Release 4.0.10.94 QCACLD WLAN Driver

Merge remote-tracking branch 'origin/caf/caf-wlan/master' into HEAD

* origin/caf/caf-wlan/master:
  Cafstaging Release 4.0.10.94
  wlan: Correct the condition which validates size of ACL MAC list.
  qcacld: Reducing severity of debug print to avoid watchdog bark
  qcacld-2.0: Add compat changes for __iw_set_var_ints_getnone
  qcacld: Check wmm inactivity timer before stop and destroy
  qcacld: Fix crash while connecting to 5G AP
  qca_cld: rx packet processing optimization-kw fix
  qcacld-2.0: Stop HIF service before HTC cleanup
  qcacld: Add rx forward stats in txrx stats
  qcacld: Add packets recieved per completion histogram
  qcacld: Add tx/rx packet histogram support
  qcacld: Set the hdd state to not connected if disconnect timeout.

Change-Id: I235096c5bf51fb3896f7891da56376e840694cfd

17 files changed, 338 insertions, 98 deletions

diff --git a/CORE/CLD_TXRX/TXRX/ol_rx.c b/CORE/CLD_TXRX/TXRX/ol_rx.c
index 5a9df691f62e..67d17a140ac8 100644
--- a/CORE/CLD_TXRX/TXRX/ol_rx.c
+++ b/CORE/CLD_TXRX/TXRX/ol_rx.c
@@ -1018,6 +1018,13 @@ DONE:
             OL_RX_PEER_STATS_UPDATE(peer, msdu);
             OL_RX_ERR_STATISTICS_1(pdev, vdev, peer, rx_desc, OL_RX_ERR_NONE);
             TXRX_STATS_MSDU_INCR(vdev->pdev, rx.delivered, msdu);
+
+            adf_os_spin_lock_bh(&pdev->txrx_histogram_lock);
+            if (pdev->txrx_histogram_count <
+                        TXRX_DATA_HISTROGRAM_NUM_INTERVALS)
+                pdev->rx_pkt_histrogram[vdev->pdev->txrx_histogram_count]++;
+            adf_os_spin_unlock_bh(&pdev->txrx_histogram_lock);
+
             OL_TXRX_LIST_APPEND(deliver_list_head, deliver_list_tail, msdu);
         }
         msdu = next;
@@ -1167,7 +1174,7 @@ ol_rx_in_order_indication_handler(
     if (peer) {
         vdev = peer->vdev;
     } else {
-        TXRX_PRINT(TXRX_PRINT_LEVEL_ERR,
+        TXRX_PRINT(TXRX_PRINT_LEVEL_INFO2,
                    "%s: Couldn't find peer from ID 0x%x\n", __FUNCTION__,
                    peer_id);
         while (head_msdu) {
@@ -1207,6 +1214,12 @@ ol_rx_in_order_deliver(
         OL_RX_ERR_STATISTICS_1(vdev->pdev, vdev, peer, rx_desc, OL_RX_ERR_NONE);
         TXRX_STATS_MSDU_INCR(vdev->pdev, rx.delivered, msdu);
 
+        adf_os_spin_lock_bh(&vdev->pdev->txrx_histogram_lock);
+        if (vdev->pdev->txrx_histogram_count <
+                        TXRX_DATA_HISTROGRAM_NUM_INTERVALS)
+            vdev->pdev->rx_pkt_histrogram[vdev->pdev->txrx_histogram_count]++;
+        adf_os_spin_unlock_bh(&vdev->pdev->txrx_histogram_lock);
+
         msdu = next;
     }
 
diff --git a/CORE/CLD_TXRX/TXRX/ol_rx_fwd.c b/CORE/CLD_TXRX/TXRX/ol_rx_fwd.c
index 7a71fe01d92a..f37f302d632e 100644
--- a/CORE/CLD_TXRX/TXRX/ol_rx_fwd.c
+++ b/CORE/CLD_TXRX/TXRX/ol_rx_fwd.c
@@ -130,7 +130,6 @@ ol_rx_fwd_to_tx(struct ol_txrx_vdev_t *vdev, adf_nbuf_t msdu)
      */
     adf_nbuf_map_single(pdev->osdev, msdu, ADF_OS_DMA_TO_DEVICE);
     adf_nbuf_set_next(msdu, NULL); /* add NULL terminator */
-    TXRX_STATS_MSDU_INCR(vdev->pdev, rx.forwarded, msdu);
 
     /* for HL, point to payload before send to tx again.*/
     if (pdev->cfg.is_high_latency) {
@@ -217,13 +216,17 @@ ol_rx_fwd_check(
                 htt_rx_msdu_desc_free(pdev->htt_pdev, msdu);
                 ol_rx_fwd_to_tx(tx_vdev, msdu);
                 msdu = NULL; /* already handled this MSDU */
+                TXRX_STATS_ADD(pdev, pub.rx.intra_bss_fwd.packets_fwd, 1);
             } else {
-				adf_nbuf_t copy;
-				copy = adf_nbuf_copy(msdu);
+                adf_nbuf_t copy;
+                copy = adf_nbuf_copy(msdu);
                 if (copy) {
-					ol_rx_fwd_to_tx(tx_vdev, copy);
+                    ol_rx_fwd_to_tx(tx_vdev, copy);
                 }
+                TXRX_STATS_ADD(pdev, pub.rx.intra_bss_fwd.packets_stack_n_fwd, 1);
             }
+        } else {
+            TXRX_STATS_ADD(pdev, pub.rx.intra_bss_fwd.packets_stack, 1);
         }
         if (msdu) {
             /* send this frame to the OS */
diff --git a/CORE/CLD_TXRX/TXRX/ol_tx.c b/CORE/CLD_TXRX/TXRX/ol_tx.c
index 3b4ef4987864..593c2aaf3970 100644
--- a/CORE/CLD_TXRX/TXRX/ol_tx.c
+++ b/CORE/CLD_TXRX/TXRX/ol_tx.c
@@ -91,6 +91,13 @@ ol_tx_ll(ol_txrx_vdev_handle vdev, adf_nbuf_t msdu_list)
 
         msdu_info.htt.info.ext_tid = adf_nbuf_get_tid(msdu);
         msdu_info.peer = NULL;
+
+        adf_os_spin_lock_bh(&vdev->pdev->txrx_histogram_lock);
+        if (vdev->pdev->txrx_histogram_count <
+                        TXRX_DATA_HISTROGRAM_NUM_INTERVALS)
+            vdev->pdev->tx_pkt_histrogram[vdev->pdev->txrx_histogram_count]++;
+        adf_os_spin_unlock_bh(&vdev->pdev->txrx_histogram_lock);
+
         ol_tx_prepare_ll(tx_desc, vdev, msdu, &msdu_info);
 
         /*
@@ -579,6 +586,12 @@ ol_tx_hl_base(
          */
         next = adf_nbuf_next(msdu);
 
+        adf_os_spin_lock_bh(&pdev->txrx_histogram_lock);
+        if (pdev->txrx_histogram_count <
+                        TXRX_DATA_HISTROGRAM_NUM_INTERVALS)
+            pdev->tx_pkt_histrogram[vdev->pdev->txrx_histogram_count]++;
+        adf_os_spin_unlock_bh(&pdev->txrx_histogram_lock);
+
 #if defined(CONFIG_TX_DESC_HI_PRIO_RESERVE)
         if (adf_os_atomic_read(&pdev->tx_queue.rsrc_cnt) >
                                         TXRX_HL_TX_DESC_HI_PRIO_RESERVED) {
diff --git a/CORE/CLD_TXRX/TXRX/ol_txrx.c b/CORE/CLD_TXRX/TXRX/ol_txrx.c
index ff85ca21b600..b92cf8089491 100644
--- a/CORE/CLD_TXRX/TXRX/ol_txrx.c
+++ b/CORE/CLD_TXRX/TXRX/ol_txrx.c
@@ -315,6 +315,20 @@ credit_update:
 }
 #endif
 
+void ol_txrx_pdev_histogram_timer(void *context)
+{
+    struct ol_txrx_pdev_t *pdev = (struct ol_txrx_pdev_t *)context;
+
+    adf_os_spin_lock_bh(&pdev->txrx_histogram_lock);
+    pdev->txrx_histogram_count++;
+    adf_os_spin_unlock_bh(&pdev->txrx_histogram_lock);
+
+    if (pdev->txrx_histogram_count < TXRX_DATA_HISTROGRAM_NUM_INTERVALS) {
+        adf_os_timer_start(&pdev->txrx_histogram_timer,
+                 TXRX_DATA_HISTROGRAM_GRANULARITY);
+    }
+}
+
 ol_txrx_pdev_handle
 ol_txrx_pdev_attach(
     ol_pdev_handle ctrl_pdev,
@@ -764,6 +778,18 @@ ol_txrx_pdev_attach(
     pdev->tid_to_ac[OL_TX_NUM_TIDS + OL_TX_VDEV_DEFAULT_MGMT] =
         OL_TX_SCHED_WRR_ADV_CAT_MCAST_MGMT;
 
+
+    adf_os_spinlock_init(&pdev->txrx_histogram_lock);
+    pdev->txrx_histogram_count = 0;
+    adf_os_timer_init(
+            pdev->osdev,
+            &pdev->txrx_histogram_timer,
+            ol_txrx_pdev_histogram_timer,
+            pdev);
+
+    adf_os_timer_start(&pdev->txrx_histogram_timer,
+                    TXRX_DATA_HISTROGRAM_GRANULARITY);
+
     return pdev; /* success */
 
 fail8:
@@ -839,6 +865,11 @@ ol_txrx_pdev_detach(ol_txrx_pdev_handle pdev, int force)
     adf_os_timer_free(&pdev->tx_throttle.tx_timer);
 #endif
 #endif
+
+    adf_os_timer_cancel(&pdev->txrx_histogram_timer);
+    adf_os_timer_free(&pdev->txrx_histogram_timer);
+    adf_os_spinlock_destroy(&pdev->txrx_histogram_lock);
+
     if (force) {
         /*
          * The assertion above confirms that all vdevs within this pdev
@@ -2125,18 +2156,18 @@ void
 ol_txrx_stats_display(ol_txrx_pdev_handle pdev)
 {
 
-    VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_ERROR, "TXRX Stats:");
+    adf_os_print("TXRX Stats:\n");
     if (TXRX_STATS_LEVEL == TXRX_STATS_LEVEL_BASIC) {
-        VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_ERROR,
-            "  tx: %lld msdus (%lld B) rejected %lld (%lld B)",
+        adf_os_print(
+            "  tx: %lld msdus (%lld B) rejected %lld (%lld B) \n",
             pdev->stats.pub.tx.delivered.pkts,
             pdev->stats.pub.tx.delivered.bytes,
             pdev->stats.pub.tx.dropped.host_reject.pkts,
             pdev->stats.pub.tx.dropped.host_reject.bytes);
     } else { /* full */
-        VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO,
-            "  tx: sent %lld msdus (%lld B), rejected %lld (%lld B)"
-            "  dropped %lld (%lld B)\n",
+        adf_os_print(
+            "  tx: sent %lld msdus (%lld B), rejected %lld (%lld B)\n"
+            "      dropped %lld (%lld B)\n",
             pdev->stats.pub.tx.delivered.pkts,
             pdev->stats.pub.tx.delivered.bytes,
             pdev->stats.pub.tx.dropped.host_reject.pkts,
@@ -2147,7 +2178,7 @@ ol_txrx_stats_display(ol_txrx_pdev_handle pdev)
             pdev->stats.pub.tx.dropped.download_fail.bytes
               + pdev->stats.pub.tx.dropped.target_discard.bytes
               + pdev->stats.pub.tx.dropped.no_ack.bytes);
-        VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO,
+        adf_os_print(
             "    download fail: %lld (%lld B), "
             "target discard: %lld (%lld B), "
             "no ack: %lld (%lld B)\n",
@@ -2157,20 +2188,38 @@ ol_txrx_stats_display(ol_txrx_pdev_handle pdev)
             pdev->stats.pub.tx.dropped.target_discard.bytes,
             pdev->stats.pub.tx.dropped.no_ack.pkts,
             pdev->stats.pub.tx.dropped.no_ack.bytes);
-    }
-    VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_ERROR,
-        "  rx: %lld ppdus, %lld mpdus, %lld msdus, %lld bytes, %lld errs",
+        adf_os_print(
+            "Tx completion per interrupt:\n"
+            "Single Packet  %d\n"
+            " 2-10 Packets  %d\n"
+            "11-20 Packets  %d\n"
+            "21-30 Packets  %d\n"
+            "31-40 Packets  %d\n"
+            "41-50 Packets  %d\n"
+            "51-60 Packets  %d\n"
+            "  60+ Packets  %d\n",
+            pdev->stats.pub.tx.comp_histogram.pkts_1,
+            pdev->stats.pub.tx.comp_histogram.pkts_2_10,
+            pdev->stats.pub.tx.comp_histogram.pkts_11_20,
+            pdev->stats.pub.tx.comp_histogram.pkts_21_30,
+            pdev->stats.pub.tx.comp_histogram.pkts_31_40,
+            pdev->stats.pub.tx.comp_histogram.pkts_41_50,
+            pdev->stats.pub.tx.comp_histogram.pkts_51_60,
+            pdev->stats.pub.tx.comp_histogram.pkts_61_plus);
+    }
+    adf_os_print(
+        "  rx: %lld ppdus, %lld mpdus, %lld msdus, %lld bytes, %lld errs\n",
         pdev->stats.priv.rx.normal.ppdus,
         pdev->stats.priv.rx.normal.mpdus,
         pdev->stats.pub.rx.delivered.pkts,
         pdev->stats.pub.rx.delivered.bytes,
         pdev->stats.priv.rx.err.mpdu_bad);
-    if (TXRX_STATS_LEVEL == TXRX_STATS_LEVEL_FULL) {
-        VOS_TRACE(VOS_MODULE_ID_TXRX, VOS_TRACE_LEVEL_INFO,
-            "    forwarded %lld msdus, %lld bytes\n",
-            pdev->stats.pub.rx.forwarded.pkts,
-            pdev->stats.pub.rx.forwarded.bytes);
-    }
+
+    adf_os_print(
+        "  fwd to stack %d, fwd to fw %d, fwd to stack & fw  %d\n",
+        pdev->stats.pub.rx.intra_bss_fwd.packets_stack,
+        pdev->stats.pub.rx.intra_bss_fwd.packets_fwd,
+        pdev->stats.pub.rx.intra_bss_fwd.packets_stack_n_fwd);
 }
 
 void
@@ -2181,8 +2230,8 @@ ol_txrx_stats_clear(ol_txrx_pdev_handle pdev)
        pdev->stats.pub.tx.delivered.bytes = 0;
        pdev->stats.pub.tx.dropped.host_reject.pkts = 0;
        pdev->stats.pub.tx.dropped.host_reject.bytes = 0;
-       adf_os_mem_zero(&pdev->stats.pub.rx.delivered,
-                       sizeof(pdev->stats.pub.rx.delivered));
+       adf_os_mem_zero(&pdev->stats.pub.rx,
+                       sizeof(pdev->stats.pub.rx));
        adf_os_mem_zero(&pdev->stats.priv.rx, sizeof(pdev->stats.priv.rx));
     } else { /* Full */
        adf_os_mem_zero(&pdev->stats, sizeof(pdev->stats));
@@ -2199,6 +2248,52 @@ ol_txrx_stats_publish(ol_txrx_pdev_handle pdev, struct ol_txrx_stats *buf)
 }
 #endif /* TXRX_STATS_LEVEL */
 
+void
+ol_txrx_histogram_display(ol_txrx_pdev_handle pdev)
+{
+    u_int16_t i;
+    u_int16_t rx_pkt_histrogram[TXRX_DATA_HISTROGRAM_NUM_INTERVALS];
+    u_int16_t tx_pkt_histrogram[TXRX_DATA_HISTROGRAM_NUM_INTERVALS];
+
+    adf_os_spin_lock_bh(&pdev->txrx_histogram_lock);
+    adf_os_mem_copy(&rx_pkt_histrogram, &pdev->rx_pkt_histrogram,
+                                           sizeof(rx_pkt_histrogram));
+    adf_os_mem_copy(&tx_pkt_histrogram, &pdev->tx_pkt_histrogram,
+                                           sizeof(tx_pkt_histrogram));
+    adf_os_spin_unlock_bh(&pdev->txrx_histogram_lock);
+
+    for (i=0; i < TXRX_DATA_HISTROGRAM_NUM_INTERVALS; i++) {
+        if (i % 10 == 0) {
+            adf_os_print("\n: rx_packet_histrogram[%d...%d]: ", i, i+10);
+        }
+        adf_os_print("%d,", rx_pkt_histrogram[i]);
+    }
+    adf_os_print("\n");
+    for (i=0; i < TXRX_DATA_HISTROGRAM_NUM_INTERVALS; i++) {
+        if (i % 10 == 0) {
+            adf_os_print("\n: tx_packet_histrogram[%d...%d]: ", i, i+10);
+        }
+        adf_os_print("%d,", tx_pkt_histrogram[i]);
+    }
+    adf_os_print("\n");
+}
+
+void
+ol_txrx_histogram_clear(ol_txrx_pdev_handle pdev)
+{
+
+    adf_os_timer_cancel(&pdev->txrx_histogram_timer);
+    adf_os_spin_lock_bh(&pdev->txrx_histogram_lock);
+    pdev->txrx_histogram_count = 0;
+    adf_os_mem_zero(&pdev->rx_pkt_histrogram, sizeof(pdev->rx_pkt_histrogram));
+    adf_os_mem_zero(&pdev->tx_pkt_histrogram, sizeof(pdev->tx_pkt_histrogram));
+    adf_os_spin_unlock_bh(&pdev->txrx_histogram_lock);
+
+    adf_os_timer_start(&pdev->txrx_histogram_timer,
+                 TXRX_DATA_HISTROGRAM_GRANULARITY);
+
+}
+
 #if defined(ENABLE_TXRX_PROT_ANALYZE)
 
 void
@@ -2413,6 +2508,9 @@ void ol_txrx_display_stats(struct ol_txrx_pdev_t *pdev, uint16_t value)
         case WLAN_TXRX_STATS:
             ol_txrx_stats_display(pdev);
             break;
+        case WLAN_TXRX_HIST_STATS:
+            ol_txrx_histogram_display(pdev);
+            break;
 #ifdef CONFIG_HL_SUPPORT
         case WLAN_SCHEDULER_STATS:
             ol_tx_sched_cur_state_display(pdev);
@@ -2448,6 +2546,9 @@ void ol_txrx_clear_stats(struct ol_txrx_pdev_t *pdev, uint16_t value)
         case WLAN_TXRX_STATS:
             ol_txrx_stats_clear(pdev);
             break;
+        case WLAN_TXRX_HIST_STATS:
+            ol_txrx_histogram_clear(pdev);
+            break;
 #ifdef CONFIG_HL_SUPPORT
         case WLAN_SCHEDULER_STATS:
             ol_tx_sched_stats_clear(pdev);
diff --git a/CORE/CLD_TXRX/TXRX/ol_txrx_internal.h b/CORE/CLD_TXRX/TXRX/ol_txrx_internal.h
index bbe5c38e439d..f09db5ce9901 100644
--- a/CORE/CLD_TXRX/TXRX/ol_txrx_internal.h
+++ b/CORE/CLD_TXRX/TXRX/ol_txrx_internal.h
@@ -245,28 +245,51 @@ ol_rx_mpdu_list_next(
         break; \
     }
 
-#define TXRX_STATS_UPDATE_TX_STATS(_pdev, _status, _p_cntrs, _b_cntrs)          \
-do {                                                                            \
-    switch (status) {                                                           \
-    case htt_tx_status_ok:                                                      \
-       TXRX_STATS_ADD(_pdev, pub.tx.delivered.pkts, _p_cntrs);                  \
-       TXRX_STATS_ADD(_pdev, pub.tx.delivered.bytes, _b_cntrs);                 \
-        break;                                                                  \
-    case htt_tx_status_discard:                                                 \
-       TXRX_STATS_ADD(_pdev, pub.tx.dropped.target_discard.pkts, _p_cntrs);     \
-       TXRX_STATS_ADD(_pdev, pub.tx.dropped.target_discard.bytes, _b_cntrs);    \
-        break;                                                                  \
-    case htt_tx_status_no_ack:                                                  \
-       TXRX_STATS_ADD(_pdev, pub.tx.dropped.no_ack.pkts, _p_cntrs);             \
-       TXRX_STATS_ADD(_pdev, pub.tx.dropped.no_ack.bytes, _b_cntrs);            \
-        break;                                                                  \
-    case htt_tx_status_download_fail:                                           \
-       TXRX_STATS_ADD(_pdev, pub.tx.dropped.download_fail.pkts, _p_cntrs);      \
-       TXRX_STATS_ADD(_pdev, pub.tx.dropped.download_fail.bytes, _b_cntrs);     \
-        break;                                                                  \
-    default:                                                                    \
-        break;                                                                  \
-    }                                                                           \
+#define TXRX_STATS_UPDATE_TX_COMP_HISTOGRAM(_pdev, _p_cntrs)                   \
+do {                                                                           \
+    if (_p_cntrs > 60)                                                         \
+        TXRX_STATS_ADD(_pdev,pub.tx.comp_histogram.pkts_61_plus,1);            \
+    else if (_p_cntrs > 50)                                                    \
+        TXRX_STATS_ADD(_pdev,pub.tx.comp_histogram.pkts_51_60,1);              \
+    else if (_p_cntrs > 40)                                                    \
+        TXRX_STATS_ADD(_pdev,pub.tx.comp_histogram.pkts_41_50,1);              \
+    else if (_p_cntrs > 30)                                                    \
+        TXRX_STATS_ADD(_pdev,pub.tx.comp_histogram.pkts_31_40,1);              \
+    else if (_p_cntrs > 20)                                                    \
+        TXRX_STATS_ADD(_pdev,pub.tx.comp_histogram.pkts_21_30,1);              \
+    else if (_p_cntrs > 10)                                                    \
+        TXRX_STATS_ADD(_pdev,pub.tx.comp_histogram.pkts_11_20,1);              \
+    else if (_p_cntrs > 2)                                                     \
+        TXRX_STATS_ADD(_pdev,pub.tx.comp_histogram.pkts_2_10,1);               \
+    else                                                                       \
+        TXRX_STATS_ADD(_pdev,pub.tx.comp_histogram.pkts_1,1);                  \
+                                                                               \
+} while (0)
+
+
+#define TXRX_STATS_UPDATE_TX_STATS(_pdev, _status, _p_cntrs, _b_cntrs)         \
+do {                                                                           \
+    switch (status) {                                                          \
+    case htt_tx_status_ok:                                                     \
+       TXRX_STATS_ADD(_pdev, pub.tx.delivered.pkts, _p_cntrs);                 \
+       TXRX_STATS_ADD(_pdev, pub.tx.delivered.bytes, _b_cntrs);                \
+        break;                                                                 \
+    case htt_tx_status_discard:                                                \
+       TXRX_STATS_ADD(_pdev, pub.tx.dropped.target_discard.pkts, _p_cntrs);    \
+       TXRX_STATS_ADD(_pdev, pub.tx.dropped.target_discard.bytes, _b_cntrs);   \
+        break;                                                                 \
+    case htt_tx_status_no_ack:                                                 \
+       TXRX_STATS_ADD(_pdev, pub.tx.dropped.no_ack.pkts, _p_cntrs);            \
+       TXRX_STATS_ADD(_pdev, pub.tx.dropped.no_ack.bytes, _b_cntrs);           \
+        break;                                                                 \
+    case htt_tx_status_download_fail:                                          \
+       TXRX_STATS_ADD(_pdev, pub.tx.dropped.download_fail.pkts, _p_cntrs);     \
+       TXRX_STATS_ADD(_pdev, pub.tx.dropped.download_fail.bytes, _b_cntrs);    \
+        break;                                                                 \
+    default:                                                                   \
+        break;                                                                 \
+    }                                                                          \
+    TXRX_STATS_UPDATE_TX_COMP_HISTOGRAM(_pdev, _p_cntrs);                      \
 } while (0)
 
 #elif /*---*/ TXRX_STATS_LEVEL == TXRX_STATS_LEVEL_BASIC
diff --git a/CORE/CLD_TXRX/TXRX/ol_txrx_types.h b/CORE/CLD_TXRX/TXRX/ol_txrx_types.h
index f4689f29257f..d4b526d9aed1 100644
--- a/CORE/CLD_TXRX/TXRX/ol_txrx_types.h
+++ b/CORE/CLD_TXRX/TXRX/ol_txrx_types.h
@@ -48,6 +48,7 @@
 #include "ol_htt_rx_api.h"
 #include "wlan_qct_tl.h"
 #include <ol_txrx_ctrl_api.h>
+
 /*
  * The target may allocate multiple IDs for a peer.
  * In particular, the target may allocate one ID to represent the
@@ -80,6 +81,10 @@
 #define OL_TX_MUTEX_TYPE adf_os_spinlock_t
 #define OL_RX_MUTEX_TYPE adf_os_spinlock_t
 
+/* TXRX Histogram defines */
+#define TXRX_DATA_HISTROGRAM_GRANULARITY      1000
+#define TXRX_DATA_HISTROGRAM_NUM_INTERVALS    100
+
 struct ol_txrx_pdev_t;
 struct ol_txrx_vdev_t;
 struct ol_txrx_peer_t;
@@ -762,6 +767,12 @@ struct ol_txrx_pdev_t {
 	u_int8_t ocb_peer_valid;
 	struct ol_txrx_peer_t *ocb_peer;
 	int tid_to_ac[OL_TX_NUM_TIDS + OL_TX_VDEV_NUM_QUEUES];
+
+	adf_os_spinlock_t txrx_histogram_lock;
+	adf_os_timer_t txrx_histogram_timer;
+	u_int16_t txrx_histogram_count;
+	u_int16_t rx_pkt_histrogram[TXRX_DATA_HISTROGRAM_NUM_INTERVALS];
+	u_int16_t tx_pkt_histrogram[TXRX_DATA_HISTROGRAM_NUM_INTERVALS];
 };
 
 struct ol_txrx_vdev_t {
diff --git a/CORE/HDD/inc/wlan_hdd_wmm.h b/CORE/HDD/inc/wlan_hdd_wmm.h
index 0b94fd977ae9..5e992866b94c 100644
--- a/CORE/HDD/inc/wlan_hdd_wmm.h
+++ b/CORE/HDD/inc/wlan_hdd_wmm.h
@@ -139,6 +139,7 @@ typedef struct
    hdd_wlan_wmm_status_e        lastStatus;
    struct work_struct           wmmAcSetupImplicitQos;
    v_U32_t                      magic;
+   bool                         is_inactivity_timer_running;
 } hdd_wmm_qos_context_t;
 
 /*! @brief WMM related per-AC state & status info
diff --git a/CORE/HDD/src/wlan_hdd_cfg80211.c b/CORE/HDD/src/wlan_hdd_cfg80211.c
index ca81036881ed..3d3c0e1f5345 100644
--- a/CORE/HDD/src/wlan_hdd_cfg80211.c
+++ b/CORE/HDD/src/wlan_hdd_cfg80211.c
@@ -14172,7 +14172,7 @@ static int wlan_hdd_cfg80211_connect( struct wiphy *wiphy,
  */
 int wlan_hdd_disconnect( hdd_adapter_t *pAdapter, u16 reason )
 {
-    int status;
+    int status, result = 0;
     unsigned long rc;
     hdd_station_ctx_t *pHddStaCtx = WLAN_HDD_GET_STATION_CTX_PTR(pAdapter);
     hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
@@ -14209,7 +14209,8 @@ int wlan_hdd_disconnect( hdd_adapter_t *pAdapter, u16 reason )
                "%s csrRoamDisconnect failure, returned %d",
                __func__, (int)status );
         pHddStaCtx->staDebugState = status;
-        return -EINVAL;
+        result = -EINVAL;
+        goto disconnected;
     }
     rc = wait_for_completion_timeout(
                 &pAdapter->disconnect_comp_var,
@@ -14218,7 +14219,7 @@ int wlan_hdd_disconnect( hdd_adapter_t *pAdapter, u16 reason )
     if (!rc) {
        hddLog(VOS_TRACE_LEVEL_ERROR,
               "%s: Failed to disconnect, timed out", __func__);
-       return -ETIMEDOUT;
+       result = -ETIMEDOUT;
     }
 
 disconnected:
@@ -14227,7 +14228,7 @@ disconnected:
     hdd_connSetConnectionState(pAdapter,
                                 eConnectionState_NotConnected);
 
-    return 0;
+    return result;
 }
 
 
diff --git a/CORE/HDD/src/wlan_hdd_softap_tx_rx.c b/CORE/HDD/src/wlan_hdd_softap_tx_rx.c
index 318e574dc31b..d3b95226066e 100644
--- a/CORE/HDD/src/wlan_hdd_softap_tx_rx.c
+++ b/CORE/HDD/src/wlan_hdd_softap_tx_rx.c
@@ -1093,6 +1093,12 @@ VOS_STATUS hdd_softap_rx_packet_cbk(v_VOID_t *vosContext,
        return VOS_STATUS_E_FAILURE;
    }
 
+   if (!pAdapter->dev) {
+       VOS_TRACE(VOS_MODULE_ID_HDD_DATA, VOS_TRACE_LEVEL_FATAL,
+          "Invalid DEV(NULL) Drop packets");
+       return VOS_STATUS_E_FAILURE;
+   }
+
    ++pAdapter->hdd_stats.hddTxRxStats.rxChains;
 
    // walk the chain until all are processed
@@ -1101,13 +1107,6 @@ VOS_STATUS hdd_softap_rx_packet_cbk(v_VOID_t *vosContext,
    while (NULL != skb) {
       skb_next = skb->next;
       skb->dev = pAdapter->dev;
-      if (skb->dev == NULL) {
-         VOS_TRACE( VOS_MODULE_ID_HDD_SAP_DATA, VOS_TRACE_LEVEL_ERROR,
-                   "%s: ERROR!!Invalid netdevice", __func__);
-         kfree_skb(skb);
-         skb = skb_next;
-         continue;
-      }
 
       ++pAdapter->hdd_stats.hddTxRxStats.rxPackets;
       ++pAdapter->stats.rx_packets;
diff --git a/CORE/HDD/src/wlan_hdd_wext.c b/CORE/HDD/src/wlan_hdd_wext.c
index f8f0b862ae3e..847fcc7f221e 100644
--- a/CORE/HDD/src/wlan_hdd_wext.c
+++ b/CORE/HDD/src/wlan_hdd_wext.c
@@ -7446,29 +7446,23 @@ static int __iw_set_var_ints_getnone(struct net_device *dev,
     hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR(dev);
     tHalHandle hHal = WLAN_HDD_GET_HAL_CTX(pAdapter);
     int sub_cmd;
-    int apps_args[MAX_VAR_ARGS] = {0};
-    int num_args;
+    int *apps_args = (int *) extra;
     hdd_station_ctx_t *pStaCtx = NULL ;
     hdd_ap_ctx_t  *pAPCtx = NULL;
     int cmd = 0;
     int staId = 0;
-    struct iw_point s_priv_data;
     hdd_context_t *pHddCtx = NULL;
-    int ret = 0;
-
-    /* helper function to get iwreq_data with compat handling. */
-    if (hdd_priv_get_data(&s_priv_data, wrqu)) {
-       return -EINVAL;
-    }
+    int ret = 0, num_args;
 
-    if (NULL == s_priv_data.pointer) {
-       return -EINVAL;
+    if (extra == NULL) {
+        hddLog(LOGE, FL("NULL extra buffer pointer"));
+        return -EINVAL;
     }
 
-    sub_cmd = s_priv_data.flags;
-    num_args = s_priv_data.length;
+    sub_cmd = wrqu->data.flags;
+    num_args = wrqu->data.length;
 
-    hddLog(LOG1, FL("Received length %d"), s_priv_data.length);
+    hddLog(LOG1, FL("Received length %d"), wrqu->data.length);
 
     pHddCtx = WLAN_HDD_GET_CTX(pAdapter);
     ret = wlan_hdd_validate_context(pHddCtx);
@@ -7477,19 +7471,6 @@ static int __iw_set_var_ints_getnone(struct net_device *dev,
         return ret;
     }
 
-    if (num_args > MAX_VAR_ARGS)
-    {
-       num_args = MAX_VAR_ARGS;
-    }
-
-    /* ODD number is used for set, copy data using copy_from_user */
-    if (copy_from_user(apps_args, s_priv_data.pointer,
-                       (sizeof(int)) * num_args)) {
-        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
-                  "%s: failed to copy data to user buffer", __func__);
-        return -EFAULT;
-    }
-
     if(( sub_cmd == WE_MCC_CONFIG_CREDENTIAL ) ||
         (sub_cmd == WE_MCC_CONFIG_PARAMS ))
     {
@@ -7695,6 +7676,50 @@ static int __iw_set_var_ints_getnone(struct net_device *dev,
     return 0;
 }
 
+/**
+ * iw_hdd_set_var_ints_getnone() - set var ints getnone callback
+ * @dev: pointer to net_device structure
+ * @info: pointer to iw_request_info structure
+ * @wrqu: pointer to iwreq_data
+ * @extra; extra
+ *
+ * Return: 0 on success, error number otherwise
+ *
+ */
+static int iw_hdd_set_var_ints_getnone(struct net_device *dev,
+				       struct iw_request_info *info,
+				       union iwreq_data *wrqu, char *extra)
+{
+	union iwreq_data u_priv_wrqu;
+	int apps_args[MAX_VAR_ARGS] = {0};
+	int ret, num_args;
+
+	/* Helper function to get iwreq_data with compat handling. */
+	if (hdd_priv_get_data(&u_priv_wrqu.data, wrqu))
+		return -EINVAL;
+
+	if (NULL == u_priv_wrqu.data.pointer) {
+		hddLog(LOGE, FL("NULL data pointer"));
+		return -EINVAL;
+	}
+
+	num_args = u_priv_wrqu.data.length;
+	if (num_args > MAX_VAR_ARGS)
+		num_args = MAX_VAR_ARGS;
+
+	if (copy_from_user(apps_args, u_priv_wrqu.data.pointer,
+			  (sizeof(int)) * num_args)) {
+		hddLog(LOGE, FL("failed to copy data from user buffer"));
+		return -EFAULT;
+	}
+
+	vos_ssr_protect(__func__);
+	ret = __iw_set_var_ints_getnone(dev, info, &u_priv_wrqu,
+					(char *)&apps_args);
+	vos_ssr_unprotect(__func__);
+	return ret;
+}
+
 
 int iw_set_var_ints_getnone(struct net_device *dev,
                             struct iw_request_info *info,
@@ -9888,7 +9913,7 @@ static const iw_handler we_private[] = {
    [WLAN_PRIV_SET_THREE_INT_GET_NONE - SIOCIWFIRSTPRIV]  = iw_set_three_ints_getnone,
    [WLAN_PRIV_GET_CHAR_SET_NONE      - SIOCIWFIRSTPRIV]  = iw_get_char_setnone,
    [WLAN_PRIV_SET_NONE_GET_NONE     - SIOCIWFIRSTPRIV]   = iw_setnone_getnone, //action priv ioctl
-   [WLAN_PRIV_SET_VAR_INT_GET_NONE  - SIOCIWFIRSTPRIV]   = iw_set_var_ints_getnone,
+   [WLAN_PRIV_SET_VAR_INT_GET_NONE  - SIOCIWFIRSTPRIV]   = iw_hdd_set_var_ints_getnone,
    [WLAN_PRIV_SET_NONE_GET_THREE_INT - SIOCIWFIRSTPRIV]  = iw_setnone_get_threeint,
    [WLAN_PRIV_ADD_TSPEC             - SIOCIWFIRSTPRIV]   = iw_add_tspec,
    [WLAN_PRIV_DEL_TSPEC             - SIOCIWFIRSTPRIV]   = iw_del_tspec,
diff --git a/CORE/HDD/src/wlan_hdd_wmm.c b/CORE/HDD/src/wlan_hdd_wmm.c
index 9cc5e9ed05b9..a9a595841589 100644
--- a/CORE/HDD/src/wlan_hdd_wmm.c
+++ b/CORE/HDD/src/wlan_hdd_wmm.c
@@ -488,12 +488,19 @@ VOS_STATUS hdd_wmm_enable_inactivity_timer(hdd_wmm_qos_context_t* pQosContext, v
     {
         VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                 FL("Starting inactivity timer failed on AC %d"), acType);
+        vos_status = vos_timer_destroy(&pAc->wmmInactivityTimer);
+        if (VOS_STATUS_SUCCESS != vos_status) {
+            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                    FL("Failed to destroy inactivity timer"));
+        }
         return vos_status;
     }
     pAc->wmmInactivityTime = inactivityTime;
     // Initialize the current tx traffic count on this AC
     pAc->wmmPrevTrafficCnt = pAdapter->hdd_stats.hddTxRxStats.txXmitClassifiedAC[pQosContext->acType];
 
+    pQosContext->is_inactivity_timer_running = true;
+
     return vos_status;
 }
 
@@ -517,10 +524,23 @@ VOS_STATUS hdd_wmm_disable_inactivity_timer(hdd_wmm_qos_context_t* pQosContext)
     // Clear the timer and the counter
     pAc->wmmInactivityTime = 0;
     pAc->wmmPrevTrafficCnt = 0;
-    vos_timer_stop(&pAc->wmmInactivityTimer);
-    vos_status = vos_timer_destroy(&pAc->wmmInactivityTimer);
 
-    return vos_status;
+    if (pQosContext->is_inactivity_timer_running == true) {
+        pQosContext->is_inactivity_timer_running = false;
+        vos_status = vos_timer_stop(&pAc->wmmInactivityTimer);
+        if (VOS_STATUS_SUCCESS != vos_status) {
+            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                    FL("Failed to stop inactivity timer"));
+            return vos_status;
+        }
+        vos_status = vos_timer_destroy(&pAc->wmmInactivityTimer);
+        if (VOS_STATUS_SUCCESS != vos_status) {
+            VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                    FL("Failed to destroy inactivity timer:Timer started"));
+        }
+   }
+
+   return vos_status;
 }
 #endif // FEATURE_WLAN_ESE
 
@@ -2028,6 +2048,7 @@ VOS_STATUS hdd_wmm_acquire_access( hdd_adapter_t* pAdapter,
    pQosContext->qosFlowId = 0;
    pQosContext->handle = HDD_WMM_HANDLE_IMPLICIT;
    pQosContext->magic = HDD_WMM_CTX_MAGIC;
+   pQosContext->is_inactivity_timer_running = false;
 
 #ifdef CONFIG_CNSS
    cnss_init_work(&pQosContext->wmmAcSetupImplicitQos,
diff --git a/CORE/MAC/inc/qwlan_version.h b/CORE/MAC/inc/qwlan_version.h
index 77e577a3db56..75a335e5ba63 100644
--- a/CORE/MAC/inc/qwlan_version.h
+++ b/CORE/MAC/inc/qwlan_version.h
@@ -42,9 +42,9 @@ BRIEF DESCRIPTION:
 #define QWLAN_VERSION_MINOR            0
 #define QWLAN_VERSION_PATCH            10
 #define QWLAN_VERSION_EXTRA            ""
-#define QWLAN_VERSION_BUILD            93 
+#define QWLAN_VERSION_BUILD            94 
 
-#define QWLAN_VERSIONSTR               "4.0.10.93"
+#define QWLAN_VERSIONSTR               "4.0.10.94"
 
 
 #define AR6320_REV1_VERSION             0x5000000
diff --git a/CORE/MAC/src/pe/lim/limSerDesUtils.c b/CORE/MAC/src/pe/lim/limSerDesUtils.c
index 702c371ac098..571612006145 100644
--- a/CORE/MAC/src/pe/lim/limSerDesUtils.c
+++ b/CORE/MAC/src/pe/lim/limSerDesUtils.c
@@ -284,6 +284,12 @@ limGetBssDescription( tpAniSirGlobal pMac, tSirBssDescription *pBssDescription,
     /* 1 reserved byte padding */
     pBuf += (WSCIE_PROBE_RSP_LEN + 1);
     len -= (WSCIE_PROBE_RSP_LEN + 1);
+    if (limCheckRemainingLength(pMac, len) == eSIR_FAILURE)
+        return eSIR_FAILURE;
+
+    pBssDescription->tsf_delta = limGetU32(pBuf);
+    pBuf += sizeof(tANI_U32);
+    len  -= sizeof(tANI_U32);
 
     if (len > 0)
     {
diff --git a/CORE/SAP/src/sapFsm.c b/CORE/SAP/src/sapFsm.c
index ace582e3c755..b4a8acdd6822 100644
--- a/CORE/SAP/src/sapFsm.c
+++ b/CORE/SAP/src/sapFsm.c
@@ -4115,7 +4115,7 @@ sapAddMacToACL(v_MACADDR_t *macList, v_U8_t *size, v_U8_t *peerMac)
     v_SINT_t nRes = -1;
     int i;
 
-    if (NULL == macList || *size == 0 || *size > MAX_ACL_MAC_ADDRESS) {
+    if ((NULL == macList) || (*size > MAX_ACL_MAC_ADDRESS)) {
         VOS_TRACE(VOS_MODULE_ID_SAP, VOS_TRACE_LEVEL_INFO_HIGH,
                   FL("either buffer is NULL or size = %d is incorrect."),
                   *size);
diff --git a/CORE/SERVICES/COMMON/ol_txrx_ctrl_api.h b/CORE/SERVICES/COMMON/ol_txrx_ctrl_api.h
index 79550877bc04..7c73a8916fee 100644
--- a/CORE/SERVICES/COMMON/ol_txrx_ctrl_api.h
+++ b/CORE/SERVICES/COMMON/ol_txrx_ctrl_api.h
@@ -65,13 +65,14 @@ enum wlan_op_mode {
 #define OL_TXQ_PAUSE_REASON_VDEV_SUSPEND      (1 << 4)
 
 /* command options for dumpStats*/
-#define WLAN_HDD_STATS        0
-#define WLAN_TXRX_STATS       1
+#define WLAN_HDD_STATS               0
+#define WLAN_TXRX_STATS              1
+#define WLAN_TXRX_HIST_STATS         2
 #ifdef CONFIG_HL_SUPPORT
-#define WLAN_SCHEDULER_STATS  2
-#define WLAN_TX_QUEUE_STATS   3
-#define WLAN_BUNDLE_STATS     4
-#define WLAN_CREDIT_STATS     5
+#define WLAN_SCHEDULER_STATS        21
+#define WLAN_TX_QUEUE_STATS         22
+#define WLAN_BUNDLE_STATS           23
+#define WLAN_CREDIT_STATS           24
 #endif
 
 /**
diff --git a/CORE/SERVICES/COMMON/ol_txrx_stats.h b/CORE/SERVICES/COMMON/ol_txrx_stats.h
index 1e2b78dde248..afc67d543d7f 100644
--- a/CORE/SERVICES/COMMON/ol_txrx_stats.h
+++ b/CORE/SERVICES/COMMON/ol_txrx_stats.h
@@ -41,7 +41,11 @@
 #define TXRX_STATS_LEVEL_FULL  2
 
 #ifndef TXRX_STATS_LEVEL
+#ifdef CONFIG_HL_SUPPORT
 #define TXRX_STATS_LEVEL TXRX_STATS_LEVEL_BASIC
+#else
+#define TXRX_STATS_LEVEL TXRX_STATS_LEVEL_FULL
+#endif
 #endif
 
 typedef struct {
@@ -68,12 +72,29 @@ struct ol_txrx_stats {
             /* MSDUs which the target sent but couldn't get an ack for */
             ol_txrx_stats_elem no_ack;
         } dropped;
+        /* contains information of packets recevied per tx completion*/
+        struct {
+            u_int32_t pkts_1;
+            u_int32_t pkts_2_10;
+            u_int32_t pkts_11_20;
+            u_int32_t pkts_21_30;
+            u_int32_t pkts_31_40;
+            u_int32_t pkts_41_50;
+            u_int32_t pkts_51_60;
+            u_int32_t pkts_61_plus;
+        } comp_histogram;
     } tx;
     struct {
         /* MSDUs given to the OS shim */
         ol_txrx_stats_elem delivered;
-        /* MSDUs forwarded from the rx path to the tx path */
-        ol_txrx_stats_elem forwarded;
+        struct {
+            /* MSDUs forwarded to network stack */
+            u_int32_t packets_stack;
+            /* MSDUs forwarded from the rx path to the tx path */
+            u_int32_t packets_fwd;
+            /* MSDUs forwarded to stack and tx path */
+            u_int32_t packets_stack_n_fwd;
+       } intra_bss_fwd;
     } rx;
 };
 
diff --git a/CORE/SERVICES/HTC/htc.c b/CORE/SERVICES/HTC/htc.c
index bdbd2fb92f8e..b48a90492a9b 100644
--- a/CORE/SERVICES/HTC/htc.c
+++ b/CORE/SERVICES/HTC/htc.c
@@ -291,6 +291,7 @@ void  HTCDestroy(HTC_HANDLE HTCHandle)
 {
     HTC_TARGET *target = GET_HTC_TARGET_FROM_HANDLE(HTCHandle);
     AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("+HTCDestroy ..  Destroying :0x%p \n",target));
+    HIFStop(HTCGetHifDevice(HTCHandle));
     HTCCleanup(target);
     AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("-HTCDestroy \n"));
 }