WifiHal: Address Debug framework bugs and misc issues

Fix multiple issues
1) Extract wmsg length from nlmsg_hdr with ntohs()
2) Do not free local frame_content in get()
3) Avoid illegal memory access in wifi_set_packet_filter fn
4) Updating new enums related to WIFI Configuration

BUG: 27502434
BUG: 27595799

Change-Id: I369a6b278f3e587f07d3a57be97b61eda658104d

4 files changed, 37 insertions, 21 deletions

diff --git a/qcwcn/wifi_hal/vendor_definitions.h b/qcwcn/wifi_hal/vendor_definitions.h
index eb08b29..dfadd35 100644
--- a/qcwcn/wifi_hal/vendor_definitions.h
+++ b/qcwcn/wifi_hal/vendor_definitions.h
@@ -941,6 +941,10 @@ enum qca_wlan_vendor_attr_wifi_config {
     QCA_WLAN_VENDOR_ATTR_WIFI_CONFIG_GUARD_TIME = 3,
     /* Unsigned 32-bit value */
     QCA_WLAN_VENDOR_ATTR_WIFI_CONFIG_FINE_TIME_MEASUREMENT = 4,
+    /* Unsigned 32-bit value */
+    QCA_WLAN_VENDOR_ATTR_WIFI_CONFIG_TX_RATE = 5,
+    /* Unsigned 32-bit value */
+    QCA_WLAN_VENDOR_ATTR_WIFI_CONFIG_PENALIZE_AFTER_NCONS_BEACON_MISS = 6,
     /* keep last */
     QCA_WLAN_VENDOR_ATTR_WIFI_CONFIG_AFTER_LAST,
     QCA_WLAN_VENDOR_ATTR_WIFI_CONFIG_MAX =
diff --git a/qcwcn/wifi_hal/wifi_hal.cpp b/qcwcn/wifi_hal/wifi_hal.cpp
index a407741..3727e0b 100644
--- a/qcwcn/wifi_hal/wifi_hal.cpp
+++ b/qcwcn/wifi_hal/wifi_hal.cpp
@@ -1269,15 +1269,15 @@ static wifi_error wifi_set_packet_filter(wifi_interface_handle iface,
         return WIFI_ERROR_INVALID_ARGS;
     }
 
-    ret = initialize_vendor_cmd(iface, get_requestid(),
-                                QCA_NL80211_VENDOR_SUBCMD_PACKET_FILTER,
-                                &vCommand);
-    if (ret != WIFI_SUCCESS) {
-        ALOGE("%s: Initialization failed", __FUNCTION__);
-        return (wifi_error)ret;
-    }
-
     do {
+        ret = initialize_vendor_cmd(iface, get_requestid(),
+                                    QCA_NL80211_VENDOR_SUBCMD_PACKET_FILTER,
+                                    &vCommand);
+        if (ret != WIFI_SUCCESS) {
+            ALOGE("%s: Initialization failed", __FUNCTION__);
+            return (wifi_error)ret;
+        }
+
         /* Add the vendor specific attributes for the NL command. */
         nlData = vCommand->attr_start(NL80211_ATTR_VENDOR_DATA);
         if (!nlData)
@@ -1317,11 +1317,16 @@ static wifi_error wifi_set_packet_filter(wifi_interface_handle iface,
             goto cleanup;
         }
 
+        /* destroy the object after sending each fragment to driver */
+        delete vCommand;
+        vCommand = NULL;
+
         current_offset += min(info->firmware_bus_max_size, len);
     } while (current_offset < len);
 
 cleanup:
-    delete vCommand;
+    if (vCommand)
+        delete vCommand;
     return (wifi_error)ret;
 }
 
diff --git a/qcwcn/wifi_hal/wifilogger.cpp b/qcwcn/wifi_hal/wifilogger.cpp
index 0ce2bab..506e0df 100644
--- a/qcwcn/wifi_hal/wifilogger.cpp
+++ b/qcwcn/wifi_hal/wifilogger.cpp
@@ -686,10 +686,12 @@ wifi_error wifi_get_tx_pkt_fates(wifi_interface_handle iface,
                 tx_report_bufs[i].frame_inf.frame_content.ieee_80211_mgmt_bytes,
                 tx_fate_stats[i].frame_inf.frame_content,
                 min(tx_fate_stats[i].frame_inf.frame_len,
-                    MAX_FRAME_LEN_ETHERNET));
+                    MAX_FRAME_LEN_80211_MGMT));
         else
-            ALOGE("Unknown format packet");
-        free (tx_fate_stats[i].frame_inf.frame_content);
+            /* Currently framework is interested only two types(
+             * FRAME_TYPE_ETHERNET_II and FRAME_TYPE_80211_MGMT) of packets, so
+             * ignore the all other types of packets received from driver */
+            ALOGI("Unknown format packet");
     }
 
     return WIFI_SUCCESS;
@@ -750,10 +752,12 @@ wifi_error wifi_get_rx_pkt_fates(wifi_interface_handle iface,
                 rx_report_bufs[i].frame_inf.frame_content.ieee_80211_mgmt_bytes,
                 rx_fate_stats[i].frame_inf.frame_content,
                 min(rx_fate_stats[i].frame_inf.frame_len,
-                    MAX_FRAME_LEN_ETHERNET));
+                    MAX_FRAME_LEN_80211_MGMT));
         else
-            ALOGE("Unknown format packet");
-        free (rx_fate_stats[i].frame_inf.frame_content);
+            /* Currently framework is interested only two types(
+             * FRAME_TYPE_ETHERNET_II and FRAME_TYPE_80211_MGMT) of packets, so
+             * ignore the all other types of packets received from driver */
+            ALOGI("Unknown format packet");
     }
 
     return WIFI_SUCCESS;
diff --git a/qcwcn/wifi_hal/wifilogger_diag.cpp b/qcwcn/wifi_hal/wifilogger_diag.cpp
index 9ecbf45..e3090e0 100644
--- a/qcwcn/wifi_hal/wifilogger_diag.cpp
+++ b/qcwcn/wifi_hal/wifilogger_diag.cpp
@@ -1831,7 +1831,7 @@ static wifi_error parse_tx_pkt_fate_stats(hal_info *info, u8 *buf, u16 size)
         memcpy(pkt_fate_stats->frame_inf.frame_content,
                buf + sizeof(pktdump_hdr), pkt_fate_stats->frame_inf.frame_len);
     } else {
-        ALOGE("Failed to allocate mem for Tx frame_content for packet: %d",
+        ALOGE("Failed to allocate mem for Tx frame_content for packet: %zu",
               info->pkt_fate_stats->n_tx_stats_collected);
         pkt_fate_stats->frame_inf.frame_len = 0;
     }
@@ -1873,7 +1873,7 @@ static wifi_error parse_rx_pkt_fate_stats(hal_info *info, u8 *buf, u16 size)
         memcpy(pkt_fate_stats->frame_inf.frame_content,
                buf + sizeof(pktdump_hdr), pkt_fate_stats->frame_inf.frame_len);
     } else {
-        ALOGE("Failed to allocate mem for Rx frame_content for packet: %d",
+        ALOGE("Failed to allocate mem for Rx frame_content for packet: %zu",
               info->pkt_fate_stats->n_rx_stats_collected);
         pkt_fate_stats->frame_inf.frame_len = 0;
     }
@@ -2051,8 +2051,9 @@ wifi_error diag_message_handler(hal_info *info, nl_msg *msg)
     /* Check nlmsg_type also to avoid processing unintended msgs */
     if (wnl->nlh.nlmsg_type == ANI_NL_MSG_PUMAC) {
         if ((wnl->nlh.nlmsg_len <= sizeof(tAniNlHdr)) ||
-            (wnl->nlh.nlmsg_len < (sizeof(tAniNlHdr) + wnl->wmsg.length))) {
-            ALOGE("Received message with insufficent length: %d", wnl->nlh.nlmsg_len);
+            (wnl->nlh.nlmsg_len < (sizeof(tAniNlHdr) + ntohs(wnl->wmsg.length)))) {
+            ALOGE("Received UMAC message with insufficent length: %d",
+                  wnl->nlh.nlmsg_len);
             return WIFI_ERROR_UNKNOWN;
         }
         if (wnl->wmsg.type == ANI_NL_MSG_LOG_HOST_EVENT_LOG_TYPE) {
@@ -2124,7 +2125,8 @@ wifi_error diag_message_handler(hal_info *info, nl_msg *msg)
     } else if (wnl->nlh.nlmsg_type == ANI_NL_MSG_LOG) {
         if ((wnl->nlh.nlmsg_len <= sizeof(tAniNlHdr)) ||
             (wnl->nlh.nlmsg_len < (sizeof(tAniNlHdr) + wnl->wmsg.length))) {
-            ALOGE("Received message with insufficent length: %d", wnl->nlh.nlmsg_len);
+            ALOGE("Received LOG message with insufficent length: %d",
+                  wnl->nlh.nlmsg_len);
             return WIFI_ERROR_UNKNOWN;
         }
         if (wnl->wmsg.type == ANI_NL_MSG_LOG_HOST_PRINT_TYPE) {
@@ -2142,7 +2144,8 @@ wifi_error diag_message_handler(hal_info *info, nl_msg *msg)
         if ((wnl->nlh.nlmsg_len <= NLMSG_HDRLEN + sizeof(fw_event_hdr_t)) ||
             (wnl->nlh.nlmsg_len < (NLMSG_HDRLEN + sizeof(fw_event_hdr_t) +
                                     event_hdr->length))) {
-            ALOGE("Received message with insufficent length: %d", wnl->nlh.nlmsg_len);
+            ALOGE("Received CNSS_DIAG message with insufficent length: %d",
+                  wnl->nlh.nlmsg_len);
             return WIFI_ERROR_UNKNOWN;
         }
         diag_fw_type = event_hdr->diag_type;