Release 1.0.0.128 QCACLD WLAN Driver

Merge commit 'fdcbd508df2843b9345b3e55a93b7302dbb7b27e' into HEAD

* commit 'fdcbd508df2843b9345b3e55a93b7302dbb7b27e':
  Cafstaging Release 1.0.0.128
  qcacld: Compilation error on x86-64 PCIE
  qcacld: Fix compilation error
  Skip channel 14 only once in channel selection initialization
  Droidsec: sscanf parameter count check
  wlan: Limit the Deauth Frames sent by AP to STA
  qcacld:Fix compilation issues on enabling CONFIG_ATH_PCIE_ACCESS_DEBUG
  qcacld: CL 986653 - update fw common interface files
  Timer leak for tx_flow_control_timer in wlan host driver
  qca-cld:sap: Improve HT80 primary channel selection
  qcacld: HDD: Provide fix kernel panic while adding virtual intf

Change-Id: If723b0b437f2d9e19f9a47459221fc8fd6ea0d8b

16 files changed, 233 insertions, 58 deletions

diff --git a/CORE/HDD/src/wlan_hdd_cfg80211.c b/CORE/HDD/src/wlan_hdd_cfg80211.c
index a880933e62c9..75c06e81aeca 100644
--- a/CORE/HDD/src/wlan_hdd_cfg80211.c
+++ b/CORE/HDD/src/wlan_hdd_cfg80211.c
@@ -3468,17 +3468,14 @@ static int __wlan_hdd_cfg80211_change_iface(struct wiphy *wiphy,
                     return -EINVAL;
 
 #ifdef QCA_LL_TX_FLOW_CT
-                if (NL80211_IFTYPE_P2P_CLIENT == type)
-                {
-                   vos_timer_init(&pAdapter->tx_flow_control_timer,
+                vos_timer_init(&pAdapter->tx_flow_control_timer,
                               VOS_TIMER_TYPE_SW,
                               hdd_tx_resume_timer_expired_handler,
                               pAdapter);
-                   WLANTL_RegisterTXFlowControl(pHddCtx->pvosContext,
+                WLANTL_RegisterTXFlowControl(pHddCtx->pvosContext,
                               hdd_tx_resume_cb,
                               pAdapter->sessionId,
                              (void *)pAdapter);
-                }
 #endif /* QCA_LL_TX_FLOW_CT */
 
 #endif
@@ -3674,7 +3671,8 @@ static int __wlan_hdd_cfg80211_change_iface(struct wiphy *wiphy,
                 }
                 hdd_enable_bmps_imps(pHddCtx);
 #ifdef QCA_LL_TX_FLOW_CT
-                if (NL80211_IFTYPE_P2P_CLIENT == type)
+                if ((NL80211_IFTYPE_P2P_CLIENT == type) ||
+                     (NL80211_IFTYPE_STATION == type))
                 {
                    vos_timer_init(&pAdapter->tx_flow_control_timer,
                               VOS_TIMER_TYPE_SW,
diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c
index 055e2c09caa1..78ed1a5eaaf6 100755
--- a/CORE/HDD/src/wlan_hdd_main.c
+++ b/CORE/HDD/src/wlan_hdd_main.c
@@ -13519,7 +13519,7 @@ void wlan_hdd_restart_sap(hdd_adapter_t *ap_pAdapter)
             }
         }
         clear_bit(SOFTAP_BSS_STARTED, &ap_pAdapter->event_flags);
-        wlan_hdd_decr_active_session(pHddCtx, pHostapdAdapter->device_mode);
+        wlan_hdd_decr_active_session(pHddCtx, ap_pAdapter->device_mode);
         hddLog(LOGE,FL("%s: SAP Stop Success"), __func__);
 
         if (WLANSAP_StartBss(
@@ -13542,7 +13542,7 @@ void wlan_hdd_restart_sap(hdd_adapter_t *ap_pAdapter)
         }
         hddLog(LOGE,FL("%s: SAP Start Success"), __func__);
         set_bit(SOFTAP_BSS_STARTED, &ap_pAdapter->event_flags);
-        wlan_hdd_incr_active_session(pHddCtx, ap_pAdapter-->device_mode);
+        wlan_hdd_incr_active_session(pHddCtx, ap_pAdapter->device_mode);
         pHostapdState->bCommit = TRUE;
     }
 end:
diff --git a/CORE/HDD/src/wlan_hdd_p2p.c b/CORE/HDD/src/wlan_hdd_p2p.c
index 91dd27ce3a68..f8557c3b83ef 100644
--- a/CORE/HDD/src/wlan_hdd_p2p.c
+++ b/CORE/HDD/src/wlan_hdd_p2p.c
@@ -1427,6 +1427,7 @@ int hdd_setP2pNoa( struct net_device *dev, tANI_U8 *command )
     tP2pPsConfig NoA;
     int count, duration, start_time;
     char *param;
+    int ret;
 
     param = strnchr(command, strlen(command), ' ');
     if (param == NULL)
@@ -1436,9 +1437,15 @@ int hdd_setP2pNoa( struct net_device *dev, tANI_U8 *command )
        return -EINVAL;
     }
     param++;
-    sscanf(param, "%d %d %d", &count, &start_time, &duration);
+    ret = sscanf(param, "%d %d %d", &count, &start_time, &duration);
+    if (ret != 3) {
+        VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+               "%s: P2P_SET GO NoA: fail to read params, ret=%d",
+                __func__, ret);
+        return -EINVAL;
+    }
     VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
-               "%s: P2P_SET GO NoA: count=%d duration=%d interval=%d",
+               "%s: P2P_SET GO NoA: count=%d start_time=%d duration=%d",
                 __func__, count, start_time, duration);
     duration = MS_TO_MUS(duration);
     /* PS Selection
@@ -1504,6 +1511,7 @@ int hdd_setP2pOpps( struct net_device *dev, tANI_U8 *command )
     tP2pPsConfig NoA;
     char *param;
     int legacy_ps, opp_ps, ctwindow;
+    int ret;
 
     param = strnchr(command, strlen(command), ' ');
     if (param == NULL)
@@ -1513,7 +1521,13 @@ int hdd_setP2pOpps( struct net_device *dev, tANI_U8 *command )
         return -EINVAL;
     }
     param++;
-    sscanf(param, "%d %d %d", &legacy_ps, &opp_ps, &ctwindow);
+    ret = sscanf(param, "%d %d %d", &legacy_ps, &opp_ps, &ctwindow);
+    if (ret != 3) {
+        VOS_TRACE (VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+                 "%s: P2P_SET GO PS: fail to read params, ret=%d",
+                 __func__, ret);
+        return -EINVAL;
+    }
     VOS_TRACE (VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO,
                  "%s: P2P_SET GO PS: legacy_ps=%d opp_ps=%d ctwindow=%d",
                  __func__, legacy_ps, opp_ps, ctwindow);
@@ -1670,7 +1684,7 @@ struct net_device* wlan_hdd_add_virtual_intf(
     {
        VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                 "%s:LOGP in Progress. Ignore!!!", __func__);
-       return NULL;
+       return ERR_PTR(-EINVAL);
     }
 
     MTRACE(vos_trace(VOS_MODULE_ID_HDD,
@@ -1690,7 +1704,7 @@ struct net_device* wlan_hdd_add_virtual_intf(
        hddLog(VOS_TRACE_LEVEL_ERROR,"%s: Interface type %d already exists. "
                   "Two interfaces of same type are not supported currently.",
                   __func__, type);
-       return NULL;
+       return ERR_PTR(-EINVAL);
     }
 
     if (pHddCtx->cfg_ini->isP2pDeviceAddrAdministrated &&
diff --git a/CORE/HDD/src/wlan_hdd_wext.c b/CORE/HDD/src/wlan_hdd_wext.c
index 74f2e30a8453..813ebeb853ab 100644
--- a/CORE/HDD/src/wlan_hdd_wext.c
+++ b/CORE/HDD/src/wlan_hdd_wext.c
@@ -367,6 +367,9 @@ static const hdd_freq_chan_map_t freq_chan_map[] = { {2412, 1}, {2417, 2},
 #define WE_DUMP_CHANINFO_START     13
 #define WE_DUMP_CHANINFO           14
 #define WE_DUMP_WATCHDOG           15
+#ifdef CONFIG_ATH_PCIE_ACCESS_DEBUG
+#define WE_DUMP_PCIE_LOG           16
+#endif
 #endif
 
 /* Private ioctls and their sub-ioctls */
@@ -7418,6 +7421,16 @@ static int iw_setnone_getnone(struct net_device *dev, struct iw_request_info *in
                                           0, GEN_CMD);
             break;
         }
+#ifdef CONFIG_ATH_PCIE_ACCESS_DEBUG
+        case WE_DUMP_PCIE_LOG:
+        {
+          hddLog(LOGE, "WE_DUMP_PCIE_LOG");
+          ret = process_wma_set_command((int) pAdapter->sessionId,
+                                        (int) GEN_PARAM_DUMP_PCIE_ACCESS_LOG,
+                                        0, GEN_CMD);
+          break;
+        }
+#endif
 #endif
         default:
         {
@@ -10824,6 +10837,12 @@ static const struct iw_priv_args we_private_args[] = {
         0,
         0,
         "dump_watchdog" },
+#ifdef CONFIG_ATH_PCIE_ACCESS_DEBUG
+    {   WE_DUMP_PCIE_LOG,
+        0,
+        0,
+        "dump_pcie_log" },
+#endif
 #endif
     /* handlers for main ioctl */
     {   WLAN_PRIV_SET_VAR_INT_GET_NONE,
diff --git a/CORE/MAC/inc/qwlan_version.h b/CORE/MAC/inc/qwlan_version.h
index 9ba0b45b125e..303a09deebdf 100644
--- a/CORE/MAC/inc/qwlan_version.h
+++ b/CORE/MAC/inc/qwlan_version.h
@@ -42,9 +42,9 @@ BRIEF DESCRIPTION:
 #define QWLAN_VERSION_MINOR            0
 #define QWLAN_VERSION_PATCH            0
 #define QWLAN_VERSION_EXTRA            ""
-#define QWLAN_VERSION_BUILD            127
+#define QWLAN_VERSION_BUILD            128
 
-#define QWLAN_VERSIONSTR               "1.0.0.127"
+#define QWLAN_VERSIONSTR               "1.0.0.128"
 
 #ifdef QCA_WIFI_2_0
 
diff --git a/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c b/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c
index b1529abc1dc5..2a9fefa5a33d 100644
--- a/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c
+++ b/CORE/MAC/src/pe/lim/limProcessMlmRspMessages.c
@@ -1999,7 +1999,8 @@ void limProcessMlmDelBssRsp( tpAniSirGlobal pMac, tpSirMsgQ limMsgQ,tpPESession
    //     limLog( pMac, LOGE, FL( "Session deos not exist with given sessionId" ));
    //     return;
   //  }
-  SET_LIM_PROCESS_DEFD_MESGS(pMac, true);
+    SET_LIM_PROCESS_DEFD_MESGS(pMac, true);
+    pMac->sys.gSysFrameCount[SIR_MAC_MGMT_FRAME][SIR_MAC_MGMT_DEAUTH] = 0;
 
     if (((psessionEntry->limSystemRole == eLIM_BT_AMP_AP_ROLE)  ||
          (psessionEntry->limSystemRole == eLIM_BT_AMP_STA_ROLE)
diff --git a/CORE/SAP/src/sapChSelect.c b/CORE/SAP/src/sapChSelect.c
index 6a9b0f23c5c0..33afbd993fcd 100644
--- a/CORE/SAP/src/sapChSelect.c
+++ b/CORE/SAP/src/sapChSelect.c
@@ -650,7 +650,6 @@ v_BOOL_t sapChanSelInit(tHalHandle halHandle,
         if(*pChans == 14 &&
                eCSR_DOT11_MODE_11b != sme_GetPhyMode(halHandle))
         {
-            pChans++;
             continue;
         }
 
@@ -1920,7 +1919,6 @@ void sapSortChlWeightHT80(tSapChSelSpectInfo *pSpectInfoParams)
 {
     v_U8_t i, j, n;
     tSapSpectChInfo *pSpectInfo;
-    v_U32_t minWeight;
     v_U8_t minIdx;
 
     pSpectInfo = pSpectInfoParams->pSpectCh;
@@ -1946,15 +1944,22 @@ void sapSortChlWeightHT80(tSapChSelSpectInfo *pSpectInfoParams)
                                            pSpectInfo[j+2].weight +
                                            pSpectInfo[j+3].weight;
             /* find best channel among 4 channels as the primary channel */
-            minWeight = pSpectInfo[j].weight;
-            minIdx = 0;
-            for (n=1; n<4; n++)
+            if ((pSpectInfo[j].weight + pSpectInfo[j+1].weight) <
+                    (pSpectInfo[j+2].weight + pSpectInfo[j+3].weight))
             {
-                if (minWeight > pSpectInfo[j+n].weight)
-                {
-                    minWeight = pSpectInfo[j+n].weight;
-                    minIdx = n;
-                }
+                /* lower 2 channels are better choice */
+                if (pSpectInfo[j].weight < pSpectInfo[j+1].weight)
+                    minIdx = 0;
+                else
+                    minIdx = 1;
+            }
+            else
+            {
+                /* upper 2 channels are better choice */
+                if (pSpectInfo[j+2].weight <= pSpectInfo[j+3].weight)
+                    minIdx = 2;
+                else
+                    minIdx = 3;
             }
 
             /* set all 4 channels to max value first, then reset the
diff --git a/CORE/SERVICES/COMMON/hif.h b/CORE/SERVICES/COMMON/hif.h
index 3a2c01bcf60a..b31cea757e27 100644
--- a/CORE/SERVICES/COMMON/hif.h
+++ b/CORE/SERVICES/COMMON/hif.h
@@ -354,6 +354,15 @@ typedef struct {
     void    *pOSDevice;
 } HIF_DEVICE_OS_DEVICE_INFO;
 
+#ifdef CONFIG_ATH_PCIE_ACCESS_DEBUG
+typedef struct _HID_ACCESS_LOG {
+    A_UINT32     seqnum;
+    bool         is_write;
+    void         *addr;
+    A_UINT32     value;
+}HIF_ACCESS_LOG;
+#endif
+
 #define HIF_MAX_DEVICES                 1
 
 struct htc_callbacks {
@@ -620,10 +629,12 @@ inline int HIFDiagWriteMem(HIF_DEVICE *hif_device, A_UINT32 address, A_UINT8 *da
 #define CONFIG_PCIE_ENABLE_L1_CLOCK_GATE 1
 
 /*
- * When CONFIG_ATH_PCIE_MAX_PERF is 0:
- * Set this to 1 to catch erroneous Target accesses during debug.
+ * PCIE_ACCESS_LOG_NUM specifies the number of
+ * read/write records to store
  */
-#define CONFIG_ATH_PCIE_ACCESS_DEBUG 0
+#ifdef CONFIG_ATH_PCIE_ACCESS_DEBUG
+#define PCIE_ACCESS_LOG_NUM 500
+#endif
 
 /* 64-bit MSI support */
 #define CONFIG_PCIE_64BIT_MSI 0
@@ -726,7 +737,7 @@ void WAR_PCI_WRITE32(char *addr, u32 offset, u32 value);
         do {unsigned long unused = (unsigned long)(targid); unused = unused;} while(0)
 #endif /* CONFIG_ATH_PCIE_ACCESS_LIKELY */
 
-#if CONFIG_ATH_PCIE_ACCESS_DEBUG
+#ifdef CONFIG_ATH_PCIE_ACCESS_DEBUG
 extern A_UINT32 HIFTargetReadChecked(A_target_id_t targid, A_UINT32 offset);
 extern void HIFTargetWriteChecked(A_target_id_t targid, A_UINT32 offset, A_UINT32 value);
 #define A_TARGET_READ(targid, offset)         HIFTargetReadChecked((targid), (offset))
diff --git a/CORE/SERVICES/COMMON/wma_api.h b/CORE/SERVICES/COMMON/wma_api.h
index 1bc500f100e1..1688bfb61db9 100644
--- a/CORE/SERVICES/COMMON/wma_api.h
+++ b/CORE/SERVICES/COMMON/wma_api.h
@@ -75,6 +75,9 @@ typedef enum {
     GEN_PARAM_DUMP_CHANINFO,
     GEN_PARAM_DUMP_WATCHDOG,
     GEN_PARAM_CRASH_INJECT,
+#ifdef CONFIG_ATH_PCIE_ACCESS_DEBUG
+    GEN_PARAM_DUMP_PCIE_ACCESS_LOG
+#endif
 } GEN_PARAM;
 
 #define VDEV_CMD 1
diff --git a/CORE/SERVICES/COMMON/wmi_unified.h b/CORE/SERVICES/COMMON/wmi_unified.h
index bd5496b00d4b..336b6ea97a85 100644
--- a/CORE/SERVICES/COMMON/wmi_unified.h
+++ b/CORE/SERVICES/COMMON/wmi_unified.h
@@ -3470,6 +3470,9 @@ typedef enum {
     * instead of waiting for the inactivity timeout. */
     WMI_VDEV_PARAM_TXSP_END_INACTIVITY_TIME_MS,
 
+    /** DTIM policy */
+    WMI_VDEV_PARAM_DTIM_POLICY,
+
 } WMI_VDEV_PARAM;
 
 /* Length of ATIM Window in TU */
diff --git a/CORE/SERVICES/HIF/PCIe/hif_pci.c b/CORE/SERVICES/HIF/PCIe/hif_pci.c
index 10f98bbfbd5f..69d87807c149 100644
--- a/CORE/SERVICES/HIF/PCIe/hif_pci.c
+++ b/CORE/SERVICES/HIF/PCIe/hif_pci.c
@@ -83,8 +83,11 @@ ATH_DEBUG_INSTANTIATE_MODULE_VAR(hif,
 #endif
 
 
-#if CONFIG_ATH_PCIE_ACCESS_DEBUG
+#ifdef CONFIG_ATH_PCIE_ACCESS_DEBUG
 spinlock_t pcie_access_log_lock;
+unsigned int pcie_access_log_seqnum = 0;
+HIF_ACCESS_LOG pcie_access_log[PCIE_ACCESS_LOG_NUM];
+static void HIFTargetDumpAccessLog(void);
 #endif
 
 /* Forward references */
@@ -103,6 +106,9 @@ static int hif_post_recv_buffers_for_pipe(struct HIF_CE_pipe_info *pipe_info);
 #define AGC_DUMP         1
 #define CHANINFO_DUMP    2
 #define BB_WATCHDOG_DUMP 3
+#ifdef CONFIG_ATH_PCIE_ACCESS_DEBUG
+#define PCIE_ACCESS_DUMP 4
+#endif
 /*
  * Fix EV118783, poll to check whether a BMI response comes
  * other than waiting for the interruption which may be lost.
@@ -182,10 +188,6 @@ int HIFInit(OSDRV_CALLBACKS *callbacks)
     HIF_osDrvcallback.deviceWakeupHandler = callbacks->deviceWakeupHandler;
     HIF_osDrvcallback.context = callbacks->context;
 
-#if CONFIG_ATH_PCIE_ACCESS_DEBUG
-    spin_lock_init(&pcie_access_log_lock);
-#endif
-
     AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("-%s\n",__FUNCTION__));
     return EOK;
 }
@@ -492,7 +494,9 @@ HIFPostInit(HIF_DEVICE *hif_device, void *unused, MSG_BASED_HIF_CALLBACKS *callb
     struct HIF_CE_state *hif_state = (struct HIF_CE_state *)hif_device;
 
     AR_DEBUG_PRINTF(ATH_DEBUG_TRC, ("+%s\n",__FUNCTION__));
-
+#ifdef CONFIG_ATH_PCIE_ACCESS_DEBUG
+    spin_lock_init(&pcie_access_log_lock);
+#endif
     /* Save callbacks for later installation */
     A_MEMCPY(&hif_state->msg_callbacks_pending, callbacks, sizeof(hif_state->msg_callbacks_pending));
 
@@ -1370,6 +1374,11 @@ void HIFDump(HIF_DEVICE *hif_device, u_int8_t cmd_id, bool start)
         priv_dump_bbwatchdog(sc);
         break;
 
+#ifdef CONFIG_ATH_PCIE_ACCESS_DEBUG
+    case PCIE_ACCESS_DUMP:
+        HIFTargetDumpAccessLog();
+        break;
+#endif
     default:
         AR_DEBUG_PRINTF(ATH_DEBUG_INFO, ("Invalid htc dump command\n"));
         break;
@@ -2520,7 +2529,7 @@ HIFTargetForcedAwake(A_target_id_t targid)
     return (awake && pcie_forced_awake);
 }
 
-#if CONFIG_ATH_PCIE_ACCESS_DEBUG
+#ifdef CONFIG_ATH_PCIE_ACCESS_DEBUG
 A_UINT32
 HIFTargetReadChecked(A_target_id_t targid, A_UINT32 offset)
 {
@@ -2580,7 +2589,40 @@ void
 HIFdebug(void)
 {
     /* BUG_ON(1); */
-    BREAK();
+//    BREAK();
+}
+
+void
+HIFTargetDumpAccessLog(void)
+{
+    int idx, len, start_idx, cur_idx;
+    unsigned long irq_flags;
+
+    spin_lock_irqsave(&pcie_access_log_lock, irq_flags);
+    if (pcie_access_log_seqnum > PCIE_ACCESS_LOG_NUM)
+    {
+        len = PCIE_ACCESS_LOG_NUM;
+        start_idx = pcie_access_log_seqnum % PCIE_ACCESS_LOG_NUM;
+    }
+    else
+    {
+        len = pcie_access_log_seqnum;
+        start_idx = 0;
+    }
+
+    for(idx = 0; idx < len; idx++)
+    {
+        cur_idx = (start_idx + idx) % PCIE_ACCESS_LOG_NUM;
+        printk("idx:%d\t sn:%u wr:%d addr:%p val:%u.\n",
+               idx,
+               pcie_access_log[cur_idx].seqnum,
+               pcie_access_log[cur_idx].is_write,
+               pcie_access_log[cur_idx].addr,
+               pcie_access_log[cur_idx].value);
+    }
+
+    pcie_access_log_seqnum = 0;
+    spin_unlock_irqrestore(&pcie_access_log_lock, irq_flags);
 }
 #endif
 
diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c
index 5cf851e2d444..c7168c00cac1 100644
--- a/CORE/SERVICES/WMA/wma.c
+++ b/CORE/SERVICES/WMA/wma.c
@@ -133,6 +133,9 @@
 #define AGC_DUMP  1
 #define CHAN_DUMP 2
 #define WD_DUMP   3
+#ifdef CONFIG_ATH_PCIE_ACCESS_DEBUG
+#define PCIE_DUMP 4
+#endif
 
 /* conformance test limits */
 #define FCC       0x10
@@ -8466,6 +8469,11 @@ static void wma_process_cli_set_cmd(tp_wma_handle wma,
 		case GEN_PARAM_CRASH_INJECT:
 			ret = wmi_crash_inject(wma->wmi_handle, privcmd->param_value);
 			break;
+#ifdef CONFIG_ATH_PCIE_ACCESS_DEBUG
+		case GEN_PARAM_DUMP_PCIE_ACCESS_LOG:
+			HTCDump(wma->htc_handle, PCIE_DUMP, false);
+			break;
+#endif
 		default:
 			WMA_LOGE("Invalid param id 0x%x", privcmd->param_id);
 			break;
diff --git a/CORE/SYS/legacy/src/system/src/sysEntryFunc.c b/CORE/SYS/legacy/src/system/src/sysEntryFunc.c
index 7c7ccc981e83..1284dfcb5563 100644
--- a/CORE/SYS/legacy/src/system/src/sysEntryFunc.c
+++ b/CORE/SYS/legacy/src/system/src/sysEntryFunc.c
@@ -60,6 +60,7 @@ postPTTMsgApi(tpAniSirGlobal pMac, tSirMsgQ *pMsg);
 #include "vos_types.h"
 #include "vos_packet.h"
 
+#define MAX_DEAUTH_ALLOWED 20
 // ---------------------------------------------------------------------------
 /**
  * sysInitGlobals
@@ -134,6 +135,8 @@ sysBbtProcessMessageCore(tpAniSirGlobal pMac, tpSirMsgQ pMsg, tANI_U32 type,
 
     if(type == SIR_MAC_MGMT_FRAME)
     {
+            if ((subType == SIR_MAC_MGMT_DEAUTH) && (pMac->sys.gSysFrameCount[type][subType] >= MAX_DEAUTH_ALLOWED))
+                goto fail;
 
             if( (dropReason = limIsPktCandidateForDrop(pMac, pBd, subType)) != eMGMT_DROP_NO_DROP)
             {
diff --git a/CORE/VOSS/inc/wcnss_api.h b/CORE/VOSS/inc/wcnss_api.h
index 9add2c7fa5d5..2a49826bc7d7 100644
--- a/CORE/VOSS/inc/wcnss_api.h
+++ b/CORE/VOSS/inc/wcnss_api.h
@@ -88,6 +88,45 @@ static inline unsigned int wcnss_get_serial_number(void)
         return 0;
 }
 
+#if !defined(CONFIG_CNSS) && !defined(HIF_USB) && !defined(HIF_SDIO)
+static inline void *wcnss_wlan_crypto_alloc_ahash(const char *alg_name,
+                                                  unsigned int type,
+                                                  unsigned int mask)
+{
+        return NULL;
+}
+
+static inline int wcnss_wlan_crypto_ahash_digest(void *req)
+{
+        return 0;
+}
+
+static inline void wcnss_wlan_crypto_free_ahash(void *tfm)
+{
+}
+
+static inline int wcnss_wlan_crypto_ahash_setkey(void *tfm,
+                                                 const u8 *key,
+                                                 unsigned int keylen)
+{
+        return 0;
+}
+
+static inline void *wcnss_wlan_crypto_alloc_ablkcipher(const char *alg_name,
+                                                       u32 type, u32 mask)
+{
+        return NULL;
+}
+
+static inline void wcnss_wlan_ablkcipher_request_free(void *req)
+{
+}
+
+static inline void wcnss_wlan_crypto_free_ablkcipher(void *tfm)
+{
+}
+#endif /* !CONFIG_CNSS */
+
 static inline int req_riva_power_on_lock(char *driver_name)
 {
         return 0;
diff --git a/CORE/VOSS/src/vos_utils.c b/CORE/VOSS/src/vos_utils.c
index 6786f8884bb3..e34b77f9978f 100644
--- a/CORE/VOSS/src/vos_utils.c
+++ b/CORE/VOSS/src/vos_utils.c
@@ -96,6 +96,7 @@
    Function Definitions and Documentation
  * -------------------------------------------------------------------------*/
 #ifndef CONFIG_CNSS
+#if defined(WLAN_FEATURE_11W) && (defined(HIF_USB) || defined(HIF_SDIO))
 #define CMAC_TLEN 8 /* CMAC TLen = 64 bits (8 octets) */
 
 static inline void xor_128(const u8 *a, const u8 *b, u8 *out)
@@ -200,6 +201,7 @@ void cmac_calc_mic(struct crypto_cipher *tfm, u8 *m,
         memcpy(mac, x, CMAC_TLEN);
 }
 #endif
+#endif
 
 /*--------------------------------------------------------------------------
 
@@ -396,7 +398,8 @@ vos_attach_mmie(v_U8_t *igtk, v_U8_t *ipn, u_int16_t key_id,
     /*
      * Calculate MIC and then copy
      */
-#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS)
+#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS) && \
+(defined(HIF_USB) || defined(HIF_SDIO))
     tfm = crypto_alloc_cipher( "aes", 0, CRYPTO_ALG_ASYNC);
 #else
     tfm = wcnss_wlan_crypto_alloc_cipher( "aes", 0, CRYPTO_ALG_ASYNC);
@@ -451,7 +454,8 @@ vos_attach_mmie(v_U8_t *igtk, v_U8_t *ipn, u_int16_t key_id,
                 (v_U8_t*)(efrm-(frmLen-sizeof(struct ieee80211_frame))),
                 nBytes - AAD_LEN - CMAC_TLEN);
 
-#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS)
+#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS) && \
+(defined(HIF_USB) || defined(HIF_SDIO))
     cmac_calc_mic(tfm, input, nBytes, mic);
 #else
     wcnss_wlan_cmac_calc_mic(tfm, input, nBytes, mic);
@@ -472,7 +476,8 @@ err_tfm:
     }
 
     if (tfm)
-#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS)
+#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS) && \
+(defined(HIF_USB) || defined(HIF_SDIO))
        crypto_free_cipher(tfm);
 #else
        wcnss_wlan_crypto_free_cipher(tfm);
@@ -521,7 +526,8 @@ v_BOOL_t vos_is_mmie_valid(v_U8_t *igtk, v_U8_t *ipn,
         return VOS_FALSE;
     }
 
-#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS)
+#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS) && \
+(defined(HIF_USB) || defined(HIF_SDIO))
     tfm = crypto_alloc_cipher( "aes", 0, CRYPTO_ALG_ASYNC);
 #else
     tfm = wcnss_wlan_crypto_alloc_cipher( "aes", 0, CRYPTO_ALG_ASYNC);
@@ -569,7 +575,8 @@ v_BOOL_t vos_is_mmie_valid(v_U8_t *igtk, v_U8_t *ipn,
     vos_mem_copy(input, aad, AAD_LEN);
     vos_mem_copy(input+AAD_LEN, (v_U8_t*)(wh+1), nBytes - AAD_LEN - CMAC_TLEN);
 
-#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS)
+#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS) && \
+(defined(HIF_USB) || defined(HIF_SDIO))
     cmac_calc_mic(tfm, input, nBytes, mic);
 #else
     wcnss_wlan_cmac_calc_mic(tfm, input, nBytes, mic);
@@ -599,7 +606,8 @@ v_BOOL_t vos_is_mmie_valid(v_U8_t *igtk, v_U8_t *ipn,
 
 err_tfm:
     if (tfm)
-#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS)
+#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS) && \
+(defined(HIF_USB) || defined(HIF_SDIO))
         crypto_free_cipher(tfm);
 #else
         wcnss_wlan_crypto_free_cipher(tfm);
@@ -663,7 +671,8 @@ int hmac_sha1(v_U8_t *key, v_U8_t ksize, char *plaintext, v_U8_t psize,
 
     init_completion(&tresult.completion);
 
-#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS)
+#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS) && \
+(defined(HIF_USB) || defined(HIF_SDIO))
     tfm = crypto_alloc_ahash("hmac(sha1)", CRYPTO_ALG_TYPE_AHASH,
                                         CRYPTO_ALG_TYPE_AHASH_MASK);
 #else
@@ -699,7 +708,8 @@ int hmac_sha1(v_U8_t *key, v_U8_t ksize, char *plaintext, v_U8_t psize,
 
     if (ksize) {
         crypto_ahash_clear_flags(tfm, ~0);
-#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS)
+#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS) && \
+(defined(HIF_USB) || defined(HIF_SDIO))
         ret = crypto_ahash_setkey(tfm, key, ksize);
 #else
         ret = wcnss_wlan_crypto_ahash_setkey(tfm, key, ksize);
@@ -712,7 +722,8 @@ int hmac_sha1(v_U8_t *key, v_U8_t ksize, char *plaintext, v_U8_t psize,
     }
 
     ahash_request_set_crypt(req, &sg, hash_result, psize);
-#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS)
+#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS) && \
+(defined(HIF_USB) || defined(HIF_SDIO))
     ret = crypto_ahash_digest(req);
 #else
     ret = wcnss_wlan_crypto_ahash_digest(req);
@@ -746,7 +757,8 @@ err_setkey:
 err_hash_buf:
     ahash_request_free(req);
 err_req:
-#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS)
+#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS) && \
+(defined(HIF_USB) || defined(HIF_SDIO))
     crypto_free_ahash(tfm);
 #else
     wcnss_wlan_crypto_free_ahash(tfm);
@@ -834,7 +846,8 @@ int hmac_md5(v_U8_t *key, v_U8_t ksize, char *plaintext, v_U8_t psize,
 
     init_completion(&tresult.completion);
 
-#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS)
+#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS) && \
+(defined(HIF_USB) || defined(HIF_SDIO))
     tfm = crypto_alloc_ahash("hmac(md5)", CRYPTO_ALG_TYPE_AHASH,
                                         CRYPTO_ALG_TYPE_AHASH_MASK);
 #else
@@ -870,7 +883,8 @@ int hmac_md5(v_U8_t *key, v_U8_t ksize, char *plaintext, v_U8_t psize,
 
     if (ksize) {
         crypto_ahash_clear_flags(tfm, ~0);
-#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS)
+#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS) && \
+(defined(HIF_USB) || defined(HIF_SDIO))
         ret = crypto_ahash_setkey(tfm, key, ksize);
 #else
         ret = wcnss_wlan_crypto_ahash_setkey(tfm, key, ksize);
@@ -882,7 +896,8 @@ int hmac_md5(v_U8_t *key, v_U8_t ksize, char *plaintext, v_U8_t psize,
     }
 
     ahash_request_set_crypt(req, &sg, hash_result, psize);
-#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS)
+#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS) && \
+(defined(HIF_USB) || defined(HIF_SDIO))
     ret = crypto_ahash_digest(req);
 #else
     ret = wcnss_wlan_crypto_ahash_digest(req);
@@ -917,7 +932,8 @@ err_setkey:
 err_hash_buf:
         ahash_request_free(req);
 err_req:
-#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS)
+#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS) && \
+(defined(HIF_USB) || defined(HIF_SDIO))
         crypto_free_ahash(tfm);
 #else
         wcnss_wlan_crypto_free_ahash(tfm);
@@ -1010,7 +1026,8 @@ VOS_STATUS vos_encrypt_AES(v_U32_t cryptHandle, /* Handle */
 
     init_completion(&result.completion);
 
-#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS)
+#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS) && \
+(defined(HIF_USB) || defined(HIF_SDIO))
     tfm =  crypto_alloc_ablkcipher( "cbc(aes)", 0, 0);
 #else
     tfm =  wcnss_wlan_crypto_alloc_ablkcipher( "cbc(aes)", 0, 0);
@@ -1054,13 +1071,15 @@ VOS_STATUS vos_encrypt_AES(v_U32_t cryptHandle, /* Handle */
 
 // -------------------------------------
 err_setkey:
-#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS)
+#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS) && \
+(defined(HIF_USB) || defined(HIF_SDIO))
     ablkcipher_request_free(req);
 #else
     wcnss_wlan_ablkcipher_request_free(req);
 #endif
 err_req:
-#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS)
+#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS) && \
+(defined(HIF_USB) || defined(HIF_SDIO))
     crypto_free_ablkcipher(tfm);
 #else
     wcnss_wlan_crypto_free_ablkcipher(tfm);
@@ -1118,7 +1137,8 @@ VOS_STATUS vos_decrypt_AES(v_U32_t cryptHandle, /* Handle */
 
     init_completion(&result.completion);
 
-#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS)
+#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS) && \
+(defined(HIF_USB) || defined(HIF_SDIO))
     tfm =  crypto_alloc_ablkcipher( "cbc(aes)", 0, 0);
 #else
     tfm =  wcnss_wlan_crypto_alloc_ablkcipher( "cbc(aes)", 0, 0);
@@ -1162,13 +1182,15 @@ VOS_STATUS vos_decrypt_AES(v_U32_t cryptHandle, /* Handle */
 
 // -------------------------------------
 err_setkey:
-#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS)
+#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS) && \
+(defined(HIF_USB) || defined(HIF_SDIO))
     ablkcipher_request_free(req);
 #else
     wcnss_wlan_ablkcipher_request_free(req);
 #endif
 err_req:
-#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS)
+#if !defined(QCA_WIFI_ISOC) && !defined(CONFIG_CNSS) && \
+(defined(HIF_USB) || defined(HIF_SDIO))
     crypto_free_ablkcipher(tfm);
 #else
     wcnss_wlan_crypto_free_ablkcipher(tfm);
diff --git a/Kbuild b/Kbuild
index d8d4616e4c6b..ea107822465f 100644
--- a/Kbuild
+++ b/Kbuild
@@ -181,6 +181,9 @@ CONFIG_CHECKSUM_OFFLOAD := 1
 
 #Enable GTK offload
 CONFIG_GTK_OFFLOAD := 1
+
+#Set this to 1 to catch erroneous Target accesses during debug.
+CONFIG_ATH_PCIE_ACCESS_DEBUG := 0
 endif
 
 #Enable IPA offload
@@ -1313,6 +1316,10 @@ ifeq ($(CONFIG_TARGET_RAMDUMP_AFTER_KERNEL_PANIC), 1)
 CDEFINES += -DTARGET_RAMDUMP_AFTER_KERNEL_PANIC
 endif
 
+ifeq ($(CONFIG_ATH_PCIE_ACCESS_DEBUG), 1)
+CDEFINES += -DCONFIG_ATH_PCIE_ACCESS_DEBUG
+endif
+
 # Some kernel include files are being moved.  Check to see if
 # the old version of the files are present