Merge "Wlan: Optimize set key part to reduce the set key time"
diff --git a/CORE/HDD/src/wlan_hdd_p2p.c b/CORE/HDD/src/wlan_hdd_p2p.c
index 3119acc..615da70 100644
--- a/CORE/HDD/src/wlan_hdd_p2p.c
+++ b/CORE/HDD/src/wlan_hdd_p2p.c
@@ -75,7 +75,7 @@
        CASE_RETURN_STRING(SIR_MAC_ACTION_UNPROT_WNM);
        CASE_RETURN_STRING(SIR_MAC_ACTION_TDLS);
        CASE_RETURN_STRING(SIR_MAC_ACITON_MESH);
-       CASE_RETURN_STRING(SIR_MAC_ACTION_MULTIHOP);
+       CASE_RETURN_STRING(SIR_MAC_ACTION_MHF);
        CASE_RETURN_STRING(SIR_MAC_SELF_PROTECTED);
        CASE_RETURN_STRING(SIR_MAC_ACTION_WME);
        CASE_RETURN_STRING(SIR_MAC_ACTION_VHT);
diff --git a/CORE/MAC/inc/sirMacProtDef.h b/CORE/MAC/inc/sirMacProtDef.h
index d03a192..abe09c8 100644
--- a/CORE/MAC/inc/sirMacProtDef.h
+++ b/CORE/MAC/inc/sirMacProtDef.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -173,9 +173,10 @@
 #define SIR_MAC_ACTION_UNPROT_WNM     11
 #define SIR_MAC_ACTION_TDLS           12
 #define SIR_MAC_ACITON_MESH           13
-#define SIR_MAC_ACTION_MULTIHOP       14
+#define SIR_MAC_ACTION_MHF            14
 #define SIR_MAC_SELF_PROTECTED        15
 #define SIR_MAC_ACTION_WME            17
+#define SIR_MAC_ACTION_FST            18
 #define SIR_MAC_ACTION_VHT            21
 
 
diff --git a/CORE/MAC/src/pe/lim/limApi.c b/CORE/MAC/src/pe/lim/limApi.c
index a9abca3..defbd47 100644
--- a/CORE/MAC/src/pe/lim/limApi.c
+++ b/CORE/MAC/src/pe/lim/limApi.c
@@ -2170,6 +2170,12 @@
          return;
     }
 #endif
+    if (pMac->pmm.inMissedBeaconScenario == TRUE) {
+         limLog(pMac, LOGW,
+               FL("beacon miss handling is already going on for BSSIdx:%d"),
+               pSirMissedBeaconInd->bssIdx);
+         return;
+    }
     if ( (pMac->pmm.gPmmState == ePMM_STATE_BMPS_SLEEP) ||
          (pMac->pmm.gPmmState == ePMM_STATE_UAPSD_SLEEP)||
          (pMac->pmm.gPmmState == ePMM_STATE_WOWLAN) )
diff --git a/CORE/MAC/src/pe/lim/limP2P.c b/CORE/MAC/src/pe/lim/limP2P.c
index 6952d81..04028f0 100644
--- a/CORE/MAC/src/pe/lim/limP2P.c
+++ b/CORE/MAC/src/pe/lim/limP2P.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2014, 2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -1169,56 +1169,35 @@
     pActionHdr = (tpSirMacActionFrameHdr) (pFrame + sizeof(tSirMacMgmtHdr));
 
     /*
-     * Setting Protected bit for SA_QUERY Action Frame
+     * Setting Protected bit only for Robust Action Frames
      * This has to be based on the current Connection with the station
-     * limSetProtectedBit API will set the protected bit if connection if PMF
+     * limSetProtectedBit API will set the protected bit if connection is PMF
      */
-
     if ((SIR_MAC_MGMT_ACTION == pFc->subType) &&
-        (SIR_MAC_ACTION_SA_QUERY == pActionHdr->category))
+        psessionEntry->limRmfEnabled && (!limIsGroupAddr(pMacHdr->da)) &&
+        lim_is_robust_mgmt_action_frame(pActionHdr->category))
     {
-        pMacHdr    = (tpSirMacMgmtHdr ) pFrame;
-        psessionEntry = peFindSessionByBssid(pMac,
-                        (tANI_U8*)pMbMsg->data + BSSID_OFFSET, &sessionId);
-
-        /* Check for session corresponding to ADDR2 ss supplicant is filling
-           ADDR2  with BSSID */
-        if(NULL == psessionEntry)
-        {
-            psessionEntry = peFindSessionByBssid(pMac,
-                       (tANI_U8*)pMbMsg->data + ADDR2_OFFSET, &sessionId);
-        }
-
-        if(NULL != psessionEntry)
-        {
-            limSetProtectedBit(pMac, psessionEntry, pMacHdr->da, pMacHdr);
-        }
-        else
-        {
-            limLog(pMac, LOGE,
-                FL("Dropping SA Query frame - Unable to find PE Session "));
-            limSendSmeRsp(pMac, eWNI_SME_ACTION_FRAME_SEND_CNF,
-                    eHAL_STATUS_FAILURE, pMbMsg->sessionId, 0);
-            palPktFree( pMac->hHdd, HAL_TXRX_FRM_802_11_MGMT,
-                    ( void* ) pFrame, ( void* ) pPacket );
-            return;
-        }
+        pMacHdr = (tpSirMacMgmtHdr)pFrame;
+        /* All psession checks are already done at start */
+        limSetProtectedBit(pMac, psessionEntry, pMacHdr->da, pMacHdr);
 
         /*
-         * If wep bit is not set in MAC header then we are trying to
-         * send SA Query via non PMF connection. Drop the packet.
+         * If wep bit is not set in MAC header of robust management action frame
+         * then we are trying to send RMF via non PMF connection.
+         * Drop the packet instead of sending malform packet.
          */
-
-        if(0 ==  pMacHdr->fc.wep)
+        if (0 ==  pMacHdr->fc.wep)
         {
             limLog(pMac, LOGE,
-                FL("Dropping SA Query frame due to non PMF connection\n"));
+                FL("Drop action frame with category[%d] due to non-PMF conn"),
+                pActionHdr->category);
             limSendSmeRsp(pMac, eWNI_SME_ACTION_FRAME_SEND_CNF,
                     eHAL_STATUS_FAILURE, pMbMsg->sessionId, 0);
             palPktFree( pMac->hHdd, HAL_TXRX_FRM_802_11_MGMT,
                     ( void* ) pFrame, ( void* ) pPacket );
             return;
         }
+
     }
 #endif
 
diff --git a/CORE/MAC/src/pe/lim/limProcessActionFrame.c b/CORE/MAC/src/pe/lim/limProcessActionFrame.c
index 869b30f..bff5151 100644
--- a/CORE/MAC/src/pe/lim/limProcessActionFrame.c
+++ b/CORE/MAC/src/pe/lim/limProcessActionFrame.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -2247,15 +2247,20 @@
     tpSirMacActionFrameHdr pActionHdr = (tpSirMacActionFrameHdr) pBody;
 #ifdef WLAN_FEATURE_11W
     tpSirMacMgmtHdr pHdr = WDA_GET_RX_MAC_HEADER(pRxPacketInfo);
+
+    if (lim_is_robust_mgmt_action_frame(pActionHdr->category) &&
+        limDropUnprotectedActionFrame(pMac, psessionEntry, pHdr,
+                                      pActionHdr->category)) {
+        limLog(pMac, LOGE,
+               FL("Don't send unprotect action frame to upper layer categ %d "),
+               pActionHdr->category);
+        return;
+    }
 #endif
 
     switch (pActionHdr->category)
     {
         case SIR_MAC_ACTION_QOS_MGMT:
-#ifdef WLAN_FEATURE_11W
-            if (limDropUnprotectedActionFrame(pMac, psessionEntry, pHdr, pActionHdr->category))
-                break;
-#endif
             if ( (psessionEntry->limQosEnabled) ||
                   (pActionHdr->actionID == SIR_MAC_QOS_MAP_CONFIGURE) )
             {
@@ -2288,10 +2293,6 @@
            break;
 
         case SIR_MAC_ACTION_SPECTRUM_MGMT:
-#ifdef WLAN_FEATURE_11W
-            if (limDropUnprotectedActionFrame(pMac, psessionEntry, pHdr, pActionHdr->category))
-                break;
-#endif
             switch (pActionHdr->actionID)
             {
 #ifdef ANI_SUPPORT_11H
@@ -2362,10 +2363,6 @@
 
         case SIR_MAC_ACTION_BLKACK:
             // Determine the "type" of BA Action Frame
-#ifdef WLAN_FEATURE_11W
-            if (limDropUnprotectedActionFrame(pMac, psessionEntry, pHdr, pActionHdr->category))
-                break;
-#endif
             switch(pActionHdr->actionID)
             {
               case SIR_MAC_BLKACK_ADD_REQ:
@@ -2401,10 +2398,6 @@
 
     case SIR_MAC_ACTION_WNM:
     {
-#ifdef WLAN_FEATURE_11W
-        if (limDropUnprotectedActionFrame(pMac, psessionEntry, pHdr, pActionHdr->category))
-            break;
-#endif
         PELOGE(limLog(pMac, LOG1, FL("WNM Action category %d action %d."),
                                 pActionHdr->category, pActionHdr->actionID);)
         switch (pActionHdr->actionID)
@@ -2429,10 +2422,6 @@
     }
 #if defined WLAN_FEATURE_VOWIFI
     case SIR_MAC_ACTION_RRM:
-#ifdef WLAN_FEATURE_11W
-        if (limDropUnprotectedActionFrame(pMac, psessionEntry, pHdr, pActionHdr->category))
-            break;
-#endif
         if( pMac->rrm.rrmPEContext.rrmEnable )
         {
             switch(pActionHdr->actionID) {
@@ -2564,8 +2553,6 @@
     case SIR_MAC_ACTION_SA_QUERY:
     {
         PELOGE(limLog(pMac, LOG1, FL("SA Query Action category %d action %d."), pActionHdr->category, pActionHdr->actionID);)
-        if (limDropUnprotectedActionFrame(pMac, psessionEntry, pHdr, pActionHdr->category))
-            break;
         switch (pActionHdr->actionID)
         {
             case  SIR_MAC_SA_QUERY_REQ:
diff --git a/CORE/MAC/src/pe/lim/limUtils.c b/CORE/MAC/src/pe/lim/limUtils.c
index 33c3120..a1c94e6 100644
--- a/CORE/MAC/src/pe/lim/limUtils.c
+++ b/CORE/MAC/src/pe/lim/limUtils.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015. The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016. The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -8498,3 +8498,45 @@
             pTxBdStatus->txBdToken, pTxBdStatus->txCompleteStatus);
     return eHAL_STATUS_SUCCESS;
 }
+
+/**
+ * lim_is_robust_mgmt_action_frame() - Check if action catagory is
+ * robust action frame
+ * @action_catagory: Action frame catagory.
+ *
+ * This function is used to check if given action catagory is robust
+ * action frame.
+ *
+ * Return: bool
+ */
+bool lim_is_robust_mgmt_action_frame(uint8 action_catagory)
+{
+   switch (action_catagory) {
+       /*
+        * NOTE: This function doesn't take care of the DMG
+        * (Directional Multi-Gigatbit) BSS case as 8011ad
+        * support is not yet added. In future, if the support
+        * is required then this function need few more arguments
+        * and little change in logic.
+        */
+       case SIR_MAC_ACTION_SPECTRUM_MGMT:
+       case SIR_MAC_ACTION_QOS_MGMT:
+       case SIR_MAC_ACTION_DLP:
+       case SIR_MAC_ACTION_BLKACK:
+       case SIR_MAC_ACTION_RRM:
+       case SIR_MAC_ACTION_FAST_BSS_TRNST:
+       case SIR_MAC_ACTION_SA_QUERY:
+       case SIR_MAC_ACTION_PROT_DUAL_PUB:
+       case SIR_MAC_ACTION_WNM:
+       case SIR_MAC_ACITON_MESH:
+       case SIR_MAC_ACTION_MHF:
+       case SIR_MAC_ACTION_FST:
+            return true;
+       default:
+            VOS_TRACE (VOS_MODULE_ID_PE, VOS_TRACE_LEVEL_INFO,
+                   FL("non-PMF action category[%d] "),
+                   action_catagory);
+            break;
+   }
+   return false;
+}
diff --git a/CORE/MAC/src/pe/lim/limUtils.h b/CORE/MAC/src/pe/lim/limUtils.h
index 4086f64..6a2a9b2 100644
--- a/CORE/MAC/src/pe/lim/limUtils.h
+++ b/CORE/MAC/src/pe/lim/limUtils.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -558,4 +558,6 @@
 void limDecrementPendingMgmtCount (tpAniSirGlobal pMac);
 
 eHalStatus limTxBdComplete(tpAniSirGlobal pMac, void *pData);
+bool lim_is_robust_mgmt_action_frame(uint8 action_catagory);
+
 #endif /* __LIM_UTILS_H */
diff --git a/CORE/VOSS/inc/vos_packet.h b/CORE/VOSS/inc/vos_packet.h
index 2fe96d9..3aa0a33 100644
--- a/CORE/VOSS/inc/vos_packet.h
+++ b/CORE/VOSS/inc/vos_packet.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -1134,4 +1134,40 @@
    void  *pskb,
    v_U8_t tracking_map
 );
+
+/**
+  @brief vos_get_pkt_head() - Get skb head pointer
+
+  @param
+       pPacket - the voss Packet to operate on
+  @return
+       v_PVOID_t - skb head pointer
+
+*/
+v_PVOID_t vos_get_pkt_head(vos_pkt_t *pPacket);
+
+/**
+
+  @brief vos_get_pkt_end() - Get skb end pointer
+
+  @param
+       pPacket - the voss Packet to operate on
+  @return
+       v_PVOID_t - skb end pointer
+
+*/
+v_PVOID_t vos_get_pkt_end(vos_pkt_t *pPacket);
+
+/**
+
+  @brief vos_recover_tail() - Recover corrupted tail of skb
+
+  @param
+       pPacket - the voss Packet to operate on
+  @return
+       v_VOID_t - None
+
+*/
+v_VOID_t vos_recover_tail(vos_pkt_t *pPacket);
+
 #endif  // !defined( __VOS_PKT_H )
diff --git a/CORE/VOSS/src/vos_packet.c b/CORE/VOSS/src/vos_packet.c
index 5dba8ac..43daf9f 100644
--- a/CORE/VOSS/src/vos_packet.c
+++ b/CORE/VOSS/src/vos_packet.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -59,6 +59,8 @@
 #define VOS_PKT_PROT_DHCP_CLI_PORT   68
 #define VOS_PKT_PROT_EAPOL_ETH_TYPE  0x888E
 #define VOS_PKT_PROT_ARP_ETH_TYPE    0x0806
+#define VOS_PKT_GET_HEAD(skb)        (skb->head)
+#define VOS_PKT_GET_END(skb)         (skb->end)
 
 /*--------------------------------------------------------------------------
   Type declarations
@@ -3097,6 +3099,87 @@
    /* Protocol type map */
    return pkt_proto_type;
 }
+
+v_PVOID_t vos_get_pkt_head(vos_pkt_t *pPacket)
+{
+   struct sk_buff *skb;
+
+   // Validate the parameter pointers
+   if (unlikely(NULL == pPacket))
+   {
+      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
+                "VPKT [%d]: NULL pointer", __LINE__);
+      return NULL;
+   }
+
+   if ( VOS_STATUS_SUCCESS !=
+        vos_pkt_get_os_packet(pPacket, (void**)&skb, VOS_FALSE ))
+   {
+      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
+                "OS-PKT [%d]: OS PKT pointer is NULL", __LINE__);
+      return NULL;
+   }
+
+   return VOS_PKT_GET_HEAD(skb);
+}
+
+v_PVOID_t vos_get_pkt_end(vos_pkt_t *pPacket)
+{
+   struct sk_buff *skb;
+
+    // Validate the parameter pointers
+   if (unlikely(NULL == pPacket))
+   {
+      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
+                "VPKT [%d]: NULL pointer", __LINE__);
+      return NULL;
+   }
+
+   if ( VOS_STATUS_SUCCESS !=
+        vos_pkt_get_os_packet(pPacket, (void**)&skb, VOS_FALSE ))
+   {
+     VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
+                "OS-PKT [%d]: OS PKT pointer is NULL", __LINE__);
+     return NULL;
+   }
+
+ /* find end point if skb->end is an offset */
+#ifdef NET_SKBUFF_DATA_USES_OFFSET
+   return VOS_PKT_GET_HEAD(skb) + VOS_PKT_GET_END(skb);
+#else
+   return VOS_PKT_GET_END(skb);
+#endif
+}
+
+v_VOID_t vos_recover_tail(vos_pkt_t *pPacket)
+{
+   struct skb_shared_info *shinfo;
+   struct sk_buff *skb;
+
+   // Validate the parameter pointers
+   if (unlikely(NULL == pPacket))
+   {
+      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
+                "VPKT [%d]: NULL pointer", __LINE__);
+      return;
+   }
+
+   if ( VOS_STATUS_SUCCESS !=
+        vos_pkt_get_os_packet(pPacket, (void**)&skb, VOS_FALSE ))
+   {
+      VOS_TRACE(VOS_MODULE_ID_VOSS, VOS_TRACE_LEVEL_FATAL,
+                "OS-PKT [%d]: OS PKT pointer is NULL", __LINE__);
+      return;
+   }
+
+   shinfo = skb_shinfo(skb);
+   memset(shinfo, 0, sizeof(struct skb_shared_info));
+   atomic_set(&shinfo->dataref, 1);
+   kmemcheck_annotate_variable(shinfo->destructor_arg);
+
+   return;
+}
+
 #ifdef VOS_PACKET_UNIT_TEST
 #include "vos_packet_test.c"
 #endif
diff --git a/CORE/WDI/TRP/DTS/src/wlan_qct_wdi_dts.c b/CORE/WDI/TRP/DTS/src/wlan_qct_wdi_dts.c
index 9921287..1aebf0a 100644
--- a/CORE/WDI/TRP/DTS/src/wlan_qct_wdi_dts.c
+++ b/CORE/WDI/TRP/DTS/src/wlan_qct_wdi_dts.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2016 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -75,6 +75,25 @@
    uint32 tputBpus;  //unit in Bytes per usec: round off to integral value
 }WDTS_RateInfo;
 
+#define WDTS_MAX_NUMBER_OF_RX_PKT 5
+#define WDTS_MAX_PAGE_SIZE 4096
+#define WDTS_MAX_RXDB_DATA_SIZE 128
+
+struct WDTS_RxPktInfo
+{
+    uint8 rx_bd[WDTS_MAX_RXDB_DATA_SIZE];
+    void *pFrame_head;
+    void *pFrame_tail;
+    uint32 pFrame_len;
+};
+
+static struct WDTS_PktInfoBuff
+{
+    struct WDTS_RxPktInfo PktInfo[WDTS_MAX_NUMBER_OF_RX_PKT];
+    uint32 current_count;
+    uint8 current_position;
+}WDTS_Pkt_Data_Buff = { .current_position = 0, .current_count = 0 };
+
 #define WDTS_MAX_RATE_NUM               137
 #define WDTS_MAX_11B_RATE_NUM           8
 #define MB_PER_SEC_TO_BYTES_PER_MSEC    13
@@ -515,6 +534,56 @@
 #endif
 }
 
+/* Store RXBD, skb lenght, skb head, and skb end offset to global buffer.
+ * This function should  be invoked when MPDU lenght + MPDU herader Offset
+ * if higher then 3872 bytes.
+ * Parameters:
+ * pFrame:Refernce to PAL frame.
+ * pBDHeader: BD header for PAL Frame.
+ * Return Value: v_VOID_t
+ *
+ */
+v_VOID_t
+WDTS_StoreMetaInfo(wpt_packet *pFrame, wpt_uint8 *pBDHeader)
+{
+    wpt_uint8  usMPDUHLen;
+    wpt_boolean usAsf, usAef, usLsf, usESF;
+    wpt_uint16 usMPDULen;
+    wpt_uint32 usPmiCmd24to25;
+    struct WDTS_RxPktInfo *current_data =
+           &WDTS_Pkt_Data_Buff.PktInfo[WDTS_Pkt_Data_Buff.current_position];
+
+    vos_mem_copy(current_data->rx_bd, (void*)wpalPacketGetRawBuf(pFrame),
+                                                       WDTS_MAX_RXDB_DATA_SIZE);
+
+    usMPDULen = (wpt_uint16)WDI_RX_BD_GET_MPDU_LEN(pBDHeader);
+    usMPDUHLen = (wpt_uint8)WDI_RX_BD_GET_MPDU_H_LEN(pBDHeader);
+    usAsf = (wpt_boolean)WDI_RX_BD_GET_ASF(pBDHeader);
+    usAef = (wpt_boolean)WDI_RX_BD_GET_AEF(pBDHeader);
+    usLsf = (wpt_boolean)WDI_RX_BD_GET_LSF(pBDHeader);
+    usESF = (wpt_boolean)WDI_RX_BD_GET_ESF(pBDHeader);
+    usPmiCmd24to25 = (wpt_uint32)WDI_RX_BD_GET_PMICMD_24TO25(pBDHeader);
+
+    current_data->pFrame_head = wpalGetOSPktHead(pFrame);
+    current_data->pFrame_tail = wpalGetOSPktend(pFrame);
+    current_data->pFrame_len = wpalPacketGetLength(pFrame);
+
+    WDTS_Pkt_Data_Buff.current_count++;
+
+    /* Dump packet info */
+    VOS_TRACE(VOS_MODULE_ID_WDI, VOS_TRACE_LEVEL_ERROR,
+                  "count: %d usMPDULen: 0x%x, usMPDUHLen: 0x%x, usAsf: %x,"
+                  "usAef: %x, usLsf: 0x%x, usESF: 0x%x, usPmiCmd24to25: 0x%x,"
+                  "skb_len: 0x%x",WDTS_Pkt_Data_Buff.current_count, usMPDULen,
+                  usMPDUHLen, usAsf, usAef, usLsf, usESF, usPmiCmd24to25,
+                  current_data->pFrame_len);
+
+    WDTS_Pkt_Data_Buff.current_position++;
+    if(WDTS_Pkt_Data_Buff.current_position >= WDTS_MAX_NUMBER_OF_RX_PKT)
+       WDTS_Pkt_Data_Buff.current_position = 0;
+
+    return;
+}
 
 /* DTS Rx packet function. 
  * This function should be invoked by the transport device to indicate 
@@ -602,18 +671,29 @@
   // Special handling for frames which contain logging information
   if (WDTS_CHANNEL_RX_LOG == channel)
   {
-      if(VPKT_SIZE_BUFFER_ALIGNED < (usMPDULen+ucMPDUHOffset)){
-        WPAL_TRACE(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_FATAL,
+      if (VPKT_SIZE_BUFFER_ALIGNED < (usMPDULen+ucMPDUHOffset))
+      {
+          /* Size of the packet tranferred by the DMA engine is
+           * greater than the the memory allocated for the skb
+           * Recover the SKB  case of length is in same memory page
+           */
+          WPAL_TRACE(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_FATAL,
                    "Invalid Frame size, might memory corrupted(%d+%d/%d)",
                    usMPDULen, ucMPDUHOffset, VPKT_SIZE_BUFFER_ALIGNED);
 
-        /* Size of the packet tranferred by the DMA engine is
-         * greater than the the memory allocated for the skb
-         */
-        WPAL_BUG(0);
+          // Store RXBD,  skb head, tail and skb lenght in circular buffer
+          WDTS_StoreMetaInfo(pFrame, pBDHeader);
 
-        wpalPacketFree(pFrame);
-        return eWLAN_PAL_STATUS_SUCCESS;
+          if ((usMPDULen+ucMPDUHOffset) <= WDTS_MAX_PAGE_SIZE)
+          {
+              wpalRecoverTail(pFrame);
+              wpalPacketFree(pFrame);
+          } else {
+              //Recovery may cause adjoining buffer corruption
+              WPAL_BUG(0);
+          }
+
+          return eWLAN_PAL_STATUS_SUCCESS;
       }
 
       /* Firmware should send the Header offset as length
@@ -657,19 +737,31 @@
         ucMPDUHOffset = usMPDUDOffset;
       }
 
-      if(VPKT_SIZE_BUFFER_ALIGNED < (usMPDULen+ucMPDUHOffset)){
-        WPAL_TRACE(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_FATAL,
+      if (VPKT_SIZE_BUFFER_ALIGNED < (usMPDULen+ucMPDUHOffset))
+      {
+          /* Size of the packet tranferred by the DMA engine is
+           * greater than the the memory allocated for the skb
+           * Recover the SKB  case of length is in same memory page
+           */
+          WPAL_TRACE(eWLAN_MODULE_DAL_DATA, eWLAN_PAL_TRACE_LEVEL_FATAL,
                    "Invalid Frame size, might memory corrupted(%d+%d/%d)",
                    usMPDULen, ucMPDUHOffset, VPKT_SIZE_BUFFER_ALIGNED);
 
-        /* Size of the packet tranferred by the DMA engine is
-         * greater than the the memory allocated for the skb
-         */
-        WPAL_BUG(0);
+          // Store RXBD,  skb head, tail and skb lenght in circular buffer
+          WDTS_StoreMetaInfo(pFrame, pBDHeader);
 
-        wpalPacketFree(pFrame);
-        return eWLAN_PAL_STATUS_SUCCESS;
+          if ((usMPDULen+ucMPDUHOffset) <= WDTS_MAX_PAGE_SIZE)
+          {
+              wpalRecoverTail(pFrame);
+              wpalPacketFree(pFrame);
+          } else {
+              //Recovery may cause adjoining buffer corruption
+              WPAL_BUG(0);
+          }
+
+          return eWLAN_PAL_STATUS_SUCCESS;
       }
+
       if(eWLAN_PAL_STATUS_SUCCESS != wpalPacketSetRxLength(pFrame, usMPDULen+ucMPDUHOffset))
       {
           DTI_TRACE( DTI_TRACE_LEVEL_ERROR, "Invalid Frame Length, Frame dropped..");
diff --git a/CORE/WDI/WPAL/inc/wlan_qct_pal_packet.h b/CORE/WDI/WPAL/inc/wlan_qct_pal_packet.h
index fc080e4..027d966 100644
--- a/CORE/WDI/WPAL/inc/wlan_qct_pal_packet.h
+++ b/CORE/WDI/WPAL/inc/wlan_qct_pal_packet.h
@@ -448,4 +448,35 @@
 (
    wpt_packet *pFrame
 );
+
+/*---------------------------------------------------------------------------
+    wpalGetOSPktHead – Get the head of OS spacific socket buffer
+    Param:
+        pPacket – pointer to a wpt_packet
+
+    Return:
+        void* - success
+---------------------------------------------------------------------------*/
+void* wpalGetOSPktHead( wpt_packet *pPacket);
+
+/*---------------------------------------------------------------------------
+     wpalGetOSPktend – Get end pointer of OS spacific socket buffer
+    Param:
+        pPacket – pointer to a wpt_packet
+
+    Return:
+        void*  - success
+---------------------------------------------------------------------------*/
+void* wpalGetOSPktend( wpt_packet *pPacket);
+
+/*---------------------------------------------------------------------------
+    wpalRecoverTail – recover currupted skb tail.
+    Param:
+        pPacket – pointer to a wpt_packet
+
+    Return:
+        void  - success
+---------------------------------------------------------------------------*/
+void wpalRecoverTail( wpt_packet *pPacket);
+
 #endif // __WLAN_QCT_PAL_PACKET_H
diff --git a/CORE/WDI/WPAL/src/wlan_qct_pal_packet.c b/CORE/WDI/WPAL/src/wlan_qct_pal_packet.c
index b35e550..e5b310b 100644
--- a/CORE/WDI/WPAL/src/wlan_qct_pal_packet.c
+++ b/CORE/WDI/WPAL/src/wlan_qct_pal_packet.c
@@ -441,6 +441,45 @@
    }
 }/*wpalPacketSetRxLength*/
 
+void wpalRecoverTail(wpt_packet *pFrame)
+{
+   // Validate the parameter pointers
+   if (unlikely(NULL == pFrame))
+   {
+      WPAL_TRACE(eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+                "%s : NULL packet pointer", __func__);
+      return;
+   }
+
+   return vos_recover_tail(WPAL_TO_VOS_PKT(pFrame));
+}
+
+void* wpalGetOSPktHead(wpt_packet *pFrame)
+{
+   // Validate the parameter pointers
+   if (unlikely(NULL == pFrame))
+   {
+      WPAL_TRACE(eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+                "%s : NULL packet pointer", __func__);
+      return NULL;
+   }
+
+   return vos_get_pkt_head(WPAL_TO_VOS_PKT(pFrame));
+}
+
+void* wpalGetOSPktend(wpt_packet *pFrame)
+{
+   // Validate the parameter pointers
+   if (unlikely(NULL == pFrame))
+   {
+      WPAL_TRACE(eWLAN_MODULE_PAL, eWLAN_PAL_TRACE_LEVEL_ERROR,
+                "%s : NULL packet pointer", __func__);
+      return 0;
+   }
+
+   return vos_get_pkt_end(WPAL_TO_VOS_PKT(pFrame));
+}
+
 /*
   Set of helper functions that will prepare packet for DMA transfer,
   based on the type of transfer : - to and from the device