198a8f3fa149ea72797d2096fcc
CRs-Fixed: 605122
wlan: do not wait for WDA_HALDumpCmdReq() to complete

WDA_HALDumpCmdReq() does not return till it receives
a response from the firmware, so do not wait for it
to complete as it is a synchronous call.

Change-Id: I89743c58d2f82b7cae561c024349ca5be394649e
CRs-Fixed: 609232
wlan: prima: Fix ambiguous ioctl error logging

There are multiple places where the message "Invalid IOCTL command" is
logged.  All of the messages are identical, so when the message is
actually logged it is impossible to determine exactly where, and hence
why, it was logged.  Update the logs to add the function name so that
the source of the log will be unique.

Change-Id: I5906627fc3ebd7896dd35e0b82579d02fa915bc3
CRs-fixed: 616348
wlan: memory overflow/corruption in ftm test

In iw_ftm_setchar_getnone() iotctl_private_iw_point() cannnnot
be used to allocate memory to store data from userspace as
IW_SETCHAR_GETNONE is defined as odd number which assigns set_args
to zero.we assisgn memory using kzalloc here to hold userspace data

Change-Id: Ie2de8ab8c9b4ced301ab03f72302f390fa0ec488
CRs-fixed: 591712
wlan: UMAC: update channel list support

Enhance capability of update channel list

Change-Id: I661351531e6f902ed9a262ffb71bcddcfdc1d88c
CRs-Fixed: 605330
STA is disconnected with specific AP IPTIME N904NS

STA gets disconnected with AP IPTIME N904NS when AP is configured
for WPA1 + TKIP on CH 161

Change-Id: I21a9e56d776c625c186c6083d58f711ae30bbcfe
CRs-Fixed: 599931
wlan: wrong bitwise operation in get interface mac addr

In wlan_hdd_get_intf_addr the bitwise operation to check for
unused mac address is not proper.

Add proper check to get the unused mac address.

Change-Id: Iafdf59750a68a4b7ab4b6b7e8de3f782d750990c
CRs-Fixed: 600550
Merge "STA is disconnected with specific AP IPTIME N904NS"
Merge "wlan: reprogram skb data buffer if all the headroom is available"
DroidSec: Check sscanf returns in function iw_set_priv

In the two clauses "powermode" and "CONFIG-TX-TRACKING",
it should be confirmed that cmd_len is greater than amount
incrementing cmd when form ptr,and must check return from
sscanf to confirm that parameters were parsed correctly
before subsequent use.

Change-Id: I9e93c3f34b116f6fac1bd81f32956fb88cba807a
CRs-fixed: 554538
wlan: Fix for netd crash due to improper length updation.

Netd crash due to improper length updation to the user space. i.e
actual length of data copied to the user space buffer being
calculated after indication of the same to the user and wrong value
being updated to the user space.
This commit ensures that the length of the data copied to the user
space buffer and the length indicated to user is same.

Change-Id: I0a402798f5d923eaad1a681724a63cf0cb2c2663
CRs-Fixed: 612326
Wlan: Check for Roam command in csrIsRoamCommandWaitingForSession.

If connect and disconnect comes in same order, connect command
will put eSmeCommandRoam to roamcmd Pending list.
If disconnect comes at the same time, driver is unable to
call cancel roaming as disconnect handler is not checking
for roamPending list.

csrRoamIssueConnect->csrQueueSmeCommand->
csrRequestFullPower->eHAL_STATUS_PMC_PENDING
as driver requests for FULL POWER. Driver adds Roam
command to pMac->roam.roamCmdPendingList.

Now if  supplicant calls disconnect
wlan_hdd_disconnect->sme_RoamDisconnect->
csrRoamDisconnect->csrRoamDisconnectInternal->
csrIsRoamCommandWaitingForSession

Here in csrIsRoamCommandWaitingForSession API driver is
checking only two lists
1.smeCmdActiveList
2. smeCmdPendingList
Now as Roam command is not in both these lists disconnect
command doesn't get processed.

CRs-Fixed: 606986
Change-Id: I55708f4f8667675ea46e39958b83d274e23293cb
STA+GO New INI parameter to enable FCC regulatory rule

Ini parameter gEnableStrictRegulatoryForFCC  to enable
 or disable FCC regulatory rule
By default Strict Regulatory FCC rule is enabled.

Change-Id: I64681698727c9d45451e32fe3739dcfb6989fd59
CRs-fixed: 607653
wlan: Fix VOS Core run out of message wrapper.

Vos-Wrappers were  getting exhausted in case of Concurrent Session.
Whenever TL dosent get scheduled for longtime and incase of
concurrent sessions we don't check whether there has been a message of
type WLANTL_TX_STAID_AC_IND already posted to TL which is leading to
Vos Message Wrappers getting exhausted.

In non-Concurrent mode we directly invoke WDA_DS_StartXmit which will
post WDA_DS_TX_START_XMIT message to TL.

But in the case of Concurrent sessions we post WLANTL_TX_STAID_AC_IND
message then again post WDA_DS_TX_START_XMIT to TL.

The changes has been made to directly invoke WDA_DS_StartXmit
in case of both Concurrent/Non-Concurrent sessions.

Change-Id: I10c8e4a95dd7887a9cf9848b285e03aa784c3fdd
CRs-Fixed: 601242
wlan: Fix to pass global temporary dynamic IPv6 addr

In Stateless DHCP configuration, IPv6 AP is assigning global
temporary dynamic IPv6 address along with logic link and
global dynamic. As host is passing only logic link and
global dynamic address to FW. while running ping on global
temporary dynamic IPv6 address FW is droping this packet
instead of sending NS response

To address this issue pass global temporary dynamic IPv6
address along with logic link and global dynamic while
configuring NS offload

Change-Id: Ib248dc77fe24e4e1fe6e2dcb53e39fbf4d3d3a44
CRs-Fixed: 592499
wlan: Do not process SIGNAL_POLL request if roaming is in progress

When framework issues signal_poll request to get the statistics of
the station, supplicant shall get blocked for a maximum period of
800 msec waiting for the response if the processing of the
corresponding command fails in the host driver. This time out is
configured by WLAN_WAIT_TIME_STATS.
It is observed that if the signal_poll command is issued when the
device is trying to roam, the host driver times out to get the
response and thus the supplicant is blocked for this duration.
This results in the failed security association (4-way handshake)
with the AP as the supplicant shall not receive any of the events
from the driver till it gets the response from the driver as part
of the signal_poll command.
Thus do not process signal_poll request in the host driver if the
device is in the roaming state.

Change-Id: I0bea7027fd2fc54ac188251082e14b0d84d877aa
CRs-Fixed: 593755
wlan: Roam Scan Channels defined to a constant

The LFR Message structure uses a MACRO
WLAN_HAL_ROAM_SCAN_MAX_CHANNELS which in turn points to
NUM_RF_CHANNELS as of today.NUM_RF_CHANNELS is closely
tied up with nv bin files.To decouple LFR from NUM_RF_CHANNELS
we are defining WLAN_HAL_ROAM_SCAN_MAX_CHANNELS to a
constant value.

Change-Id: Ic7db6cf4b6a930127f4581ec27957a19382c8e4d
CRs-Fixed: 612494
wlan: per AC re-order aging time

Enable configuring different re-order aging times per AC.

CRs-fixed: 576877
Change-Id: I6131018a00e196fe2042a61194f935f64d0ad00e