Merge "Release 1.0.0.100 QCACLD WLAN Driver"

31 files changed, 316 insertions, 103 deletions

diff --git a/CORE/CLD_TXRX/TLSHIM/tl_shim.c b/CORE/CLD_TXRX/TLSHIM/tl_shim.c
index e01c883fad56..7d86d3454140 100644
--- a/CORE/CLD_TXRX/TLSHIM/tl_shim.c
+++ b/CORE/CLD_TXRX/TLSHIM/tl_shim.c
@@ -45,9 +45,7 @@
 #include "adf_nbuf.h"
 #include "wma_api.h"
 #include "vos_utils.h"
-#ifdef QCA_LL_TX_FLOW_CT
 #include "wdi_out.h"
-#endif /* QCA_LL_TX_FLOW_CT */
 #define ENTER() VOS_TRACE(VOS_MODULE_ID_TL, VOS_TRACE_LEVEL_INFO, "Enter:%s", __func__)
 
 #define TLSHIM_LOGD(args...) \
@@ -932,6 +930,7 @@ void WLANTL_RegisterVdev(void *vos_ctx, void *vdev)
 	wdi_in_osif_vdev_register(vdev_handle, tl_shim, &txrx_ops);
 	/* TODO: Keep vdev specific tx callback, if needed */
 	tl_shim->tx = txrx_ops.tx.std;
+	adf_os_atomic_set(&tl_shim->vdev_active[vdev_handle->vdev_id], 1);
 }
 
 /*
@@ -948,6 +947,7 @@ void WLANTL_UnRegisterVdev(void *vos_ctx, u_int8_t vdev_id)
 		return;
 	}
 
+	adf_os_atomic_set(&tl_shim->vdev_active[vdev_id], 0);
 #ifdef QCA_LL_TX_FLOW_CT
 	WLANTL_DeRegisterTXFlowControl(vos_ctx, vdev_id);
 #endif /* QCA_LL_TX_FLOW_CT */
@@ -1032,7 +1032,7 @@ adf_nbuf_t WLANTL_SendSTA_DataFrame(void *vos_ctx, u_int8_t sta_id,
 
 #ifdef IPA_OFFLOAD
 adf_nbuf_t WLANTL_SendIPA_DataFrame(void *vos_ctx, void *vdev,
-                                    adf_nbuf_t skb)
+                                    adf_nbuf_t skb,  v_U8_t interface_id)
 {
     struct txrx_tl_shim_ctx *tl_shim = vos_get_context(VOS_MODULE_ID_TL,
                                                            vos_ctx);
@@ -1040,6 +1040,11 @@ adf_nbuf_t WLANTL_SendIPA_DataFrame(void *vos_ctx, void *vdev,
 
 	ENTER();
 
+	if (!adf_os_atomic_read(&tl_shim->vdev_active[interface_id])) {
+		TLSHIM_LOGW("INACTIVE VDEV");
+		return skb;
+	}
+
 	if ((tl_shim->ip_checksum_offload) && (skb->protocol == htons(ETH_P_IP))
 		 && (skb->ip_summed == CHECKSUM_PARTIAL))
 		skb->ip_summed = CHECKSUM_COMPLETE;
@@ -1648,7 +1653,7 @@ VOS_STATUS WLANTL_Close(void *vos_ctx)
 	}
 	adf_os_mem_free(tl_shim->session_flow_control);
 #endif /* QCA_LL_TX_FLOW_CT */
-
+	adf_os_mem_free(tl_shim->vdev_active);
 #ifdef FEATURE_WLAN_ESE
 	vos_flush_work(&tl_shim->iapp_work.deferred_work);
 #endif
@@ -1671,9 +1676,7 @@ VOS_STATUS WLANTL_Open(void *vos_ctx, WLANTL_ConfigInfoType *tl_cfg)
 	struct txrx_tl_shim_ctx *tl_shim;
 	VOS_STATUS status;
 	u_int8_t i;
-#ifdef QCA_LL_TX_FLOW_CT
 	int max_vdev;
-#endif /* QCA_LL_TX_FLOW_CT */
 
 	ENTER();
 	status = vos_alloc_context(vos_ctx, VOS_MODULE_ID_TL,
@@ -1710,9 +1713,15 @@ VOS_STATUS WLANTL_Open(void *vos_ctx, WLANTL_ConfigInfoType *tl_cfg)
 	 * TODO: Allocate memory for tx callback for maximum supported
 	 * vdevs to maintain tx callbacks per vdev.
 	 */
+	max_vdev = wdi_out_cfg_max_vdevs(((pVosContextType)vos_ctx)->cfg_ctx);
+	tl_shim->vdev_active = adf_os_mem_alloc(NULL,
+		max_vdev * sizeof(adf_os_atomic_t));
+	for (i = 0; i < max_vdev; i++) {
+		adf_os_atomic_init(&tl_shim->vdev_active[i]);
+		adf_os_atomic_set(&tl_shim->vdev_active[i], 0);
+	}
 
 #ifdef QCA_LL_TX_FLOW_CT
-	max_vdev = wdi_out_cfg_max_vdevs(((pVosContextType)vos_ctx)->cfg_ctx);
 	tl_shim->session_flow_control = adf_os_mem_alloc(NULL,
 			max_vdev * sizeof(struct tlshim_session_flow_Control));
 	if (!tl_shim->session_flow_control) {
diff --git a/CORE/CLD_TXRX/TLSHIM/tl_shim.h b/CORE/CLD_TXRX/TLSHIM/tl_shim.h
index bbc400585cfe..bb675cc34618 100644
--- a/CORE/CLD_TXRX/TLSHIM/tl_shim.h
+++ b/CORE/CLD_TXRX/TLSHIM/tl_shim.h
@@ -30,6 +30,7 @@
 
 #include <ol_txrx_osif_api.h>
 #include <adf_os_lock.h>
+#include <adf_os_atomic.h>
 
 #ifdef FEATURE_WLAN_ESE
 typedef struct deferred_iapp_work {
@@ -88,6 +89,7 @@ struct deferred_iapp_work iapp_work;
 	u_int32_t   last_beacon_len;
 	u_int32_t delay_interval;
 	v_BOOL_t enable_rxthread;
+	adf_os_atomic_t *vdev_active;
 #ifdef QCA_LL_TX_FLOW_CT
 	struct tlshim_session_flow_Control *session_flow_control;
 #endif /* QCA_LL_TX_FLOW_CT */
diff --git a/CORE/HDD/src/wlan_hdd_assoc.c b/CORE/HDD/src/wlan_hdd_assoc.c
index 59465ed8eaf9..31ef227b0a41 100644
--- a/CORE/HDD/src/wlan_hdd_assoc.c
+++ b/CORE/HDD/src/wlan_hdd_assoc.c
@@ -2621,6 +2621,16 @@ eHalStatus hdd_RoamTdlsStatusUpdateHandler(hdd_adapter_t *pAdapter,
 #ifdef CONFIG_TDLS_IMPLICIT
             hddTdlsPeer_t *curr_peer;
 
+            /* ignore TDLS_SHOULD_DISCOVER if any concurrency detected */
+            if ((1 << VOS_STA_MODE) != pHddCtx->concurrency_mode)
+            {
+                VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+                          "%s: concurrency detected. ignore SHOULD_DISCOVER",
+                          __func__);
+                status = eHAL_STATUS_FAILURE;
+                break;
+            }
+
             curr_peer = wlan_hdd_tdls_get_peer(pAdapter, pRoamInfo->peerMac);
             if (!curr_peer)
             {
diff --git a/CORE/HDD/src/wlan_hdd_cfg80211.c b/CORE/HDD/src/wlan_hdd_cfg80211.c
index ce3a10fc5d02..651e859a8ed3 100644
--- a/CORE/HDD/src/wlan_hdd_cfg80211.c
+++ b/CORE/HDD/src/wlan_hdd_cfg80211.c
@@ -2487,10 +2487,20 @@ static int wlan_hdd_cfg80211_start_bss(hdd_adapter_t *pHostapdAdapter,
         else
             pConfig->SapHw_mode = eSAP_DOT11_MODE_11ac;
 
-        /* Disable VHT support in 2.4 GHz band */
-        if (iniConfig->apOperatingBand == eSAP_RF_SUBBAND_2_4_GHZ &&
-                WLAN_HDD_GET_CTX(pHostapdAdapter)->
-                        cfg_ini->enableVhtFor24GHzBand == FALSE)
+        /*If ACS disable and selected channel <= 14
+             OR
+             ACS enabled and ACS operating band is choosen as 2.4
+         AND
+             VHT in 2.4G Disabled
+         THEN
+             Fallback to 11N mode
+        */
+        if (((AUTO_CHANNEL_SELECT != pConfig->channel && pConfig->channel <= 14)
+                || (AUTO_CHANNEL_SELECT == pConfig->channel &&
+                iniConfig->apOperatingBand == eSAP_RF_SUBBAND_2_4_GHZ))
+            &&
+            (WLAN_HDD_GET_CTX(pHostapdAdapter)->cfg_ini->enableVhtFor24GHzBand
+                                                                     == FALSE))
             pConfig->SapHw_mode = eSAP_DOT11_MODE_11n;
     }
 #endif
@@ -7579,7 +7589,7 @@ static int wlan_hdd_cfg80211_set_wiphy_params(struct wiphy *wiphy,
 
     if (changed & WIPHY_PARAM_RTS_THRESHOLD)
     {
-        u16 rts_threshold = (wiphy->rts_threshold == -1) ?
+        u32 rts_threshold = (wiphy->rts_threshold == -1) ?
                                WNI_CFG_RTS_THRESHOLD_STAMAX :
                                wiphy->rts_threshold;
 
@@ -7587,7 +7597,7 @@ static int wlan_hdd_cfg80211_set_wiphy_params(struct wiphy *wiphy,
                 (WNI_CFG_RTS_THRESHOLD_STAMAX < rts_threshold))
         {
             hddLog(VOS_TRACE_LEVEL_ERROR,
-                    "%s: Invalid RTS Threshold value %hu",
+                    "%s: Invalid RTS Threshold value %u",
                     __func__, rts_threshold);
             return -EINVAL;
         }
@@ -7597,12 +7607,12 @@ static int wlan_hdd_cfg80211_set_wiphy_params(struct wiphy *wiphy,
                     eANI_BOOLEAN_TRUE))
         {
             hddLog(VOS_TRACE_LEVEL_ERROR,
-                    "%s: ccmCfgSetInt failed for rts_threshold value %hu",
+                    "%s: ccmCfgSetInt failed for rts_threshold value %u",
                     __func__, rts_threshold);
             return -EIO;
         }
 
-        hddLog(VOS_TRACE_LEVEL_INFO_MED, "%s: set rts threshold %hu", __func__,
+        hddLog(VOS_TRACE_LEVEL_INFO_MED, "%s: set rts threshold %u", __func__,
                 rts_threshold);
     }
 
@@ -9368,7 +9378,8 @@ static int wlan_hdd_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *d
         return -ENOTSUPP;
     }
 
-    /* other than teardown frame, other mgmt frames are not sent if disabled */
+    /* other than teardown frame, other mgmt frames are not sent if disabled
+       or concurrency is detected */
     if (SIR_MAC_TDLS_TEARDOWN != action_code)
     {
        /* if tdls_mode is disabled to respond to peer's request */
@@ -9379,7 +9390,16 @@ static int wlan_hdd_cfg80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *d
                         " TDLS mode is disabled. action %d declined.",
                         __func__, MAC_ADDR_ARRAY(peer), action_code);
 
-        return -ENOTSUPP;
+             return -ENOTSUPP;
+        }
+
+        /* if any concurrency is detected */
+        if ((1 << VOS_STA_MODE) != pHddCtx->concurrency_mode)
+        {
+            VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
+                      "%s: concurrency detected. ignore TDLS MGMT frame. action_code=%d",
+                      __func__, action_code);
+            return -ENOTSUPP;
         }
     }
 
diff --git a/CORE/HDD/src/wlan_hdd_hostapd.c b/CORE/HDD/src/wlan_hdd_hostapd.c
index 0da8dd01ab50..d7031cd21556 100644
--- a/CORE/HDD/src/wlan_hdd_hostapd.c
+++ b/CORE/HDD/src/wlan_hdd_hostapd.c
@@ -1804,7 +1804,7 @@ static iw_softap_setparam(struct net_device *dev,
                 ret = process_wma_set_command((int)pHostapdAdapter->sessionId,
                                 (int)WMI_VDEV_PARAM_ENABLE_RTSCTS,
                                 set_value, VDEV_CMD);
-                if (!ret) {
+                if (ret) {
                     hddLog(LOGE, "FAILED TO SET RTSCTS at SAP");
                     ret = -EIO;
                 }
diff --git a/CORE/HDD/src/wlan_hdd_ipa.c b/CORE/HDD/src/wlan_hdd_ipa.c
index dd280110cbb9..12039ce9b2c8 100644
--- a/CORE/HDD/src/wlan_hdd_ipa.c
+++ b/CORE/HDD/src/wlan_hdd_ipa.c
@@ -156,6 +156,7 @@ struct hdd_ipa_iface_context {
 
 	uint8_t iface_id; /* This iface ID */
 	uint8_t sta_id; /* This iface station ID */
+	vos_spin_lock_t interface_lock;
 };
 
 
@@ -867,6 +868,7 @@ static void hdd_ipa_i2w_cb(void *priv, enum ipa_dp_evt_type evt,
 	struct ipa_rx_data *ipa_tx_desc;
 	struct hdd_ipa_iface_context *iface_context;
 	adf_nbuf_t skb;
+	v_U8_t interface_id;
 
 	if (evt == IPA_RECEIVE) {
 
@@ -887,8 +889,20 @@ static void hdd_ipa_i2w_cb(void *priv, enum ipa_dp_evt_type evt,
 
 		hdd_ipa->stats.tx_ipa_recv++;
 
+		vos_spin_lock_acquire(&iface_context->interface_lock);
+		if (iface_context->adapter) {
+			interface_id = iface_context->adapter->sessionId;
+		}
+		else{
+			HDD_IPA_LOG(VOS_TRACE_LEVEL_WARN, "Interface Down");
+			ipa_free_skb(ipa_tx_desc);
+			vos_spin_lock_release(&iface_context->interface_lock);
+			return;
+		}
+		vos_spin_lock_release(&iface_context->interface_lock);
+
 		skb = WLANTL_SendIPA_DataFrame(hdd_ipa->hdd_ctx->pvosContext,
-				iface_context->tl_context, ipa_tx_desc->skb);
+				iface_context->tl_context, ipa_tx_desc->skb, interface_id);
 		if (skb) {
 			HDD_IPA_LOG(VOS_TRACE_LEVEL_DEBUG, "TLSHIM tx fail");
 			ipa_free_skb(ipa_tx_desc);
@@ -1252,9 +1266,11 @@ static void hdd_ipa_cleanup_iface(struct hdd_ipa_iface_context *iface_context)
 
 	hdd_ipa_clean_hdr(iface_context->adapter);
 
+	vos_spin_lock_acquire(&iface_context->interface_lock);
 	iface_context->adapter->ipa_context = NULL;
 	iface_context->adapter = NULL;
 	iface_context->tl_context = NULL;
+	vos_spin_lock_release(&iface_context->interface_lock);
 }
 
 
@@ -1677,6 +1693,7 @@ VOS_STATUS hdd_ipa_init(hdd_context_t *hdd_ctx)
 		iface_context->prod_client =
 			hdd_ipa_adapter_2_client[i].prod_client;
 		iface_context->iface_id = i;
+		vos_spin_lock_init(&iface_context->interface_lock);
 	}
 
 	ret = hdd_ipa_setup_rm(hdd_ipa);
@@ -1710,10 +1727,18 @@ fail_setup_rm:
 VOS_STATUS hdd_ipa_cleanup(hdd_context_t *hdd_ctx)
 {
 	struct hdd_ipa_priv *hdd_ipa = hdd_ctx->hdd_ipa;
+	int i;
+	struct hdd_ipa_iface_context *iface_context = NULL;
 
 	if (!hdd_ipa_is_enabled(hdd_ctx))
 		return VOS_STATUS_SUCCESS;
 
+	/* destory the interface lock */
+	for (i = 0; i < HDD_IPA_MAX_IFACE; i++) {
+		iface_context = &hdd_ipa->iface_context[i];
+		vos_spin_lock_destroy(&iface_context->interface_lock);
+	}
+
 	hdd_ipa_debugfs_remove(hdd_ipa);
 
 	if (hdd_ipa->pending_desc_cnt != 0) {
diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c
index 8a62d25b9ed0..772f6fecd04f 100644
--- a/CORE/HDD/src/wlan_hdd_main.c
+++ b/CORE/HDD/src/wlan_hdd_main.c
@@ -286,6 +286,11 @@ extern int hdd_ftm_stop(hdd_context_t *pHddCtx);
 v_VOID_t wlan_hdd_auto_shutdown_cb(v_PVOID_t data);
 #endif
 
+/* Store WLAN driver version info in a global variable such that crash debugger
+   can extract it from driver debug symbol and crashdump for post processing */
+tANI_U8 g_wlan_driver_version[ ] = QWLAN_VERSIONSTR;
+
+
 #if defined(FEATURE_WLAN_ESE) && defined(FEATURE_WLAN_ESE_UPLOAD)
 VOS_STATUS hdd_parse_get_cckm_ie(tANI_U8 *pValue,
                                  tANI_U8 **pCckmIe,
diff --git a/CORE/HDD/src/wlan_hdd_wext.c b/CORE/HDD/src/wlan_hdd_wext.c
index 0e051c2f07b6..be2092513e43 100644
--- a/CORE/HDD/src/wlan_hdd_wext.c
+++ b/CORE/HDD/src/wlan_hdd_wext.c
@@ -618,7 +618,7 @@ void hdd_wlan_get_version(hdd_adapter_t *pAdapter, union iwreq_data *wrqu,
     tSirVersionString wcnss_SW_version;
     const char *pSWversion;
     const char *pHWversion;
-    v_U32_t CBId = 0, CBSId = 0, CRMId = 0;
+    v_U32_t MSPId = 0, mSPId = 0, SIId = 0, CRMId = 0;
 #ifndef QCA_WIFI_2_0
     VOS_STATUS status;
     tSirVersionString wcnss_HW_version;
@@ -640,8 +640,9 @@ void hdd_wlan_get_version(hdd_adapter_t *pAdapter, union iwreq_data *wrqu,
         pHddContext->target_fw_version);
 
     pSWversion = wcnss_SW_version;
-    CBId = (pHddContext->target_fw_version & 0xf8000000) >> 27;
-    CBSId = (pHddContext->target_fw_version & 0x07000000) >> 24;
+    MSPId = (pHddContext->target_fw_version & 0xf0000000) >> 28;
+    mSPId = (pHddContext->target_fw_version & 0xf000000) >> 24;
+    SIId = (pHddContext->target_fw_version & 0xf00000) >> 20;
     CRMId = pHddContext->target_fw_version & 0x7fff;
 
     for (i = 0; i < ARRAY_SIZE(qwlan_hw_list); i++) {
@@ -679,17 +680,19 @@ void hdd_wlan_get_version(hdd_adapter_t *pAdapter, union iwreq_data *wrqu,
 
     if (wrqu) {
         wrqu->data.length = scnprintf(extra, WE_MAX_STR_LEN,
-                                     "Host SW:%s, FW:%d.%d.%d, HW:%s",
+                                     "Host SW:%s, FW:%d.%d.%d.%d, HW:%s",
                                      QWLAN_VERSIONSTR,
-                                     CBId,
-                                     CBSId,
+                                     MSPId,
+                                     mSPId,
+                                     SIId,
                                      CRMId,
                                      pHWversion);
     } else {
-        pr_info("Host SW:%s, FW:%d.%d.%d, HW:%s\n",
+        pr_info("Host SW:%s, FW:%d.%d.%d.%d, HW:%s\n",
                 QWLAN_VERSIONSTR,
-                CBId,
-                CBSId,
+                MSPId,
+                mSPId,
+                SIId,
                 CRMId,
                 pHWversion);
     }
diff --git a/CORE/HDD/src/wlan_hdd_wmm.c b/CORE/HDD/src/wlan_hdd_wmm.c
index 6d7fba2df744..55c51d510177 100644
--- a/CORE/HDD/src/wlan_hdd_wmm.c
+++ b/CORE/HDD/src/wlan_hdd_wmm.c
@@ -1883,7 +1883,7 @@ v_U16_t hdd_hostapd_select_queue(struct net_device * dev, struct sk_buff *skb)
    /*Get the Station ID*/
    if (VOS_STATUS_SUCCESS != hdd_softap_GetStaId(pAdapter, pDestMacAddress, &STAId))
    {
-      VOS_TRACE( VOS_MODULE_ID_HDD_SOFTAP, VOS_TRACE_LEVEL_ERROR,
+      VOS_TRACE( VOS_MODULE_ID_HDD_SOFTAP, VOS_TRACE_LEVEL_INFO,
             "%s: Failed to find right station", __func__);
       *pSTAId = HDD_WLAN_INVALID_STA_ID;
       goto done;
@@ -1905,7 +1905,7 @@ v_U16_t hdd_hostapd_select_queue(struct net_device * dev, struct sk_buff *skb)
       //If 3/4th of Tx queue is used then place the DHCP packet in VOICE AC queue
       if (pAdapter->aStaInfo[STAId].vosLowResource && is_dhcp_packet(skb))
       {
-         VOS_TRACE(VOS_MODULE_ID_HDD, WMM_TRACE_LEVEL_WARN,
+         VOS_TRACE(VOS_MODULE_ID_HDD, WMM_TRACE_LEVEL_INFO,
                     "%s: Making priority of DHCP packet as VOICE", __func__);
          up = SME_QOS_WMM_UP_VO;
          ac = hddWmmUpToAcMap[up];
diff --git a/CORE/MAC/inc/qwlan_version.h b/CORE/MAC/inc/qwlan_version.h
index fd5d85e989e2..b39955a81dfc 100644
--- a/CORE/MAC/inc/qwlan_version.h
+++ b/CORE/MAC/inc/qwlan_version.h
@@ -42,9 +42,9 @@ BRIEF DESCRIPTION:
 #define QWLAN_VERSION_MINOR            0
 #define QWLAN_VERSION_PATCH            0
 #define QWLAN_VERSION_EXTRA            ""
-#define QWLAN_VERSION_BUILD            99
+#define QWLAN_VERSION_BUILD            100
 
-#define QWLAN_VERSIONSTR               "1.0.0.99"
+#define QWLAN_VERSIONSTR               "1.0.0.100"
 
 #ifdef QCA_WIFI_2_0
 
diff --git a/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c b/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
index 10a813263733..00560216d8a6 100644
--- a/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
+++ b/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
@@ -643,6 +643,12 @@ limProcessAssocReqFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,
     /* if additional IE is present, check if it has WscIE */
     if( pAssocReq->addIEPresent && pAssocReq->addIE.length )
         wpsIe = limGetWscIEPtr(pMac, pAssocReq->addIE.addIEdata, pAssocReq->addIE.length);
+    else
+    {
+          limLog(pMac, LOG1, FL("Assoc req addIEPresent = %d "
+                                "addIE length = %d"), pAssocReq->addIEPresent,
+                                pAssocReq->addIE.length);
+    }
     /* when wpsIe is present, RSN/WPA IE is ignored */
     if( wpsIe == NULL )
     {
@@ -765,6 +771,10 @@ limProcessAssocReqFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,
             && psessionEntry->pLimStartBssReq->rsnIE->length) */
 
     } /* end of     if( ! pAssocReq->wscInfo.present ) */
+    else
+    {
+          limLog(pMac, LOG1, FL("Assoc req WSE IE is present"));
+    }
 
     /**
      * Extract 'associated' context for STA, if any.
diff --git a/CORE/MAC/src/pe/lim/limSendManagementFrames.c b/CORE/MAC/src/pe/lim/limSendManagementFrames.c
index c8458ecbf30e..fa08d362955c 100644
--- a/CORE/MAC/src/pe/lim/limSendManagementFrames.c
+++ b/CORE/MAC/src/pe/lim/limSendManagementFrames.c
@@ -156,7 +156,7 @@ void limUpdateExtCapIEtoStruct(tpAniSirGlobal pMac,
     if ( DOT11F_EID_EXTCAP != pBuf[0] ||
          pBuf[1] > DOT11F_IE_EXTCAP_MAX_LEN )
     {
-        limLog( pMac, LOGE,
+        limLog( pMac, LOG1,
                FL("Invalid IEs eid = %d elem_len=%d "),
                                                pBuf[0],pBuf[1]);
         return;
@@ -1692,6 +1692,8 @@ limSendAssocRspMgmtFrame(tpAniSirGlobal pMac,
 
                     vos_mem_set(( tANI_U8* )&extractedExtCap,
                         sizeof( tDot11fIEExtCap ), 0);
+
+                    addStripoffIELen = addnIELen;
                     nSirStatus = limStripOffExtCapIEAndUpdateStruct(pMac,
                                       &addIE[0],
                                       &addStripoffIELen,
@@ -1710,8 +1712,12 @@ limSendAssocRspMgmtFrame(tpAniSirGlobal pMac,
                 }
             }
         }
+        else
+        {
+            limLog(pMac, LOG1, FL("addnIEPresent = %d for Assoc Resp : %d"),
+                                addnIEPresent, pAssocReq->addIEPresent);
+        }
     }
-
     halstatus = palPktAlloc( pMac->hHdd, HAL_TXRX_FRM_802_11_MGMT,
                              ( tANI_U16 )nBytes, ( void** ) &pFrame,
                              ( void** ) &pPacket );
diff --git a/CORE/SERVICES/COMMON/dbglog_id.h b/CORE/SERVICES/COMMON/dbglog_id.h
index 5a62909b1b86..774499ef4d4f 100644
--- a/CORE/SERVICES/COMMON/dbglog_id.h
+++ b/CORE/SERVICES/COMMON/dbglog_id.h
@@ -681,7 +681,9 @@ extern "C" {
 #define WAL_DBGID_SMPS_DISABLE                      63
 #define WAL_DBGID_SMPS_ENABLE_HW_CNTRL              64
 #define WAL_DBGID_SMPS_SWSEL_CHAINMASK              65
-#define WAL_DBGID_DEFINITION_END                    66
+#define WAL_DBGID_SUSPEND                           66
+#define WAL_DBGID_RESUME                            67
+#define WAL_DBGID_DEFINITION_END                    68
 
 #define ANI_DBGID_POLL                               0
 #define ANI_DBGID_CONTROL                            1
diff --git a/CORE/SERVICES/COMMON/targaddrs.h b/CORE/SERVICES/COMMON/targaddrs.h
index 4c035562f5f8..aa655c3febab 100644
--- a/CORE/SERVICES/COMMON/targaddrs.h
+++ b/CORE/SERVICES/COMMON/targaddrs.h
@@ -357,6 +357,8 @@ PREPACK64 struct host_interest_s {
 #define CDC_MAX_PERF_WAR_ENABLED()    \
         (!(HOST_INTEREST->hi_option_flag2 & HI_OPTION_DISABLE_CDC_MAX_PERF_WAR))
 
+#define HI_OPTION_USE_EXT_LDO       0x40 /* use LDO27 for 1.1V instead of PMU */
+
 /* hi_reset_flag */
 #define HI_RESET_FLAG_PRESERVE_APP_START         0x01  /* preserve App Start address */
 #define HI_RESET_FLAG_PRESERVE_HOST_INTEREST     0x02  /* preserve host interest */
diff --git a/CORE/SERVICES/COMMON/wmi_tlv_defs.h b/CORE/SERVICES/COMMON/wmi_tlv_defs.h
index aae8b88e3095..cb55b0147760 100644
--- a/CORE/SERVICES/COMMON/wmi_tlv_defs.h
+++ b/CORE/SERVICES/COMMON/wmi_tlv_defs.h
@@ -423,6 +423,8 @@ typedef enum {
     WMITLV_TAG_STRUC_wmi_pdev_l1ss_track_event_fixed_param,
     WMITLV_TAG_STRUC_wmi_diag_data_container_event_fixed_param,
     WMITLV_TAG_STRUC_wmi_modem_power_state_cmd_param,
+    WMITLV_TAG_STRUC_wmi_aggr_state_trig_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_mhf_offload_routing_table_entry,
 } WMITLV_TAG_ID;
 
 /*
@@ -638,7 +640,8 @@ typedef enum {
     OP(WMI_THERMAL_MGMT_EVENTID) \
     OP(WMI_NAN_EVENTID) \
     OP(WMI_PDEV_L1SS_TRACK_EVENTID) \
-    OP(WMI_DIAG_DATA_CONTAINER_EVENTID)
+    OP(WMI_DIAG_DATA_CONTAINER_EVENTID) \
+    OP(WMI_AGGR_STATE_TRIG_EVENTID)
 
 /* TLV definitions of WMI commands */
 
@@ -1490,8 +1493,9 @@ WMITLV_CREATE_PARAM_STRUC(WMI_MHF_OFFLOAD_SET_MODE_CMDID);
 
 #define WMITLV_TABLE_WMI_MHF_OFFLOAD_PLUMB_ROUTING_TBL_CMDID(id,op,buf,len)   \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_mhf_offload_plumb_routing_table_cmd_fixed_param, \
-    wmi_mhf_offload_plumb_routing_table_cmd, fixed_param, WMITLV_SIZE_FIX)
-
+                wmi_mhf_offload_plumb_routing_table_cmd, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_mhf_offload_routing_table_entry, \
+                routing_tbl_entries, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_MHF_OFFLOAD_PLUMB_ROUTING_TBL_CMDID)
 
 #define WMITLV_TABLE_WMI_BATCH_SCAN_DISABLE_CMDID(id,op,buf,len) \
@@ -1620,6 +1624,12 @@ WMITLV_CREATE_PARAM_STRUC(WMI_TX_ADDBA_COMPLETE_EVENTID);
     WMITLV_ELEM(id, op, buf, len, WMITLV_TAG_ARRAY_STRUC, wmi_ba_event_ssn, ba_event_ssn_list, WMITLV_SIZE_VAR)
 
 WMITLV_CREATE_PARAM_STRUC(WMI_BA_RSP_SSN_EVENTID);
+
+/* Aggregation Request event */
+#define WMITLV_TABLE_WMI_AGGR_STATE_TRIG_EVENTID(id,op,buf,len)                                       \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_aggr_state_trig_event_fixed_param, wmi_aggr_state_trig_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_AGGR_STATE_TRIG_EVENTID);
+
 /* Roam Event */
 #define WMITLV_TABLE_WMI_ROAM_EVENTID(id,op,buf,len)                                                         \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_roam_event_fixed_param, wmi_roam_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
diff --git a/CORE/SERVICES/COMMON/wmi_unified.h b/CORE/SERVICES/COMMON/wmi_unified.h
index eb4cbb3f0bc3..03fbc537b860 100644
--- a/CORE/SERVICES/COMMON/wmi_unified.h
+++ b/CORE/SERVICES/COMMON/wmi_unified.h
@@ -675,6 +675,10 @@ typedef enum {
 
     /* Seq num returned from hw for a sta/tid pair */
     WMI_BA_RSP_SSN_EVENTID,
+
+    /* Aggregation state requested by BTC */
+    WMI_AGGR_STATE_TRIG_EVENTID,
+
     /** Roam event to trigger roaming on host */
     WMI_ROAM_EVENTID = WMI_EVT_GRP_START_ID(WMI_GRP_ROAM),
 
@@ -3004,6 +3008,9 @@ typedef enum {
     /* set ebt resync timeout value, in the unit of TU */
     WMI_VDEV_PARAM_EBT_RESYNC_TIMEOUT,
 
+    /* Enable Aggregation State Trigger Event */
+    WMI_VDEV_PARAM_AGGR_TRIG_EVENT_ENABLE,
+
 } WMI_VDEV_PARAM;
 
 enum wmi_pkt_type {
@@ -5057,6 +5064,28 @@ typedef struct {
  */
 } wmi_ba_rsp_ssn_event_fixed_param;
 
+
+enum wmi_aggr_state_req_type {
+    WMI_DISABLE_AGGREGATION,
+    WMI_ENABLE_AGGREGATION
+};
+
+/*
+ * This event is generated by the COEX module
+ * when esco call is begins the coex module in fw genrated this event to host to
+ * disable the RX aggregation and after completion of the esco call fw will indicate to
+ * enable back the Rx aggregation .
+*/
+
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_aggr_state_trig_event_fixed_param */
+    /** unique id identifying the VDEV, generated by the caller */
+    A_UINT32 vdev_id;
+   /** req_type  contains values from enum
+     *  wmi_aggr_state_req_type; 0 (disable) 1(enable) */
+    A_UINT32  req_type;
+}wmi_aggr_state_trig_event_fixed_param;
+
 typedef struct {
     A_UINT32    tlv_header;     /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_vdev_install_key_complete_event_fixed_param */
     /** unique id identifying the VDEV, generated by the caller */
@@ -6284,10 +6313,12 @@ typedef struct {
 } wmi_mhf_offload_set_mode_cmd_fixed_param;
 
 enum wmi_mhf_ofl_table_action {
-    /** Add entry to multihop forwarding offload table */
-    WMI_MHF_OFL_TBL_ADD_ENTRY = 0,
-    /** Delete entry from multihop forwarding offload table */
-    WMI_MHF_OFL_TBL_DEL_ENTRY = 1,
+   /** Create forwarding offload table in FW */
+   WMI_MHF_OFL_TBL_CREATE = 0,
+   /** Append to existing multihop forwarding offload table */
+   WMI_MHF_OFL_TBL_APPEND = 1,
+   /** Flush entire multihop forwarding offload table in FW */
+   WMI_MHF_OFL_TBL_FLUSH = 2,
 };
 
 typedef struct {
@@ -6297,13 +6328,21 @@ typedef struct {
     /** action corresponds to values from enum
      *  wmi_mhf_ofl_table_action */
     A_UINT32 action;
+    /** number of entries in the table */
+    A_UINT32 num_entries;
+/** Followed by the variable length TLV
+ *  wmi_mhf_offload_routing_table_entry entries[] */
+}wmi_mhf_offload_plumb_routing_table_cmd;
+
+typedef struct {
+    /** TLV tag and len; tag equals
+     *  WMITLV_TAG_STRUC_wmi_mhf_offload_routing_table_entry */
+    A_UINT32 tlv_header;
     /** Destination node's IP address */
     WMI_IPV4_ADDR dest_ipv4_addr;
-    /** Next hop node's IP address */
-    WMI_IPV4_ADDR next_hop_ipv4_addr;
     /** Next hop node's MAC address */
     wmi_mac_addr next_hop_mac_addr;
-} wmi_mhf_offload_plumb_routing_table_cmd;
+}wmi_mhf_offload_routing_table_entry;
 
 typedef struct {
     /** tlv tag and len, tag equals
diff --git a/CORE/SERVICES/COMMON/wmi_version.h b/CORE/SERVICES/COMMON/wmi_version.h
index c02750b48599..779b85966ffe 100644
--- a/CORE/SERVICES/COMMON/wmi_version.h
+++ b/CORE/SERVICES/COMMON/wmi_version.h
@@ -36,7 +36,7 @@
 #define __WMI_VER_MINOR_    0
 /** WMI revision number has to be incremented when there is a
  *  change that may or may not break compatibility. */
-#define __WMI_REVISION_ 38
+#define __WMI_REVISION_ 40
 
 /** The Version Namespace should not be normally changed. Only
  *  host and firmware of the same WMI namespace will work
diff --git a/CORE/SERVICES/HIF/USB/hif_usb.c b/CORE/SERVICES/HIF/USB/hif_usb.c
index 4503af783eba..c2084de506d5 100644
--- a/CORE/SERVICES/HIF/USB/hif_usb.c
+++ b/CORE/SERVICES/HIF/USB/hif_usb.c
@@ -155,9 +155,6 @@ int HIF_USBDeviceInserted(struct usb_interface *interface, hif_handle_t hif_hdl)
 	return retval;
 }
 
-A_STATUS HIFDiagWriteWARMRESET(struct usb_interface *interface,
-			       A_UINT32 address, A_UINT32 data);
-
 void HIF_USBDeviceDetached(struct usb_interface *interface,
 			   a_uint8_t surprise_removed)
 {
@@ -173,8 +170,6 @@ void HIF_USBDeviceDetached(struct usb_interface *interface,
 			break;
 		}
 
-		HIFDiagWriteWARMRESET(interface, 0, 0);
-
 		device->surpriseRemoved = surprise_removed;
 		/* inform upper layer if it is still interested */
 		if (surprise_removed
diff --git a/CORE/SERVICES/HIF/USB/hif_usb_internal.h b/CORE/SERVICES/HIF/USB/hif_usb_internal.h
index dae0cc624325..88b91d7cc745 100644
--- a/CORE/SERVICES/HIF/USB/hif_usb_internal.h
+++ b/CORE/SERVICES/HIF/USB/hif_usb_internal.h
@@ -161,4 +161,6 @@ extern void usb_hif_io_comp_work(struct work_struct *work);
 /* Support for USB Suspend / Resume */
 extern void usb_hif_suspend(struct usb_interface *interface);
 extern void usb_hif_resume(struct usb_interface *interface);
+A_STATUS HIFDiagWriteWARMRESET(struct usb_interface *interface,
+			       A_UINT32 address, A_UINT32 data);
 #endif
diff --git a/CORE/SERVICES/HIF/USB/if_usb.c b/CORE/SERVICES/HIF/USB/if_usb.c
index 6786558db4fd..fcbcf0bd5b8d 100644
--- a/CORE/SERVICES/HIF/USB/if_usb.c
+++ b/CORE/SERVICES/HIF/USB/if_usb.c
@@ -85,6 +85,15 @@ static void hif_nointrs(struct hif_usb_softc *sc)
 {
 }
 
+static int hif_usb_reboot(struct notifier_block *nb, unsigned long val,
+			     void *v)
+{
+	struct hif_usb_softc *sc;
+	sc = container_of(nb, struct hif_usb_softc, reboot_notifier);
+	HIFDiagWriteWARMRESET(sc->interface, 0, 0);
+	return NOTIFY_DONE;
+}
+
 static int
 hif_usb_probe(struct usb_interface *interface, const struct usb_device_id *id)
 {
@@ -163,6 +172,10 @@ hif_usb_probe(struct usb_interface *interface, const struct usb_device_id *id)
 
 	if (ret) {
 		hif_nointrs(sc);
+		if (sc->hif_device != NULL) {
+			((HIF_DEVICE_USB *)(sc->hif_device))->sc = NULL;
+		}
+		athdiag_procfs_remove();
 		goto err_config;
 	}
 #ifndef REMOVE_PKT_LOG
@@ -182,6 +195,9 @@ hif_usb_probe(struct usb_interface *interface, const struct usb_device_id *id)
 	send_btc_nlink_msg(WLAN_MODULE_UP_IND, 0);
 #endif
 
+	sc->interface = interface;
+	sc->reboot_notifier.notifier_call = hif_usb_reboot;
+	register_reboot_notifier(&sc->reboot_notifier);
 	return 0;
 
 err_config:
@@ -202,15 +218,17 @@ static void hif_usb_remove(struct usb_interface *interface)
 	struct hif_usb_softc *sc = device->sc;
 	struct ol_softc *scn;
 
-	usb_put_dev(interface_to_usbdev(interface));
 	/* Attach did not succeed, all resources have been
 	 * freed in error handler
 	 */
 	if (!sc)
 		return;
 
-	scn = sc->ol_sc;
+	HIFDiagWriteWARMRESET(interface, 0, 0);
+	unregister_reboot_notifier(&sc->reboot_notifier);
 
+	usb_put_dev(interface_to_usbdev(interface));
+	scn = sc->ol_sc;
 #ifndef REMOVE_PKT_LOG
 	if (vos_get_conparam() != VOS_FTM_MODE)
 		pktlogmod_exit(scn);
@@ -314,14 +332,19 @@ void hif_init_adf_ctx(adf_os_device_t adf_dev, void *ol_sc)
 	sc->adf_dev = adf_dev;
 }
 
+static int is_usb_driver_register = 0;
 int hif_register_driver(void)
 {
+	is_usb_driver_register = 1;
 	return usb_register(&hif_usb_drv_id);
 }
 
 void hif_unregister_driver(void)
 {
-	usb_deregister(&hif_usb_drv_id);
+	if (is_usb_driver_register) {
+		is_usb_driver_register = 0;
+		usb_deregister(&hif_usb_drv_id);
+	}
 }
 
 void hif_init_pdev_txrx_handle(void *ol_sc, void *txrx_handle)
diff --git a/CORE/SERVICES/HIF/USB/if_usb.h b/CORE/SERVICES/HIF/USB/if_usb.h
index 94537302fa26..976ab790a921 100644
--- a/CORE/SERVICES/HIF/USB/if_usb.h
+++ b/CORE/SERVICES/HIF/USB/if_usb.h
@@ -34,6 +34,7 @@
 #include <linux/semaphore.h>
 #endif
 #include <linux/interrupt.h>
+#include <linux/reboot.h>
 
 /*
  * There may be some pending tx frames during platform suspend.
@@ -73,6 +74,8 @@ struct hif_usb_softc {
 	u16 devid;
 	struct targetdef_s *targetdef;
 	struct hostdef_s *hostdef;
+	struct usb_interface *interface;
+	struct notifier_block reboot_notifier;  /* default mode before reboot */
 };
 #if defined(CONFIG_ATH_PROCFS_DIAG_SUPPORT)
 int athdiag_procfs_init(void *scn);
diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c
index 4650c082462b..cd3e8b5720d1 100644
--- a/CORE/SERVICES/WMA/wma.c
+++ b/CORE/SERVICES/WMA/wma.c
@@ -1003,14 +1003,18 @@ static void wma_delete_all_ibss_peers(tp_wma_handle wma, A_UINT32 vdev_id)
 		return;
 
 	/* remove all IBSS remote peers first */
+	adf_os_spin_lock_bh(&vdev->pdev->peer_ref_mutex);
 	TAILQ_FOREACH(peer, &vdev->peer_list, peer_list_elem) {
 		if (peer != TAILQ_FIRST(&vdev->peer_list)) {
+			adf_os_spin_unlock_bh(&vdev->pdev->peer_ref_mutex);
 			adf_os_atomic_init(&peer->ref_cnt);
 			adf_os_atomic_inc(&peer->ref_cnt);
 			wma_remove_peer(wma, wma->interfaces[vdev_id].bssid,
 				vdev_id, peer);
+			adf_os_spin_lock_bh(&vdev->pdev->peer_ref_mutex);
 		}
 	}
+	adf_os_spin_unlock_bh(&vdev->pdev->peer_ref_mutex);
 
 	/* remove IBSS bss peer last */
 	peer = TAILQ_FIRST(&vdev->peer_list);
@@ -1020,26 +1024,31 @@ static void wma_delete_all_ibss_peers(tp_wma_handle wma, A_UINT32 vdev_id)
 
 static void wma_delete_all_ap_remote_peers(tp_wma_handle wma, A_UINT32 vdev_id)
 {
-		ol_txrx_vdev_handle vdev;
-		ol_txrx_peer_handle peer;
+	ol_txrx_vdev_handle vdev;
+	ol_txrx_peer_handle peer;
 
-		if (!wma || vdev_id > wma->max_bssid)
-			return;
+	if (!wma || vdev_id > wma->max_bssid)
+		return;
 
-		vdev = wma->interfaces[vdev_id].handle;
-		if (!vdev)
-			return;
+	vdev = wma->interfaces[vdev_id].handle;
+	if (!vdev)
+		return;
 
-		/* remove all remote peers of SAP */
-		TAILQ_FOREACH(peer, &vdev->peer_list, peer_list_elem) {
+	/* remove all remote peers of SAP */
+	adf_os_spin_lock_bh(&vdev->pdev->peer_ref_mutex);
+	TAILQ_FOREACH(peer, &vdev->peer_list, peer_list_elem) {
 		if (peer != TAILQ_FIRST(&vdev->peer_list)) {
+			adf_os_spin_unlock_bh(&vdev->pdev->peer_ref_mutex);
 			adf_os_atomic_init(&peer->ref_cnt);
 			adf_os_atomic_inc(&peer->ref_cnt);
 			wma_remove_peer(wma, peer->mac_addr.raw,
 					vdev_id, peer);
+			adf_os_spin_lock_bh(&vdev->pdev->peer_ref_mutex);
 		}
 	}
+	adf_os_spin_unlock_bh(&vdev->pdev->peer_ref_mutex);
 }
+
 #ifdef QCA_IBSS_SUPPORT
 static void wma_recreate_ibss_vdev_and_bss_peer(tp_wma_handle wma, u_int8_t vdev_id)
 {
@@ -5138,6 +5147,12 @@ v_VOID_t wma_roam_scan_fill_scan_params(tp_wma_handle wma_handle,
                                    wmi_start_scan_cmd_fixed_param *scan_params)
 {
     tANI_U8 channels_per_burst = 0;
+
+    if (NULL == pMac) {
+        WMA_LOGE("%s: pMac is NULL", __func__);
+        return;
+    }
+
     vos_mem_zero(scan_params, sizeof(wmi_start_scan_cmd_fixed_param));
     if (roam_req != NULL) {
         /* Parameters updated after association is complete */
@@ -5376,6 +5391,12 @@ VOS_STATUS wma_roam_scan_offload_end_connect(tp_wma_handle wma_handle)
                 wma_handle->vos_context);
     wmi_start_scan_cmd_fixed_param scan_params;
 
+    if (NULL == pMac)
+    {
+        WMA_LOGE("%s: pMac is NULL", __func__);
+        return VOS_STATUS_E_FAILURE;
+    }
+
     /* If roam scan is running, stop it */
     if (wma_handle->roam_offload_enabled) {
 
@@ -5402,6 +5423,13 @@ VOS_STATUS wma_process_roam_scan_req(tp_wma_handle wma_handle,
     u_int32_t mode = 0;
 
     WMA_LOGI("%s: command 0x%x", __func__, roam_req->Command);
+
+    if (NULL == pMac)
+    {
+        WMA_LOGE("%s: pMac is NULL", __func__);
+        return VOS_STATUS_E_FAILURE;
+    }
+
     if (!wma_handle->roam_offload_enabled) {
 	/* roam scan offload is not enabled in firmware.
 	 * Cannot initialize it in the middle of connection.
@@ -13774,6 +13802,10 @@ static void wma_start_oem_data_req(tp_wma_handle wma_handle,
 	}
 
 out:
+	/* free oem data req buffer received from UMAC */
+	if (startOemDataReq)
+		vos_mem_free(startOemDataReq);
+
 	/* Now send data resp back to PE/SME with message sub-type of
 	 * WMI_OEM_INTERNAL_RSP. This is required so that PE/SME clears
 	 * up pending active command. Later when desired oem response(s)
diff --git a/CORE/SERVICES/WMI/wmi_unified.c b/CORE/SERVICES/WMI/wmi_unified.c
index a31fc730404a..d0814462a133 100644
--- a/CORE/SERVICES/WMI/wmi_unified.c
+++ b/CORE/SERVICES/WMI/wmi_unified.c
@@ -64,10 +64,11 @@ struct wmi_command_debug wmi_command_log_buffer[WMI_EVENT_DEBUG_MAX_ENTRY];
 u_int32_t g_wmi_event_buf_idx = 0;
 struct wmi_event_debug wmi_event_log_buffer[WMI_EVENT_DEBUG_MAX_ENTRY];
 
-#define WMI_COMMAND_RECORD(a) {						\
+#define WMI_COMMAND_RECORD(a, b) {					\
 	if (WMI_EVENT_DEBUG_MAX_ENTRY <= g_wmi_command_buf_idx)		\
 		g_wmi_command_buf_idx = 0;				\
 	wmi_command_log_buffer[g_wmi_command_buf_idx].command = a;	\
+	adf_os_mem_copy(wmi_command_log_buffer[g_wmi_command_buf_idx].data, b , 8);\
 	wmi_command_log_buffer[g_wmi_command_buf_idx].time =		\
 						 adf_os_ticks();	\
 	g_wmi_command_buf_idx++;					\
@@ -606,7 +607,8 @@ int wmi_unified_cmd_send(wmi_unified_t wmi_handle, wmi_buf_t buf, int len,
 
 #ifdef WMI_INTERFACE_EVENT_LOGGING
 	adf_os_spin_lock_bh(&wmi_handle->wmi_record_lock);
-	WMI_COMMAND_RECORD(cmd_id);
+        /*Record 8 bytes of WMI cmd data - exclude TLV and WMI headers*/
+        WMI_COMMAND_RECORD(cmd_id ,((u_int32_t *)adf_nbuf_data(buf) + 2));
 	adf_os_spin_unlock_bh(&wmi_handle->wmi_record_lock);
 #endif
 
diff --git a/CORE/SERVICES/WMI/wmi_unified_priv.h b/CORE/SERVICES/WMI/wmi_unified_priv.h
index 885c926aff72..8921f83aef58 100644
--- a/CORE/SERVICES/WMI/wmi_unified_priv.h
+++ b/CORE/SERVICES/WMI/wmi_unified_priv.h
@@ -48,6 +48,7 @@ typedef adf_nbuf_t wmi_buf_t;
 
 struct wmi_command_debug{
 	u_int32_t command;
+	u_int32_t data[2]; /*8 bytes of WMI cmd excluding TLV and WMI headers*/
 	unsigned long time;
 };
 
diff --git a/CORE/TL/inc/wlan_qct_tl.h b/CORE/TL/inc/wlan_qct_tl.h
index 31b75e90b756..c75c8bd5bf68 100644
--- a/CORE/TL/inc/wlan_qct_tl.h
+++ b/CORE/TL/inc/wlan_qct_tl.h
@@ -1361,7 +1361,7 @@ adf_nbuf_t WLANTL_SendSTA_DataFrame(v_PVOID_t pvosGCtx, v_U8_t ucSTAId,
 
 ============================================================================*/
 adf_nbuf_t WLANTL_SendIPA_DataFrame(void *vos_ctx, void *vdev,
-                                    adf_nbuf_t buf);
+                                    adf_nbuf_t buf, v_U8_t interface_id);
 #endif
 
 
diff --git a/CORE/UTILS/FWLOG/dbglog_host.c b/CORE/UTILS/FWLOG/dbglog_host.c
index d765d8e44127..ca80976229df 100644
--- a/CORE/UTILS/FWLOG/dbglog_host.c
+++ b/CORE/UTILS/FWLOG/dbglog_host.c
@@ -2354,28 +2354,28 @@ dbglog_wal_print_handler(
         dbglog_printf(timestamp, vap_id, "WAL Tx enqueue discard msdu_id=0x%x", args[0]);
         break;
     case WAL_DBGID_SET_HW_CHAINMASK:
-        dbglog_printf(timestamp, vap_id, "WAL set hw chainmask "
+        dbglog_printf(timestamp, vap_id, "WAL_DBGID_SET_HW_CHAINMASK "
                                          "pdev=%d, txchain=0x%x, rxchain=0x%x",
                 args[0], args[1], args[2]);
         break;
     case WAL_DBGID_SET_HW_CHAINMASK_TXRX_STOP_FAIL:
-        dbglog_printf(timestamp, vap_id, "WAL hw chainmask tx stop fail rxstop=%d, txstop=%d",
+        dbglog_printf(timestamp, vap_id, "WAL_DBGID_SET_HW_CHAINMASK_TXRX_STOP_FAIL rxstop=%d, txstop=%d",
                 args[0], args[1]);
         break;
     case WAL_DBGID_GET_HW_CHAINMASK:
-        dbglog_printf(timestamp, vap_id, "WAL get hw chainmask "
+        dbglog_printf(timestamp, vap_id, "WAL_DBGID_GET_HW_CHAINMASK "
                                          "txchain=0x%x, rxchain=0x%x",
                 args[0], args[1]);
         break;
     case WAL_DBGID_SMPS_DISABLE:
-        dbglog_printf(timestamp, vap_id, "WAL smps disable");
+        dbglog_printf(timestamp, vap_id, "WAL_DBGID_SMPS_DISABLE");
         break;
     case WAL_DBGID_SMPS_ENABLE_HW_CNTRL:
-        dbglog_printf(timestamp, vap_id, "WAL enable hw ctrl low_pwr_mask=0x%x, high_pwr_mask=0x%x",
+        dbglog_printf(timestamp, vap_id, "WAL_DBGID_SMPS_ENABLE_HW_CNTRL low_pwr_mask=0x%x, high_pwr_mask=0x%x",
                 args[0], args[1]);
         break;
     case WAL_DBGID_SMPS_SWSEL_CHAINMASK:
-        dbglog_printf(timestamp, vap_id, "WAL smps swsel chainmask low_pwr=0x%x, chain_mask=0x%x",
+        dbglog_printf(timestamp, vap_id, "WAL_DBGID_SMPS_SWSEL_CHAINMASK low_pwr=0x%x, chain_mask=0x%x",
                 args[0], args[1]);
     break;
     default:
@@ -2972,18 +2972,18 @@ A_BOOL dbglog_smps_print_handler(A_UINT32 mod_id,
                 args[2]);
         break;
     case STA_SMPS_DBGID_DTIM_EBT_EVENT_CHMASK_UPDATE:
-        dbglog_printf(timestamp, vap_id, "STA_SMPS ebt event chmask update");
+        dbglog_printf(timestamp, vap_id, "STA_SMPS_DBGID_DTIM_EBT_EVENT_CHMASK_UPDATE");
         break;
     case STA_SMPS_DBGID_DTIM_CHMASK_UPDATE:
-        dbglog_printf(timestamp, vap_id, "STA_SMPS dtim chmask update "
+        dbglog_printf(timestamp, vap_id, "STA_SMPS_DBGID_DTIM_CHMASK_UPDATE "
                                          "tx_mask %#x rx_mask %#x arb_dtim_mask %#x",
                 args[0], args[1], args[2]);
         break;
     case STA_SMPS_DBGID_DTIM_BEACON_EVENT_CHMASK_UPDATE:
-        dbglog_printf(timestamp, vap_id, "STA_SMPS beacon event chmask update");
+        dbglog_printf(timestamp, vap_id, "STA_SMPS_DBGID_DTIM_BEACON_EVENT_CHMASK_UPDATE");
         break;
     case STA_SMPS_DBGID_DTIM_POWER_STATE_CHANGE:
-        dbglog_printf(timestamp, vap_id, "STA_SMPS cur_pwr_state %s new_pwr_state %d",
+        dbglog_printf(timestamp, vap_id, "STA_SMPS_DBGID_DTIM_POWER_STATE_CHANGE cur_pwr_state %s new_pwr_state %s",
                 (args[0] == 0x1 ? "SLEEP":
                  (args[0] == 0x2 ? "AWAKE":
                   (args[0] == 0x3 ? "FULL_SLEEP" : "UNKNOWN"))),
@@ -2992,12 +2992,12 @@ A_BOOL dbglog_smps_print_handler(A_UINT32 mod_id,
                   (args[1] == 0x3 ? "FULL_SLEEP" : "UNKNOWN"))));
         break;
     case STA_SMPS_DBGID_DTIM_CHMASK_UPDATE_SLEEP:
-        dbglog_printf(timestamp, vap_id, "STA_SMPS chmask update sleep "
+        dbglog_printf(timestamp, vap_id, "STA_SMPS_DBGID_DTIM_CHMASK_UPDATE_SLEEP "
                                          "tx_mask %#x rx_mask %#x orig_rx %#x dtim_rx %#x",
                 args[0], args[1], args[2], args[3]);
         break;
     case STA_SMPS_DBGID_DTIM_CHMASK_UPDATE_AWAKE:
-        dbglog_printf(timestamp, vap_id, "STA_SMPS chmask update awake "
+        dbglog_printf(timestamp, vap_id, "STA_SMPS_DBGID_DTIM_CHMASK_UPDATE_AWAKE "
                                          "tx_mask %#x rx_mask %#x orig_rx %#x",
                 args[0], args[1], args[2]);
         break;
diff --git a/CORE/VOSS/src/vos_nvitem.c b/CORE/VOSS/src/vos_nvitem.c
index c19304e84657..4ad1100a4cb4 100644
--- a/CORE/VOSS/src/vos_nvitem.c
+++ b/CORE/VOSS/src/vos_nvitem.c
@@ -3278,7 +3278,8 @@ static int create_linux_regulatory_entry(struct wiphy *wiphy,
                         wiphy->bands[i]->channels[j].flags &= ~IEEE80211_CHAN_NO_IBSS;
                     }
 
-                    wiphy->bands[i]->channels[j].max_power = reg_rule->power_rule.max_eirp;
+                    wiphy->bands[i]->channels[j].max_power =
+                        (int) MBM_TO_DBM(reg_rule->power_rule.max_eirp);
                 }
             }
 
diff --git a/Kbuild b/Kbuild
index e926db22d990..aceb525c26e7 100644
--- a/Kbuild
+++ b/Kbuild
@@ -1291,6 +1291,14 @@ endif
 
 KBUILD_CPPFLAGS += $(CDEFINES)
 
+# Currently, for versions of gcc which support it, the kernel Makefile
+# is disabling the maybe-uninitialized warning.  Re-enable it for the
+# WLAN driver.  Note that we must use EXTRA_CFLAGS here so that it
+# will override the kernel settings.
+ifeq ($(call cc-option-yn, -Wmaybe-uninitialized),y)
+EXTRA_CFLAGS += -Wmaybe-uninitialized
+endif
+
 # Module information used by KBuild framework
 obj-$(CONFIG_QCA_CLD_WLAN) += $(MODNAME).o
 $(MODNAME)-y := $(OBJS)
diff --git a/firmware_bin/WCNSS_qcom_cfg.usb.ini b/firmware_bin/WCNSS_qcom_cfg.usb.ini
index f8a2c57fad45..78bdaf321fde 100644
--- a/firmware_bin/WCNSS_qcom_cfg.usb.ini
+++ b/firmware_bin/WCNSS_qcom_cfg.usb.ini
@@ -491,6 +491,9 @@ gEnableMCCAdaptiveScheduler=0
 
 #Enable or Disable p2p device address administered
 isP2pDeviceAddrAdministrated=0
+
+#Disable scan_pno by default
+gPNOScanSupport=0
 END
 
 # Note: Configuration parser would not read anything past the END marker
diff --git a/tools/fwdebuglog/cld-fwlog-parser.c b/tools/fwdebuglog/cld-fwlog-parser.c
index 29ad61b6273c..6b60123cca3e 100644
--- a/tools/fwdebuglog/cld-fwlog-parser.c
+++ b/tools/fwdebuglog/cld-fwlog-parser.c
@@ -1867,28 +1867,28 @@ dbglog_wal_print_handler(
         dbglog_printf(timestamp, vap_id, "WAL Tx enqueue discard msdu_id=0x%x", args[0]);
         break;
     case WAL_DBGID_SET_HW_CHAINMASK:
-        dbglog_printf(timestamp, vap_id, "WAL set hw chainmask "
+        dbglog_printf(timestamp, vap_id, "WAL_DBGID_SET_HW_CHAINMASK "
                                          "pdev=%d, txchain=0x%x, rxchain=0x%x",
                 args[0], args[1], args[2]);
         break;
     case WAL_DBGID_SET_HW_CHAINMASK_TXRX_STOP_FAIL:
-        dbglog_printf(timestamp, vap_id, "WAL hw chainmask tx stop fail rxstop=%d, txstop=%d",
+        dbglog_printf(timestamp, vap_id, "WAL_DBGID_SET_HW_CHAINMASK_TXRX_STOP_FAIL rxstop=%d, txstop=%d",
                 args[0], args[1]);
         break;
     case WAL_DBGID_GET_HW_CHAINMASK:
-        dbglog_printf(timestamp, vap_id, "WAL get hw chainmask "
+        dbglog_printf(timestamp, vap_id, "WAL_DBGID_GET_HW_CHAINMASK "
                                          "txchain=0x%x, rxchain=0x%x",
                 args[0], args[1]);
         break;
     case WAL_DBGID_SMPS_DISABLE:
-        dbglog_printf(timestamp, vap_id, "WAL smps disable");
+        dbglog_printf(timestamp, vap_id, "WAL_DBGID_SMPS_DISABLE");
         break;
     case WAL_DBGID_SMPS_ENABLE_HW_CNTRL:
-        dbglog_printf(timestamp, vap_id, "WAL enable hw ctrl low_pwr_mask=0x%x, high_pwr_mask=0x%x",
+        dbglog_printf(timestamp, vap_id, "WAL_DBGID_SMPS_ENABLE_HW_CNTRL low_pwr_mask=0x%x, high_pwr_mask=0x%x",
                 args[0], args[1]);
         break;
     case WAL_DBGID_SMPS_SWSEL_CHAINMASK:
-        dbglog_printf(timestamp, vap_id, "WAL smps swsel chainmask low_pwr=0x%x, chain_mask=0x%x",
+        dbglog_printf(timestamp, vap_id, "WAL_DBGID_SMPS_SWSEL_CHAINMASK low_pwr=0x%x, chain_mask=0x%x",
                 args[0], args[1]);
         break;
     default:
@@ -2486,18 +2486,18 @@ A_BOOL dbglog_smps_print_handler(A_UINT32 mod_id,
                 args[2]);
         break;
     case STA_SMPS_DBGID_DTIM_EBT_EVENT_CHMASK_UPDATE:
-        dbglog_printf(timestamp, vap_id, "STA_SMPS ebt event chmask update");
+        dbglog_printf(timestamp, vap_id, "STA_SMPS_DBGID_DTIM_EBT_EVENT_CHMASK_UPDATE");
         break;
     case STA_SMPS_DBGID_DTIM_CHMASK_UPDATE:
-        dbglog_printf(timestamp, vap_id, "STA_SMPS chmask update "
+        dbglog_printf(timestamp, vap_id, "STA_SMPS_DBGID_DTIM_CHMASK_UPDATE "
                                          "tx_mask %#x rx_mask %#x arb_dtim_mask %#x",
                 args[0], args[1], args[2]);
         break;
     case STA_SMPS_DBGID_DTIM_BEACON_EVENT_CHMASK_UPDATE:
-        dbglog_printf(timestamp, vap_id, "STA_SMPS beacon event chmask update");
+        dbglog_printf(timestamp, vap_id, "STA_SMPS_DBGID_DTIM_BEACON_EVENT_CHMASK_UPDATE");
         break;
     case STA_SMPS_DBGID_DTIM_POWER_STATE_CHANGE:
-        dbglog_printf(timestamp, vap_id, "STA_SMPS cur_pwr_state %s new_pwr_state %d",
+        dbglog_printf(timestamp, vap_id, "STA_SMPS_DBGID_DTIM_POWER_STATE_CHANGE cur_pwr_state %s new_pwr_state %s",
                 (args[0] == 0x1 ? "SLEEP":
                  (args[0] == 0x2 ? "AWAKE":
                   (args[0] == 0x3 ? "FULL_SLEEP" : "UNKNOWN"))),
@@ -2506,12 +2506,12 @@ A_BOOL dbglog_smps_print_handler(A_UINT32 mod_id,
                   (args[1] == 0x3 ? "FULL_SLEEP" : "UNKNOWN"))));
         break;
     case STA_SMPS_DBGID_DTIM_CHMASK_UPDATE_SLEEP:
-        dbglog_printf(timestamp, vap_id, "STA_SMPS chmask update sleep "
+        dbglog_printf(timestamp, vap_id, "STA_SMPS_DBGID_DTIM_CHMASK_UPDATE_SLEEP "
                                          "tx_mask %#x rx_mask %#x orig_rx %#x dtim_rx %#x",
                 args[0], args[1], args[2], args[3]);
         break;
     case STA_SMPS_DBGID_DTIM_CHMASK_UPDATE_AWAKE:
-        dbglog_printf(timestamp, vap_id, "STA_SMPS chmask update awake "
+        dbglog_printf(timestamp, vap_id, "STA_SMPS_DBGID_DTIM_CHMASK_UPDATE_AWAKE "
                                          "tx_mask %#x rx_mask %#x orig_rx %#x",
                 args[0], args[1], args[2]);
     break;
diff --git a/tools/fwdebuglog/parser.c b/tools/fwdebuglog/parser.c
index f50ce82c74af..85548dc2edcd 100644
--- a/tools/fwdebuglog/parser.c
+++ b/tools/fwdebuglog/parser.c
@@ -1888,28 +1888,28 @@ dbglog_wal_print_handler(
         dbglog_printf(timestamp, vap_id, "WAL Tx enqueue discard msdu_id=0x%x", args[0]);
         break;
     case WAL_DBGID_SET_HW_CHAINMASK:
-        dbglog_printf(timestamp, vap_id, "WAL set hw chainmask "
+        dbglog_printf(timestamp, vap_id, "WAL_DBGID_SET_HW_CHAINMASK "
                                          "pdev=%d, txchain=0x%x, rxchain=0x%x",
                 args[0], args[1], args[2]);
         break;
     case WAL_DBGID_SET_HW_CHAINMASK_TXRX_STOP_FAIL:
-        dbglog_printf(timestamp, vap_id, "WAL hw chainmask tx stop fail: rxstop=%d, txstop=%d",
+        dbglog_printf(timestamp, vap_id, "WAL_DBGID_SET_HW_CHAINMASK_TXRX_STOP_FAIL: rxstop=%d, txstop=%d",
                 args[0], args[1]);
         break;
     case WAL_DBGID_GET_HW_CHAINMASK:
-         dbglog_printf(timestamp, vap_id, "WAL get hw chainmask "
+         dbglog_printf(timestamp, vap_id, "WAL_DBGID_GET_HW_CHAINMASK "
                                           "txchain=0x%x, rxchain=0x%x",
                  args[0], args[1]);
         break;
     case WAL_DBGID_SMPS_DISABLE:
-        dbglog_printf(timestamp, vap_id, "WAL smps disable");
+        dbglog_printf(timestamp, vap_id, "WAL_DBGID_SMPS_DISABLE");
         break;
     case WAL_DBGID_SMPS_ENABLE_HW_CNTRL:
-        dbglog_printf(timestamp, vap_id, "WAL enable hw ctrl low_pwr_mask=0x%x, high_pwr_mask=0x%x",
+        dbglog_printf(timestamp, vap_id, "WAL_DBGID_SMPS_ENABLE_HW_CNTRL low_pwr_mask=0x%x, high_pwr_mask=0x%x",
                 args[0], args[1]);
         break;
     case WAL_DBGID_SMPS_SWSEL_CHAINMASK:
-        dbglog_printf(timestamp, vap_id, "WAL smps swsel chainmask low_pwr=0x%x, chain_mask=0x%x",
+        dbglog_printf(timestamp, vap_id, "WAL_DBGID_SMPS_SWSEL_CHAINMASK low_pwr=0x%x, chain_mask=0x%x",
                 args[0], args[1]);
         break;
     default:
@@ -2507,18 +2507,18 @@ A_BOOL dbglog_smps_print_handler(A_UINT32 mod_id,
                 args[2]);
         break;
     case STA_SMPS_DBGID_DTIM_EBT_EVENT_CHMASK_UPDATE:
-        dbglog_printf(timestamp, vap_id,  "STA_SMPS ebt event chmask update");
+        dbglog_printf(timestamp, vap_id,  "STA_SMPS_DBGID_DTIM_EBT_EVENT_CHMASK_UPDATE");
         break;
     case STA_SMPS_DBGID_DTIM_CHMASK_UPDATE:
-        dbglog_printf(timestamp, vap_id,  "STA_SMPS chmask update "
+        dbglog_printf(timestamp, vap_id,  "STA_SMPS_DBGID_DTIM_CHMASK_UPDATE "
                                           "tx_mask %#x rx_mask %#x arb_dtim_mask %#x",
                 args[0], args[1], args[2]);
         break;
     case STA_SMPS_DBGID_DTIM_BEACON_EVENT_CHMASK_UPDATE:
-        dbglog_printf(timestamp, vap_id,  "STA_SMPS beacon event chmask update");
+        dbglog_printf(timestamp, vap_id,  "STA_SMPS_DBGID_DTIM_BEACON_EVENT_CHMASK_UPDATE");
         break;
     case STA_SMPS_DBGID_DTIM_POWER_STATE_CHANGE:
-        dbglog_printf(timestamp, vap_id, "STA_SMPS cur_pwr_state %s new_pwr_state %d",
+        dbglog_printf(timestamp, vap_id, "STA_SMPS_DBGID_DTIM_POWER_STATE_CHANGE cur_pwr_state %s new_pwr_state %s",
                 (args[0] == 0x1 ? "SLEEP":
                  (args[0] == 0x2 ? "AWAKE":
                   (args[0] == 0x3 ? "FULL_SLEEP" : "UNKNOWN"))),
@@ -2527,12 +2527,12 @@ A_BOOL dbglog_smps_print_handler(A_UINT32 mod_id,
                   (args[1] == 0x3 ? "FULL_SLEEP" : "UNKNOWN"))));
         break;
     case STA_SMPS_DBGID_DTIM_CHMASK_UPDATE_SLEEP:
-        dbglog_printf(timestamp, vap_id, "STA_SMPS chmask update sleep "
+        dbglog_printf(timestamp, vap_id, "STA_SMPS_DBGID_DTIM_CHMASK_UPDATE_SLEEP "
                                          "tx_mask %#x rx_mask %#x orig_rx %#x dtim_rx %#x",
                 args[0], args[1], args[2], args[3]);
         break;
     case STA_SMPS_DBGID_DTIM_CHMASK_UPDATE_AWAKE:
-        dbglog_printf(timestamp, vap_id, "STA_SMPS chmask update awake "
+        dbglog_printf(timestamp, vap_id, "STA_SMPS_DBGID_DTIM_CHMASK_UPDATE_AWAKE "
                                          "tx_mask %#x rx_mask %#x orig_rx %#x",
                 args[0], args[1], args[2]);
     break;