Merge "qcacmn: Possible information leak due to uninitialized data"

dp/inc/cdp_txrx_host_stats.h

@@ -167,7 +167,7 @@ cdp_disable_enhanced_stats(ol_txrx_soc_handle soc, struct cdp_pdev *pdev)
  * @brief Get the desired stats from the message.
  *
  * @param pdev - the physical device object
- * @param stats_base - stats buffer recieved from FW
+ * @param stats_base - stats buffer received from FW
  * @param type - stats type.
  * @return - pointer to requested stat identified by type
  */
@@ -416,7 +416,7 @@ static inline void cdp_get_dp_htt_stats(ol_txrx_soc_handle soc,
  * @brief Parse the stats header and get the payload from the message.
  *
  * @param pdev - the physical device object
- * @param msg_word - stats buffer recieved from FW
+ * @param msg_word - stats buffer received from FW
  * @param msg_len - length of the message
  * @param type - place holder for parsed message type
  * @param status - place holder for parsed message status

dp/inc/cdp_txrx_ops.h

@@ -611,7 +611,7 @@ struct cdp_host_stats_ops {
 	 * @brief Get the desired stats from the message.
 	 *
 	 * @param pdev - the physical device object
-	 * @param stats_base - stats buffer recieved from FW
+	 * @param stats_base - stats buffer received from FW
 	 * @param type - stats type.
 	 * @return - pointer to requested stat identified by type
 	 */

dp/inc/cdp_txrx_stats_struct.h

@@ -510,9 +510,9 @@ struct cdp_htt_tx_pdev_stats_cmn_tlv {
     uint32_t mpdu_dropped_xretry;
     /* illegal rate phy errors  */
     uint32_t illgl_rate_phy_err;
-    /* wal pdev continous xretry */
+    /* wal pdev continuous xretry */
     uint32_t cont_xretry;
-    /* wal pdev continous xretry */
+    /* wal pdev continuous xretry */
     uint32_t tx_timeout;
     /* wal pdev resets  */
     uint32_t pdev_resets;
@@ -1120,9 +1120,9 @@ enum _ol_ath_param_t {
 	/* firmware should intimate us about ps state change for node  */
 	OL_ATH_PARAM_PS_STATE_CHANGE = 200,
 	OL_ATH_PARAM_MCAST_BCAST_ECHO,
-	/* OBSS RSSI threshold for 20/40 coexistance */
+	/* OBSS RSSI threshold for 20/40 coexistence */
 	OL_ATH_PARAM_OBSS_RSSI_THRESHOLD,
-	/* Link/node RX RSSI threshold  for 20/40 coexistance */
+	/* Link/node RX RSSI threshold  for 20/40 coexistence */
 	OL_ATH_PARAM_OBSS_RX_RSSI_THRESHOLD,
 #if ATH_CHANNEL_BLOCKING
 	OL_ATH_PARAM_ACS_BLOCK_MODE = 205,

dp/wifi3.0/dp_internal.h

@@ -23,6 +23,9 @@
 
 #define RX_BUFFER_SIZE_PKTLOG_LITE 1024
 
+/* Macro For NYSM value received in VHT TLV */
+#define VHT_SGI_NYSM 3
+
 #if DP_PRINT_ENABLE
 #include <stdarg.h>       /* va_list */
 #include <qdf_types.h> /* qdf_vprint */
@@ -277,6 +280,7 @@ while (0)
 		DP_STATS_AGGR_PKT(_tgtobj, _srcobj, tx.mcast); \
 		DP_STATS_AGGR_PKT(_tgtobj, _srcobj, tx.bcast); \
 		DP_STATS_AGGR_PKT(_tgtobj, _srcobj, tx.tx_success); \
+		DP_STATS_AGGR_PKT(_tgtobj, _srcobj, tx.nawds_mcast); \
 		DP_STATS_AGGR(_tgtobj, _srcobj, tx.tx_failed); \
 		DP_STATS_AGGR(_tgtobj, _srcobj, tx.ofdma); \
 		DP_STATS_AGGR(_tgtobj, _srcobj, tx.stbc); \

dp/wifi3.0/dp_main.c

@@ -3653,7 +3653,7 @@ static void dp_peer_setup_wifi3(struct cdp_vdev *vdev_hdl, void *peer_hdl)
 		pdev->pdev_id, hash_based);
 
 	/*
-	 * Below line of code will ensure the proper reo_dest ring is choosen
+	 * Below line of code will ensure the proper reo_dest ring is chosen
 	 * for cases where toeplitz hash cannot be generated (ex: non TCP/UDP)
 	 */
 	reo_dest = pdev->reo_dest;
@@ -4771,7 +4771,7 @@ void dp_peer_set_mesh_rx_filter(struct cdp_vdev *vdev_hdl, uint32_t val)
 
 /*
  * dp_aggregate_pdev_ctrl_frames_stats()- function to agreegate peer stats
- * Current scope is bar recieved count
+ * Current scope is bar received count
  *
  * @pdev_handle: DP_PDEV handle
  *

dp/wifi3.0/dp_peer.c

@@ -396,7 +396,7 @@ static inline void dp_peer_map_ast(struct dp_soc *soc,
  * @mac_addr: MAC address of ast node
  * @is_self: Is this base AST entry with peer mac address
  *
- * This API is used by WDS source port learning funtion to
+ * This API is used by WDS source port learning function to
  * add a new AST entry into peer AST list
  *
  * Return: 0 if new entry is allocated,
@@ -1656,7 +1656,7 @@ void dp_addba_responsesetup_wifi3(void *peer_handle, uint8_t tid,
 	struct dp_rx_tid *rx_tid = &peer->rx_tid[tid];
 
 	rx_tid->num_of_addba_resp++;
-	/* setup ADDBA response paramters */
+	/* setup ADDBA response parameters */
 	*dialogtoken = rx_tid->dialogtoken;
 	*statuscode = rx_tid->statuscode;
 	*buffersize = rx_tid->ba_win_size;

dp/wifi3.0/dp_rx.c

@@ -257,6 +257,8 @@ dp_rx_deliver_raw(struct dp_vdev *vdev, qdf_nbuf_t nbuf_list,
 
 		DP_RX_LIST_APPEND(deliver_list_head, deliver_list_tail, nbuf);
 
+		DP_STATS_INC(vdev->pdev, rx_raw_pkts, 1);
+		DP_STATS_INC_PKT(peer, rx.raw, 1, qdf_nbuf_len(nbuf));
 		/*
 		 * reset the chfrag_start and chfrag_end bits in nbuf cb
 		 * as this is a non-amsdu pkt and RAW mode simulation expects
@@ -1519,6 +1521,7 @@ done:
 				htt_cmn_pkt_type_raw)) {
 
 			DP_STATS_INC(vdev->pdev, rx_raw_pkts, 1);
+			DP_STATS_INC_PKT(peer, rx.raw, 1, qdf_nbuf_len(nbuf));
 
 			nbuf = dp_rx_sg_create(nbuf, rx_tlv_hdr);
 			next = nbuf->next;

dp/wifi3.0/dp_rx.h

@@ -247,8 +247,16 @@ void *dp_rx_cookie_2_va_rxdma_buf(struct dp_soc *soc, uint32_t cookie)
 {
 	uint8_t pool_id = DP_RX_DESC_COOKIE_POOL_ID_GET(cookie);
 	uint16_t index = DP_RX_DESC_COOKIE_INDEX_GET(cookie);
-	/* TODO */
-	/* Add sanity for pool_id & index */
+	struct rx_desc_pool *rx_desc_pool;
+
+	if (qdf_unlikely(pool_id >= MAX_RXDESC_POOLS))
+		return NULL;
+
+	rx_desc_pool = &soc->rx_desc_buf[pool_id];
+
+	if (qdf_unlikely(index >= rx_desc_pool->pool_size))
+		return NULL;
+
 	return &(soc->rx_desc_buf[pool_id].array[index].rx_desc);
 }
 

dp/wifi3.0/dp_rx_defrag.c

@@ -1306,7 +1306,7 @@ static QDF_STATUS dp_rx_defrag_store_fragment(struct dp_soc *soc,
 	peer = dp_peer_find_by_id(soc, peer_id);
 
 	if (!peer) {
-		/* We should not recieve anything from unknown peer
+		/* We should not receive anything from unknown peer
 		 * however, that might happen while we are in the monitor mode.
 		 * We don't need to handle that here
 		 */

dp/wifi3.0/dp_rx_mon_dest.c

@@ -615,7 +615,7 @@ mpdu_stitch_done:
 	/* Check if this buffer contains the PPDU end status for TSF */
 	/* Need revist this code to see where we can get tsf timestamp */
 #if 0
-	/* PPDU end TLV will be retrived from monitor status ring */
+	/* PPDU end TLV will be retrieved from monitor status ring */
 	last_mpdu =
 		(*(((u_int32_t *)&rx_desc->attention)) &
 		RX_ATTENTION_0_LAST_MPDU_MASK) >>

dp/wifi3.0/dp_rx_mon_status.c

@@ -60,7 +60,11 @@ dp_rx_populate_cdp_indication_ppdu(struct dp_pdev *pdev,
 	cdp_rx_ppdu->other_msdu_count = ppdu_info->rx_status.other_msdu_count;
 	cdp_rx_ppdu->u.nss = ppdu_info->rx_status.nss;
 	cdp_rx_ppdu->u.mcs = ppdu_info->rx_status.mcs;
-	cdp_rx_ppdu->u.gi = ppdu_info->rx_status.sgi;
+	if ((ppdu_info->rx_status.sgi == VHT_SGI_NYSM) &&
+		(ppdu_info->rx_status.preamble_type == HAL_RX_PKT_TYPE_11AC))
+		cdp_rx_ppdu->u.gi = CDP_SGI_0_4_US;
+	else
+		cdp_rx_ppdu->u.gi = ppdu_info->rx_status.sgi;
 	cdp_rx_ppdu->u.ldpc = ppdu_info->rx_status.ldpc;
 	cdp_rx_ppdu->u.preamble = ppdu_info->rx_status.preamble_type;
 	cdp_rx_ppdu->u.ppdu_type = ppdu_info->rx_status.reception_type;

dp/wifi3.0/dp_tx.c

@@ -2542,12 +2542,11 @@ static void dp_tx_update_peer_stats(struct dp_peer *peer,
 
 	if (peer->bss_peer) {
 		DP_STATS_INC_PKT(peer, tx.mcast, 1, length);
-		DP_STATS_INC_PKT(peer, tx.tx_success, 1, length);
 	} else {
 		if (ts->status == HAL_TX_TQM_RR_FRAME_ACKED) {
-			DP_STATS_INC_PKT(peer, tx.ucast, 1, length);
 			DP_STATS_INC_PKT(peer, tx.tx_success, 1, length);
 		}
+		DP_STATS_INC_PKT(peer, tx.ucast, 1, length);
 	}
 
 	DP_STATS_INCC(peer, tx.dropped.age_out, 1,
@@ -3333,7 +3332,7 @@ static void dp_tx_me_mem_free(struct dp_pdev *pdev,
 }
 
 /**
- * dp_tx_me_send_convert_ucast(): fuction to convert multicast to unicast
+ * dp_tx_me_send_convert_ucast(): function to convert multicast to unicast
  * @vdev: DP VDEV handle
  * @nbuf: Multicast nbuf
  * @newmac: Table of the clients to which packets have to be sent

dp/wifi3.0/dp_wdi_event.c

@@ -63,7 +63,7 @@ dp_wdi_event_del_subs(wdi_event_subscribe *wdi_sub, int event_index)
 
 /*
  * dp_wdi_event_iter_sub() - Iterate through all WDI event in the list
- * and pass WDI event to callback funtion
+ * and pass WDI event to callback function
  * @pdev: DP pdev handle
  * @event_index: Event index in list
  * @wdi_event: WDI event handle

dp/wifi3.0/hal_rx.h

@@ -1687,7 +1687,7 @@ hal_rx_mpdu_get_fr_ds(uint8_t *buf)
  *
  * @buf: pointer to the start of RX PKT TLV headera
  * @mac_addr: pointer to mac address
- * Return: sucess/failure
+ * Return: success/failure
  */
 static inline
 QDF_STATUS hal_rx_mpdu_get_addr1(uint8_t *buf, uint8_t *mac_addr)
@@ -1722,7 +1722,7 @@ QDF_STATUS hal_rx_mpdu_get_addr1(uint8_t *buf, uint8_t *mac_addr)
  *
  * @buf: pointer to the start of RX PKT TLV header
  * @mac_addr: pointer to mac address
- * Return: sucess/failure
+ * Return: success/failure
  */
 static inline
 QDF_STATUS hal_rx_mpdu_get_addr2(uint8_t *buf, uint8_t *mac_addr)
@@ -1757,7 +1757,7 @@ QDF_STATUS hal_rx_mpdu_get_addr2(uint8_t *buf, uint8_t *mac_addr)
  *
  * @buf: pointer to the start of RX PKT TLV header
  * @mac_addr: pointer to mac address
- * Return: sucess/failure
+ * Return: success/failure
  */
 static inline
 QDF_STATUS hal_rx_mpdu_get_addr3(uint8_t *buf, uint8_t *mac_addr)
@@ -1792,7 +1792,7 @@ QDF_STATUS hal_rx_mpdu_get_addr3(uint8_t *buf, uint8_t *mac_addr)
  *
  * @buf: pointer to the start of RX PKT TLV header
  * @mac_addr: pointer to mac address
- * Return: sucess/failure
+ * Return: success/failure
  */
 static inline
 QDF_STATUS hal_rx_mpdu_get_addr4(uint8_t *buf, uint8_t *mac_addr)

global_lmac_if/src/wlan_global_lmac_if.c

@@ -43,7 +43,7 @@ qdf_export_symbol(wlan_lmac_if_sptrl_set_rx_ops_register_cb);
 #endif /* WLAN_CONV_SPECTRAL_ENABLE */
 
 /*
- * spectral scan is built as seperate .ko for WIN where
+ * spectral scan is built as separate .ko for WIN where
  * MCL it is part of wlan.ko so the registration of
 .* rx ops to global lmac if layer is different between WIN
  * and MCL

hal/wifi3.0/hal_api_mon.h

@@ -477,7 +477,7 @@ hal_rx_status_get_next_tlv(uint8_t *rx_tlv) {
 	tlv_len = HAL_RX_GET_USER_TLV32_LEN(rx_tlv);
 	tlv_tag = HAL_RX_GET_USER_TLV32_TYPE(rx_tlv);
 
-	/* The actual length of PPDU_END is the combined lenght of many PHY
+	/* The actual length of PPDU_END is the combined length of many PHY
 	 * TLVs that follow. Skip the TLV header and
 	 * rx_rxpcu_classification_overview that follows the header to get to
 	 * next TLV.

hal/wifi3.0/hal_srng.c

@@ -34,7 +34,7 @@
 
 /**
  * Common SRNG register access macros:
- * The SRNG registers are distributed accross various UMAC and LMAC HW blocks,
+ * The SRNG registers are distributed across various UMAC and LMAC HW blocks,
  * but the register group and format is exactly same for all rings, with some
  * difference between producer rings (these are 'producer rings' with respect
  * to HW and refered as 'destination rings' in SW) and consumer rings (these

hif/src/ce/ce_assignment.h

@@ -343,7 +343,7 @@ static struct CE_attr host_ce_config_wlan_ar9888[] = {
 	/* host->target HTT */
 	{ /* CE4 */ CE_ATTR_FLAGS | CE_ATTR_DISABLE_INTR, 0,
 		CE_HTT_H2T_MSG_SRC_NENTRIES_AR900B, 256, 0, NULL, },
-#if WLAN_FEATURE_FASTPATH
+#ifdef WLAN_FEATURE_FASTPATH
 	/* target->host HTT messages */
 	{ /* CE5 */ CE_ATTR_FLAGS, 0, 0, 512, 512, NULL, },
 #else   /* WLAN_FEATURE_FASTPATH */
@@ -371,7 +371,7 @@ static struct CE_attr host_ce_config_wlan_ar900b[] = {
 	/* host->target HTT */
 	{ /* CE4 */ CE_ATTR_FLAGS | CE_ATTR_DISABLE_INTR, 0,
 		CE_HTT_H2T_MSG_SRC_NENTRIES_AR900B, 256, 0, NULL, },
-#if WLAN_FEATURE_FASTPATH
+#ifdef WLAN_FEATURE_FASTPATH
 	/* target->host HTT messages */
 	{ /* CE5 */ CE_ATTR_FLAGS, 0, 0, 512, 512, NULL, },
 #else   /* WLAN_FEATURE_FASTPATH */
@@ -396,7 +396,7 @@ static struct CE_attr host_lowdesc_ce_cfg_wlan_ar9888[] = {
 	/* host->target HTC control and raw streams */
 	{ /* CE0 */ CE_ATTR_FLAGS, 0, 16, 256, 0, NULL, },
 	/* could be moved to share CE3 */
-#if WLAN_FEATURE_FASTPATH
+#ifdef WLAN_FEATURE_FASTPATH
 	/* target->host BMI + HTC control */
 	{ /* CE1 */ CE_ATTR_FLAGS, 0, 0, 512, 64, NULL, },
 #else
@@ -410,7 +410,7 @@ static struct CE_attr host_lowdesc_ce_cfg_wlan_ar9888[] = {
 	/* host->target HTT */
 	{ /* CE4 */ CE_ATTR_FLAGS | CE_ATTR_DISABLE_INTR, 0,
 		CE_HTT_H2T_MSG_SRC_NENTRIES_AR900B, 256, 0, NULL, },
-#if WLAN_FEATURE_FASTPATH
+#ifdef WLAN_FEATURE_FASTPATH
 	/* target->host HTT messages */
 	{ /* CE5 */ CE_ATTR_FLAGS, 0, 0, 512, 512, NULL, },
 #else   /* WLAN_FEATURE_FASTPATH */
@@ -429,7 +429,7 @@ static struct CE_attr host_lowdesc_ce_cfg_wlan_ar900b[] = {
 	/* host->target HTC control and raw streams */
 	{ /* CE0 */ CE_ATTR_FLAGS, 0, 16, 256, 0, NULL, },
 	/* could be moved to share CE3 */
-#if WLAN_FEATURE_FASTPATH
+#ifdef WLAN_FEATURE_FASTPATH
 	/* target->host BMI + HTC control */
 	{ /* CE1 */ CE_ATTR_FLAGS, 0, 0, 512, 64, NULL, },
 #else
@@ -443,7 +443,7 @@ static struct CE_attr host_lowdesc_ce_cfg_wlan_ar900b[] = {
 	/* host->target HTT */
 	{ /* CE4 */ CE_ATTR_FLAGS | CE_ATTR_DISABLE_INTR, 0,
 		CE_HTT_H2T_MSG_SRC_NENTRIES_AR900B, 256, 0, NULL, },
-#if WLAN_FEATURE_FASTPATH
+#ifdef WLAN_FEATURE_FASTPATH
 	/* target->host HTT messages */
 	{ /* CE5 */ CE_ATTR_FLAGS, 0, 0, 512, 512, NULL, },
 #else   /* WLAN_FEATURE_FASTPATH */
@@ -468,7 +468,7 @@ static struct CE_attr host_lowdesc_ce_cfg_wlan_ar900b_nopktlog[] = {
 	/* host->target HTC control and raw streams */
 	{ /* CE0 */ CE_ATTR_FLAGS, 0, 16, 256, 0, NULL, },
 	/* could be moved to share CE3 */
-#if WLAN_FEATURE_FASTPATH
+#ifdef WLAN_FEATURE_FASTPATH
 	/* target->host BMI + HTC control */
 	{ /* CE1 */ CE_ATTR_FLAGS, 0, 0, 512, 64, NULL, },
 #else
@@ -482,7 +482,7 @@ static struct CE_attr host_lowdesc_ce_cfg_wlan_ar900b_nopktlog[] = {
 	/* host->target HTT */
 	{ /* CE4 */ CE_ATTR_FLAGS | CE_ATTR_DISABLE_INTR, 0,
 		CE_HTT_H2T_MSG_SRC_NENTRIES_AR900B, 256, 0, NULL, },
-#if WLAN_FEATURE_FASTPATH
+#ifdef WLAN_FEATURE_FASTPATH
 	/* target->host HTT messages */
 	{ /* CE5 */ CE_ATTR_FLAGS, 0, 0, 512, 512, NULL, },
 #else   /* WLAN_FEATURE_FASTPATH */
@@ -515,7 +515,7 @@ static struct CE_pipe_config target_ce_config_wlan_ar9888[] = {
 	/* host->target HTT */
 	{ /* CE4 */ 4, PIPEDIR_OUT, 256, 256, CE_ATTR_FLAGS, 0, },
 	/* NB: 50% of src nentries, since tx has 2 frags */
-#if WLAN_FEATURE_FASTPATH
+#ifdef WLAN_FEATURE_FASTPATH
 	/* target->host HTT */
 	{ /* CE5 */ 5, PIPEDIR_IN, 32, 512, CE_ATTR_FLAGS, 0, },
 #else
@@ -539,7 +539,7 @@ static struct CE_pipe_config target_ce_config_wlan_ar900b[] = {
 	/* host->target HTT */
 	{ /* CE4 */ 4, PIPEDIR_OUT, 256, 256, CE_ATTR_FLAGS, 0, },
 	/* NB: 50% of src nentries, since tx has 2 frags */
-#if WLAN_FEATURE_FASTPATH
+#ifdef WLAN_FEATURE_FASTPATH
 	/* target->host HTT */
 	{ /* CE5 */ 5, PIPEDIR_IN, 32, 512, CE_ATTR_FLAGS, 0, },
 #else

hif/src/ce/ce_main.c

@@ -541,7 +541,7 @@ static struct service_to_pipe target_service_to_ce_map_ar900b[] = {
 		PIPEDIR_OUT,    /* out = UL = host -> target */
 		4,
 	},
-#if WLAN_FEATURE_FASTPATH
+#ifdef WLAN_FEATURE_FASTPATH
 	{
 		HTT_DATA_MSG_SVC,
 		PIPEDIR_IN,     /* in = DL = target -> host */
@@ -1849,7 +1849,7 @@ hif_pci_ce_send_done(struct CE_handle *copyeng, void *ce_context,
  * @nbytes: number of bytes in the message
  * @pipe_info: used for the pipe_number info
  *
- * Checks the packet length, configures the lenght in the netbuff,
+ * Checks the packet length, configures the length in the netbuff,
  * and calls the upper layer callback.
  *
  * return: None

hif/src/ce/ce_service.c

@@ -321,7 +321,7 @@ bool hif_ce_service_should_yield(struct hif_softc *scn,
  * chooses what to send (buffer address, length). The destination
  * side keeps a supply of "anonymous receive buffers" available and
  * it handles incoming data as it arrives (when the destination
- * recieves an interrupt).
+ * receives an interrupt).
  *
  * The sender may send a simple buffer (address/length) or it may
  * send a small list of buffers.  When a small list is sent, hardware
@@ -1712,10 +1712,10 @@ ce_completed_send_next(struct CE_handle *copyeng,
 #ifdef ATH_11AC_TXCOMPACT
 /* CE engine descriptor reap
  * Similar to ce_per_engine_service , Only difference is ce_per_engine_service
- * does recieve and reaping of completed descriptor ,
+ * does receive and reaping of completed descriptor ,
  * This function only handles reaping of Tx complete descriptor.
  * The Function is called from threshold reap  poll routine
- * hif_send_complete_check so should not countain recieve functionality
+ * hif_send_complete_check so should not countain receive functionality
  * within it .
  */
 
@@ -1743,7 +1743,7 @@ void ce_per_engine_servicereap(struct hif_softc *scn, unsigned int ce_id)
 	 * enabled in TX polling mode. If this is not the case, more
 	 * bottom halve spin lock changes are needed. Due to data path
 	 * performance concern, after internal discussion we've decided
-	 * to make minimum change, i.e., only address the issue occured
+	 * to make minimum change, i.e., only address the issue occurred
 	 * in this function. The possible negative effect of this minimum
 	 * change is that, in the future, if some other function will also
 	 * be opened to let the user context to use, those cases need to be

hif/src/dispatcher/dummy.c

@@ -163,7 +163,7 @@ void hif_dummy_nointrs(struct hif_softc *hif_sc)
  * hif_dummy_bus_configure - dummy call
  * hif_ctx: hif context
  *
- * Return: 0 for sucess
+ * Return: 0 for success
  */
 int hif_dummy_bus_configure(struct hif_softc *hif_sc)
 {
@@ -177,7 +177,7 @@ int hif_dummy_bus_configure(struct hif_softc *hif_sc)
  * @config: configuration value to set
  * @config_len: configuration length
  *
- * Return: 0 for sucess
+ * Return: 0 for success
  */
 QDF_STATUS
 hif_dummy_get_config_item(struct hif_softc *hif_sc,

hif/src/hif_main.c

@@ -1164,6 +1164,7 @@ int hif_send_single(struct hif_opaque_softc *osc, qdf_nbuf_t msdu, uint32_t
 }
 qdf_export_symbol(hif_send_single);
 
+#ifdef WLAN_FEATURE_FASTPATH
 /**
  * hif_send_fast() - API to access hif specific function
  * ce_send_fast.
@@ -1185,6 +1186,7 @@ int hif_send_fast(struct hif_opaque_softc *osc, qdf_nbuf_t nbuf,
 }
 qdf_export_symbol(hif_send_fast);
 #endif
+#endif
 
 /**
  * hif_reg_write() - API to access hif specific function

hif/src/pcie/if_pci.c

@@ -2825,7 +2825,7 @@ int hif_pci_bus_resume(struct hif_softc *scn)
  * hif_pci_bus_suspend_noirq() - ensure there are no pending transactions
  * @scn: hif context
  *
- * Ensure that if we recieved the wakeup message before the irq
+ * Ensure that if we received the wakeup message before the irq
  * was disabled that the message is pocessed before suspending.
  *
  * Return: -EBUSY if we fail to flush the tasklets.
@@ -2848,7 +2848,7 @@ int hif_pci_bus_suspend_noirq(struct hif_softc *scn)
  * hif_pci_bus_resume_noirq() - ensure there are no pending transactions
  * @scn: hif context
  *
- * Ensure that if we recieved the wakeup message before the irq
+ * Ensure that if we received the wakeup message before the irq
  * was disabled that the message is pocessed before suspending.
  *
  * Return: -EBUSY if we fail to flush the tasklets.
@@ -4198,7 +4198,7 @@ static int __hif_pm_runtime_allow_suspend(struct hif_pci_softc *hif_sc,
  * hif_pm_runtime_lock_timeout_fn() - callback the runtime lock timeout
  * @data: calback data that is the pci context
  *
- * if runtime locks are aquired with a timeout, this function releases
+ * if runtime locks are acquired with a timeout, this function releases
  * the locks when the last runtime lock expires.
  *
  * dummy implementation until lock acquisition is implemented.
@@ -4388,7 +4388,7 @@ int hif_pm_runtime_prevent_suspend_timeout(struct hif_opaque_softc *ol_sc,
  * hif_runtime_lock_init() - API to initialize Runtime PM context
  * @name: Context name
  *
- * This API initalizes the Runtime PM context of the caller and
+ * This API initializes the Runtime PM context of the caller and
  * return the pointer.
  *
  * Return: None

hif/src/sdio/hif_sdio_dev.c

@@ -54,7 +54,7 @@
  * mempool, for example, data using Interface Memory,
  * desc and other using DRAM, they need different SDIO
  * mbox channels.
- * b) currently, tx mempool in LL case is seperated from
+ * b) currently, tx mempool in LL case is separated from
  * main mempool, the structure (descs at the beginning
  * of every pool buffer) is different, because they only
  * need store tx desc from host. To align with LL case,

hif/src/sdio/if_sdio.c

@@ -486,7 +486,7 @@ void hif_sdio_disable_bus(struct hif_softc *hif_sc)
  * @config: configuration value to set
  * @config_len: configuration length
  *
- * Return: QDF_STATUS_SUCCESS for sucess
+ * Return: QDF_STATUS_SUCCESS for success
  */
 QDF_STATUS hif_sdio_get_config_item(struct hif_softc *hif_sc,
 		     int opcode, void *config, uint32_t config_len)

hif/src/snoc/if_snoc.c

@@ -448,7 +448,7 @@ int hif_snoc_bus_resume(struct hif_softc *scn)
  * hif_snoc_bus_suspend_noirq() - ensure there are no pending transactions
  * @scn: hif context
  *
- * Ensure that if we recieved the wakeup message before the irq
+ * Ensure that if we received the wakeup message before the irq
  * was disabled that the message is pocessed before suspending.
  *
  * Return: -EBUSY if we fail to flush the tasklets.

os_if/linux/cp_stats/inc/wlan_cfg80211_mc_cp_stats.h

@@ -62,6 +62,30 @@ int wlan_cfg80211_mc_cp_stats_get_wakelock_stats(struct wlan_objmgr_psoc *psoc,
 int wlan_cfg80211_mc_cp_stats_get_tx_power(struct wlan_objmgr_vdev *vdev,
 					   int *dbm);
 
+/**
+ * wlan_cfg80211_mc_cp_stats_get_station_stats() - API to get station
+ * statistics to firmware
+ * @vdev:    Pointer to vdev
+ * @info:    pointer to object to populate with station stats
+ *
+ * Call of this API must call wlan_cfg80211_mc_cp_stats_put_station_stats
+ * API when done with information provided by info.
+ * Return: 0 on success, negative value on failure
+ */
+int wlan_cfg80211_mc_cp_stats_get_station_stats(
+					struct wlan_objmgr_vdev *vdev,
+					struct stats_event *info);
+
+/**
+ * wlan_cfg80211_mc_cp_stats_put_station_stats() - API to release station
+ * statistics buffer
+ * @vdev:    Pointer to vdev
+ * @info:    pointer to object to populate with station stats
+ *
+ * Return: None
+ */
+void wlan_cfg80211_mc_cp_stats_put_station_stats(struct stats_event *info);
+
 /**
  * wlan_cfg80211_mc_cp_stats_get_peer_rssi() - API to fetch peer rssi
  * @vdev:    Pointer to vdev

os_if/linux/cp_stats/src/wlan_cfg80211_mc_cp_stats.c

@@ -361,3 +361,83 @@ void wlan_cfg80211_mc_cp_stats_put_peer_rssi(struct stats_event *rssi_info)
 {
 	ucfg_mc_cp_stats_free_stats_resources(rssi_info);
 }
+
+/**
+ * get_station_stats_cb() - get_station_stats_cb callback function
+ * @cookie: a cookie for the request context
+ *
+ * Return: None
+ */
+static void get_station_stats_cb(struct stats_event *station_info, void *cookie)
+{
+	struct stats_event *priv;
+	struct osif_request *request;
+
+	request = osif_request_get(cookie);
+	if (!request) {
+		cfg80211_err("Obsolete request");
+		return;
+	}
+	priv = osif_request_priv(request);
+	*priv = *station_info;
+	osif_request_complete(request);
+	osif_request_put(request);
+}
+
+int wlan_cfg80211_mc_cp_stats_get_station_stats(struct wlan_objmgr_vdev *vdev,
+						struct stats_event *out)
+{
+	int ret;
+	void *cookie;
+	QDF_STATUS status;
+	struct stats_event *priv;
+	struct osif_request *request;
+	struct request_info info = {0};
+	static const struct osif_request_params params = {
+		.priv_size = sizeof(*priv),
+		.timeout_ms = 2 * CP_STATS_WAIT_TIME_STAT,
+	};
+
+	qdf_mem_zero(out, sizeof(*out));
+	request = osif_request_alloc(&params);
+	if (!request) {
+		cfg80211_err("Request allocation failure, return cached value");
+		return -EINVAL;
+	}
+
+	cookie = osif_request_cookie(request);
+	priv = osif_request_priv(request);
+	info.cookie = cookie;
+	info.u.get_station_stats_cb = get_station_stats_cb;
+	info.vdev_id = wlan_vdev_get_id(vdev);
+	info.pdev_id = wlan_objmgr_pdev_get_pdev_id(wlan_vdev_get_pdev(vdev));
+	qdf_mem_copy(info.peer_mac_addr, wlan_vdev_mlme_get_macaddr(vdev),
+		     WLAN_MACADDR_LEN);
+	status = ucfg_mc_cp_stats_send_stats_request(vdev, TYPE_STATION_STATS,
+						     &info);
+	if (QDF_IS_STATUS_ERROR(status)) {
+		cfg80211_err("wlan_mc_cp_stats_send_stats_request status: %d",
+			     status);
+		ret = qdf_status_to_os_return(status);
+	} else {
+		ret = osif_request_wait_for_response(request);
+		if (ret)
+			cfg80211_err("wait failed or timed out ret: %d", ret);
+		else
+			*out = *priv;
+	}
+
+	/*
+	 * either we never sent a request, we sent a request and
+	 * received a response or we sent a request and timed out.
+	 * regardless we are done with the request.
+	 */
+	osif_request_put(request);
+
+	return ret;
+}
+
+void wlan_cfg80211_mc_cp_stats_put_station_stats(struct stats_event *info)
+{
+	ucfg_mc_cp_stats_free_stats_resources(info);
+}

os_if/linux/qca_vendor.h

@@ -1036,7 +1036,7 @@ enum qca_wlan_vendor_attr_tdls_state {
 		QCA_WLAN_VENDOR_ATTR_TDLS_STATE_AFTER_LAST - 1,
 };
 
-/* enum's to provide TDLS capabilites */
+/* enum's to provide TDLS capabilities */
 enum qca_wlan_vendor_attr_get_tdls_capabilities {
 	QCA_WLAN_VENDOR_ATTR_TDLS_GET_CAPS_INVALID = 0,
 	QCA_WLAN_VENDOR_ATTR_TDLS_GET_CAPS_MAX_CONC_SESSIONS = 1,

os_if/linux/tdls/inc/wlan_cfg80211_tdls.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017-2018 The Linux Foundation. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -176,7 +176,7 @@ int wlan_cfg80211_tdls_get_all_peers(struct wlan_objmgr_vdev *vdev,
  * @status_code: status to be incuded in the frame
  * @peer_capability: peer capability information
  * @buf: additional IEs to be included
- * @len: lenght of additional Ies
+ * @len: length of additional Ies
  * @oper: cfg80211 TDLS operation
  *
  * Return: 0 on success; negative errno otherwise

qdf/inc/qdf_flex_mem.h

@@ -120,7 +120,7 @@ void *qdf_flex_mem_alloc(struct qdf_flex_mem_pool *pool);
 /**
  * qdf_flex_mem_free() - logically frees @ptr from the pool
  * @pool: the pool to return the memory to
- * @ptr: a pointer recieved via a call to qdf_flex_mem_alloc()
+ * @ptr: a pointer received via a call to qdf_flex_mem_alloc()
  *
  * This function marks the item corresponding to @ptr as unused. If that item
  * was the last used item in the segment it belongs to, and the segment was

qdf/linux/src/i_qdf_nbuf.h

@@ -94,7 +94,7 @@ typedef union {
  *      for the priv_cb_w since it must be at same offset for both
  *      TX and RX union
  *
- * @paddr   : physical addressed retrived by dma_map of nbuf->data
+ * @paddr   : physical addressed retrieved by dma_map of nbuf->data
  *
  * @rx.dev.priv_cb_w.ext_cb_ptr: extended cb pointer
  * @rx.dev.priv_cb_w.fctx      : ctx to handle special pkts defined by ftype
@@ -1750,7 +1750,7 @@ static inline bool __qdf_nbuf_tso_tcp_v6(struct sk_buff *skb)
 }
 
 /**
- * __qdf_nbuf_l2l3l4_hdr_len() - return the l2+l3+l4 hdr lenght of the skb
+ * __qdf_nbuf_l2l3l4_hdr_len() - return the l2+l3+l4 hdr length of the skb
  * @skb: sk buff
  *
  * Return: size of l2+l3+l4 header length

qdf/linux/src/i_qdf_types.h

@@ -270,7 +270,7 @@ typedef uint32_t ath_dma_addr_t;
 /**
  * typedef __qdf_segment_t - segment of memory
  * @daddr: dma address
- * @len: lenght of segment
+ * @len: length of segment
  */
 typedef struct __qdf_segment {
 	dma_addr_t  daddr;

qdf/linux/src/qdf_nbuf.c

@@ -2856,7 +2856,7 @@ static inline void __qdf_nbuf_fill_tso_cmn_seg_info(
 uint32_t __qdf_nbuf_get_tso_info(qdf_device_t osdev, struct sk_buff *skb,
 		struct qdf_tso_info_t *tso_info)
 {
-	/* common accross all segments */
+	/* common across all segments */
 	struct qdf_tso_cmn_seg_info_t tso_cmn_info;
 	/* segment specific */
 	void *tso_frag_vaddr;

qdf/linux/src/qdf_trace.c

@@ -361,7 +361,7 @@ void qdf_trace_hex_dump(QDF_MODULE_ID module, QDF_TRACE_LEVEL level,
 		return;
 
 	while (buf_len > 0) {
-		unsigned char linebuf[BUFFER_SIZE];
+		unsigned char linebuf[BUFFER_SIZE] = {0};
 		int linelen = min(buf_len, ROW_SIZE);
 
 		buf_len -= ROW_SIZE;

target_if/core/inc/target_if.h

@@ -372,7 +372,7 @@ wmi_legacy_service_ready_callback
  * target_if_register_legacy_service_ready_cb() - get legacy
  *                                       service ready handler from scn handle
  *
- * @service_ready_cb: funtion pointer to service ready callback
+ * @service_ready_cb: function pointer to service ready callback
  *
  * Return: QDF Status
  */

target_if/cp_stats/src/target_if_mc_cp_stats.c

@@ -56,6 +56,10 @@ static void target_if_cp_stats_free_stats_event(struct stats_event *ev)
 	ev->peer_stats = NULL;
 	qdf_mem_free(ev->cca_stats);
 	ev->cca_stats = NULL;
+	qdf_mem_free(ev->vdev_summary_stats);
+	ev->vdev_summary_stats = NULL;
+	qdf_mem_free(ev->vdev_chain_rssi);
+	ev->vdev_chain_rssi = NULL;
 }
 
 static QDF_STATUS target_if_cp_stats_extract_pdev_stats(
@@ -159,6 +163,136 @@ static QDF_STATUS target_if_cp_stats_extract_cca_stats(
 	return QDF_STATUS_SUCCESS;
 }
 
+static QDF_STATUS target_if_cp_stats_extract_vdev_summary_stats(
+					struct wmi_unified *wmi_hdl,
+					wmi_host_stats_event *stats_param,
+					struct stats_event *ev, uint8_t *data)
+{
+	uint32_t i, j;
+	QDF_STATUS status;
+	int32_t bcn_snr, dat_snr;
+	wmi_host_vdev_stats vdev_stats;
+
+	ev->num_summary_stats = stats_param->num_vdev_stats;
+	if (!ev->num_summary_stats)
+		return QDF_STATUS_SUCCESS;
+
+	ev->vdev_summary_stats = qdf_mem_malloc(sizeof(*ev->vdev_summary_stats)
+					* ev->num_summary_stats);
+
+	if (!ev->vdev_summary_stats) {
+		cp_stats_err("malloc failed");
+		return QDF_STATUS_E_NOMEM;
+	}
+
+	for (i = 0; i < ev->num_summary_stats; i++) {
+		status = wmi_extract_vdev_stats(wmi_hdl, data, i, &vdev_stats);
+		if (QDF_IS_STATUS_ERROR(status))
+			continue;
+
+		bcn_snr = vdev_stats.vdev_snr.bcn_snr;
+		dat_snr = vdev_stats.vdev_snr.dat_snr;
+		ev->vdev_summary_stats[i].vdev_id = vdev_stats.vdev_id;
+
+		for (j = 0; j < 4; j++) {
+			ev->vdev_summary_stats[i].stats.tx_frm_cnt[j]
+					= vdev_stats.tx_frm_cnt[j];
+			ev->vdev_summary_stats[i].stats.fail_cnt[j]
+					= vdev_stats.fail_cnt[j];
+			ev->vdev_summary_stats[i].stats.multiple_retry_cnt[j]
+					= vdev_stats.multiple_retry_cnt[j];
+		}
+
+		ev->vdev_summary_stats[i].stats.rx_frm_cnt =
+						vdev_stats.rx_frm_cnt;
+		ev->vdev_summary_stats[i].stats.rx_error_cnt =
+						vdev_stats.rx_err_cnt;
+		ev->vdev_summary_stats[i].stats.rx_discard_cnt =
+						vdev_stats.rx_discard_cnt;
+		ev->vdev_summary_stats[i].stats.ack_fail_cnt =
+						vdev_stats.ack_fail_cnt;
+		ev->vdev_summary_stats[i].stats.rts_succ_cnt =
+						vdev_stats.rts_succ_cnt;
+		ev->vdev_summary_stats[i].stats.rts_fail_cnt =
+						vdev_stats.rts_fail_cnt;
+		/* Update SNR and RSSI in SummaryStats */
+		if (TGT_IS_VALID_SNR(bcn_snr)) {
+			ev->vdev_summary_stats[i].stats.snr = bcn_snr;
+			ev->vdev_summary_stats[i].stats.rssi =
+						bcn_snr + TGT_NOISE_FLOOR_DBM;
+		} else if (TGT_IS_VALID_SNR(dat_snr)) {
+			ev->vdev_summary_stats[i].stats.snr = dat_snr;
+			ev->vdev_summary_stats[i].stats.rssi =
+						dat_snr + TGT_NOISE_FLOOR_DBM;
+		} else {
+			ev->vdev_summary_stats[i].stats.snr = TGT_INVALID_SNR;
+			ev->vdev_summary_stats[i].stats.rssi = 0;
+		}
+	}
+
+	return QDF_STATUS_SUCCESS;
+}
+
+
+static QDF_STATUS target_if_cp_stats_extract_vdev_chain_rssi_stats(
+					struct wmi_unified *wmi_hdl,
+					wmi_host_stats_event *stats_param,
+					struct stats_event *ev, uint8_t *data)
+{
+	uint32_t i;
+	QDF_STATUS status;
+	int32_t bcn_snr, dat_snr;
+	struct wmi_host_per_chain_rssi_stats rssi_stats;
+
+	ev->num_chain_rssi_stats = stats_param->num_rssi_stats;
+	if (!ev->num_chain_rssi_stats)
+		return QDF_STATUS_SUCCESS;
+
+	ev->vdev_chain_rssi = qdf_mem_malloc(sizeof(*ev->vdev_chain_rssi) *
+						ev->num_chain_rssi_stats);
+	if (!ev->vdev_chain_rssi) {
+		cp_stats_err("malloc failed");
+		return QDF_STATUS_E_NOMEM;
+	}
+
+	for (i = 0; i < ev->num_chain_rssi_stats; i++) {
+		status = wmi_extract_per_chain_rssi_stats(wmi_hdl, data, i,
+							  &rssi_stats);
+		if (QDF_IS_STATUS_ERROR(status))
+			continue;
+
+		for (i = 0; i < MAX_NUM_CHAINS; i++) {
+			dat_snr = rssi_stats.rssi_avg_data[i];
+			bcn_snr = rssi_stats.rssi_avg_beacon[i];
+			cp_stats_err("Chain %d SNR bcn: %d data: %d", i,
+				     bcn_snr, dat_snr);
+			if (TGT_IS_VALID_SNR(bcn_snr))
+				ev->vdev_chain_rssi[i].chain_rssi[i] = bcn_snr;
+			else if (TGT_IS_VALID_SNR(dat_snr))
+				ev->vdev_chain_rssi[i].chain_rssi[i] = dat_snr;
+			else
+				/*
+				 * Firmware sends invalid snr till it sees
+				 * Beacon/Data after connection since after
+				 * vdev up fw resets the snr to invalid. In this
+				 * duartion Host will return an invalid rssi
+				 * value.
+				 */
+				ev->vdev_chain_rssi[i].chain_rssi[i] =
+							TGT_INVALID_SNR;
+			/*
+			 * Get the absolute rssi value from the current rssi
+			 * value the snr value is hardcoded into 0 in the
+			 * qcacld-new/CORE stack
+			 */
+			ev->vdev_chain_rssi[i].chain_rssi[i] +=
+							TGT_NOISE_FLOOR_DBM;
+		}
+	}
+
+	return QDF_STATUS_SUCCESS;
+}
+
 static QDF_STATUS target_if_cp_stats_extract_event(struct wmi_unified *wmi_hdl,
 						   struct stats_event *ev,
 						   uint8_t *data)
@@ -168,7 +302,7 @@ static QDF_STATUS target_if_cp_stats_extract_event(struct wmi_unified *wmi_hdl,
 
 	status = wmi_extract_stats_param(wmi_hdl, data, &stats_param);
 	if (QDF_IS_STATUS_ERROR(status)) {
-		cp_stats_debug("stats param extract failed: %d", status);
+		cp_stats_err("stats param extract failed: %d", status);
 		return status;
 	}
 	cp_stats_debug("num: pdev: %d, vdev: %d, peer: %d, rssi: %d",
@@ -190,6 +324,18 @@ static QDF_STATUS target_if_cp_stats_extract_event(struct wmi_unified *wmi_hdl,
 	if (QDF_IS_STATUS_ERROR(status))
 		return status;
 
+	status = target_if_cp_stats_extract_vdev_summary_stats(wmi_hdl,
+							       &stats_param,
+							       ev, data);
+	if (QDF_IS_STATUS_ERROR(status))
+		return status;
+
+	status = target_if_cp_stats_extract_vdev_chain_rssi_stats(wmi_hdl,
+								  &stats_param,
+								  ev, data);
+	if (QDF_IS_STATUS_ERROR(status))
+		return status;
+
 	return QDF_STATUS_SUCCESS;
 }
 
@@ -373,6 +519,12 @@ static uint32_t get_stats_id(enum stats_req_type type)
 		return WMI_REQUEST_PDEV_STAT;
 	case TYPE_PEER_STATS:
 		return WMI_REQUEST_PEER_STAT;
+	case TYPE_STATION_STATS:
+		return (WMI_REQUEST_AP_STAT   |
+			WMI_REQUEST_PEER_STAT |
+			WMI_REQUEST_VDEV_STAT |
+			WMI_REQUEST_PDEV_STAT |
+			WMI_REQUEST_RSSI_PER_CHAIN_STAT);
 	}
 	return 0;
 }

umac/cmn_services/cmn_defs/inc/wlan_cmn_ieee80211.h

@@ -348,7 +348,7 @@ enum element_ie {
 
 /**
  * enum extn_element_ie :- extended management information element
- * @WLAN_EXTN_ELEMID_HECAP: HE capabilites IE
+ * @WLAN_EXTN_ELEMID_HECAP: HE capabilities IE
  * @WLAN_EXTN_ELEMID_HEOP:  HE Operation IE
  * @WLAN_EXTN_ELEMID_SRP:   spatial reuse parameter IE
  */

umac/cmn_services/inc/wlan_cmn.h

@@ -34,6 +34,11 @@
 #define WLAN_UMAC_PDEV_MAX_VDEVS 17
 /* Max no. of Peers, a device can support */
 #define WLAN_UMAC_PSOC_MAX_PEERS (1024 + WLAN_UMAC_PSOC_MAX_VDEVS)
+/* Max no. of Temporary Peers, a pdev can support */
+#define WLAN_MAX_PDEV_TEMP_PEERS 128
+/* Max no. of Temporary Peers, a psoc can support */
+#define WLAN_MAX_PSOC_TEMP_PEERS \
+		(WLAN_MAX_PDEV_TEMP_PEERS * WLAN_UMAC_MAX_PDEVS)
 
 /* Max length of a SSID */
 #define WLAN_SSID_MAX_LEN 32

umac/cmn_services/obj_mgr/inc/wlan_objmgr_pdev_obj.h

@@ -43,7 +43,7 @@
 #define WLAN_PDEV_F_USEPROT                 0x00000040
   /* STATUS: use barker preamble*/
 #define WLAN_PDEV_F_USEBARKER               0x00000080
-  /* CONF: DISABLE 2040 coexistance */
+  /* CONF: DISABLE 2040 coexistence */
 #define WLAN_PDEV_F_COEXT_DISABLE           0x00000100
   /* STATE: scan pending */
 #define WLAN_PDEV_F_SCAN_PENDING            0x00000200
@@ -149,6 +149,7 @@ struct wlan_objmgr_pdev_mlme {
  * @wlan_vdev_list:    List maintains the VDEVs created on this PDEV
  * @wlan_peer_count:   Peer count
  * @max_peer_count:    Max Peer count
+ * @temp_peer_count:   Temporary peer count
  * @wlan_psoc:         back pointer to PSOC, its attached to
  * @ref_cnt:           Ref count
  * @ref_id_dbg:        Array to track Ref count
@@ -161,6 +162,7 @@ struct wlan_objmgr_pdev_objmgr {
 	qdf_list_t wlan_vdev_list;
 	uint16_t wlan_peer_count;
 	uint16_t max_peer_count;
+	uint16_t temp_peer_count;
 	struct wlan_objmgr_psoc *wlan_psoc;
 	qdf_atomic_t ref_cnt;
 	qdf_atomic_t ref_id_dbg[WLAN_REF_ID_MAX];
@@ -841,6 +843,20 @@ static inline uint16_t wlan_pdev_get_peer_count(struct wlan_objmgr_pdev *pdev)
 	return pdev->pdev_objmgr.wlan_peer_count;
 }
 
+/**
+ * wlan_pdev_get_temp_peer_count() - get pdev temporary peer count
+ * @pdev: PDEV object
+ *
+ * API to get temporary peer count from PDEV
+ *
+ * Return: temp_peer_count - pdev's temporary peer count
+ */
+static inline uint16_t wlan_pdev_get_temp_peer_count(struct wlan_objmgr_pdev *pdev)
+{
+	return pdev->pdev_objmgr.temp_peer_count;
+}
+
+
 /**
  * wlan_pdev_incr_peer_count() - increment pdev peer count
  * @pdev: PDEV object
@@ -867,6 +883,32 @@ static inline void wlan_pdev_decr_peer_count(struct wlan_objmgr_pdev *pdev)
 	pdev->pdev_objmgr.wlan_peer_count--;
 }
 
+/**
+ * wlan_pdev_incr_temp_peer_count() - increment temporary pdev peer count
+ * @pdev: PDEV object
+ *
+ * API to increment temporary  peer count of PDEV by 1
+ *
+ * Return: void
+ */
+static inline void wlan_pdev_incr_temp_peer_count(struct wlan_objmgr_pdev *pdev)
+{
+	pdev->pdev_objmgr.temp_peer_count++;
+}
+
+/**
+ * wlan_pdev_decr_temp_peer_count() - decrement pdev temporary peer count
+ * @pdev: PDEV object
+ *
+ * API to decrement temporary peer count of PDEV by 1
+ *
+ * Return: void
+ */
+static inline void wlan_pdev_decr_temp_peer_count(struct wlan_objmgr_pdev *pdev)
+{
+	pdev->pdev_objmgr.temp_peer_count--;
+}
+
 /**
  * wlan_pdev_get_vdev_count() - get PDEV vdev count
  * @pdev: PDEV object

umac/cmn_services/obj_mgr/inc/wlan_objmgr_peer_obj.h

@@ -591,6 +591,37 @@ static inline enum wlan_peer_type wlan_peer_get_peer_type(
 	return peer->peer_mlme.peer_type;
 }
 
+/**
+ * wlan_peer_set_phymode() - set phymode
+ * @peer: PEER object
+ * @phymode: phymode of peer
+ *
+ * API to set phymode
+ *
+ * Return: void
+ */
+static inline void wlan_peer_set_phymode(struct wlan_objmgr_peer *peer,
+					 enum wlan_phymode phymode)
+{
+	peer->peer_mlme.phymode = phymode;
+}
+
+/**
+ * wlan_peer_get_phymode() - get phymode
+ * @peer: PEER object
+ *
+ * API to get phymode
+ *
+ * Return:
+ * @phymode: phymode of PEER
+ */
+static inline enum wlan_phymode wlan_peer_get_phymode(
+				struct wlan_objmgr_peer *peer)
+{
+	return peer->peer_mlme.phymode;
+}
+
+
 /**
  * wlan_peer_set_macaddr() - set mac addr
  * @peer: PEER object

umac/cmn_services/obj_mgr/inc/wlan_objmgr_psoc_obj.h

@@ -247,6 +247,7 @@ struct wlan_objmgr_psoc_nif {
  * @print_cnt:            Count to throttle Logical delete prints
  * @wlan_peer_count:      PEER count
  * @max_peer_count:       Max no. of peers supported by this PSOC
+ * @temp_peer_count:      Temporary peer count
  * @wlan_pdev_list[]:     PDEV list
  * @wlan_vdev_list[]:     VDEV list
  * @wlan_vdev_id_map[]:   VDEV id map, to allocate free ids
@@ -264,6 +265,7 @@ struct wlan_objmgr_psoc_objmgr {
 	uint8_t print_cnt;
 	uint16_t wlan_peer_count;
 	uint16_t max_peer_count;
+	uint16_t temp_peer_count;
 	struct wlan_objmgr_pdev *wlan_pdev_list[WLAN_UMAC_MAX_PDEVS];
 	struct wlan_objmgr_vdev *wlan_vdev_list[WLAN_UMAC_PSOC_MAX_VDEVS];
 	uint32_t wlan_vdev_id_map[2];

umac/cmn_services/obj_mgr/src/wlan_objmgr_pdev_obj.c

@@ -130,6 +130,7 @@ struct wlan_objmgr_pdev *wlan_objmgr_pdev_obj_create(
 	pdev->pdev_objmgr.wlan_vdev_count = 0;
 	pdev->pdev_objmgr.max_vdev_count = WLAN_UMAC_PDEV_MAX_VDEVS;
 	pdev->pdev_objmgr.wlan_peer_count = 0;
+	pdev->pdev_objmgr.temp_peer_count = 0;
 	pdev->pdev_objmgr.max_peer_count = wlan_psoc_get_max_peer_count(psoc);
 	/* Save HDD/OSIF pointer */
 	pdev->pdev_nif.pdev_ospriv = osdev_priv;

umac/cmn_services/obj_mgr/src/wlan_objmgr_psoc_obj.c

@@ -77,7 +77,8 @@ static void wlan_objmgr_psoc_peer_list_init(struct wlan_peer_list *peer_list)
 	qdf_spinlock_create(&peer_list->peer_list_lock);
 	for (i = 0; i < WLAN_PEER_HASHSIZE; i++)
 		qdf_list_create(&peer_list->peer_hash[i],
-				WLAN_UMAC_PSOC_MAX_PEERS);
+			WLAN_UMAC_PSOC_MAX_PEERS +
+			WLAN_MAX_PSOC_TEMP_PEERS);
 }
 
 static void wlan_objmgr_psoc_peer_list_deinit(struct wlan_peer_list *peer_list)
@@ -129,6 +130,7 @@ struct wlan_objmgr_psoc *wlan_objmgr_psoc_obj_create(uint32_t phy_version,
 	objmgr->wlan_vdev_count = 0;
 	objmgr->max_vdev_count = WLAN_UMAC_PSOC_MAX_VDEVS;
 	objmgr->wlan_peer_count = 0;
+	objmgr->temp_peer_count = 0;
 	objmgr->max_peer_count = WLAN_UMAC_PSOC_MAX_PEERS;
 	qdf_atomic_init(&objmgr->ref_cnt);
 	objmgr->print_cnt = 0;
@@ -1494,11 +1496,21 @@ QDF_STATUS wlan_objmgr_psoc_peer_attach(struct wlan_objmgr_psoc *psoc,
 
 	wlan_psoc_obj_lock(psoc);
 	objmgr = &psoc->soc_objmgr;
-	/* Max peer limit is reached, return failure */
-	if (objmgr->wlan_peer_count >= wlan_psoc_get_max_peer_count(psoc)) {
-		wlan_psoc_obj_unlock(psoc);
-		return QDF_STATUS_E_FAILURE;
+	/* Max temporary peer limit is reached, return failure */
+	if (peer->peer_mlme.peer_type == WLAN_PEER_STA_TEMP) {
+		if (objmgr->temp_peer_count >= WLAN_MAX_PSOC_TEMP_PEERS) {
+			wlan_psoc_obj_unlock(psoc);
+			return QDF_STATUS_E_FAILURE;
+		}
+	} else {
+		/* Max peer limit is reached, return failure */
+		if (objmgr->wlan_peer_count
+			>= wlan_psoc_get_max_peer_count(psoc)) {
+			wlan_psoc_obj_unlock(psoc);
+			return QDF_STATUS_E_FAILURE;
+		}
 	}
+
 	/* Derive hash index from mac address */
 	hash_index = WLAN_PEER_HASH(peer->macaddr);
 	peer_list = &objmgr->peer_list;
@@ -1510,7 +1522,11 @@ QDF_STATUS wlan_objmgr_psoc_peer_attach(struct wlan_objmgr_psoc *psoc,
 							peer);
 	qdf_spin_unlock_bh(&peer_list->peer_list_lock);
 	/* Increment peer count */
-	objmgr->wlan_peer_count++;
+	if (peer->peer_mlme.peer_type == WLAN_PEER_STA_TEMP)
+		objmgr->temp_peer_count++;
+	else
+		objmgr->wlan_peer_count++;
+
 	wlan_psoc_obj_unlock(psoc);
 
 	return QDF_STATUS_SUCCESS;
@@ -1547,7 +1563,10 @@ QDF_STATUS wlan_objmgr_psoc_peer_detach(struct wlan_objmgr_psoc *psoc,
 	}
 	qdf_spin_unlock_bh(&peer_list->peer_list_lock);
 	/* Decrement peer count */
-	objmgr->wlan_peer_count--;
+	if (peer->peer_mlme.peer_type == WLAN_PEER_STA_TEMP)
+		objmgr->temp_peer_count--;
+	else
+		objmgr->wlan_peer_count--;
 	wlan_psoc_obj_unlock(psoc);
 
 	return QDF_STATUS_SUCCESS;

umac/cmn_services/obj_mgr/src/wlan_objmgr_vdev_obj.c

@@ -215,7 +215,8 @@ struct wlan_objmgr_vdev *wlan_objmgr_vdev_obj_create(
 
 	/* Initialize peer list */
 	qdf_list_create(&vdev->vdev_objmgr.wlan_peer_list,
-			vdev->vdev_objmgr.max_peer_count);
+			vdev->vdev_objmgr.max_peer_count +
+			WLAN_MAX_PDEV_TEMP_PEERS);
 	/* TODO init other parameters */
 
 	/* Invoke registered create handlers */
@@ -646,21 +647,35 @@ QDF_STATUS wlan_objmgr_vdev_peer_attach(struct wlan_objmgr_vdev *vdev,
 
 	wlan_vdev_obj_lock(vdev);
 	pdev = wlan_vdev_get_pdev(vdev);
-	/* If Max peer count exceeds, return failure */
-	if (objmgr->wlan_peer_count >= objmgr->max_peer_count) {
-		wlan_vdev_obj_unlock(vdev);
-		return QDF_STATUS_E_FAILURE;
+	/* If Max VDEV peer count exceeds, return failure */
+	if (peer->peer_mlme.peer_type != WLAN_PEER_STA_TEMP) {
+		if (objmgr->wlan_peer_count >= objmgr->max_peer_count) {
+			wlan_vdev_obj_unlock(vdev);
+			return QDF_STATUS_E_FAILURE;
+		}
 	}
 	wlan_vdev_obj_unlock(vdev);
 
+	/* If Max PDEV peer count exceeds, return failure */
 	wlan_pdev_obj_lock(pdev);
-	if (wlan_pdev_get_peer_count(pdev) >=
+	if (peer->peer_mlme.peer_type == WLAN_PEER_STA_TEMP) {
+		if (wlan_pdev_get_temp_peer_count(pdev) >=
+			WLAN_MAX_PDEV_TEMP_PEERS) {
+			wlan_pdev_obj_unlock(pdev);
+			return QDF_STATUS_E_FAILURE;
+		}
+	} else {
+		if (wlan_pdev_get_peer_count(pdev) >=
 			wlan_pdev_get_max_peer_count(pdev)) {
-		wlan_pdev_obj_unlock(pdev);
-		return QDF_STATUS_E_FAILURE;
+			wlan_pdev_obj_unlock(pdev);
+			return QDF_STATUS_E_FAILURE;
+		}
 	}
 
-	wlan_pdev_incr_peer_count(wlan_vdev_get_pdev(vdev));
+	if (peer->peer_mlme.peer_type == WLAN_PEER_STA_TEMP)
+		wlan_pdev_incr_temp_peer_count(wlan_vdev_get_pdev(vdev));
+	else
+		wlan_pdev_incr_peer_count(wlan_vdev_get_pdev(vdev));
 	wlan_pdev_obj_unlock(pdev);
 
 	wlan_vdev_obj_lock(vdev);
@@ -744,7 +759,10 @@ QDF_STATUS wlan_objmgr_vdev_peer_detach(struct wlan_objmgr_vdev *vdev,
 	wlan_vdev_obj_unlock(vdev);
 
 	wlan_pdev_obj_lock(pdev);
-	wlan_pdev_decr_peer_count(pdev);
+	if (peer->peer_mlme.peer_type == WLAN_PEER_STA_TEMP)
+		wlan_pdev_decr_temp_peer_count(pdev);
+	else
+		wlan_pdev_decr_peer_count(pdev);
 	wlan_pdev_obj_unlock(pdev);
 
 	/* decrement vdev ref count after peer released its reference */

umac/cmn_services/policy_mgr/inc/wlan_policy_mgr_api.h

@@ -303,7 +303,7 @@ uint8_t policy_mgr_get_channel(struct wlan_objmgr_psoc *psoc,
  * @psoc: PSOC object information
  * @mode:	Device mode
  * @pcl_channels: PCL channels
- * @len: lenght of the PCL
+ * @len: length of the PCL
  * @pcl_weight: Weights of the PCL
  * @weight_len: Max length of the weights list
  *
@@ -532,7 +532,7 @@ bool policy_mgr_is_ibss_conn_exist(struct wlan_objmgr_psoc *psoc,
 
 /**
  * policy_mgr_get_conn_info() - get the current connections list
- * @len: lenght of the list
+ * @len: length of the list
  *
  * This function returns a pointer to the current connections
  * list

umac/cmn_services/policy_mgr/src/wlan_policy_mgr_get_set_utils.c

@@ -375,7 +375,7 @@ void policy_mgr_init_dbs_config(struct wlan_objmgr_psoc *psoc,
 	if (DISABLE_DBS_CXN_AND_SCAN ==
 			wlan_objmgr_psoc_get_dual_mac_disable(psoc)) {
 		policy_mgr_err("Disabling dual mac capabilities");
-		/* All capabilites are initialized to 0. We can return */
+		/* All capabilities are initialized to 0. We can return */
 		goto done;
 	}
 

umac/cmn_services/policy_mgr/src/wlan_policy_mgr_pcl.c

@@ -184,7 +184,7 @@ void policy_mgr_reg_chan_change_callback(struct wlan_objmgr_psoc *psoc,
 			avoid_freq_ind->chan_list.ch_list,
 			pm_ctx->unsafe_channel_count *
 			sizeof(pm_ctx->unsafe_channel_list[0]));
-	policy_mgr_debug("Channel list update, recieved %d avoided channels",
+	policy_mgr_debug("Channel list update, received %d avoided channels",
 		pm_ctx->unsafe_channel_count);
 }
 

umac/cmn_services/serialization/src/wlan_serialization_dequeue.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017-2018 The Linux Foundation. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -130,7 +130,7 @@ wlan_serialization_remove_all_cmd_from_queue(qdf_list_t *queue,
 		/*
 		 * active queue can't be removed directly, requester needs to
 		 * wait for active command response and send remove request for
-		 * active command seperately
+		 * active command separately
 		 */
 		if (is_active_queue) {
 			if (!psoc || !cmd_list) {
@@ -391,7 +391,7 @@ wlan_serialization_dequeue_cmd(struct wlan_serialization_command *cmd,
 	 * 2) two main types of commands to process
 	 *    a) SCAN
 	 *    b) NON-SCAN
-	 * 3) for each command there are seperate command queues per pdev
+	 * 3) for each command there are separate command queues per pdev
 	 * 4) iterate through every pdev object and find the command and remove
 	 */
 

umac/cmn_services/serialization/src/wlan_serialization_enqueue.c

@@ -176,7 +176,7 @@ wlan_serialization_enqueue_cmd(struct wlan_serialization_command *cmd,
 	 * 2) two main types of commands to process
 	 *    a) SCAN
 	 *    b) NON-SCAN
-	 * 3) for each command there are seperate command queues per pdev
+	 * 3) for each command there are separate command queues per pdev
 	 * 4) pull pdev from vdev structure and get the command queue associated
 	 *    with that pdev and try to enqueue on those queue
 	 * 5) Thumb rule:

umac/cp_stats/core/src/wlan_cp_stats_defs.h

@@ -36,6 +36,9 @@
 #include "wlan_cp_stats_cmn_defs.h"
 #include <wlan_cp_stats_utils_api.h>
 
+/* noise floor */
+#define CP_STATS_TGT_NOISE_FLOOR_DBM (-96)
+
 /**
  * struct psoc_cp_stats - defines cp stats at psoc object
  * @psoc_obj: pointer to psoc

umac/cp_stats/dispatcher/inc/wlan_cp_stats_mc_defs.h

@@ -40,6 +40,8 @@
 #include "wlan_cmn.h"
 #include "qdf_event.h"
 
+#define MAX_NUM_CHAINS              2
+
 /**
  * enum stats_req_type - enum indicating bit position of various stats type in
  * request map
@@ -54,6 +56,28 @@ enum stats_req_type {
 	TYPE_MAX,
 };
 
+/**
+ * enum tx_rate_info - tx rate flags
+ * @TX_RATE_LEGACY: Legacy rates
+ * @TX_RATE_HT20: HT20 rates
+ * @TX_RATE_HT40: HT40 rates
+ * @TX_RATE_SGI: Rate with Short guard interval
+ * @TX_RATE_LGI: Rate with Long guard interval
+ * @TX_RATE_VHT20: VHT 20 rates
+ * @TX_RATE_VHT40: VHT 40 rates
+ * @TX_RATE_VHT80: VHT 80 rates
+ */
+enum tx_rate_info {
+	TX_RATE_LEGACY = 0x1,
+	TX_RATE_HT20 = 0x2,
+	TX_RATE_HT40 = 0x4,
+	TX_RATE_SGI = 0x8,
+	TX_RATE_LGI = 0x10,
+	TX_RATE_VHT20 = 0x20,
+	TX_RATE_VHT40 = 0x40,
+	TX_RATE_VHT80 = 0x80,
+};
+
 /**
  * struct wake_lock_stats - wake lock stats structure
  * @ucast_wake_up_count:        Unicast wakeup count
@@ -125,6 +149,8 @@ struct request_info {
 	union {
 		void (*get_tx_power_cb)(int tx_power, void *cookie);
 		void (*get_peer_rssi_cb)(struct stats_event *ev, void *cookie);
+		void (*get_station_stats_cb)(struct stats_event *ev,
+					     void *cookie);
 	} u;
 	uint32_t vdev_id;
 	uint32_t pdev_id;
@@ -169,14 +195,52 @@ struct pdev_mc_cp_stats {
 	int32_t max_pwr;
 };
 
+/**
+ * struct summary_stats - summary stats
+ * @snr: snr of vdev
+ * @rssi: rssi of vdev
+ * @retry_cnt: retry count
+ * @multiple_retry_cnt: multiple_retry_cnt
+ * @tx_frm_cnt: num of tx frames
+ * @rx_frm_cnt: num of rx frames
+ * @frm_dup_cnt: duplicate frame count
+ * @fail_cnt: fail count
+ * @rts_fail_cnt: rts fail count
+ * @ack_fail_cnt: ack fail count
+ * @rts_succ_cnt: rts success count
+ * @rx_discard_cnt: rx frames discarded
+ * @rx_error_cnt: rx frames with error
+ */
+struct summary_stats {
+	uint32_t snr;
+	uint32_t rssi;
+	uint32_t retry_cnt[4];
+	uint32_t multiple_retry_cnt[4];
+	uint32_t tx_frm_cnt[4];
+	uint32_t rx_frm_cnt;
+	uint32_t frm_dup_cnt;
+	uint32_t fail_cnt[4];
+	uint32_t rts_fail_cnt;
+	uint32_t ack_fail_cnt;
+	uint32_t rts_succ_cnt;
+	uint32_t rx_discard_cnt;
+	uint32_t rx_error_cnt;
+};
+
 /**
  * struct vdev_mc_cp_stats - vdev specific stats
  * @wow_stats: wake_lock stats for vdev
  * @cca: cca stats
+ * @tx_rate_flags: tx rate flags (enum tx_rate_info)
+ * @chain_rssi: chain rssi
+ * @vdev_summary_stats: vdev's summary stats
  */
 struct vdev_mc_cp_stats {
 	struct wake_lock_stats wow_stats;
 	struct cca_stats cca;
+	uint32_t tx_rate_flags;
+	int8_t chain_rssi[MAX_NUM_CHAINS];
+	struct summary_stats vdev_summary_stats;
 };
 
 /**
@@ -203,6 +267,26 @@ struct congestion_stats_event {
 	uint32_t congestion;
 };
 
+/**
+ * struct summary_stats_event - summary_stats event param
+ * @vdev_id: vdev_id of the event
+ * @stats: summary stats
+ */
+struct summary_stats_event {
+	uint8_t vdev_id;
+	struct summary_stats stats;
+};
+
+/**
+ * struct chain_rssi_event - chain_rssi event param
+ * @vdev_id: vdev_id of the event
+ * @chain_rssi: chain_rssi
+ */
+struct chain_rssi_event {
+	uint8_t vdev_id;
+	int8_t chain_rssi[MAX_NUM_CHAINS];
+};
+
 /**
  * struct stats_event - parameters populated by stats event
  * @num_pdev_stats: num pdev stats
@@ -210,6 +294,12 @@ struct congestion_stats_event {
  * @num_peer_stats: num peer stats
  * @peer_stats: if populated array indicating peer stats
  * @cca_stats: if populated indicates congestion stats
+ * @num_summary_stats: number of summary stats
+ * @vdev_summary_stats: if populated indicates array of summary stats per vdev
+ * @num_chain_rssi_stats: number of chain rssi stats
+ * @vdev_chain_rssi: if populated indicates array of chain rssi per vdev
+ * @tx_rate: tx rate (kbps)
+ * @tx_rate_flags: tx rate flags, (enum tx_rate_info)
  */
 struct stats_event {
 	uint32_t num_pdev_stats;
@@ -217,6 +307,12 @@ struct stats_event {
 	uint32_t num_peer_stats;
 	struct peer_mc_cp_stats *peer_stats;
 	struct congestion_stats_event *cca_stats;
+	uint32_t num_summary_stats;
+	struct summary_stats_event *vdev_summary_stats;
+	uint32_t num_chain_rssi_stats;
+	struct chain_rssi_event *vdev_chain_rssi;
+	uint32_t tx_rate;
+	enum tx_rate_info tx_rate_flags;
 };
 
 #endif /* CONFIG_MCL */

umac/cp_stats/dispatcher/inc/wlan_cp_stats_mc_ucfg_api.h

@@ -104,7 +104,7 @@ QDF_STATUS ucfg_mc_cp_stats_inc_wake_lock_stats(struct wlan_objmgr_psoc *psoc,
  * @max_len: The maximum number of chars to write
  * @ret: number of bytes written
  *
- * Return - status of operation
+ * Return: status of operation
  */
 QDF_STATUS ucfg_mc_cp_stats_write_wow_stats(
 				struct wlan_objmgr_psoc *psoc,
@@ -116,7 +116,7 @@ QDF_STATUS ucfg_mc_cp_stats_write_wow_stats(
  * @vdev: pointer to vdev object
  * @type: request type
  *
- * Return - status of operation
+ * Return: status of operation
  */
 QDF_STATUS ucfg_mc_cp_stats_send_stats_request(struct wlan_objmgr_vdev *vdev,
 					       enum stats_req_type type,
@@ -127,7 +127,7 @@ QDF_STATUS ucfg_mc_cp_stats_send_stats_request(struct wlan_objmgr_vdev *vdev,
  * @vdev: pointer to vdev object
  * @dbm: pointer to tx power in dbm
  *
- * Return - status of operation
+ * Return: status of operation
  */
 QDF_STATUS ucfg_mc_cp_stats_get_tx_power(struct wlan_objmgr_vdev *vdev,
 					 int *dbm);
@@ -137,7 +137,7 @@ QDF_STATUS ucfg_mc_cp_stats_get_tx_power(struct wlan_objmgr_vdev *vdev,
  * @psoc: pointer to psoc object
  * @type: request type to check
  *
- * Return - true of request is pending, false otherwise
+ * Return: true of request is pending, false otherwise
  */
 bool ucfg_mc_cp_stats_is_req_pending(struct wlan_objmgr_psoc *psoc,
 				     enum stats_req_type type);
@@ -148,7 +148,7 @@ bool ucfg_mc_cp_stats_is_req_pending(struct wlan_objmgr_psoc *psoc,
  * @type: request to update
  * @req: value to update
  *
- * Return - status of operation
+ * Return: status of operation
  */
 QDF_STATUS ucfg_mc_cp_stats_set_pending_req(struct wlan_objmgr_psoc *psoc,
 					    enum stats_req_type type,
@@ -159,7 +159,7 @@ QDF_STATUS ucfg_mc_cp_stats_set_pending_req(struct wlan_objmgr_psoc *psoc,
  * @psoc: pointer to psoc object
  * @type: request to update
  *
- * Return - status of operation
+ * Return: status of operation
  */
 QDF_STATUS ucfg_mc_cp_stats_reset_pending_req(struct wlan_objmgr_psoc *psoc,
 					      enum stats_req_type type);
@@ -170,7 +170,7 @@ QDF_STATUS ucfg_mc_cp_stats_reset_pending_req(struct wlan_objmgr_psoc *psoc,
  * @type: request to update
  * @info: buffer to populate
  *
- * Return - status of operation
+ * Return: status of operation
  */
 QDF_STATUS ucfg_mc_cp_stats_get_pending_req(struct wlan_objmgr_psoc *psoc,
 					    enum stats_req_type type,
@@ -190,10 +190,20 @@ void ucfg_mc_cp_stats_free_stats_resources(struct stats_event *ev);
  * @vdev: pointer to vdev object
  * @cca_stats: pointer to cca info
  *
- * Return - status of operation
+ * Return: status of operation
  */
 QDF_STATUS ucfg_mc_cp_stats_cca_stats_get(struct wlan_objmgr_vdev *vdev,
 					  struct cca_stats *cca_stats);
 
+/**
+ * ucfg_mc_cp_stats_set_rate_flags() - API to set rate flags
+ * @vdev: pointer to vdev object
+ * @flags: value to set (enum tx_rate_info)
+ *
+ * Return: status of operation
+ */
+QDF_STATUS ucfg_mc_cp_stats_set_rate_flags(struct wlan_objmgr_vdev *vdev,
+					   enum tx_rate_info flags);
+
 #endif /* QCA_SUPPORT_CP_STATS */
 #endif /* __WLAN_CP_STATS_MC_UCFG_API_H__ */

umac/cp_stats/dispatcher/src/wlan_cp_stats_mc_tgt_api.c

@@ -358,6 +358,265 @@ end:
 	wlan_objmgr_vdev_release_ref(vdev, WLAN_CP_STATS_ID);
 }
 
+static void tgt_mc_cp_stats_extract_vdev_summary_stats(
+					struct wlan_objmgr_psoc *psoc,
+					struct stats_event *ev)
+{
+	uint8_t i;
+	QDF_STATUS status;
+	struct wlan_objmgr_peer *peer;
+	struct request_info last_req = {0};
+	struct wlan_objmgr_vdev *vdev;
+	struct peer_mc_cp_stats *peer_mc_stats;
+	struct vdev_mc_cp_stats *vdev_mc_stats;
+	struct peer_cp_stats *peer_cp_stats_priv;
+	struct vdev_cp_stats *vdev_cp_stats_priv;
+
+	if (!ev->vdev_summary_stats) {
+		cp_stats_err("no summary stats");
+		return;
+	}
+
+	status = ucfg_mc_cp_stats_get_pending_req(psoc,
+						 TYPE_STATION_STATS,
+						 &last_req);
+	if (QDF_IS_STATUS_ERROR(status)) {
+		cp_stats_err("ucfg_mc_cp_stats_get_pending_req failed");
+		return;
+	}
+
+	for (i = 0; i < ev->num_summary_stats; i++) {
+		if (ev->vdev_summary_stats[i].vdev_id == last_req.vdev_id)
+			break;
+	}
+
+	if (i == ev->num_summary_stats) {
+		cp_stats_err("vdev_id %d not found", last_req.vdev_id);
+		return;
+	}
+
+	vdev = wlan_objmgr_get_vdev_by_id_from_psoc(psoc, last_req.vdev_id,
+						    WLAN_CP_STATS_ID);
+	if (!vdev) {
+		cp_stats_err("vdev is null");
+		return;
+	}
+
+	vdev_cp_stats_priv = wlan_cp_stats_get_vdev_stats_obj(vdev);
+	if (!vdev_cp_stats_priv) {
+		cp_stats_err("vdev cp stats object is null");
+		goto end;
+	}
+
+	wlan_cp_stats_vdev_obj_lock(vdev_cp_stats_priv);
+	vdev_mc_stats = vdev_cp_stats_priv->vdev_stats;
+	qdf_mem_copy(&vdev_mc_stats->vdev_summary_stats,
+		     &ev->vdev_summary_stats[i].stats,
+		     sizeof(vdev_mc_stats->vdev_summary_stats));
+	wlan_cp_stats_vdev_obj_unlock(vdev_cp_stats_priv);
+
+	peer = wlan_vdev_get_bsspeer(vdev);
+	if (!peer) {
+		cp_stats_err("bsspeer is null");
+		goto end;
+	}
+
+	peer_cp_stats_priv = wlan_cp_stats_get_peer_stats_obj(peer);
+	if (!peer_cp_stats_priv) {
+		cp_stats_err("peer cp stats object is null");
+		goto end;
+	}
+
+	wlan_cp_stats_peer_obj_lock(peer_cp_stats_priv);
+	peer_mc_stats = peer_cp_stats_priv->peer_stats;
+	peer_mc_stats->peer_rssi = ev->vdev_summary_stats[i].stats.rssi;
+	wlan_cp_stats_peer_obj_unlock(peer_cp_stats_priv);
+
+end:
+	wlan_objmgr_vdev_release_ref(vdev, WLAN_CP_STATS_ID);
+}
+
+static void tgt_mc_cp_stats_extract_vdev_chain_rssi_stats(
+					struct wlan_objmgr_psoc *psoc,
+					struct stats_event *ev)
+{
+	uint8_t i, j;
+	QDF_STATUS status;
+	struct request_info last_req = {0};
+	struct wlan_objmgr_vdev *vdev;
+	struct vdev_mc_cp_stats *vdev_mc_stats;
+	struct vdev_cp_stats *vdev_cp_stats_priv;
+
+	if (!ev->vdev_chain_rssi) {
+		cp_stats_err("no vdev chain rssi stats");
+		return;
+	}
+
+	status = ucfg_mc_cp_stats_get_pending_req(psoc,
+						  TYPE_STATION_STATS,
+						  &last_req);
+	if (QDF_IS_STATUS_ERROR(status)) {
+		cp_stats_err("ucfg_mc_cp_stats_get_pending_req failed");
+		return;
+	}
+
+	for (i = 0; i < ev->num_chain_rssi_stats; i++) {
+		if (ev->vdev_chain_rssi[i].vdev_id == last_req.vdev_id)
+			break;
+	}
+
+	if (i == ev->num_chain_rssi_stats) {
+		cp_stats_err("vdev_id %d not found", last_req.vdev_id);
+		return;
+	}
+
+	vdev = wlan_objmgr_get_vdev_by_id_from_psoc(psoc, last_req.vdev_id,
+						    WLAN_CP_STATS_ID);
+	if (!vdev) {
+		cp_stats_err("vdev is null");
+		return;
+	}
+
+	vdev_cp_stats_priv = wlan_cp_stats_get_vdev_stats_obj(vdev);
+	if (!vdev_cp_stats_priv) {
+		cp_stats_err("vdev cp stats object is null");
+		goto end;
+	}
+
+	wlan_cp_stats_vdev_obj_lock(vdev_cp_stats_priv);
+	vdev_mc_stats = vdev_cp_stats_priv->vdev_stats;
+	for (j = 0; j < MAX_NUM_CHAINS; j++) {
+		vdev_mc_stats->chain_rssi[j] =
+					ev->vdev_chain_rssi[i].chain_rssi[j];
+	}
+	wlan_cp_stats_vdev_obj_unlock(vdev_cp_stats_priv);
+
+end:
+	wlan_objmgr_vdev_release_ref(vdev, WLAN_CP_STATS_ID);
+}
+
+static void
+tgt_mc_cp_stats_prepare_n_send_raw_station_stats(struct wlan_objmgr_psoc *psoc,
+						 struct request_info *last_req)
+{
+	/* station_stats to be given to userspace thread */
+	struct stats_event info = {0};
+	struct wlan_objmgr_vdev *vdev;
+	struct wlan_objmgr_peer *peer;
+	struct peer_mc_cp_stats *peer_mc_stats;
+	struct vdev_mc_cp_stats *vdev_mc_stats;
+	struct peer_cp_stats *peer_cp_stats_priv;
+	struct vdev_cp_stats *vdev_cp_stats_priv;
+	void (*get_station_stats_cb)(struct stats_event *info, void *cookie);
+
+	get_station_stats_cb = last_req->u.get_station_stats_cb;
+	if (!get_station_stats_cb) {
+		cp_stats_err("callback is null");
+		return;
+	}
+
+	vdev = wlan_objmgr_get_vdev_by_id_from_psoc(psoc, last_req->vdev_id,
+						    WLAN_CP_STATS_ID);
+	if (!vdev) {
+		cp_stats_err("vdev object is null");
+		return;
+	}
+
+	peer = wlan_objmgr_get_peer(psoc, last_req->peer_mac_addr,
+				    WLAN_CP_STATS_ID);
+	if (!peer) {
+		cp_stats_err("peer object is null");
+		goto end;
+	}
+
+	vdev_cp_stats_priv = wlan_cp_stats_get_vdev_stats_obj(vdev);
+	if (!vdev_cp_stats_priv) {
+		cp_stats_err("vdev cp stats object is null");
+		goto end;
+	}
+
+	peer_cp_stats_priv = wlan_cp_stats_get_peer_stats_obj(peer);
+	if (!peer_cp_stats_priv) {
+		cp_stats_err("peer cp stats object is null");
+		goto end;
+	}
+
+	info.num_summary_stats = 1;
+	info.vdev_summary_stats = qdf_mem_malloc(
+					sizeof(*info.vdev_summary_stats));
+	if (!info.vdev_summary_stats)
+		goto end;
+
+	info.num_chain_rssi_stats = 1;
+	info.vdev_chain_rssi = qdf_mem_malloc(sizeof(*info.vdev_chain_rssi));;
+	if (!info.vdev_chain_rssi)
+		goto end;
+
+	wlan_cp_stats_vdev_obj_lock(vdev_cp_stats_priv);
+	vdev_mc_stats = vdev_cp_stats_priv->vdev_stats;
+	info.vdev_summary_stats[0].vdev_id = last_req->vdev_id;
+	info.vdev_summary_stats[0].stats = vdev_mc_stats->vdev_summary_stats;
+	info.vdev_chain_rssi[0].vdev_id = last_req->vdev_id;
+	qdf_mem_copy(info.vdev_chain_rssi[0].chain_rssi,
+		     vdev_mc_stats->chain_rssi,
+		     sizeof(vdev_mc_stats->chain_rssi));
+	info.tx_rate_flags = vdev_mc_stats->tx_rate_flags;
+	wlan_cp_stats_vdev_obj_unlock(vdev_cp_stats_priv);
+
+	wlan_cp_stats_peer_obj_lock(peer_cp_stats_priv);
+	peer_mc_stats = peer_cp_stats_priv->peer_stats;
+	/*
+	 * The linkspeed returned by fw is in kbps so convert
+	 * it in units of 500kbps which is expected by UMAC
+	 */
+	info.tx_rate = peer_mc_stats->tx_rate / 500;
+	wlan_cp_stats_peer_obj_unlock(peer_cp_stats_priv);
+
+end:
+	if (info.vdev_summary_stats && info.vdev_chain_rssi)
+		get_station_stats_cb(&info, last_req->cookie);
+	else
+		ucfg_mc_cp_stats_free_stats_resources(&info);
+
+	if (peer)
+		wlan_objmgr_peer_release_ref(peer, WLAN_CP_STATS_ID);
+
+	wlan_objmgr_vdev_release_ref(vdev, WLAN_CP_STATS_ID);
+}
+
+static void tgt_mc_cp_stats_extract_station_stats(
+				struct wlan_objmgr_psoc *psoc,
+				struct stats_event *ev)
+{
+	QDF_STATUS status;
+	bool is_peer_stats;
+	struct request_info last_req = {0};
+
+	is_peer_stats = (ev->peer_stats != NULL);
+	status = ucfg_mc_cp_stats_get_pending_req(psoc,
+						  TYPE_STATION_STATS,
+						  &last_req);
+	if (QDF_IS_STATUS_ERROR(status)) {
+		cp_stats_err("ucfg_mc_cp_stats_get_pending_req failed");
+		return;
+	}
+
+	tgt_mc_cp_stats_extract_tx_power(psoc, ev, true);
+	tgt_mc_cp_stats_extract_peer_stats(psoc, ev, true);
+	tgt_mc_cp_stats_extract_vdev_summary_stats(psoc, ev);
+	tgt_mc_cp_stats_extract_vdev_chain_rssi_stats(psoc, ev);
+
+	/*
+	 * PEER stats are the last stats sent for get_station statistics.
+	 * reset type_map bit for station stats .
+	 */
+	if (is_peer_stats) {
+		tgt_mc_cp_stats_prepare_n_send_raw_station_stats(psoc,
+								 &last_req);
+		ucfg_mc_cp_stats_reset_pending_req(psoc, TYPE_STATION_STATS);
+	}
+}
+
 QDF_STATUS tgt_mc_cp_stats_process_stats_event(struct wlan_objmgr_psoc *psoc,
 					       struct stats_event *ev)
 {
@@ -367,6 +626,9 @@ QDF_STATUS tgt_mc_cp_stats_process_stats_event(struct wlan_objmgr_psoc *psoc,
 	if (ucfg_mc_cp_stats_is_req_pending(psoc, TYPE_PEER_STATS))
 		tgt_mc_cp_stats_extract_peer_stats(psoc, ev, false);
 
+	if (ucfg_mc_cp_stats_is_req_pending(psoc, TYPE_STATION_STATS))
+		tgt_mc_cp_stats_extract_station_stats(psoc, ev);
+
 	tgt_mc_cp_stats_extract_cca_stats(psoc, ev);
 
 	return QDF_STATUS_SUCCESS;

umac/cp_stats/dispatcher/src/wlan_cp_stats_mc_ucfg_api.c

@@ -85,11 +85,18 @@ QDF_STATUS wlan_cp_stats_pdev_cs_deinit(struct pdev_cp_stats *pdev_cs)
 
 QDF_STATUS wlan_cp_stats_peer_cs_init(struct peer_cp_stats *peer_cs)
 {
+	peer_cs->peer_stats = qdf_mem_malloc(sizeof(struct peer_mc_cp_stats));
+	if (!peer_cs->peer_stats) {
+		cp_stats_err("malloc failed");
+		return QDF_STATUS_E_NOMEM;
+	}
 	return QDF_STATUS_SUCCESS;
 }
 
 QDF_STATUS wlan_cp_stats_peer_cs_deinit(struct peer_cp_stats *peer_cs)
 {
+	qdf_mem_free(peer_cs->peer_stats);
+	peer_cs->peer_stats = NULL;
 	return QDF_STATUS_SUCCESS;
 }
 
@@ -262,7 +269,7 @@ static void vdev_iterator(struct wlan_objmgr_psoc *psoc, void *vdev, void *arg)
 	struct vdev_cp_stats *vdev_cp_stats_priv;
 
 	vdev_cp_stats_priv = wlan_cp_stats_get_vdev_stats_obj(vdev);
-	if (NULL == vdev_cp_stats_priv) {
+	if (!vdev_cp_stats_priv) {
 		cp_stats_err("vdev cp stats object is null");
 		return;
 	}
@@ -301,7 +308,7 @@ QDF_STATUS ucfg_mc_cp_stats_get_psoc_wake_lock_stats(
 	struct psoc_mc_cp_stats *psoc_mc_stats;
 
 	psoc_cp_stats_priv = wlan_cp_stats_get_psoc_stats_obj(psoc);
-	if (NULL == psoc_cp_stats_priv) {
+	if (!psoc_cp_stats_priv) {
 		cp_stats_err("psoc cp stats object is null");
 		return QDF_STATUS_E_NULL_VALUE;
 	}
@@ -324,7 +331,7 @@ QDF_STATUS ucfg_mc_cp_stats_get_vdev_wake_lock_stats(
 	struct vdev_mc_cp_stats *vdev_mc_stats;
 
 	vdev_cp_stats_priv = wlan_cp_stats_get_vdev_stats_obj(vdev);
-	if (NULL == vdev_cp_stats_priv) {
+	if (!vdev_cp_stats_priv) {
 		cp_stats_err("vdev cp stats object is null");
 		return QDF_STATUS_E_NULL_VALUE;
 	}
@@ -532,6 +539,16 @@ QDF_STATUS ucfg_mc_cp_stats_get_pending_req(struct wlan_objmgr_psoc *psoc,
 	return QDF_STATUS_SUCCESS;
 }
 
+void ucfg_mc_cp_stats_free_stats_resources(struct stats_event *ev)
+{
+	qdf_mem_free(ev->pdev_stats);
+	qdf_mem_free(ev->peer_stats);
+	qdf_mem_free(ev->cca_stats);
+	qdf_mem_free(ev->vdev_summary_stats);
+	qdf_mem_free(ev->vdev_chain_rssi);
+	qdf_mem_zero(ev, sizeof(*ev));
+}
+
 QDF_STATUS ucfg_mc_cp_stats_cca_stats_get(struct wlan_objmgr_vdev *vdev,
 					  struct cca_stats *cca_stats)
 {
@@ -551,9 +568,22 @@ QDF_STATUS ucfg_mc_cp_stats_cca_stats_get(struct wlan_objmgr_vdev *vdev,
 	return QDF_STATUS_SUCCESS;
 }
 
-void ucfg_mc_cp_stats_free_stats_resources(struct stats_event *ev)
+QDF_STATUS ucfg_mc_cp_stats_set_rate_flags(struct wlan_objmgr_vdev *vdev,
+					   uint32_t flags)
 {
-	qdf_mem_free(ev->pdev_stats);
-	qdf_mem_free(ev->peer_stats);
-	qdf_mem_zero(ev, sizeof(*ev));
+	struct vdev_mc_cp_stats *vdev_mc_stats;
+	struct vdev_cp_stats *vdev_cp_stats_priv;
+
+	vdev_cp_stats_priv = wlan_cp_stats_get_vdev_stats_obj(vdev);
+	if (!vdev_cp_stats_priv) {
+		cp_stats_err("vdev cp stats object is null");
+		return QDF_STATUS_E_NULL_VALUE;
+	}
+
+	wlan_cp_stats_vdev_obj_lock(vdev_cp_stats_priv);
+	vdev_mc_stats = vdev_cp_stats_priv->vdev_stats;
+	vdev_mc_stats->tx_rate_flags = flags;
+	wlan_cp_stats_vdev_obj_unlock(vdev_cp_stats_priv);
+
+	return QDF_STATUS_SUCCESS;
 }

umac/dfs/core/src/misc/dfs_random_chan_sel.c

@@ -1121,7 +1121,7 @@ static uint8_t dfs_find_ch_with_fallback(
 		/*
 		 * Only 2 blocks for 160Mhz bandwidth i.e 36-64 & 100-128
 		 * and all the channels in these blocks are continuous
-		 * and seperated by 4Mhz.
+		 * and separated by 4Mhz.
 		 */
 		for (i = 1; ((i < final_cnt)); i++) {
 			if ((final_lst[i] - final_lst[i-1]) ==

umac/global_umac_dispatcher/lmac_if/inc/wlan_lmac_if_def.h

@@ -643,7 +643,7 @@ struct wlan_lmac_if_target_tx_ops {
 /**
  * struct wlan_lmac_if_offchan_txrx_ops - Function pointers to check target
  *                                     capabilities related to offchan txrx.
- * @offchan_data_tid_support: To check if target supports seperate tid for
+ * @offchan_data_tid_support: To check if target supports separate tid for
  *                                     offchan data tx.
  */
 struct wlan_lmac_if_offchan_txrx_ops {

umac/nan/dispatcher/inc/nan_ucfg_api.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017-2018 The Linux Foundation. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -168,7 +168,7 @@ uint32_t ucfg_nan_get_ndi_delete_rsp_status(struct wlan_objmgr_vdev *vdev);
  * @psoc: pointer to psoc object
  * @cb_obj: callback struct to populate
  *
- * Return: callback struct on sucess, NULL otherwise
+ * Return: callback struct on success, NULL otherwise
  */
 QDF_STATUS ucfg_nan_get_callbacks(struct wlan_objmgr_psoc *psoc,
 				  struct nan_callbacks *cb_obj);
@@ -230,7 +230,7 @@ int ucfg_nan_register_lim_callbacks(struct wlan_objmgr_psoc *psoc,
  * @psoc: pointer to psoc object
  * @cb_obj: callback struct to populate
  *
- * Return: callback struct on sucess, NULL otherwise
+ * Return: callback struct on success, NULL otherwise
  */
 QDF_STATUS ucfg_nan_get_callbacks(struct wlan_objmgr_psoc *psoc,
 				  struct nan_callbacks *cb_obj);

umac/p2p/core/src/wlan_p2p_roc.c

@@ -472,7 +472,7 @@ static QDF_STATUS p2p_process_ready_on_channel_evt(
 		roc_ctx->roc_type, roc_ctx->roc_state);
 
 	status = qdf_mc_timer_start(&roc_ctx->roc_timer,
-		(roc_ctx->duration + P2P_EVENT_PROPOGATE_TIME));
+		(roc_ctx->duration + P2P_EVENT_PROPAGATE_TIME));
 	if (status != QDF_STATUS_SUCCESS)
 		p2p_err("Remain on Channel timer start failed");
 	if (roc_ctx->roc_type == USER_REQUESTED) {

umac/p2p/core/src/wlan_p2p_roc.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017-2018 The Linux Foundation. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -27,7 +27,7 @@
 #include <qdf_mc_timer.h>
 #include <qdf_list.h>
 
-#define P2P_EVENT_PROPOGATE_TIME 10
+#define P2P_EVENT_PROPAGATE_TIME 10
 #define P2P_WAIT_CANCEL_ROC      1000
 
 #ifdef QCA_WIFI_3_0_EMU

umac/scan/core/src/wlan_scan_cache_db.c

@@ -648,7 +648,7 @@ static QDF_STATUS scm_add_update_entry(struct wlan_objmgr_psoc *psoc,
 	if (scan_params->frm_subtype ==
 	   MGMT_SUBTYPE_PROBE_RESP &&
 	   !scan_params->ie_list.ssid)
-		scm_info("Probe resp doesnt contain SSID");
+		scm_info("Probe resp doesn't contain SSID");
 
 
 	if (scan_params->ie_list.csa ||

umac/tdls/dispatcher/inc/wlan_tdls_public_structs.h

@@ -186,7 +186,7 @@ enum tdls_feature_mode {
  * @TDLS_CMD_SESSION_INCREMENT: notify session increment
  * @TDLS_CMD_SESSION_DECREMENT: notify session decrement
  * @TDLS_CMD_TEARDOWN_LINKS: notify teardown
- * @TDLS_NOTIFY_RESET_ADAPTERS: notify adapater reset
+ * @TDLS_NOTIFY_RESET_ADAPTERS: notify adapter reset
  * @TDLS_CMD_GET_ALL_PEERS: get all the tdls peers from the list
  * @TDLS_CMD_ANTENNA_SWITCH: dynamic tdls antenna switch
  */

umac/wifi_pos/src/wifi_pos_utils_i.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -181,7 +181,7 @@ struct wifi_pos_user_defined_caps {
 };
 
 /**
- * struct wifi_pos_oem_get_cap_rsp - capabilites set by userspace and target.
+ * struct wifi_pos_oem_get_cap_rsp - capabilities set by userspace and target.
  * @driver_cap: target capabilities
  * @user_defined_cap: capabilities set by userspace via set request
  */
@@ -348,7 +348,7 @@ void wifi_pos_clear_psoc(void);
 /**
  * wifi_pos_populate_caps: API to get OEM caps
  * @psoc: psoc object
- * @caps: capabilites buffer to populate
+ * @caps: capabilities buffer to populate
  *
  * Return: status of operation.
  */

wlan_cfg/wlan_cfg.c

@@ -94,7 +94,7 @@
  * The max allowed size for tx comp ring is 8191.
  * This is limitted by h/w ring max size.
  * As this is not a power of 2 it does not work with nss offload so the
- * nearest available size which is power of 2 is 4096 choosen for nss
+ * nearest available size which is power of 2 is 4096 chosen for nss
  */
 #define NSS_TX_COMP_RING_SIZE (4 << 10)
 

wmi/inc/wmi_unified_api.h

@@ -1705,6 +1705,9 @@ QDF_STATUS wmi_extract_atf_token_info_ev(void *wmi_hdl, void *evt_buf,
 QDF_STATUS wmi_extract_vdev_stats(void *wmi_hdl, void *evt_buf,
 		uint32_t index, wmi_host_vdev_stats *vdev_stats);
 
+QDF_STATUS wmi_extract_per_chain_rssi_stats(void *wmi_hdl, void *evt_buf,
+	uint32_t index, struct wmi_host_per_chain_rssi_stats *rssi_stats);
+
 QDF_STATUS wmi_extract_vdev_extd_stats(void *wmi_hdl, void *evt_buf,
 		uint32_t index, wmi_host_vdev_extd_stats *vdev_extd_stats);
 

wmi/inc/wmi_unified_param.h

@@ -605,7 +605,7 @@ struct vdev_delete_params {
 };
 
 /**
- * struct channel_param - Channel paramters with all
+ * struct channel_param - Channel parameters with all
  *			info required by target.
  * @chan_id: channel id
  * @pwr: channel power
@@ -1239,7 +1239,7 @@ struct peer_assoc_params {
 /**
  * struct sta_ps_params - sta ps cmd parameter
  * @vdev_id: vdev id
- * @param: sta ps paramter
+ * @param: sta ps parameter
  * @value: sta ps parameter value
  */
 struct sta_ps_params {
@@ -1251,8 +1251,8 @@ struct sta_ps_params {
 /**
  * struct ap_ps_params - ap ps cmd parameter
  * @vdev_id: vdev id
- * @param: ap ps paramter
- * @value: ap ps paramter value
+ * @param: ap ps parameter
+ * @value: ap ps parameter value
  */
 struct ap_ps_params {
 	uint32_t vdev_id;
@@ -1468,7 +1468,7 @@ struct tx_send_params {
 };
 
 /**
- * struct wmi_mgmt_params - wmi mgmt cmd paramters
+ * struct wmi_mgmt_params - wmi mgmt cmd parameters
  * @tx_frame: management tx frame
  * @frm_len: frame length
  * @vdev_id: vdev id
@@ -1499,7 +1499,7 @@ struct wmi_mgmt_params {
 };
 
 /**
- * struct wmi_offchan_data_tx_params - wmi offchan data tx cmd paramters
+ * struct wmi_offchan_data_tx_params - wmi offchan data tx cmd parameters
  * @tx_frame: management tx frame
  * @frm_len: frame length
  * @vdev_id: vdev id
@@ -1802,7 +1802,7 @@ struct rssi_monitor_param {
 };
 
 /**
- * struct scan_mac_oui - oui paramters
+ * struct scan_mac_oui - oui parameters
  * @oui: oui parameters
  * @vdev_id: interface id
  * @enb_probe_req_sno_randomization: control probe req sequence no randomization
@@ -2899,7 +2899,7 @@ enum packet_filter_comp_type {
 };
 
 /**
- * struct rcv_pkt_filter_params - recieve packet filter parameters
+ * struct rcv_pkt_filter_params - receive packet filter parameters
  * @protocolLayer - protocol layer
  * @cmpFlag - comparison flag
  * @dataLength - data length
@@ -2919,7 +2919,7 @@ struct rcv_pkt_filter_params {
 };
 
 /**
- * struct rcv_pkt_filter_config - recieve packet filter info
+ * struct rcv_pkt_filter_config - receive packet filter info
  * @filterId - filter id
  * @filterType - filter type
  * @numFieldParams - no of fields
@@ -4044,7 +4044,7 @@ struct remove_beacon_filter_params {
 /**
  * struct mgmt_params - Mgmt params
  * @vdev_id: vdev id
- * @buf_len: lenght of frame buffer
+ * @buf_len: length of frame buffer
  * @wbuf: frame buffer
  */
 struct mgmt_params {
@@ -4461,7 +4461,7 @@ struct proxy_ast_reserve_params {
  * @key: pointer to key
  * @key_len: length of key
  * @data: pointer data buf
- * @data_len: lenght of data buf
+ * @data_len: length of data buf
  * @mode: mode
  * @op: operation
  * @pdev_id: pdev_id for identifying the MAC
@@ -4953,8 +4953,8 @@ typedef struct {
  * @self_triggers: Scheduler self triggers
  * @sw_retry_failure: frames dropped due to excessive sw retries
  * @illgl_rate_phy_err: illegal rate phy errors
- * @pdev_cont_xretry: wal pdev continous xretry
- * @pdev_tx_timeout: wal pdev continous xretry
+ * @pdev_cont_xretry: wal pdev continuous xretry
+ * @pdev_tx_timeout: wal pdev continuous xretry
  * @pdev_resets: wal pdev resets
  * @stateless_tid_alloc_failure: frames dropped due to non-availability of
  *                               stateless TIDs
@@ -5162,6 +5162,12 @@ typedef struct {
  *	*/
 #define WMI_HOST_WLAN_MAX_AC  4
 
+/* The WMI_HOST_MAX_CHAINS macro cannot be changed without breaking WMI
+ * compatibility.
+ * The maximum value of number of chains
+ */
+#define WMI_HOST_MAX_CHAINS   8
+
 /**
  * struct wmi_host_vdev_stats - vdev stats structure
  * @vdev_id: unique id identifying the VDEV, generated by the caller
@@ -5263,6 +5269,21 @@ struct wmi_host_vdev_nac_rssi_event {
 	uint32_t rssi_seq_num;
 };
 
+
+/**
+ * struct wmi_host_per_chain_rssi_stats - VDEV nac rssi stats
+ * @vdev_id: unique id identifying the VDEV, generated by the caller
+ * @rssi_avg_beacon: per chain avg rssi for beacon
+ * @rssi_avg_data: per chain avg rssi for data
+ * @peer_macaddr: peer macaddr
+ */
+struct wmi_host_per_chain_rssi_stats {
+	uint32_t vdev_id;
+	int32_t rssi_avg_beacon[WMI_HOST_MAX_CHAINS];
+	int32_t rssi_avg_data[WMI_HOST_MAX_CHAINS];
+	wmi_host_mac_addr peer_macaddr;
+};
+
 /**
  * struct wmi_host_peer_stats - peer stats
  * @peer_macaddr: peer MAC address
@@ -7854,7 +7875,7 @@ struct wmi_host_dcs_interference_param {
  * struct wmi_host_fips_event_param: FIPS event param
  * @pdev_id: pdev id
  * @error_status: Error status: 0 (no err), 1, or OPER_TIMEOUR
- * @data_len: FIPS data lenght
+ * @data_len: FIPS data length
  * @data: pointer to data
  */
 struct wmi_host_fips_event_param {

wmi/inc/wmi_unified_priv.h

@@ -1290,6 +1290,10 @@ QDF_STATUS (*extract_pdev_ext_stats)(wmi_unified_t wmi_handle, void *evt_buf,
 QDF_STATUS (*extract_vdev_stats)(wmi_unified_t wmi_handle, void *evt_buf,
 			 uint32_t index, wmi_host_vdev_stats *vdev_stats);
 
+QDF_STATUS (*extract_per_chain_rssi_stats)(wmi_unified_t wmi_handle,
+			void *evt_buf, uint32_t index,
+			struct wmi_host_per_chain_rssi_stats *rssi_stats);
+
 QDF_STATUS (*extract_peer_stats)(wmi_unified_t wmi_handle, void *evt_buf,
 			 uint32_t index, wmi_host_peer_stats *peer_stats);
 
@@ -1722,7 +1726,7 @@ struct wmi_soc {
 	struct wmi_ops *ops;
 	const uint32_t *svc_ids;
 	uint32_t wmi_events[wmi_events_max];
-	/* WMI service bitmap recieved from target */
+	/* WMI service bitmap received from target */
 	uint32_t *wmi_service_bitmap;
 	uint32_t *wmi_ext_service_bitmap;
 #ifndef CONFIG_MCL

wmi/inc/wmi_unified_reg_api.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017-2018 The Linux Foundation. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -88,7 +88,7 @@ QDF_STATUS wmi_unified_set_user_country_code_cmd_send(void *wmi_hdl,
  * @wmi_hdl: wmi handle.
  * @evt_buf: event buffer
  * @ch_avoid_ind: buffer pointer to save the event processed data
- * @len: lenght of buffer
+ * @len: length of buffer
  *
  * Return: QDF_STATUS_SUCCESS on success and QDF_STATUS_E_FAILURE for failure
  */

wmi/src/wmi_unified_api.c

@@ -626,7 +626,7 @@ QDF_STATUS wmi_unified_sta_ps_cmd_send(void *wmi_hdl,
 /**
  * wmi_crash_inject() - inject fw crash
  * @wma_handle: wma handle
- * @param: ponirt to crash inject paramter structure
+ * @param: ponirt to crash inject parameter structure
  *
  * Return: QDF_STATUS_SUCCESS on success and QDF_STATUS_E_FAILURE for failure
  */
@@ -1106,7 +1106,7 @@ QDF_STATUS wmi_unified_get_temperature(void *wmi_hdl)
 /**
  * wmi_unified_set_sta_uapsd_auto_trig_cmd() - set uapsd auto trigger command
  * @wmi_hdl: wmi handle
- * @end_set_sta_ps_mode_cmd: cmd paramter strcture
+ * @end_set_sta_ps_mode_cmd: cmd parameter strcture
  *
  * This function sets the trigger
  * uapsd params such as service interval, delay interval
@@ -1266,7 +1266,7 @@ QDF_STATUS wmi_extract_dcc_stats(struct wmi_unified *wmi_hdl,
  *
  * This function enable/disable mcc adaptive scheduler in fw.
  *
- * Return: QDF_STATUS_SUCCESS for sucess or error code
+ * Return: QDF_STATUS_SUCCESS for success or error code
  */
 QDF_STATUS wmi_unified_set_enable_disable_mcc_adaptive_scheduler_cmd(
 		void *wmi_hdl, uint32_t mcc_adaptive_scheduler,
@@ -6210,6 +6210,27 @@ QDF_STATUS wmi_extract_vdev_stats(void *wmi_hdl, void *evt_buf,
 	return QDF_STATUS_E_FAILURE;
 }
 
+/**
+ * wmi_extract_per_chain_rssi_stats() - extract rssi stats from event
+ * @wmi_handle: wmi handle
+ * @param evt_buf: pointer to event buffer
+ * @param index: Index into rssi stats
+ * @param rssi_stats: Pointer to hold rssi stats
+ *
+ * Return: QDF_STATUS_SUCCESS on success and QDF_STATUS_E_FAILURE for failure
+ */
+QDF_STATUS wmi_extract_per_chain_rssi_stats(void *wmi_hdl, void *evt_buf,
+	uint32_t index, struct wmi_host_per_chain_rssi_stats *rssi_stats)
+{
+	wmi_unified_t wmi_handle = (wmi_unified_t) wmi_hdl;
+
+	if (wmi_handle->ops->extract_per_chain_rssi_stats)
+		return wmi_handle->ops->extract_per_chain_rssi_stats(wmi_handle,
+			evt_buf, index, rssi_stats);
+
+	return QDF_STATUS_E_FAILURE;
+}
+
 /**
  * wmi_extract_rtt_hdr() - extract rtt header from event
  * @wmi_handle: wmi handle

wmi/src/wmi_unified_non_tlv.c

@@ -36,7 +36,7 @@
 #include <htc_services.h>
 
 /* pdev_id is used to distinguish the radio for which event
- * is recieved. Since non-tlv target has only one radio, setting
+ * is received. Since non-tlv target has only one radio, setting
  * default pdev_id to one to keep rest of the code using WMI APIs unfiorm.
  */
 #define WMI_NON_TLV_DEFAULT_PDEV_ID WMI_HOST_PDEV_ID_0
@@ -461,7 +461,7 @@ static QDF_STATUS send_setup_install_key_cmd_non_tlv(wmi_unified_t wmi_handle,
  * @peer_addr: peer mac address
  * @param: pointer to hold peer flush tid parameter
  *
- * Return: 0 for sucess or error code
+ * Return: 0 for success or error code
  */
 static QDF_STATUS send_peer_flush_tids_cmd_non_tlv(wmi_unified_t wmi_handle,
 					 uint8_t peer_addr[IEEE80211_ADDR_LEN],
@@ -1041,7 +1041,7 @@ static QDF_STATUS send_suspend_cmd_non_tlv(wmi_unified_t wmi_handle,
 	wmi_buf_t wmibuf;
 	uint32_t len = sizeof(wmi_pdev_suspend_cmd);
 
-	/*send the comand to Target to ignore the
+	/*send the command to Target to ignore the
 	* PCIE reset so as to ensure that Host and target
 	* states are in sync*/
 	wmibuf = wmi_buf_alloc(wmi_handle, len);
@@ -1329,7 +1329,7 @@ static QDF_STATUS send_set_ps_mode_cmd_non_tlv(wmi_unified_t wmi_handle,
 /**
  * send_crash_inject_cmd_non_tlv() - inject fw crash
  * @param wmi_handle	  : handle to WMI.
- * @param: ponirt to crash inject paramter structure
+ * @param: ponirt to crash inject parameter structure
  *
  * Return: 0 for success or return error
  */
@@ -5741,7 +5741,7 @@ static QDF_STATUS extract_service_ready_non_tlv(wmi_unified_t wmi_handle,
 	cap->max_bcn_ie_size = ev->max_bcn_ie_size;
 	cap->fw_version = ev->sw_version;
 	cap->fw_version_1 = ev->sw_version_1;
-	/* Following caps not recieved in older fw/hw
+	/* Following caps not received in older fw/hw
 	 * Initialize it as zero(default). */
 	cap->max_num_scan_channels = 0;
 	cap->max_supported_macs = 0;
@@ -6983,7 +6983,7 @@ static QDF_STATUS extract_rtt_hdr_non_tlv(wmi_unified_t wmi_handle, void *evt_bu
 /**
  * copy_rtt_report_cfr
  * @ev: pointer to destination event pointer
- * @report_type: report type recieved in event
+ * @report_type: report type received in event
  * @p: pointer to event data
  * @hdump: pointer to destination buffer
  * @hdump_len: length of dest buffer
@@ -8033,7 +8033,7 @@ static QDF_STATUS extract_chan_stats_non_tlv(wmi_unified_t wmi_handle,
 		void *evt_buf,
 		uint32_t index, wmi_host_chan_stats *chan_stats)
 {
-	/* Non-TLV doesnt have num_chan_stats */
+	/* Non-TLV doesn't have num_chan_stats */
 	return QDF_STATUS_SUCCESS;
 }
 

wmi/src/wmi_unified_ocb_ut.c

@@ -463,7 +463,7 @@ static QDF_STATUS fake_vdev_set_param_cmd_tlv(wmi_unified_t wmi_handle,
  *
  * This function enable/disable mcc adaptive scheduler in fw.
  *
- * Return: QDF_STATUS_SUCCESS for sucess or error code
+ * Return: QDF_STATUS_SUCCESS for success or error code
  */
 static QDF_STATUS fake_set_enable_disable_mcc_adaptive_scheduler_cmd_tlv(
 		wmi_unified_t wmi_handle, uint32_t mcc_adaptive_scheduler,

wmi/src/wmi_unified_tlv.c

@@ -515,7 +515,7 @@ static QDF_STATUS send_hidden_ssid_vdev_restart_cmd_tlv(wmi_unified_t wmi_handle
  * @peer_addr: peer mac address
  * @param: pointer to hold peer flush tid parameter
  *
- * Return: 0 for sucess or error code
+ * Return: 0 for success or error code
  */
 static QDF_STATUS send_peer_flush_tids_cmd_tlv(wmi_unified_t wmi,
 					 uint8_t peer_addr[IEEE80211_ADDR_LEN],
@@ -1271,7 +1271,7 @@ static QDF_STATUS send_suspend_cmd_tlv(wmi_unified_t wmi_handle,
 	int32_t ret;
 
 	/*
-	 * send the comand to Target to ignore the
+	 * send the command to Target to ignore the
 	 * PCIE reset so as to ensure that Host and target
 	 * states are in sync
 	 */
@@ -1545,7 +1545,7 @@ static QDF_STATUS send_set_sta_ps_param_cmd_tlv(wmi_unified_t wmi_handle,
 /**
  * send_crash_inject_cmd_tlv() - inject fw crash
  * @wmi_handle: wmi handle
- * @param: ponirt to crash inject paramter structure
+ * @param: ponirt to crash inject parameter structure
  *
  * Return: QDF_STATUS_SUCCESS for success or return error
  */
@@ -3347,6 +3347,7 @@ static QDF_STATUS send_set_mimops_cmd_tlv(wmi_unified_t wmi_handle,
 		break;
 	default:
 		WMI_LOGE("%s:INVALID Mimo PS CONFIG", __func__);
+		wmi_buf_free(buf);
 		return QDF_STATUS_E_FAILURE;
 	}
 
@@ -4545,7 +4546,7 @@ static QDF_STATUS extract_ocb_dcc_stats_tlv(wmi_unified_t wmi_handle,
  *
  * This function enable/disable mcc adaptive scheduler in fw.
  *
- * Return: QDF_STATUS_SUCCESS for sucess or error code
+ * Return: QDF_STATUS_SUCCESS for success or error code
  */
 static QDF_STATUS send_set_enable_disable_mcc_adaptive_scheduler_cmd_tlv(
 		wmi_unified_t wmi_handle, uint32_t mcc_adaptive_scheduler,
@@ -10760,7 +10761,7 @@ static QDF_STATUS send_set_tdls_offchan_mode_cmd_tlv(wmi_unified_t wmi_handle,
  * @wmi_handle: wmi handle
  * @pwmaTdlsparams: TDLS params
  *
- * Return: 0 for sucess or error code
+ * Return: 0 for success or error code
  */
 static QDF_STATUS send_update_fw_tdls_state_cmd_tlv(wmi_unified_t wmi_handle,
 					 void *tdls_param, uint8_t tdls_state)
@@ -13362,7 +13363,7 @@ void wmi_copy_resource_config(wmi_resource_config *resource_cfg,
 /* copy_hw_mode_id_in_init_cmd() - Helper routine to copy hw_mode in init cmd
  * @wmi_handle: pointer to wmi handle
  * @buf_ptr: pointer to current position in init command buffer
- * @len: pointer to length. This will be updated with current lenght of cmd
+ * @len: pointer to length. This will be updated with current length of cmd
  * @param: point host parameters for init command
  *
  * Return: Updated pointer of buf_ptr.
@@ -17646,7 +17647,7 @@ static QDF_STATUS extract_ndp_confirm_tlv(wmi_unified_t wmi_handle,
 
 	event = (WMI_NDP_CONFIRM_EVENTID_param_tlvs *) data;
 	fixed_params = (wmi_ndp_confirm_event_fixed_param *)event->fixed_param;
-	WMI_LOGD("WMI_NDP_CONFIRM_EVENTID(0x%X) recieved. vdev %d, ndp_instance %d, rsp_code %d, reason_code: %d, num_active_ndps_on_peer: %d",
+	WMI_LOGD("WMI_NDP_CONFIRM_EVENTID(0x%X) received. vdev %d, ndp_instance %d, rsp_code %d, reason_code: %d, num_active_ndps_on_peer: %d",
 		 WMI_NDP_CONFIRM_EVENTID, fixed_params->vdev_id,
 		 fixed_params->ndp_instance_id, fixed_params->rsp_code,
 		 fixed_params->reason_code,
@@ -17735,7 +17736,7 @@ static QDF_STATUS extract_ndp_end_rsp_tlv(wmi_unified_t wmi_handle,
 
 	event = (WMI_NDP_END_RSP_EVENTID_param_tlvs *) data;
 	fixed_params = (wmi_ndp_end_rsp_event_fixed_param *)event->fixed_param;
-	WMI_LOGD("WMI_NDP_END_RSP_EVENTID(0x%X) recieved. transaction_id: %d, rsp_status: %d, reason_code: %d",
+	WMI_LOGD("WMI_NDP_END_RSP_EVENTID(0x%X) received. transaction_id: %d, rsp_status: %d, reason_code: %d",
 		 WMI_NDP_END_RSP_EVENTID, fixed_params->transaction_id,
 		 fixed_params->rsp_status, fixed_params->reason_code);
 
@@ -19515,6 +19516,57 @@ static QDF_STATUS extract_vdev_stats_tlv(wmi_unified_t wmi_handle,
 	return QDF_STATUS_SUCCESS;
 }
 
+/**
+ * extract_per_chain_rssi_stats_tlv() - api to extract rssi stats from event
+ * buffer
+ * @wmi_handle: wmi handle
+ * @evt_buf: pointer to event buffer
+ * @index: Index into vdev stats
+ * @rssi_stats: Pointer to hold rssi stats
+ *
+ * Return: QDF_STATUS_SUCCESS for success or error code
+ */
+static QDF_STATUS extract_per_chain_rssi_stats_tlv(wmi_unified_t wmi_handle,
+			void *evt_buf, uint32_t index,
+			struct wmi_host_per_chain_rssi_stats *rssi_stats)
+{
+	uint8_t *data;
+	wmi_rssi_stats *fw_rssi_stats;
+	wmi_per_chain_rssi_stats *rssi_event;
+	WMI_UPDATE_STATS_EVENTID_param_tlvs *param_buf;
+
+	if (!evt_buf) {
+		WMI_LOGE("evt_buf is null");
+		return QDF_STATUS_E_NULL_VALUE;
+	}
+
+	param_buf = (WMI_UPDATE_STATS_EVENTID_param_tlvs *) evt_buf;
+	rssi_event = param_buf->chain_stats;
+
+	if (index >= rssi_event->num_per_chain_rssi_stats) {
+		WMI_LOGE("invalid index");
+		return QDF_STATUS_E_INVAL;
+	}
+
+	data = ((uint8_t *)(&rssi_event[1])) + WMI_TLV_HDR_SIZE;
+	fw_rssi_stats = &((wmi_rssi_stats *)data)[index];
+
+	rssi_stats->vdev_id = fw_rssi_stats->vdev_id;
+	qdf_mem_copy(rssi_stats->rssi_avg_beacon,
+		     fw_rssi_stats->rssi_avg_beacon,
+		     sizeof(fw_rssi_stats->rssi_avg_beacon));
+	qdf_mem_copy(rssi_stats->rssi_avg_data,
+		     fw_rssi_stats->rssi_avg_data,
+		     sizeof(fw_rssi_stats->rssi_avg_data));
+	qdf_mem_copy(&rssi_stats->peer_macaddr,
+		     &fw_rssi_stats->peer_macaddr,
+		     sizeof(fw_rssi_stats->peer_macaddr));
+
+	return QDF_STATUS_SUCCESS;
+}
+
+
+
 /**
  * extract_bcn_stats_tlv() - extract bcn stats from event
  * @wmi_handle: wmi handle
@@ -19650,7 +19702,7 @@ static QDF_STATUS extract_chan_stats_tlv(wmi_unified_t wmi_handle,
 			(index * sizeof(wmi_chan_stats)));
 
 
-		/* Non-TLV doesnt have num_chan_stats */
+		/* Non-TLV doesn't have num_chan_stats */
 		chan_stats->chan_mhz = ev->chan_mhz;
 		chan_stats->sampling_period_us = ev->sampling_period_us;
 		chan_stats->rx_clear_count = ev->rx_clear_count;
@@ -22804,6 +22856,7 @@ struct wmi_ops tlv_ops =  {
 	.extract_unit_test = extract_unit_test_tlv,
 	.extract_pdev_ext_stats = extract_pdev_ext_stats_tlv,
 	.extract_vdev_stats = extract_vdev_stats_tlv,
+	.extract_per_chain_rssi_stats = extract_per_chain_rssi_stats_tlv,
 	.extract_peer_stats = extract_peer_stats_tlv,
 	.extract_bcn_stats = extract_bcn_stats_tlv,
 	.extract_bcnflt_stats = extract_bcnflt_stats_tlv,