Cumulative patch from commit a9491695b30a7f750dc45cb563d813b03f1d4b8d

a9491695b QCA vendor command to set/get NUD statistics
f593b6c11 nl80211: Do not reset vendor_scan_cookie after scan timeout
f2bc34480 wpa_supplicant: Fix global control interface for STA/STA-FIRST/STA-NEXT
cc3dae85b hostapd: Add possibility to send debug messages to syslog
0da355235 FST: Remove WPA_ASSERT from wpas_fst_send_action_cb()
968dce9b1 FST: Silence compiler warning on WPA_ASSERT
17e20b1e2 FST: Remove a bogus WPA_ASSERT()
6a5425fd6 Increase delayed EAPOL RX frame timeout
cef8fac04 wpa_auth: Make struct wpa_auth_callbacks const
30eddf352 Fix or supress various sparse warnings
b301f54e5 IBSS/mesh: Skip VHT channel setup with vht_disabled=1
adc6a5d81 mesh: Check remote peer HT Operation element
9eb5757a8 Define helper function set_disable_ht40()
7813b7c34 nl80211: Fix a memory leak on deinit with HT enabled mesh
6b585f420 mesh: Fix crash on removing virtual mesh interface
5208160b4 FILS: Parse received FILS HLP requests
5732b770f FILS: Allow FILS HLP requests to be added
a1aa2aebc Remove unused WLAN_CIPHER_SUITE_* definitions
a042e39ac nl80211: Use RSN_CIPHER_SUITE_* instead of WLAN_CIPHER_SUITE_*
2373a3117 Define all RSN_CIPHER_SUITE_* values
89ba101e1 Remove unused WLAN_AKM_SUITE_* definitions
bf9f8a052 Use RSN_AUTH_KEY_MGMT_* instead of WLAN_AKM_SUITE_* for wpa_akm_to_suite()
3aa24db95 nl80211: Use RSN_AUTH_KEY_MGMT_* instead of WLAN_AKM_SUITE_*
a1343fa6b Remove unnecessary ifdef from RSN_AUTH_KEY_MGMT_* definitions
afe731004 Fix CONFIG_SAE build without CONFIG_SME
34e8bfd7a Skip EVENT_ACS_CHANNEL_SELECTED also without CONFIG_AP
510fc2dfc Fix AKM suite selectors for FILS and Suite B
d7d0f909f QCA vendor command to carry the reason for power save failure
53b38209f GAS: Cancel gas_query_timeout when AP responds with comeback delay
d5bd94133 MBO: Silence a compiler warning when building without CONFIG_MBO
4c4070005 QCA vendor command to enable host driver offload ACS to user space
4d77d80ed mesh: Add MESH_PMKSA_GET/ADD commands
117875db3 D-Bus: Add GroupMgmt entry into the interface Capabilities dict
3cdb4ac07 D-Bus: Add pmf to global capabilities
adf8f45f8 D-Bus: Implement Pmf property
b98706c14 RSN IBSS: Fix TK clearing on Authentication frame RX
fa67debf4 Fix duplicate Reassociation Request frame dropping
6ff92677a wext: Cancel send_rfkill timeout in deinit
fcd3d6ce3 FILS: Fix PMK and PMKID derivation from ERP
ef495c78d OpenSSL: Implement sha384_vector()
a70cd0db8 nl80211: Don't register for Beacon frames for IEEE 802.11ad AP
a2aa21a3b Assign additional vendor specific elements for early HE testing
f09095d57 wpa_supplicant: Clarify group_rekey documentation
c85dfc6f8 nl80211: Set NL80211_ATTR_IFACE_SOCKET_OWNER for connect and associate
d07f450da Sync with mac80211-next.git include/uapi/linux/nl80211.h
8f315d050 Fix country code in wpa_supplicant AP mode Country element
29065686a D-Bus: Fix BSS Mode getter for invalid DMG BSS
b2442f256 nl80211: Debug prints for TDLS_OPER command and result
2901bc272 bgscan: Remove unnecessary NULL check
9d6eaad6b bgscan: Remove unnecessary NULL check
0f9b4a0f1 bgscan: Deliver beacon loss event to bgscan modules
688556722 nl80211: More complete processing of connection quality monitor events
54736d835 Store FST parameters to configuration file
35c78f7b9 Store osu_dir to configuration file
1f539c78f Store autoscan to configuration file
58ed9e31d Store filter_rssi to configuration file
1fb1bf99d Write sec_device_type to configuration file
b4bdeadfa Make "SET" behavior more consistent for dot11RSNA parameters
e3394c0e2 Make "SET non_pref_chan .." behavior more consistent
f8c201862 Fix cert_in_cb parsing in wpa_supplicant.conf
9284418d0 Fix writing of wpa_supplicant sae_groups configuration parameter
167f78a5e Send BEACON-REQ-TX-STATUS event only for beacon reports
7ba94fc4b RRM: Use wpa_hexdump_buf() instead of wpa_hexdump()
e4ec6bbfd nl80211: Register for Link Measurement Report frames in AP mode
33468e532 RRM: Document Link Measurement Report frame construction steps
40e9a3f32 RRM: Fix beacon report scan channels for VHT 80, 80+80, 160 MHz cases
5cda35089 RRM: Move wpabuf_resize() call into wpas_rrm_report_elem()
f2058f4af RRM: Remove unnecessary cb check
89fa633af nl80211: Fix error while enabling AP mode with driver-SME

The last change 89fa633af cherrypicks a later change that resolves
an issue with starting up AP mode.

Bug: 34681709
Test: Wifi Suite
Change-Id: Iba8c5824009d6480fb736b274d69243c77aef7fe
diff --git a/wpa_supplicant/rrm.c b/wpa_supplicant/rrm.c
index 942eea7..36a8336 100644
--- a/wpa_supplicant/rrm.c
+++ b/wpa_supplicant/rrm.c
@@ -160,12 +160,6 @@
 		return -EOPNOTSUPP;
 	}
 
-	if (!cb) {
-		wpa_printf(MSG_DEBUG,
-			   "RRM: Neighbor Report request must provide a callback.");
-		return -EINVAL;
-	}
-
 	/* Refuse if there's a live request */
 	if (wpa_s->rrm.notify_neighbor_rep) {
 		wpa_printf(MSG_DEBUG,
@@ -284,20 +278,20 @@
 }
 
 
-static int wpas_rrm_report_elem(struct wpabuf *buf, u8 token, u8 mode, u8 type,
+static int wpas_rrm_report_elem(struct wpabuf **buf, u8 token, u8 mode, u8 type,
 				const u8 *data, size_t data_len)
 {
-	if (wpabuf_tailroom(buf) < 5 + data_len)
+	if (wpabuf_resize(buf, 5 + data_len))
 		return -1;
 
-	wpabuf_put_u8(buf, WLAN_EID_MEASURE_REPORT);
-	wpabuf_put_u8(buf, 3 + data_len);
-	wpabuf_put_u8(buf, token);
-	wpabuf_put_u8(buf, mode);
-	wpabuf_put_u8(buf, type);
+	wpabuf_put_u8(*buf, WLAN_EID_MEASURE_REPORT);
+	wpabuf_put_u8(*buf, 3 + data_len);
+	wpabuf_put_u8(*buf, token);
+	wpabuf_put_u8(*buf, mode);
+	wpabuf_put_u8(*buf, type);
 
 	if (data_len)
-		wpabuf_put_data(buf, data, data_len);
+		wpabuf_put_data(*buf, data, data_len);
 
 	return 0;
 }
@@ -350,10 +344,7 @@
 	if (max_age != 0xffff && max_age < diff_l)
 		goto reject;
 
-	if (wpabuf_resize(buf, 5 + wpabuf_len(wpa_s->lci)))
-		return -1;
-
-	if (wpas_rrm_report_elem(*buf, req->token,
+	if (wpas_rrm_report_elem(buf, req->token,
 				 MEASUREMENT_REPORT_MODE_ACCEPT, req->type,
 				 wpabuf_head_u8(wpa_s->lci),
 				 wpabuf_len(wpa_s->lci)) < 0) {
@@ -364,12 +355,7 @@
 	return 0;
 
 reject:
-	if (wpabuf_resize(buf, sizeof(struct rrm_measurement_report_element))) {
-		wpa_printf(MSG_DEBUG, "RRM: Memory allocation failed");
-		return -1;
-	}
-
-	if (wpas_rrm_report_elem(*buf, req->token,
+	if (wpas_rrm_report_elem(buf, req->token,
 				 MEASUREMENT_REPORT_MODE_REJECT_INCAPABLE,
 				 req->type, NULL, 0) < 0) {
 		wpa_printf(MSG_DEBUG, "RRM: Failed to add report element");
@@ -438,6 +424,12 @@
 		u8 primary_chan = chan - (2 * num_primary_channels - 2) + i * 4;
 
 		freqs[i] = ieee80211_chan_to_freq(NULL, op_class, primary_chan);
+		/* ieee80211_chan_to_freq() is not really meant for this
+		 * conversion of 20 MHz primary channel numbers for wider VHT
+		 * channels, so handle those as special cases here for now. */
+		if (freqs[i] < 0 &&
+		    (op_class == 128 || op_class == 129 || op_class == 130))
+			freqs[i] = 5000 + 5 * primary_chan;
 		if (freqs[i] < 0) {
 			wpa_printf(MSG_DEBUG,
 				   "Beacon Report: Invalid channel %u",
@@ -641,8 +633,8 @@
 }
 
 
-int wpas_get_op_chan_phy(int freq, const u8 *ies, size_t ies_len,
-			 u8 *op_class, u8 *chan, u8 *phy_type)
+static int wpas_get_op_chan_phy(int freq, const u8 *ies, size_t ies_len,
+				u8 *op_class, u8 *chan, u8 *phy_type)
 {
 	const u8 *ie;
 	int sec_chan = 0, vht = 0;
@@ -832,14 +824,7 @@
 	if (ret < 0)
 		return -1;
 
-	if (wpabuf_resize(wpa_buf,
-			  sizeof(struct rrm_measurement_report_element) +
-			  sizeof(*rep) + ret)) {
-		wpa_printf(MSG_ERROR, "RRM: Memory allocation failed");
-		return -1;
-	}
-
-	return wpas_rrm_report_elem(*wpa_buf, wpa_s->beacon_rep_data.token,
+	return wpas_rrm_report_elem(wpa_buf, wpa_s->beacon_rep_data.token,
 				    MEASUREMENT_REPORT_MODE_ACCEPT,
 				    MEASURE_TYPE_BEACON, buf,
 				    ret + sizeof(*rep));
@@ -849,12 +834,7 @@
 static int wpas_beacon_rep_no_results(struct wpa_supplicant *wpa_s,
 				      struct wpabuf **buf)
 {
-	if (wpabuf_resize(buf, 5)) {
-		wpa_printf(MSG_DEBUG, "RRM: Memory allocation failed");
-		return -1;
-	}
-
-	return wpas_rrm_report_elem(*buf, wpa_s->beacon_rep_data.token,
+	return wpas_rrm_report_elem(buf, wpa_s->beacon_rep_data.token,
 				    MEASUREMENT_REPORT_MODE_ACCEPT,
 				    MEASURE_TYPE_BEACON, NULL, 0);
 }
@@ -880,11 +860,9 @@
 
 static void wpas_rrm_refuse_request(struct wpa_supplicant *wpa_s)
 {
-	struct wpabuf *buf;
+	struct wpabuf *buf = NULL;
 
-	buf = wpabuf_alloc(sizeof(struct rrm_measurement_beacon_report));
-	if (!buf ||
-	    wpas_rrm_report_elem(buf, wpa_s->beacon_rep_data.token,
+	if (wpas_rrm_report_elem(&buf, wpa_s->beacon_rep_data.token,
 				 MEASUREMENT_REPORT_MODE_REJECT_REFUSED,
 				 MEASURE_TYPE_BEACON, NULL, 0)) {
 		wpa_printf(MSG_ERROR, "RRM: Memory allocation failed");
@@ -1174,12 +1152,7 @@
 	}
 
 reject:
-	if (wpabuf_resize(buf, sizeof(struct rrm_measurement_report_element))) {
-		wpa_printf(MSG_DEBUG, "RRM: Memory allocation failed");
-		return -1;
-	}
-
-	if (wpas_rrm_report_elem(*buf, req->token,
+	if (wpas_rrm_report_elem(buf, req->token,
 				 MEASUREMENT_REPORT_MODE_REJECT_INCAPABLE,
 				 req->type, NULL, 0) < 0) {
 		wpa_printf(MSG_DEBUG, "RRM: Failed to add report element");
@@ -1311,10 +1284,14 @@
 	}
 
 	os_memset(&report, 0, sizeof(report));
+	report.dialog_token = req->dialog_token;
 	report.tpc.eid = WLAN_EID_TPC_REPORT;
 	report.tpc.len = 2;
+	/* Note: The driver is expected to update report.tpc.tx_power and
+	 * report.tpc.link_margin subfields when sending out this frame.
+	 * Similarly, the driver would need to update report.rx_ant_id and
+	 * report.tx_ant_id subfields. */
 	report.rsni = 255; /* 255 indicates that RSNI is not available */
-	report.dialog_token = req->dialog_token;
 	report.rcpi = rssi_to_rcpi(rssi);
 
 	/* action_category + action_code */
@@ -1328,8 +1305,7 @@
 	wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
 	wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
 	wpabuf_put_data(buf, &report, sizeof(report));
-	wpa_hexdump(MSG_DEBUG, "RRM: Link measurement report:",
-		    wpabuf_head(buf), wpabuf_len(buf));
+	wpa_hexdump_buf(MSG_DEBUG, "RRM: Link measurement report", buf);
 
 	if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
 				wpa_s->own_addr, wpa_s->bssid,